Defenses against loss of control in flight (LOC-I) figured prominently in recent conference presentations to pilot training specialists from major and regional airlines. A recurrent theme was how to apply lessons learned from transport airplane accidents that happened in unremarkable flight conditions with properly functioning autoflight systems.
During the World Aviation Training Conference and Trade Show (WATS 2010), presenters from two early-adopter airlines also outlined a related rationale for equipping fleets with dual head-up guidance systems (HGS) and mentioned plans for HGS-qualified first officers to land aircraft after approaches to Category III minimums. Others at the April gathering in Orlando, Florida, U.S., called for stronger emphasis on pilot understanding of aerodynamics and the adoption of updated stall recovery guidance from Airbus and Boeing Commercial Airplanes.
Several presenters concurred that despite measurable improvements since the 1980s, the LOC-I trend of the last five years should ring alarms. “If we are going to lower the overall accident rate, we have to address loss of control in flight because it stands alone as the largest threat,” said John Cox, president and CEO of Safety Operating Systems.
Regaining Control
Avoidance, recognition and recovery remain essential elements of the LOC-I solution, Cox said. “The first and most critical skill is avoidance — how we teach crews to not put the airplane in a state that has the potential for upset and how to recognize when it is near an upset condition,” he explained. “[The industry must teach] not only the incoming, next-generation pilots but equally — or even more importantly — the cadre of pilots on the flight deck today.” A U.S. National Transportation Safety Board (NTSB) study of accidents from 1986 to 1996 identified stalls as the leading cause of LOC-I, he said, noting, “This information is nothing new … yet we haven’t adequately addressed it.”
The NTSB’s animation of the Colgan Air Flight 3407 accident sequence [ASW, 3/10, p. 20] and companion graph of digital flight data recorder parameters contain lessons and reminders about air-speed control in relation to the risk factors for stall and loss of control. “This was a gradual in-crease in the speed, followed by a very rapid decrease,” Cox said, noting the captain’s manual power adjustment while the autopilot was coupled to the instrument landing system (ILS). The adjustment quickly changed the aircraft state from 15 kt over target approach speed to an apparently unrecognized rapid loss of about 66 kt, stick shaker activation, full stall and LOC-I.
“It was a totally normal airplane — there was not a mechanical fault with it,” Cox said. “Angle-of-attack is critical in understanding this accident — with each of the peaks [on the graph] gaining amplitude. The last one had over a 40-degree angle-of-attack. I did not know an airliner could get that high [angle-of-attack].”
The control wheel motions in the NTSB’s animation showed the captain’s inputs to regain roll control. “He did not [exhibit] the understanding that the solution to his roll problem was via pitch,” Cox said. “He first would have had to stop and deal with the stall issue before he would have roll control again. Lack of aerodynamic understanding of what was going on with the airplane was critical here. And this crew did not have a lot of time to sort it out.” Cox compared the Flight 3407 animation with a flight deck video showing a U.S. military crew’s successful recovery of a Lockheed C-5A after an upset during a dark night approach to Diego Garcia. “As I understand what happened, they didn’t [identify] anything abnormal as the airplane experienced almost 4 g in the recovery,” he said. “During the entire event and recovery, they never understood what the actual problem was with the airplane. The crew only much later understood what had happened.”
A “flawed impression” may exist in the airline industry of the baseline understanding of aerodynamics among today’s average pilots, he added, citing answers he heard to questions about aerodynamics that he posed informally to professional pilots from various backgrounds. “Up to a point, they under-stood the potential consequences of high–angle-of-attack flight,” Cox said. But in his opinion, only about 10 percent of the pilots he polled in 2009 and 2010 demonstrated an adequate knowledge of aerodynamics, the limitations of LOC-I training in flight simulation training devices (FSTDs) and recent changes in the response to stall indications recommended for large commercial jets.
“One of the things the industry has taught [inappropriately in FSTDs] is ‘power out’ recoveries,” he said. “We need to rethink this because there are parts of the flight envelope — particularly in high altitude and high drag conditions — where pilots do not have excess thrust, and the airplane will not accelerate out of a stall. Colgan Flight 3407 was the perfect example — this 55,000-lb [2,495-kg Bombardier Q400] with 9,000 shp [6,711 kW] would not accelerate. That’s how far back on the drag curve it was. But there is a high drag coefficient at the critical angle-of-attack near stall, and powering out may not always be possible. ‘Powering out’ certainly was the way I was taught to fly Boeing 737s in 1981, so we may have been teaching the wrong recovery for a long time.”
In those days of 737 training, the hardest maneuver was to set up the airplane for what he used to call a “precision stall.” “Trim it carefully, let the airplane slow down, [wait for] stick shaker [to activate], add power and do not lose a foot of altitude,” Cox explained. “Those were the criteria; people are still teaching that flawed approach. It’s flawed because if pilots don’t reduce angle-of-attack and don’t accept some altitude loss to quickly get flow reattachment to the wing, they are not maximizing the aerodynamic performance and they are decreasing the likelihood of a successful outcome.”
Levels of aerodynamics understanding that should not be taken for granted include angle-of-attack, extreme changes in drag, lift curves and stall characteristics of different wings — especially for specific aircraft types and models, such as relatively unstable swept-wing jet airplanes. Moreover, stall recoveries taught in FSTDs typically occur at 10,000 ft rather than at a cruise altitude — leading to startled misapprehensions of real high-altitude airplane response, he said.
“In recent weeks, Airbus and Boeing have changed their stall-recovery procedures, and I commend both organizations. [The updated procedure] is to reduce angle-of-attack, lower the nose, level the wings and increase thrust, understanding that with engines mounted under the wing, the pilot may be adding to the [resulting] nose-up pitch. That may have to be countered, so pilots may want to be a bit judicious in how rapidly they apply thrust with very high bypass–ratio fan engines. It is a consideration. [Then the pilot should] reduce speed brakes or retract them, and return to normal flight. … There is a caveat: If the airplane manufacturer has specific [actions for known] flight characteristics, follow them first.”
The new aspect is the commitment to accept some altitude loss as a matter of survival. “We should make sure that the pilots in flight decks today — and the incoming generation — learn this well,” Cox added. “In April 2010, the U.K. Civil Aviation Authority issued a flight crew training notice in which they said ‘reduce angle-of-attack; it is the primary stall recovery step.’
The unsolved problem in using FSTDs remains that the devices are more stable than airplanes in stall/LOC-I scenarios. “Trying to demonstrate post-stall flight characteristics in a simulator will build a false sense of confidence in the crew as to actual airplane stability,” Cox said. “So training has to be a demonstration in the simulators intermingled with aerodynamics in the classroom so that pilots understand what airplanes will actually do.”
Unreliable Airspeed
Early avenues of inquiry into the Air France Flight 447 accident investigation — the June 1, 2009, crash of an Airbus A330 in the Atlantic Ocean — prompted Czech Airlines to reconsider how it trains pilots to recognize and safely handle situations involving unreliable airspeed, according to Roman Hurych, a captain and chief flight instructor for the company. Recurrent line-oriented flight training (LOFT) with an unreliable speed indication began in September 2009, and ironically around the time the training was introduced, an actual event occurred.
“We reacted very quickly [to Flight 447],” he said. “We realized it could happen to anybody at any time. … We also had to admit that the last time the [typical] pilot operated the aircraft with unreliable speed was during his or her type rating course. So that was the main reason, to give all of our pilots the chance to practice again how to fly the aircraft without the speed indication and, at the same time, to fly manually at high altitude. Our flight operations department’s board of instructors and examiners decided to prepare new recurrent training cycles in a way that would include an unreliable speed indication.”
The airline designed the FSTD scenario so flight crews would be briefed a few days beforehand that unreliable airspeed could occur any time during the simulated flight from Prague to Moscow. Elements included the auxiliary power unit inoperative per provisions of the minimum equipment list (MEL) and assignment of a departure runway with a tail wind. “We wanted them to come to our re-current training already prepared,” Hurych said. “Our target was to show pilots the behavior of the aircraft and let them practice solving this very difficult situation. They were advised to use all airplane documentation … including an Airbus presentation on unreliable speed, which is of great value.”
Early in this simulator exercise, the instructor inserts a frozen standby pitot tube condition and thunderstorms on the weather radar display. Later, in cruise flight, the instructor inserts simultaneous faults on both airspeed channels along with an air data reference–frozen fault. “If this appeared shortly before reaching the [assigned] flight level, the pilot flying still had the speed indication, but unfortunately it was wrong,” Hurych said.
“Shortly after, the crew lost all the [airspeed] indications, had to start with the memory items and then had to revert to the paper checklists for unreliable speed indication. The scenario’s intent was for the flight crew to bring the aircraft back to Prague. The emergency was declared, and while using the paper checklists, the crew began their descent in preparation for approach and landing.”
Czech Airlines found that the advance briefing and pre-exercise preparation made all crews hyper-attentive to any airspeed fluctuation as a possible anomaly, and some began troubleshooting suspected unreliable-airspeed indications caused by normal turbulence encounters during climb. “They knew what was to happen, but they didn’t know when,” he said. “We saw crews comparing indications that they almost never compare and monitor during normal line flying. Generally, all crews came very well prepared for the session and coped very proficiently with all [aspects] of the scenario.”
The real incident in late 2009 also occurred during a flight from Prague to Moscow. During climb on autopilot, the crew noticed their altitude modes disappear, and then the autopilot disconnected. Air-speed on one side showed 170 kt while the other side showed 210 kt. “An instructor in the right seat took over the controls and continued to climb out using the initial pitch and thrust as per memory items,” Hurych said. “At about thrust-reduction altitude, they were in clean configuration because they had retracted flaps before recognizing the speed discrepancy.”
Effective crew resource management helped the crew to maintain control, compute pitch and thrust values for level off, perform actions on the paper checklist, declare an emergency, turn back to Prague and complete an uneventful landing, he said. The cause of this unreliable airspeed was still under investigation as of April. The basic procedure being taught in recurrent training, however, worked as advertised.
Approach to Stall
In just a five-week period in 2009, three fatal airline accidents involving stalls occurred while flight crews were flying approaches to land with the autopilot engaged, said Paul Kolisch, manager, flight operations training, Mesaba Airlines. “My contention is that these pilots were not trained for these events,” he said. “I don’t know any pilot in the airline business, or operating sophisticated corporate airplanes, who has arrived at an inadvertent stall while hand flying the airplane. … Traditional [FSTD] stall training has shifted to an artificial choreography where the pilot stops trimming in order to keep good control of the airplane during the recovery, sits there and waits until [the stick shaker activates], then recovers. Not one of the 2009 accidents happened that way.”
Mesaba has adopted what it calls “practical training for approach to stalls” from a conviction that unrealistic traditional training generates unsafe expectations of what actually will occur. “We do the training primarily in a classroom or briefing room prior to going into the simulator,” Kolisch said. “When we get into the simulator, we don’t do a ‘stall series.’ Those two words don’t occur to-gether in our syllabus. [Instead,] at some point, the pilot encounters the stall as a surprise … if at all possible. We will use any [tactic] necessary for distraction.”
Graphs produced by Boeing Commercial Airplanes since the 1980s have chronicled the relative proportion of fatal accidents involving controlled flight into terrain (CFIT) vs. the proportion of those involving LOC-I. “In just over a 10-year period, almost 2,000 people died in accidents as a result of loss of control — double the number from CFIT,” Kolisch added. “A large number [of LOC-I accidents], if not most, arose from an approach to stall.”
A U.S. Federal Aviation Administration (FAA)–industry working group that studied stall training was concerned that misconceptions about the practical implications of the agency’s practical test standards could amount to negative training. “The practical test standards say that the applicant for a pilot certificate ‘recovers to a reference airspeed, altitude and heading with a minimal loss of altitude,’” Kolisch said. “We do our approach-to-stalls [in airplanes] at practical high and low altitudes, including at 400 ft.” Mesaba’s training strongly emphasizes the “recovers to a reference altitude” and de-emphasizes “minimal,” which it considers difficult to define. No training injuries or fatalities have resulted despite the intentional distractions that startle pilots, he said.
While presenting video clips from actual training, he pointed out the degree to which autopilot dis-connect horns, aural stall warning alerts and annunciations on the electronic flight information system generate continuous distractions during stall recovery.
One concern of FAA-industry committee members was the fidelity gap between the stall characteristics of typical FSTDs and aircraft performance in stalls, he said. “I am opposed to trusting com-puter ‘speculation’ when we fly the simulators — we just don’t know how the airplane would be-have,” Kolisch said. “If we don’t take pilots up high in these jet airplane simulators, they won’t understand this [gap]. … If the first time they experience a high-altitude stall event is in an airplane, they’re going to be in big trouble.” Based on review of Mesaba’s videos, the opinion of some air-plane upset specialists was that some stall recoveries that were successful in an FSTD would have been an airplane upset in reality, he added.
Head Up Constantly
JetBlue since 2007 has deployed dual Rockwell Collins HGS-5600 HGSs on its Embraer 190 regional jets. From the last quarter of 2009 through the first quarter of 2010, Lufthansa CityLine partnered with the company to do the same for its 190/195 fleet after more than three and a half years of preparation, said Christof Kemény, a captain with Lufthansa CityLine, in a joint presentation with Mark Maskiell, a captain with JetBlue. The systems are now used routinely by all pilots in all weather conditions, and safety enhancement remains high on their lists of objectives, they said.
Lufthansa had analyzed advantages and disadvantages of HGS compared with autoland systems and envisioned how HGS could be used in the context of air traffic management transformations imminent in Europe, the United States and elsewhere.
Kemény cited findings of the most recent Flight Safety Foundation study of safety benefits from HGS technology (ASW, 5/10, p. 38) as a reinforcement of Lufthansa CityLine’s conclusions that the technology could deliver significant safety advantages. Analysis of company Bombardier CRJ landings with crews using HGS also demonstrated unprecedented, consistent touchdown-zone ac-curacy compared with landings by crews flying non-equipped CRJs.
“We find that dual HGS on board our Embraer aircraft forms a high-level man-machine integration and keeps our pilots as the active controllers,” Kemény said. “We still had to answer the question, ‘Will the flight be safer when using head-up guidance?’”
Historically, head-up displays [HUDs] only aided in making aircraft Category III autoland-capable. The idea of expanding HGS applications originally ran into strong industry resistance, he said. Lufthansa turned to its own operational data to weigh the relative utility of HGS vs. autoland. Data studied reflected all airplanes with Category III capability, and the analysis showed that “only approximately 2 percent of the landings were actually performed with the autoland system,” he said.
“In roughly 50 percent of our flights, the pilots just used the autoland system to keep up proficiency or to upgrade a system to Category III,” Kemény added. “During 90 percent of all landings, we had a system on board that did not give any safety benefits. The autoland system is limited to straight-in instrument landing system and microwave landing system approaches.
“By its design and certification, autoland is not capable of any advantage for required navigation performance approaches or nonprecision approaches, whereas a head-up display [HUD] can be used from taxi before takeoff until after landing. What makes HGS work is its flight path symbol, which gives pilots the ‘what you see is what you get’ [interface]. The flight path vector is conformal to the outside world, so when you look through the flight path symbol, you actually see where you are going to be.”
Among HGS capabilities most relevant to safety are the speed error tape, graphically depicting the offset between the selected speed and aircraft speed; an acceleration carat that transforms to an energy symbol; and tail-strike advisory information. “Every time the pilots look out of the [forward windshield through the combiner (i.e., the HUD screen)], they see the energy status for precise energy management of the aircraft with the flight path,” Kemény said. “After landing, we have the same capability as an instantaneous indication of the aircraft brake performance. This is an immediate decision-making tool; after the touchdown, the pilots have the picture of deceleration values.”
If unsafe deceleration on a contaminated runway or brake problems occur, the flight crew sees the remaining runway and the point at which the aircraft will stop — rather than relying on imprecise sensations that something is going wrong after landing, he added.
“One part of the [HGS] training is to check landing performance [using] a clear decision-making tool right after touchdown to reduce runway overruns or excursions,” Kemény said.
Another factor in the company’s analysis was any potential safety risks from adopting the technology, including the possibility that conventional glass¬ flight deck skills would deteriorate in the long term. “We asked, ‘Do pilots really maintain skills for using the primary flight display [PFD] for flying against the sun and at night after using the new system?” he said. “The beauty of the Embraer [configuration] is that that the PFD [picture is essentially] the same as the HGS picture. So when you have a failed combiner, you just look down and have the same picture — only with the flight path angle, as there is no conformal world behind it. Everything else is the same.”
During HGS training, Lufthansa CityLine had to encourage pilots “to be patient with themselves” as they advanced through four levels of proficiency, learning the new skills and presentation of the world outside the aircraft. About six months typically elapse from the first day in an HGS FSTD to line flying at level 4, in which the pilot is fully “proficient using HUD as another flight deck tool,” he said.
The decision to replace autoland with dual HGS worked out as expected, Kemény said. “Analysis of results showed that we have increased situational awareness for both pilots,” he explained. “The con-formal flight path vector of the HUD is comparable to what pilots would see head down, and we have real-time aircraft energy monitoring and improved assessment of deviations. … After six months of operating, the data are proving that with the Embraer 190, we see much less deviation on the glideslope and localizer, and in speeds during the final portion of the approach. This means in-creased landing accuracy. There is good reason to believe that we also have a reduced risk of hard landings and tail strikes. The visual indication of our brake performance after landing is something no other system provides while looking out of the window.”
The present and future role of HGS as an aid in unusual attitude recovery has been especially gratifying, Kemény said. “We have intuitive guidance during abnormal situations such as unusual attitude recoveries, engine failures and traffic-alert and collision avoidance system resolution advisories.” For further enhancement of aid to unusual attitude recovery, the platform can be configured to display g-loads in the combiner, he said.
“So will flight be safer with HGS?” Kemény asked. “We have good reason to say ‘yes.’ We also have found that it only pays off in safety benefits if both pilots are active controllers with the same level of information — both pilots need the same tools [independent, dual HGS]. … Our operating philosophy is that head-up guidance also will be used during takeoff and during all phases of flight. … All approaches are flown using the same standard operating procedure [SOP].
“We also have introduced flight path–energy flying — the next step of this evolution — instead of pitch-and-power flying, which is not an adequate technique with HGS. Manual flying while using autothrottle also is standard because pilots can see the energy status of the aircraft, which encourages them to fly manually to keep up their flying skills, except for restrictions on flying manually in crowded terminal areas.”
At the beginning of 2011, Lufthansa CityLine will qualify all first officers to conduct Category III approaches. Steep approaches using HGS in the 190 already have been approved by European authorities along with constant descents on all nonprecision approaches, he added.
JetBlue’s Maskiell said that as of April 2010, 40 of the airline’s 190s have dual HGS. Acquiring the capability — and the requisite FSTDs — was on the agenda from the company’s founding. “The traditional philosophy in commercial aviation, however, [assumes a] single HGS,” he said. “Originally, it was for low-visibility takeoffs and low-visibility approaches [but we considered this] a tool for all phases of flight.” Company analysis rated dual HGS above autoland in cost-benefit and utility, and as “a much safer technological solution through the life of the airframe,” he said.
On the training side, all of the company’s FSTDs have dual HGS. “More than a handful of pilots have shared with me that maybe the most challenging event they’d had was conducting a flight with-out dual HGS when the system was [inoperative per provisions of] the MEL for some reason. … They become very reliant on that device — not to the point of being unsafe [without it] but definitely to the point of knowing that there is a difference. … In four years, there has not been a single [HGS-induced] safety event noted.”
Human Factors
LOC-I also has been linked with concerns about how best to instill safety attitudes and a positive culture of professionalism from one generation of pilots to the next, said Cor Blokzijl, director flight operations, Mandala Airlines. Unease about pilot professionalism (ASW, 6/10, p. 24) has been increasing in some parts of the world — especially the perception that within today’s genera-tion of pilots new to their airline careers, some lack self-motivation or are too distracted by other pursuits to study beyond minimum requirements or to read aviation safety media. “This affects their in-flight situation recognition,” Blokzijl said.
Preparation to manage automation and LOC-I risks also requires a distinction between recitation of rote facts about airplane systems — knowing only the standard operating procedures and the flight crew operating manual (FCOM) — and genuinely understanding systems.
“Nowadays, understanding systems is of much more value than knowing information by heart,” Blokzijl said. “I have pilots in my airline who can recite the Airbus FCOM backwards and for-wards without a mistake … but they are unable to transfer that knowledge into practical [application] in the aircraft. If we can make them understand why things are happening and the influence of certain failures in the system on the rest [of the system], a ‘light goes on’ and the pilots are able to do what’s required.”
Continual transfer of expertise to less experienced pilots ought to bridge the gap between practicing narrowly focused tasks during recurrent training in FSTDs and truly enhancing cognitive skills. Understanding of systems, system interfaces and dynamics of system failure — “if this is failing, what else?” — have become a key factor today in successful threat management, he added.