312.630.4000   |   contact@nolan-law.com

Author Archive

Airbus Envisions a New Supersonic Transport Plane With Rocket-Like Performance

The notion of supersonic airline flight keeps popping up, like a perennial weed. The latest concept comes from Airbus, which envisions of all things an eco-friendly supersonic jet that will fly 100 passengers at hypersonic speeds. The Airbus concept for such an airplane was revealed at the Paris Air Show, to great excitement among the aerospace cognoscenti. The flying public may take a different, more ho-hum view.

The grim legacy of the supersonic Anglo-French Concorde jet seems all but forgotten. Recall that Concorde was retired in late 2003, primarily because of the airplane’s range/payload limitations and its high operating cost. An Air France Concorde suffered a spectacular takeoff crash in 2000. The jet struck a piece of metal debris on the runway at Charles de Gaulle airport; the debris strike resulted in cut wires in the landing gear well and a punctured fuel tank. The airplane, on fire, crashed into a nearby hotel.

The accident was the last and grimmest of a long line of landing gear tire failures that punctured holes in fuel tanks. French investigators into the crash identified 57 incidents of Concorde experiencing deflated or blown tires. In 1979, an Air France Concorde on takeoff from Washington’s Dulles airport experienced punctured fuel tanks. The airplane’s magnesium wheels struck the runway, broke apart and hurled metal shards into the wing fuel tanks. With fuel dribbling from the punctured tanks, the airplane returned to Dulles. Passengers could see through the holes in the wing to the ground below.

With longer takeoff runs, higher speeds and stressed tires, the Concorde was 60 times more liable that the subsonic A340 jetliner to a tire burst. The comparison is apt, as both the A340 and the Concorde are four-engine airliners.

The energy from a burst tire is equivalent to approximately 4-5 sticks of dynamite. Yet, to save weight on the Concorde, electrical and hydraulic lines in the main landing gear receptacle were not shielded. Despite easily-punctured metal skin (about the thickness of a piece of cardboard backing a pad of paper), the fuel tanks were not protected with self-sealing rubber.

In service from 1976 to 2003, Concorde was built to a lower safety standard than subsonic airliners; will ZEHST repeat this legacy?

In service from 1976 to 2003, Concorde was built to a lower safety standard than subsonic airliners; will ZEHST repeat this legacy?

Why were such practices tolerated? Because Concorde was not certificated to the same standard as subsonic airliners. Every ounce of weight that could be pared from the airframe was critical if the Concorde was to haul 100 trans-Atlantic passengers and their luggage. Thus, instead of being designed to the 1-in-a-billion standard against catastrophic failure, Concorde was designed to a lesser standard. About 10 times lower, as a matter of fact. The waivers, deviations and special provisions necessary to yield an airplane with acceptable weight meant that passengers were flying in an airplane where the risks of failure were greater. The fatal crash occurred at approximately 75,000 flights – far less than a million, much less a billion flights.

Concorde was never an economic success. The airlines could not afford to buy it, so the Anglo-French consortium that built Concorde basically gave the airplanes to Air France and British Airways. To fly supersonically across the Atlantic, Concorde burned a ton of fuel per passenger. A subsonic airliner consumes about a quarter-ton of fuel for the same distance.

Sometimes, the Concorde’s need for sufficient fuel was so great that the passengers’ luggage made the trip across the Atlantic in a subsonic jet.

Aircraft manufacturers Boeing and Lockheed toyed with supersonic airliner designs, but the operating costs and the environmental and noise challenges proved insurmountable. Their designs never progressed beyond full-scale mockups.

Enter Airbus; at a briefing a day before the 20 June opening of the Paris Air Show the manufacturer’s executives presented their vision. Jean Botti, the manufacturer’s head of technology, said the project’s success depends on cost containment and whether or not buyers for the plane can be found.

On both counts, the effort seems doomed.

The Airbus concept is known by the acronym ZEHST, for Zero Emission High Supersonic Transport. The airplane is envisioned to carry 100 passengers (like Concorde) while cruising at 2,600 mils per hour (faster by 1,000 mph than Concorde) at an altitude of 100,000 feet (twice as high as Concorde).

While Concorde was powered by four turbojet engines, the ZEHST concept features three separate types of power.

The ZEHST concept. Remember, the Space Shuttle was supposed to feature a shirt-sleeves environment for the crew and ended up with the crews wearing bulky pressure suits for launch and recovery

The ZEHST concept. Remember, the Space Shuttle was supposed to feature a shirt-sleeves environment for the crew and ended up with the crews wearing bulky pressure suits for launch and recovery

The airplane would climb to approximately 40,000 feet using turbofan engines, whose fuel would be derived from seaweed or algae (thus satisfying the environmental dictates). At 40,000 feet, ramjet engines would take over, powering the airplane to approximately 100,000 feet, where yet another set of engines would propel the airplane at four times the speed of sound (Mach 4).

The airplane would be geared towards business travelers, who supposedly could afford the cost of a ticket. That cost would be first class plus a premium. The question is how many business travelers would be willing to pay two, three, four or more times the cost of a subsonic first-class ticket for the privilege of arriving a few hours earlier.

Given the highly public demise of Concorde, ZEHST will have to be built to a 1-in-a-billion standard, which means no slipping around or sidestepping certification requirements. Those standards are independent of the cruising speed of the airplane.

To borrow a somber nautical term, ZEHST seems dead in the water.

Latest Air France Crash Update Bereft of Analysis

Even now with the benefit of the flight recorders, French investigators seem quite flummoxed about the circumstances which led to the crash of Air France flight 447 in the South Atlantic on 1 June 2009. The answer to one question seems clear: Is the pilot training to combat automation anomalies and their inherent malfunction complexities adequate enough to prevent further disasters similar to AF 447? The answer appears to be – in a word – no.

The flight recorders were recovered from the wreckage in May of this year, ending repeated and frustrating searches.

A photo released by the BEA showing the plane's landing gear at a depth of some 12,000 feet

A photo released by the BEA showing the plane's landing gear at a depth of some 12,000 feet

The digital flight data recorder and the cockpit voice recorder (DFDR/CVR) were flown to accident investigators at the Bureau d’Enquêtes et d’Analyses (BEA) in France. From the downloaded recordings and data, BEA produced an update of its investigation. This latest update follows two BEA interim reports of 2 July 2009 and 17 December 2009.

The cockpit voice recorder at the bottom of the Atlantic

The cockpit voice recorder at the bottom of the Atlantic

 

The interim report of July 2009 clearly focused on the A330-200’s three Thales-manufactured pitot probes and how they feed speed information to the airplane’s computerized engine and flight control systems. It can be credibly argued that the pitot probes on the accident airplane became clogged with ice while flying high over the Atlantic on the journey from Rio de Janeiro to Paris. When the airplane flew into a broad front of clouds, ice crystals – or supercooled water which turns into ice on impact — rammed into the pitot probes and overpowered their electric heating. (See Aviation Safety Journal, August 2009, “Prompted by Crash, Airworthiness Directive Issued on Pitot Probes” and for replacement of the pitots see February 2011, “Significant Regulatory & Related Activity”)

With ice crystals clogging the pitot tubes, the aircraft computers “sensed” from these duff readings that the airplane was flying slower than it actually was. Auto-thrust quietly added power incrementally as supercooled ice crystals overcame the limited pitot-heating capabilities and ice gradually accumulated as a granular filter inside each pitot – clogging drain and tube equally. The pilots failed to notice the minor power additions or fuel flow increases, as it is common for pilots to manage the fuel management display’s synoptic screen, which focuses on fuel remaining, not on the flow rate.

The three pitots on the A330

The three pitots on the A330

A simplified schematic of a pitot tube blocked by ice

A simplified schematic of a pitot tube blocked by ice

It is not difficult to imagine the scene in the cockpit if the airplane was being buffeted by a raging storm (although ice crystals can accumulate while cruising in relatively smooth Cirrostratus-type layer cloud, interspersed with a few bumps from embedded Cirrocumulus; it is not necessary to be embroiled in a localized thunderstorm for the pitot probes to be clogged by ice). At the altitude and speed the airplane was flying, it was near “coffin corner” or that top right-hand portion of the flight envelope where the speed-band between controlled and uncontrolled flight is inherently constricted. Long-haul airliners must fly at those heights for best range (e.g. air nautical miles per pound of fuel expended). If, as is suspected, the speed sensors were progressively feeding a false reading of lower than actual airspeed to the automation, the airplane could well have experienced a departure from controlled flight. Equally likely is that the size of the airspeed or trim discrepancy may have triggered an “air data disagree” as the air data inputs fell outside system parameters, causing an auto-pilot disconnect. Whatever the trigger, the unalerted auto-pilot disconnect began the mayhem for AF 447.

From the latest BEA update, this situation appears to be the case.

The captain, Marc DuBois, was on a rest break and not in the cockpit. The first officer, Pierre-Cédric Bonin, and the relief first officer, David Robert, were at the controls. One of them contacted the cabin staff on the intercom and advised that the airplane might experience some turbulence: “In two minutes we should enter an area where it’ll move about a bit more than at the moment…” His reassuring communication did not convey the drama of the situation in the night sky before him. The airplane was using its weather radar to weave a course between the tops of thunderstorms containing black, electrically charged clouds which were roiling up to 41,000 feet at 100 miles per hour – typical seasonal weather for the oceanic InterTropic Convergence Zone (ITCZ).

As the airplane flew into turbulence, the auto-thrust and auto-pilot disengaged. The pilot flying (PF), Bonin, said, “I have the controls.” He applied a nose-up input and the stall warning sounded.

The pilot not flying (PNF), Robert, said, “So, we’ve lost the speeds” and then remarked “alternate law”. [In alternate or direct law, the computerized angle-of-attack protections are no longer available; thus, whatever pitch, yaw and roll inputs the pilot commands will be executed by the fly-by-wire system.]

Pitch attitude increased beyond 10º, and the pilot flying made nose-down and left/right roll inputs. The airplane climbed from its planned cruising altitude of 35,000 feet to 38,000 feet; pitch attitude increased to 16º.

The captain re-entered the cockpit to help trouble shoot the situation. The BEA update report stated, “During the following seconds, all of the recorded speeds became invalid and the stall warning stopped.”

With a nose-up pitch, the airplane began a plummet of 10,000 feet per minute to the inky dark ocean below. The airplane rolled left and right up to 40º and engine power was reduced to idle.

The BEA put a positive spin on the frightening scenario: “The engines were operating and always responded to crew commands.”

All 228 people aboard were killed when the jet pancaked into the water at an unsurvivable high rate of descent but, quite extraordinarily, with a forward speed of only 107 knots.

3: The airplane made a slight turn to the left to avoid clouds and turbulence; 4: Auto-pilot and auto-thrust disengaged; 5: Stall warning was triggered again; 6: Captain entered the cockpit

3: The airplane made a slight turn to the left to avoid clouds and turbulence; 4: Auto-pilot and auto-thrust disengaged; 5: Stall warning was triggered again; 6: Captain entered the cockpit

Despite the benefit of the DFDR/CVR data, the 4-page BEA update is scant on analysis.

Presented below are the thoughts of John Sampson, a retired Royal Australian Air Force pilot. His thoughts are easily the most profound on this accident:

BEA report: “The stall warning sounded twice in a row. The recorded parameters show a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS)”.

Sampson: The fall off in speed is to be expected in a total pitot clog. The DFDR was of course recording exactly what the pilots were seeing but meanwhile the aircraft’s auto-thrust had actually been increasing power to maintain the programmed speed. The programmed speed was actually exceeded by a considerable margin, as a result of the gradual ice-crystal blockage in the pitot tubes. Speed was headed towards critical Mach [airliners are not designed to fly near critical Mach; at this speed shock waves are sufficient to stall the wing and massively increase drag; from the location of the shock wave on the airfoil, there is laminar flow forward and boundary layer separation aft].

What triggered the auto-pilot disconnect? Was it the critical Mach encounter or was it that the auto-pilot could not hold the increasing elevator force of a system-driven (by an invalid low indicated airspeed) trimmable horizontal stabilizer (THS)? Or, was the auto-pilot disconnect caused by the sudden clog of the pitots and the erroneous speed readings causing an “air data disagree”?

 

BEA report: “At 2 hr 10 min 51 sec the stall warning was triggered again. The thrust levers were positioned in the TO/GA [take off/go around] detent and the PF maintained nose-up inputs. The recorded angle-of-attack, of around 6º at the triggering of the stall warning, continued to increase. The [THS] passed from 3 to 13º nose-up in about 1 minute and remained in the latter position until the end of the flight.”

Sampson: Over time, as the pilots cruised in the cloud’s ice crystals, the pitot heating was overpowered – a known anomaly for that particular model of pitot. The gradually clogging pitot system resulted in the auto-thrust incrementally applying power to stop the “apparent” speed decay. Similarly, the auto-trim maintained the nose-up trim for that programmed speed – and the auto-pilot offset the elevator trim to hold height – as the aircraft was actually flying faster than shown. When the design pitch-holding limit was reached (i.e. the maximum nose-down force gradient the auto-pilot could hold), the auto-pilot gave up, and the handling pilot had an instant unalerted surprise handful of an aircraft in Alternate Law (or perhaps Direct Law) with nearly full nose-up trim and near to full power. It is not clear from the BEA update if the DFDR faithfully recorded the precise dangerous sequence of arcane events that resulted in a surprised pilot (and the inevitable “startle” reflex). Or did the BEA just conveniently conclude the aircraft’s pitch-up Direct Law behavior had resulted from an aberrant aft side-stick input by the pilot?

When it comes to high speed protection, under the Airbus philosophy, should a flight crew attain an attitude likely to exceed (or undershoot) a design flight envelope speed, they will attract an automatic pitch to a “safe” altitude, and the airplane will try to maintain minimum maneuvering speed plus a few knots. It should be noted that the pilots decided to reduce speed – due to expected turbulence – only two minutes earlier.

Therefore, it is not unusual, following the auto-pilot and auto-thrust disconnect, for the PF to instinctively add TOGA power (a standardized response known as a Standard Operating Procedure). That power addition induced pitch-up, reinforced by the nose-up trim, initiating the unintentional “zoom” of 3,000 feet. It should be noted that the true airspeed (TAS) at cruise height is twice that at sea-level. The effect of this “doubling” is an apparent increase in aircraft inertia and a seemingly quite disproportionate response to a minor pitch attitude change.

RVSM (Reduced Vertical Separation Minima) only became possible a few years ago with the same sort of precision in avionics and barometric altitude maintenance that permitted a business jet and a B737 on the same airway to collide head-on over the Brazilian jungle in September 2006. (See Aviation Safety Journal, January 2009, “Complacency & Computer Perversity Lead to Brazilian Mid-Air Collision”) Until RVSM became technically (although not humanly) possible, the likelihood of large altitude “excursions” (even on auto-pilot) was high enough to predicate a 2,000 foot height separation between cruising aircraft (i.e. a prior separation standard of twice that now allowed under RVSM).

To a pilot not used to hand-flying at high altitude, it would be quite easy to be caught out by this TAS and pitch-up phenomenon and inadvertently gain a few thousand feet while distracted. Additionally, there is the “handling novelty” stemming from nil exposure in training to manual flight at high altitude. Moreover, the non-moving (detented) Airbus throttles mean that urgent power is more easily attained by selecting TOGA. Therefore, the combination of too much power, a nose-up trim at disconnect and the TAS/inertia phenomenon took them up to a ballistic stall at an attitude and height they should never have reached at their weight – let alone at stall speed. A much safer SOP would dictate a deliberate Flight Idle unpowered descent entry at a mild 10º of nose-down pitch (i.e. a safe instant “departure” from coffin corner).

 

These may only be speculative considerations, based upon a knowledge of the factors involved, but they are likely to be supported by analysis. One cannot fill a cockpit suddenly with failed instruments, alerts and alarms, and expect relatively inexperienced and bewildered pilots to confidently assume precise manual flight at high altitude. The Federal Aviation Agency (FAA) has ongoing concerns about pilot proficiency at high altitude, as evidenced by an advisory circular (AC 61-107A) about this very subject; a PowerPoint slide presentation in an appendix to the AC provides information relevant to the case of AF 447.

From the FAA's high altitude upset recovery, guidance for pilots; for the full PowerPoint, go to www.tinyurl.com/64bc346

From the FAA's high altitude upset recovery, guidance for pilots; for the full PowerPoint, go to www.tinyurl.com/64bc346

We can theorize that they were actually at an initially higher airspeed than indicated – although this would not have been recorded by the DFDR. However, the engines’ parameters were recorded and the aircraft’s weight is known, so an interpolation of the speed to within a few knots of actual speed should be possible. After the pilots’ involuntary zoom climb (perhaps due to the trim state at auto-pilot disconnect), the static pressure changes in the pitots would have had a considerable additive effect on the blocked pitots’ trapped pressure and thus the displayed airspeed. This further confusing effect is intimated by the BEA report: “The speed displayed on the left side increased sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the recorded angle-of-attack was around 4º”.

 

BEA report: “The angle-of-attack exceeded 40º”.

Sampson: The pilots would not have known the angle-of-attack, as there is no such display to them of it. The angle-of-attack vane sits in the relative airflow and directly advises stick-shaker, stall warning, and fly-by-wire protective systems of any incipient exceedance. However, like a wind vane atop a chimney, once the relative wind-speed drops off, the angle-of-attack vane can weathercock uselessly. In the A330, its contribution cuts out at 60 knots. It has been argued that this is necessary to cover the takeoff case; however, a weight on wheels switch would normally inhibit false low speed warnings in such systems. The fact that the angle-of-attack system is not “there” at very low speeds and very high (>30º) angles of attack would be fatally pertinent to what happened later as AF 447 passed 10,000 feet in its deep-stall condition.

By the time the airplane reached the apex of the ensuing pitch up and following the auto-thrust/auto-pilot disconnect, it was actually on a ballistic trajectory and entering into a deep stall with a forward speed of approximately 60 kt and a high angle-of-attack –ultimately resulting in the 10,000 ft per minute rate of descent at a sustained high angle-of-attack – reportedly an astounding 40º (most airfoils stall at just over 16º angle-of-attack). The pilots had initially responded correctly to the stall warning with TOGA power. But, because of the underslung engines, did that coupling also contribute to their pitch-up moment? Sometimes, if you don’t concentrate solely upon flying the airplane in such dynamic situations, it will just “fly you”.

However, the validity of that initial pilot response was soon to change. Why? This is where the startle factor and the understandable inability to identify and interpret Airbus flight control mode changes cuts in.

In Direct (or plausibly even Abnormal) Law, which they should now have been in, holding the side-stick back will maintain the stall. The PF might have persisted in holding back-stick to attain/maintain level flight – in the confusion of the situation (with its alerts and alarms), perhaps quite unaware of the airplane’s height gain into even more rarified air. If the fly-by-wire software was now in Direct Law, “kid gloves” for control inputs would have been required.

Why shift the throttles from TOGA thrust to idle? There is a possible clue; in the subsequent descent with static pressure increasing and the pitots still blocked, even though the airplane was actually stalled (complete with stick-shaker) the indicated airspeed could be rising alarmingly – courtesy of increasing static pressure. I have personally experienced this with frozen trapped water in the static lines (i.e. the opposite effect of trapped dynamic pressure). There is a report from the Irish Accident Board about a B747 on a test flight with uncapped static lines due to a maintenance error. It is an elucidating gaelic tale that shows just how confusing the compromised pitot-static scenario can be. Ask any instrument technician how much a 1,000 feet of altitude change is worth in terms of “displayed knots”. He’ll demonstrate this for you on his test bench. An airspeed indicator will wind down from 250 knots to zero over a 3,400-foot climb band – and do the opposite on descent. This phenomenon all depends upon whether the pitot ports were blocked and the pitot drain holes were not.

The other possibility is that the captain, upon re-entering the cockpit, saw a high descent rate, inappropriate airspeed and TOGA power and misinterpreted what he saw as a gyrating loss of control and selected idle thrust (after all, there was no stall warning or stickshaker at this point, because they were, angle-of-attack wise, well above the regime where the angle-of-attack vane functioned). How could the captain know at night that they were stalled? The only clue, of a nose-high attitude, was missing. The captain might not have been able to see what the PF was doing with his side-stick control. Courtesy of the trimmable tailplane, stuck at 13º nose-up (but not advertising its status), AF 447 was now descending rapidly, but in a quite normal flight attitude.

As somebody said, “All this will probably come down to crew composition, very high workload, in adverse weather conditions, having to manually hand-fly an aircraft which suddenly found itself in alternate law at high altitude due to spurious information being fed to not only the flight displays, but also to the flight control guidance computers simultaneously”.

Suddenly? Do not underestimate the power of surprise.

Spurious information? When you are taught to believe your instruments, that is what you react and respond to. You see a high and increasing airspeed and you apply back-stick in an attempt to control it. You idle the throttles for the same reason.

The effect, unbeknownst to the pilots, was to embed themselves in a deep-stall condition. Will the stall warning simply cease once the airplane is embedded in a deep stall at 40º angle-of-attack? That is my guess. From the limited dialogue on the CVR, it is evident they were nonplussed by developments. Even the captain was struck dumb by what he saw. No solution was apparent in the time available. The airspeed could have been seen to be much more than just “adequate” (perhaps even high, and higher as static pressure increased inexorably on descent), so how could they be stalled? Unthinkable, so it wasn’t even considered? They just ran out of ideas in a very distracting and dynamic circumstance for which they had never been trained.

Someone also said, “You are not only dealing with conflicting airspeed information. You are also presented with multiple spurious ECAM [Electronic Caution Alert Module, or the Master Warning Display] warnings and cautions – many of which are irrelevant, yet are persistent and therefore impossible to ignore; also depending on the Alternate Law protection loss, which would mean direct side-stick to flight control input without any load protection, leading to control overload.” Isn’t automation wonderful? Only when it works.

A pitot-static system’s pneumatic airspeed data output relies wholly upon very accurate dynamic pressure and static (i.e. ambient atmospheric) pressure inputs – and the latter changes rapidly during a descent at 10,000 feet per minute. No digitizing the source of that information; it is all air pressure analogue. Falsify either one (via blockage or leak) and zoom up or descend and the story will be ever more confusing to the pilots. The totally bewildered pilots in the fatal crashes of the Birgenair and Air Peru B757s found that to be the case.

In the case of AF 447, a frozen static pressure can mean the airspeed will wind back from 250 knots to zero over as little as 3,400 ft of climb at 250 knots indicated airspeed. BEA investigators may be assuming that the zoom was the result of pilot input and not an aerodynamic pitch-up as a result of possibly hitting critical Mach with auto-pilot disconnect and a very nose-down trimmed horizontal stabilizer (3º nose-up, increasing to 13º nose-up due to the pilot’s aft side-stick inputs after the top of zoom climb). Do I think they hit critical Mach? No; more likely was the excessive elevator force gradient that kicked out the auto-pilot and kick-started the fatal zoom sequence. Perhaps the answer will be evident from the DFDR, but maybe not, as the DFDR was being fed erroneous speed information.

A pilot said of the AF 447 crash, “Direct Law is there to give the pilot more direct control of the aircraft but it still has some protection to offer. BUT the protection on offer is only as good and accurate as the information provided to the computers involved. Much more information is needed before one can create a valid picture of what went wrong when it comes to the decisions the pilots made in the last few minutes of the flight.” However, the change in static pressure resulting from the zoom into ever more rarified air and the instinctive attempt to maintain level flight and use backstick to reduce the possibly ever higher displayed airspeed indicated during the ensuing descent after zoom climb are key factors dictating an inevitable entry into the unrecognized deep-stall condition. Add the dearth of information the pilots had to work with, little prior exposure to degraded flight control laws, at night and hurtling into the turbulent clouds below, and the makings of disaster are evident.

 

BEA report: “The airplane’s pitch attitude increased progressively beyond 10º and the plane started to climb. The PF made nose-down control inputs and alternately left and right roll inputs.”

Sampson: Perhaps the left and right roll inputs were the PF’s insufficient attempts to get the nose to drop. When you’ve got a stuck elevator, or an aircraft pitching up of its own volition due to a runaway elevator pitch-trim, roll the beast onto its wingtip to get the nose to drop. Pity the pilots didn’t think of that, or were trained to think of that, during the January 2003 Beech 1900 stuck elevator take-off accident at Charlotte, NC (52º nose-up at 1,200 feet above the ground). The PF’s nose-down control inputs? They would have been his opposition to the pitch-up of trim and power.

According to the BEA’s interim report, the horizontal stabilizer moved from 3º to 13º, almost the maximum. In doing so, it forced the airplane into an increasingly steep climb. The airplane “remained in the latter position [i.e. 13º nose-up] until the end of the flight,” the report notes.

As pointed out earlier, with underslung engines, maximum thrust can result in an aircraft’s nose rising on its own, exacerbating any incipient control difficulty. Manufacturers have recognized this pitch-up phenomenon. In a 12 May 2010 post-crash Flight Operations Telex, Airbus quietly removed the maximum thrust instruction from its flight manuals (for loss of control and stall scenarios).

An explanation for the A330’s rising nose could also be provided by that innocuous line in the BEA report referring to the trimmable horizontal stabilizer (THS). If the THS had trimmed itself to 13º nose-up prior to the auto-pilot disconnect, as a result of perceived slowing, it would have boosted the pitch-up effect of the pilot’s TOGA power input. The timing of this THS change should be clearer on the DFDR readout.

Gerhard Hüttig, a professor at the Institute of Aeronautics and Astronautics at the Technical University in Berlin, considers the high angle of the THS to be a failure of the Airbus’ electronic flight control system. Hüttig, a former Airbus pilot himself, calls it “a programming error with fatal consequences.” The THS, and not the side-stick controlled elevators, has the real pitch authority at low speeds.

“No matter how hard the crew tried to push down the nose of the aircraft, they would have had no chance,” Hüttig maintains. He is demanding that the entire fleet of Airbus A330’s be grounded until the phenomenon is adequately explained. The PF was never aware of that 13º nose-up THS (or he might have manually trimmed it out – yet another completely unnatural input for a fly-by-wire Airbus pilot). There was nothing to stimulate any awareness of the extreme position of the THS. Hüttig pointed out that Airbus published a detailed explanation of the correct pilot behavior in the event of a stall in the January 2010 issue of its internal safety magazine. “And there, all of a sudden, they mention manually trimming the stabilizers,” he recounts. A November 2008 crash of an XL Airways A320 had served to alert Airbus to the hazards of a “stuck” (i.e. non auto-trimming) THS in preventing stall recovery.

In the stall, would there have been any tell-tale buffeting? In a word, no. The buffet in a level entry 1G stall is provided by the disturbed airflow over the wing hitting the tailplane. At the BEA’s stated 40º angle-of-attack, the disturbed airflow would not have impinged on the tailplane. Everybody aboard was going down in an express elevator at around that self-same 40º angle that was being presented to the relative airflow. Thus, airflow and airframe buffet would not have been a player, alerting the pilots to their airplane’s stalled condition. Indeed, the interior was probably quieter than the ambient noise in cruise, even with the engines at TOGA power.

By design, in Direct or Abnormal Law, there is no auto-trim (it disconnected after reaching 30º angle-of-attack, leaving the THS stuck at 13º nose-up), no ALPHA FLOOR PROT or ALPHA max (i.e. no maximum selectable angle-of-attack), so the aircraft can be stalled in extremis. I daresay this is a consideration that is alien – even bogus, anathema or heretic – to most Airbus pilots.

AF447’s stall occurred probably in a regime beyond the imagination of Airbus designers or test pilots, at the apex of a ballistic zoom climb with a lot of power set on the throttles, at or above the ceiling for the airplane’s weight. A design in which blockage of the pitots not only loses airspeed data but also (because the system believes speed is less than 60 knots, regardless of the truth of the matter) disables the stall warning? Well, prima facie, it seems at least “unwise” – and may have been conclusive.

Much is inconclusive, but one fact ultimately killed the pilots’ last chance of recovering the aircraft. It is very ironic that it was likely due to one of the systems meant to have saved them. The BEA report states, “At 2 h 12 min 02, the PF said, ‘we have no valid indications’. At that moment, the thrust levers were in the IDLE detent and the engines’ fan speed was at approximately 55%. Around 15 seconds later, the PF made pitch-down inputs. In the following moments, the angle-of-attack decreased, the speeds became valid again and the stall warning sounded again.”

At the sudden sound of the stall warning, the PF was likely deterred from any further initiatives, even though he was on the right track with his pitch-down inputs. Instead, he promptly handed over the controls to his more senior PNF. A stall warning that sounds off as the airplane exits a deep-stall condition? Not a great idea at all; it is likely to have the opposite of the desired effect. The overwrought pilot might easily assume that his action is initiating a stall. A much safer, and saner, proposition would be a Doppler-based stall warning whose pitch and volume varies, dependent upon the degree to which the airplane is embedded in the stall. Military fighter aircraft have had such aural calibrated stall warnings for years.

 

Having read through all of the above, whether it is precisely accurate or just roughly right, one has to ask, “Is the training to combat automation anomalies and their inherent malfunction complexities adequate?” Note how quickly the situation described above can become completely and incomprehensibly unglued. The AF 447 crew was caught out by a little known pneumatics phenomenon and reacted understandably to what they saw. They died clueless as to their actual predicament. The pilots are blameless. As one of them said, “We have no valid indications”.

His futile statement was correct. Man can easily be defeated by automation unwinding haphazardly, and it is a burgeoning problem, especially in this era of decreasing pilot experience and economically abbreviated training.

The captain of an A330-200 endorsed Sampson’s analysis:

“That scenario is horribly plausible. That it was erudite and technically accurate certainly add validity. As a current A330-200 pilot, I can envisage just such a sequence and can now perhaps understand the confusion and fear that must have reigned.”

This encomium notwithstanding, it seems that pilots need to be trained in scenarios where automation failures combine to yield an instant crop of false instrument displays and alerts sprinkled with few clues – and they must cope successfully. To be sure, this will cost the industry in pilot down time, classroom and simulator sessions, flight manual upgrades, and so forth. Adjustments must be made when automation confuses rather than enlightens the pilots’ attempts to resolve deviant and seemingly irrational aircraft behavior.

 

A post script:

As early as 2005, the pitot tube manufacturer, Thales, was well aware of the catastrophic consequences of the speed sensors. At the time, the French company concluded that such a failure could “cause plane crashes.”

A total of 32 cases is known in which A330/A340 aircrews got into difficulties because the speed sensors failed. In all 32 cases, Thales pitot sensors were involved. These particular sensors were significantly more prone to failure than a more sophisticated later model produced by American manufacturer B.F. Goodrich.

Yet none of the responsible parties saw any urgency in the dilemma. In 2007, Airbus “recommended” that the Thales sensors be replaced. Air France relied upon that underwhelming recommendation as a justification for not carrying out the modification – and had this course signed off as approved by the regulator. The regulator, the European Aviation Safety Agency (EASA), wrote back to Air France that it identified “no unsafe condition that warrants a mandatory modification of the Thales pitot tubes.”

This indemnifying letter was sent on 30 March 2009, almost two months to the day before AF 447’s demise ushered in a new level of distrust in airliner automation. “Mistrust” would suggest vague doubts. “Distrust” is rather more emphatic, suggesting positive suspicions and even a complete lack of trust. Mistrust was the status quo ante. As evidenced by numerous pilot comments, distrust is now in force.

Crash in Alaska and Lack of Probing About Key Safety System

It is not good when crash investigators reveal a distinct lack of curiosity. Case in point: the investigation into the crash in Alaska which killed the pilot, Sen. Ted Stevens and three other passengers. Four other passengers survived, although injured. (See Aviation Safety Journal, January 2011, “For Lack of a Locking Screw, a Crashed Airplane Could Not be Found Quickly”)

The DHC-3T

The DHC-3T

The National Transportation Safety Board (NTSB) just recently wrapped up its investigation into the August 2010 crash. The NTSB determined that the pilot, who had a history of stroke but had been granted a first class medical certificate after the event by the Federal Aviation Administration (FAA), was “temporarily unresponsive” as the airplane veered left into the path of high terrain.

The accident flight compared to the route that should have been taken

The accident flight compared to the route that should have been taken

The radar altimeter sounded a warning about 5 seconds before impact, and the airplane struck the tree tops in a climbing, left bank attitude indicating that the pilot was reacting at the last moment to avoid the terrain.

Left float, showing crush from the front

Left float, showing crush from the front

The airplane was equipped with a Terrain Awareness and Warning System (TAWS). This piece of avionics equipment could have alerted the pilot to dangerous terrain ahead. TAWS features a “look ahead” function that provides both aural and visual warning of looming terrain which is as high or higher than the airplane. This safety technology has saved many a pilot and his passengers from driving a perfectly good airplane into the ground.

Terrain altitude/color correlation on the TAWS display

Terrain altitude/color correlation on the TAWS display

But in this case, the TAWS was inhibited. In this mode, the aural and visual alerts of terrain ahead are deactivated. The pilot deactivates the system by pushing a button on the control panel. Investigators dug through the wreckage and found the TAWS control panel caked in mud. When the dirt was scraped away, the TAWS inhibit button was found in the depressed position – meaning TAWS essentially had been disabled by the pilot.

TAWS pushbutton found in the depressed (inhibited) position after the mud was cleared away

TAWS pushbutton found in the depressed (inhibited) position after the mud was cleared away

Investigators intimated that inhibiting TAWS is standard practice among many pilots in Alaska because of the system’s tendency to issue distracting nuisance alerts. These are not false alarms, but bona fide alerts based on the airplane’s height above terrain.

As NTSB Chairman Deborah Hersman stated:

“While aviation, especially general aviation, is a big part of life in Alaska, the risks of flying in Alaska are greater than in the continental U.S. There is unforgiving terrain – 39 mountain ranges with high peaks and deep gorges, and more than 100,000 glaciers. Then, there’s the challenging and rapidly changing weather conditions. Lastly, there are uncontrolled airports, dirt strips, lakes and rivers that serve as regular landing spots.”

One Board Member, Robert Sumwalt, was even more direct: “It makes no sense to me that to fly in Alaska you have to inhibit TAWS” [to reduce nuisance alerts].

The accident airplane was a de Havilland DHC-3T equipped with floats for take-offs and landings in the myriad lakes in the region. Lakes are not officially designated airports in the TAWS data base, so the system will alert the pilot when he is about to land on a lake, as he intends.

To suppress such an alert, TAWS can be inhibited. However, that can be done moments before landing. On the accident airplane, TAWS was inhibited during the cruise portion of flight.

Contrary to flights the previous days from the fishing camp on Lake Nerka southeast 52 miles to a remote fishing camp on the Nushagak River, the accident flight veered left to an east-northeast direction. The course change took the aircraft into mountainous terrain.

Accident flight path in red compared to flight paths with the same pilot on three previous days

Accident flight path in red compared to flight paths with the same pilot on three previous days

Had TAWS not been inhibited, the system would have issued an alert, “Caution, Terrain” about 30 seconds before impact. About 15 seconds before striking terrain the system would have sounded, “Terrain, Terrain, Pull Up, Pull Up.” The electronic map display associated with TAWS would have shown terrain 100 feet to 1,000 feet below the aircraft in yellow; terrain within 100 feet of the airplane’s altitude or higher would have been depicted in red.

What the pilot would have seen on the terrain display, had it not been inhibited -- no ground in black (a safe 1,000 feet below); rather, all yellow or red

What the pilot would have seen on the terrain display, had it not been inhibited -- no ground in black (a safe 1,000 feet below); rather, all yellow or red

With 30 seconds notice, a pilot should have had ample time to maneuver his airplane and avoid impact with the ground. That is, if TAWS is not inhibited.

A warning pop-up message, which would have been accompanied by a voice alert

A warning pop-up message, which would have been accompanied by a voice alert

Investigators were unable to determine why the pilot deviated from his previous routes and turned east-northeast. Did he have another stroke? Three autopsies were unable to find such evidence.

Investigators interviewed the senior pilot and fellow pilots at General Communications, Inc. (GCI), the owner/operator of the de Havilland float plane. NTSB investigators did not ask a single one of them about any habits on their part or the accident pilot to inhibit TAWS. Nor were other pilots in the region, flying for different companies, asked about any tendency to inhibit TAWS.

If pilots are inhibiting TAWS to suppress alerts of threatening terrain, maybe they are flying too low. After all, the accident pilot was flying about 100 feet higher than on previous flights through the mountain pass (where he suddenly turned left towards what a fellow pilot described as “smack in the biggest portion of the Muklung hills”). But the accident pilot was still flying lower than the tops of the hills.

Are there other cases in which pilots in Alaska are flying lower than the conditions warrant, with TAWS inhibited? Who knows? The records of interviews with other GCI pilots reveal no curiosity whatsoever on the part of NTSB investigators about these critical questions.

There were no recommendations from the NTSB to the FAA to find out if there is a widespread habit in Alaska for pilots to fly with TAWS inhibited – which is like flying without TAWS at all.

Any accident which occurs because a key safety system is inhibited or shut off goes beyond ironic tragedy. It is the very essence of a useless crash. There will likely be another because the NTSB did not inquire further.

Taking Credit For Scant Accomplishments

Some bureaucrats at the Federal Aviation Administration (FAA) are good at tooting their own horns in the face of overwhelming and continuing vulnerability. A case in point is an FAA Technical Center document dated May 2011.

Technical Center logo

Technical Center logo

This technical note (DOT/FAA/AR-TN11/8) is grandly titled, “Improvements in Aircraft Fire Safety Derived From FAA Research Over the Last Decade”. The reality is that the research has been selective and has not as of yet resulted in a whole scale improvement in the nation’s fleet of airliners. Passenger and cargo-carrying aircraft remain flying firetraps. Unlike public buildings, such as offices, schools, hospitals, nursing homes and the like, which are required by building codes to be 100% covered by fire detection and suppression, an airliner has entire areas bereft of fire detection and suppression, despite the fact that airplane occupants are stuck in their seats until an on-fire airplane lands. In this respect, passengers are analogous to nursing home occupants – aged patients with limited mobility, often confined to wheelchairs. The inability of nursing home occupants to quickly evacuate a burning building is a major reason for full detection and suppression of fires. Passengers do not benefit from similar protection, despite the fact that the aircraft is a mobile life support system from which immediate escape is not possible.

One could argue that the results of the Technical Center’s efforts are paltry. The TechCenter asserts that its fire safety research during the period from 2000 to 2010 has:

“[Resulted] in the adoption/issuance of five final regulations, two Airworthiness Directives, two Advisory Circulars, and two Safety Alerts for Operators, which are expected to significantly improve aircraft fire safety.”

This assertion may sound like a very productive effort. However, only regulations and Airworthiness Directives (ADs) are mandatory. Everything else is advisory, for information, and definitely not required.

If one looks only at the seven mandatory actions, these actions are the equivalent of  approximately one regulatory action or required corrective action every 1.5 years. Regarding these various mandated initiatives, some of the most important have had no effect on the fleet of aircraft because of their generous implementation time. For example, one of the touted mandatory actions concerns fuel tank inerting – or the provision of explosion-suppressing gas into the void spaces of fuel tanks. This inerting program is intended to prevent a recurrence of a TWA Flight 800 disaster, in which the flammable ullage (vapors) in the center wing tank of an older B747-100 was ignited by electrical arcing of fuel quantity indication system (FQIS) wires inside the tank. The resulting catastrophic explosion shortly after takeoff from New York’s Kennedy International Airport blew apart the airplane and killed all 230 persons aboard.

In the July 2008 Federal Register, the FAA published a final rule requiring new and existing airliners to be fitted with either a Flammability Reduction Means (FRM), which is generally understood to mean an inerting gas inside the fuel tank, or an Ignition Mitigation Means (IMM). An IMM can be foam block in the tank to reduce or contain an ignition source, preventing an explosion and thereby accomplishing the same end as inerting.

Either FRM or IMM must be installed on new aircraft within two years, placing the deadline in July 2010. The number of new airliners entering service is paltry compared to the size of the existing fleet: approximately 100 new aircraft compared to an existing fleet of some 4,000 jets.

For the existing fleet, the FAA has allowed planes to operate without retrofit until 2018 – fully 22 years after TWA 800 exploded.

The TechCenter takes credit for a rule that should have been published years ago and, in fact, published well before TWA 800 blew up, as the hazard has long been recognized and systems have been developed to mitigate it. The record demonstrates that at least three generations of inerting technology were not deployed on airliners because of the absence of an FAA requirement to do so:

1st generation: 1950, an inerting system was fitted to the first jet bomber, the B-47, based on filling canisters in the wheel wells with dry ice (CO2). The ice was heated, and the resulting CO2 gas was piped to the fuel tanks.

2nd generation: 1970, the FAA successfully demonstrated a liquid nitrogen (LN) based inerting system in a DC-9 aircraft.

3rd generation: 1983, Boeing patented a membrane-based technology to produce nitrogen-enriched air (NEA) to inert fuel tanks.

The technology mandated by the FAA is a pared down version of the 3rd generation system. A vacuum bottle, used originally, to store NEA for the descent phase of flight has been eliminated. The bottle was used to store surplus NEA produced during cruise, which would then be metered to the fuel tanks during descent. With the vacuum bottle removed (as a weight saving measure), the new system will not provide inerting during descent.

The inerting system developed by the TechCenter, which basically is a stripped down version of Boeing's patented system. The arrangement shown here lacks an oxygen sensor to ensure that the fuel tank is in fact inerted.

The inerting system developed by the TechCenter, which basically is a stripped down version of Boeing's patented system. The arrangement shown here lacks an oxygen sensor to ensure that the fuel tank is in fact inerted.

This rule addresses only heated center wing tanks, the type which exploded on TWA 800. Airplanes with unheated center wing tanks or no center tanks are not affected. A heated center wing (e.g., fuselage) tank is one in which nearby equipment generates heat which, in turn, can migrate into the center wing tank, thereby elevating the temperature of the ullage into the flammable range. A spark from fuel pumps, fuel quantity, or other electrical systems internal to the tank can ignite flammable vapors.

The National Transportation Safety Board (NTSB) did not make a distinction between unheated and heated, or between center or other tanks. The NTSB recommended that all fuel tanks be inerted.

The NTSB complained to the FAA about the unavailability of inerting on all aircraft regardless of whether or not they have heated center wing tanks. For example, in its 2004 protest over the intended Airbus A380 super-jumbo jet design, the NTSB said:

“The draft SC [Special Condition] is … based on a philosophy that accepts fuel tank flammability, proposes that safety assessments be performed to demonstrate that the presence of an ignition source within the fuel system is ‘extremely improbable’, and describes the operation of a new transport airplane with a flammable fuel/air mixture in the fuel tanks.”

Despite this complaint, the European Aviation Safety Agency (EASA) certified the A380, as did the FAA.

It gets worse. The inerting rule completely ignores safety margins. For example, the FAA considers the fuel tank to be explosive only after the fuel vapor concentration exceeds 100% of the Lower Flammability Limit (LFL), as opposed to the 25% limit adopted by the National Fire Protection Association.

The FAA assumed that if the ullage had an oxygen concentration restricted to 12% then the tank would effectively be inerted. Traditionally, an oxygen content of 9% has been used, which provides a safety margin. The FAA determined that an inerting system capable of reducing the oxygen content of the ullage to less than 12% is “impractical for commercial airplanes” since a more capable inerting system would be needed.

There are other deficiencies in the final rule on inerting. Suffice it to say, the FAA has opted for a minimalist approach to inerting which eliminates all safety margins.

The TechCenter takes credit for having influenced this travesty of a rule.

 What did the TechCenter not do? It failed to address why fuel tanks were, and are, designed with all sorts of electrical components inside the tanks, such as electric fuel pumps, electric fuel quantity measuring systems, and the routing of wires for other systems inside fuel tanks. The density of electrical systems inside fuel tanks invites the probability of failure (e.g., chafing) and the likelihood of an errant spark.

It would have been more fruitful for the TechCenter to explore alternate designs in which fuel tanks did not contain any electrical components, thereby providing a design template for aircraft manufacturers to emulate.

To be noted, the TechCenter did perform useful work by demonstrating the flammability of insulation blankets covered in metalized Mylar.

Photographs compiled by the TechCenter showing damage resulting from a hidden in-flight fire involving insulation blankets.

Photographs compiled by the TechCenter showing damage resulting from a hidden in-flight fire involving insulation blankets.

All such insulation material was removed from about 800 airliners as a result of the TechCenter’s research. Again, consider what the center has not done — it has not tested new, absolutely flameproof insulation material. Called Starlite by its manufacturer, it is superior to even the most dramatic insulation on the Space Shuttle. A Boeing official said:

“We coated an egg with a layer of [the] material about the thickness of peanut butter you’d put on a sandwich, then we put a blowtorch to it for a couple minutes until it glowed red. Immediately after the flame was removed, you could hold the egg in your hand, and when we broke the egg open it was still raw. We see the possibility of preventing injuries and death during aircraft ground fires with this material.”

Not to mention that the material, substituted for existing insulation blankets on an airplane, would enhance safety during in-flight fires as well.

Maybe the fact that this the material is the invention of a former hairdresser, not of an aerospace scientist, is part of the reluctance to accord Starlite due deference for its flame proof properties. That, and the reluctance of the inventor to divulge the exact chemical make-up of Starlite. In any event, it has not been subjected to high profile tests by the TechCenter.

The TechCenter did test a device in which a hand-held fire extinguisher could have its chemicals get behind a cabin ceiling. The Swissair Flight 111 aircraft, an MD-11, which crashed in Halifax, Canada, in 1998, was downed by a fire in the so-called attic space above the cabin ceiling panels. One company has developed a port, affixed to interior cabin panels, in which an extinguishing agent could be squirted into the area behind. The TechCenter gave the device lukewarm marks:

“A preliminary series of tests were conducted to examine the use of ports, opening in the cabin ceiling, to allow the discharge of Halon 1211 hand-held extinguishers into the attic area. Not surprisingly, it was shown that the ports could be effective in the relatively small volume that exists in a standard-body aircraft (e.g., a B737 or A320); but in a wide-body aircraft (e.g., a B747), this approach would not be effective because the agent is diluted by the large volume of the attic area. Additionally, to make the ports practical and effective in a standard-body aircraft, a detection system would be needed to locate the fire, and the ports would have to be spaced to optimize the effectiveness of the available extinguisher.”

What is not mentioned is that after the crash in Canada, Swissair installed infrared cameras in the attic space of its remaining MD-11s, with the pictures piped to a display in the cockpit. The problem of locating a hidden fire was effectively solved.

The problem of attic space conflagrations is only a part of the hidden fire problem in which access ports would be useful. The TechCenter report does not mention that behind cabin sidewalls electrical components proliferate. A series of ports along the cabin would facilitate the application of fire suppressant chemicals in a confined area where the chemicals would not be diluted by space.

The TechCenter report also fails to address the problem of smoke in the cabin and cockpit. Regarding smoke in the cabin, one manufacturer has developed a combination oxygen mask/smoke hood which would drop from the overhead instead of the “little yellow cups” which constitute the current passenger emergency oxygen mask.

The combination mask/hood would not only provide exygen, but would also protect the passenger from heat and the noxious effects of smoke. When it would be time to evacuate the airplane, the hood would break away from its oxygen umbilical and the passenger would have sufficient breathable air to evacuate the airplane.

With nil interest from the aviation industry, the manufacturer has suspended further development and marketing of the combination mask/hood. The U.S. military has not accepted this state of affairs. All military transports are equipped with portable breathing equipment (PBE) for passengers and crew. The PBE weights about 1 lb and can keep the wearer alive for up to an hour. This safety device is also used on many civil passenger planes, but is only available for the crew.

Smoke in the cockpit can be countered by oxygen masks and goggles worn in emergencies by the pilots. However, the presence of thick, blinding smoke can obscure instruments and the view out of the windscreen. In the Canadian report of the Swissair disaster, it was surmised the pilots had trouble seeing their instruments and therefore standby gauges and displays should be larger. In the presence of pervasive smoke, goggles are of no use beyond the short distance from eyeball to faceplate, and the size of the instruments is of no help. If the pilots cannot see out the windscreen, how are they supposed to land the airplane? A device known as EVAS (Emergency Vision Assurance System) features an inflatable, clear plastic bubble which physically displaces the smoke, giving the pilot a reduced view of instruments and a forward view out of the windscreen.

EVAS deployed from its briefcase-size box and in action.

EVAS deployed from its briefcase-size box and in action.

 evas schematic

This technology has not been tested or endorsed by the TechCenter. However, the FAA has equipped its own airplanes with this safety device, and it has approved installation on airplanes when applicants have asked for it. So now we have the FAA preaching “one level of safety”, with a higher standard for its own airplanes than for those of the flying public.

An example of the cockpit visibility problem comes from the September 2010 crash in the United Arab Emirates (UAE) of a United Parcel ervice (UPS) B747-400 freighter.

Crash scene of a UPS B747 freighter near Dubai

Crash scene of a UPS B747 freighter near Dubai

With a fire on the main cargo deck, the cockpit quickly filled with smoke. According to the preliminary report by the UAE’s General Civil Aviation Authority (GCAA):

“The crew informed BAH-C [Bahrain Air Traffic Control] that there was smoke in the cockpit and that the ability of the crew to view the primary flight instruments and radio frequency selection controls had become degraded …

“Based on the information available to date, it is likely that less than 5 minutes after the fire indication on the main deck, smoke had entered the flight deck and intermittently degraded the visibility to the extent that the flight instruments could not be effectively monitored by the crew.”

From the GCAA preliminary report

From the GCAA preliminary report

The crew was killed while attempting an emergency landing. Since the accident, UPS has ordered EVAS for its entire fleet.

A tantalizing — and chilling — statistic is contained in the TechCenter report: in 2006 there were more than 800 incidents of smoke or odor in the cabin or cockpit. In 34% of cases, the severity was such that the pilots diverted the aircraft to a quick landing or returned hastily to the departure airport. This works out to one incident every day for nine months. Yet smoke hoods and emergency vision for the pilots remain unexplored territory at the TechCenter.

Above all, the TechCenter has not undertaken a vigorous research program into one of the fundamental recommendations coming out of the Swissair 111 disaster. The Transportation Safety Board (TSB) of Canada, who investigated the crash, stated that if there were no flammable materials used in the construction and equipping of airliners, the danger of airborne fire would be greatly reduced.

A technical inquiry into such feasibility has not been undertaken.

Rather, research remains focused on various tactical problems, such as the vulnerability of certain types of insulation blankets to ignition from adjacent fire, or reducing fuel tank vulnerability to explosion. Promising technologies seem to be ignored and basic issues – such as electrical components routed inside fuel tanks – are not questioned.

As the TechCenter report freely notes, three crashes were major stimulants of its work:

1. The 1996 loss of a ValuJet DC-9 due to an uncontrolled fire in its foward belly hold, with the loss of 110 lives when the airplane plummeted into the muck of the Florida Everglades. Before the crash, there was smoke in the cockpit.

2. The 1996 destruction of the TWA B747 due to the explosion of flammable vapors in a fuel tank, with 230 fatalities resulting.

3. The 1998 loss of a Swissair MD-11 due to an uncontrolled fire in the attac space, with 229 fatalities. Before the crash, there was smoke in the cockpit.

Without these crashes, it is doubtful that the TechCenter would have undertaken the modest research program it did perform, looking into fire aboard airplanes. In other words, without the grim stimulus of three crashed airplanes and 569 lives lost, the belated and weak research program which was undertaken might not have been conducted.

The FAA is often accused of taking a “tombstone” approach to air safety, which means the agency is only galvanized by disaster to take action. The TechCenter report provides further evidence of this approach; and the report, with all of its self-proclaimed accomplishments, still evades basic issues, such as electrical system routing, flammable materials, and new technologies.

Indeed, the TechCenter report could be compared to one completing his/her own report card. The center gives itself an “A” for contributing effort — one required action every 1.5 years.

A knowledgeable third party might be less generous – maybe a gentleman’s “C” for doing just the basics – after hundreds of lives were unnecessarily lost.

Amendment Could Stifle Safety Regulations

A bill passed overwhelmingly by a vote of 223 to 196 contains a provision that could make it more difficult for the Federal Aviation Administration (FAA) to issue new safety regulations for the aviation industry.

Amendment 23 of the FAA Reauthorization and Reform Act of 2011 (H.R. 648) requires an analysis of how any proposed rules would affect the economy, employment, productivity, competitiveness and private markets. The amendment also requires that separate safety rules be written for the various segments of the industry. As such, the proviso flies in the face of the FAA’s “one level of safety” theology.

The amendment made it into the Reauthorization Act by a slender margin of 215 yea and 209 nay votes – a weak victory on the grounds that the FAA already must conduct cost-benefit studies on proposed regulations.

The amendment was sponsored by Rep. Bill Shuster (R-PA) and is flatly opposed by the FAA and by the National Transportation Safety Board (NTSB). According to a blunt FAA statement circulated on Capitol Hill before the Reathorization Act vote of 1 April, the amendment “enshrines in legislation a set of procedural hoops that could have the effect of slowing down rulemaking projects underway and in the future.”

The FAA suggestion that the amendment will “slow down” rulemaking sidesteps the existing problem – rulemaking already is a glacial process in which opponents of a rule have ample opportunity to delay needed safety initiatives.

NTSB Chairman Deborah Hersman said Shuster’s amendment “would add complexity to the rulemaking process” and could stifle several rulemaking projects in the FAA that are in response to the crash of a regional airliner near Buffalo, NY, that killed 50 people. A regulation to combat pilot fatigue is among the NTSB recommendations now under evaluation by the FAA. (See Aviation Safety Journal, February 2010, “General Industry Laxity Criticized in Wake of Colgan Air Crash” and October 2010, “Draft Guidance on Fatigue Evades Accountability”)

Shuster has denied that the amendment would affect any rulemaking already in progress. That may be so, but rulemaking already is such an agonizingly slow process that NTSB recommendations emanating from the Colgan Air crash at Buffalo in 2009 are not yet in the “notice of proposed rulemaking” stage.

Jeff Urbanchuk, a spokesman for Rep. Shuster, and officials from the passenger, cargo and nonscheduled airline industries, characterized the amendment as merely an effort to put into law the intent of an executive order issued by President Barack Obama in January 2011. That order directs federal agencies to make sure that the cost of regulations is fully assessed and, where possible, federal agencies should reduce the burden of regulations.

The presidential mandate makes no mention of assessing the impact of proposed regulations on the overall economy or private markets.

A representative of the Air Transport Association (ATA), the Washington DC lobbying group for the scheduled airlines, opined that the Shuster amendment is not broader than the president’s executive order. The economy and jobs “are exactly the kinds of issues he’s been talking about,” said the ATA’s Sharon Pinkerton.

Oakely Brooks, president of the National Air Carrier Association (NACA), said the FAA has not considered the cost to the nonscheduled airlines when drafting the pilot fatigue regulations. To date, the FAA has only published a non-binding draft advisory circular (AC). Even if issued as a final document, an AC lacks the power of a regulation, so Brooks seems rather exercised about an AC that is not enforceable and will not cost NACA member carriers one dime.

Kevin Kuwik, a spokesman for the families of people killed in the Buffalo crash, characterized the amendment as a “sneak attack” on the recommended fatigue regulations. “It muddies up the process on the front end and, worse, on the back end it gives them [the airlines] a chance to challenge it [pilot rest and duty regulations] in court.”

The Senate version of the FAA Reauthorization Act does not contain such an amendment. The House and Senate will have to meet in conference to negotiate the bills approved by each chamber. Hopefully, Shuster’s amendment will be cut out of the conference bill as an unnecessary impediment to rational rulemaking.

Crash Investigation Reveals Inconsistent Oversight

The investigation of a cargo airplane crash reveals inconsistencies in the government’s approach to air safety. Both the National Transportation Safety Board (NTSB) and the Federal Aviation Administration (FAA) are open to criticism for being inconsistent. The lack of a uniform approach makes safety improvement difficult, if not impossible.

The case involves the early morning 27 January 2009 crash of Empire Airlines flight 8284, an ATR-42 twin-turboprop, in Lubbock, TX. The airplane was registered to Federal Express and was painted in FedEx colors but was operated by Empire. Flight crews, dispatch and maintenance personnel were all Empire employees.

The accident airplane before the crash

The accident airplane before the crash

The NTSB just recently completed its investigation. The airplane was on an 84-minute flight from Ft. Worth and encountered icing on its flight path. If the pilot flying had maintained adequate airspeed, a safe landing could have been made. However, speed degraded and the stick shaker activated – indicative of an impending stall – just short of the runway. The airplane rolled, crashed and skidded across the tarmac. The captain and first officer were able to escape before the airplane was consumed by fire.

Bottom arrow: first impact. Second arrow: where the airplane came to rest.

Bottom arrow: first impact. Second arrow: where the airplane came to rest.

Aftermath

Aftermath

The NTSB determined that the probable cause of the accident was as follows:

“[The] flight crew’s failure to monitor and maintain a minimum safe airspeed while executing an instrument approach in icing conditions, which resulted in an aerodynamic stall at low altitude. Contributing to the accident were:

1) the flight crew’s failure to follow published standard operating procedures in response to a flap anomaly,

2) the captain’s decision to continue with the unstabilized approach,

3) the flight crew’s poor crew resource management, and

4) fatigue due to the time of day in which the accident occurred and a cumulative sleep debt, which likely impaired the captain’s performance.”

The word fatigue is in italics to emphasize that this factor was not included as a contributing factor in the fiery, fatal crash of Colgan Air flight 3407 at Buffalo, NY in 2009. The Bombardier DHC-8-400 was operating as a Continental Connection flight and crashed about 5 miles from the airport after the stick shaker activated, indicating a very low airspeed approaching stall. All 49 persons aboard the aircraft and one individual on the ground were killed in the fiery impact into a neighborhood. (See Air Safety Journal, February 2010, “General Industry Laxity Criticized in Wake of Colgan Air Crash”)

Despite a spirited debate among the NTSB Board members, pilot fatigue was not elevated to a level of being a contributing factor in the Colgan Air crash investigation, despite ample circumstantial evidence that the crew had not attained adequate rest before the flight. The captain had commuted from Florida to the Newark base, and the first officer had commuted from the West Coast. Neither individual had more than catnaps on a ready room couch before the flight to Buffalo. Despite eloquent pleading from NTSB Chairman Deborah Hersman, the Board voted not to include fatigue as a contributing factor. Yet in the Empire Air crash, in which sleep debt was present – although to a lesser degree than in the Colgan Air accident – fatigue was mentioned.

In a statement appended to the Colgan Air investigation, Hersman cited her concerns about fatigue and the Safety Board’s inconsistency:

“[During] the public Board meeting, I submitted a proposal to the Board to amend the probable cause by adding a fifth contributing factor, specifically that the flight crew members’ fatigue contributed to the accident because they did not obtain adequate rest before reporting to duty. After open discussion, the Board rejected the amendment 2 to 1 …

“Let me explain why I think fatigue, an issue that has been on our Most Wanted List of Transportation Safety Improvements since its inception in 1990, was a factor in this accident. Numerous accident investigations, research data and safety studies show that operators, like the crew in this accident, who are on duty but have not obtained adequate rest present an unnecessary risk to the traveling public. Fatigue results from continuous activity, inadequate rest, sleep loss or nonstandard work schedules. The effects of fatigue include slowed reaction time, diminished vigilance and attention to detail, errors of omission, compromised problem solving, reduced motivation, decreased vigor for successful completion of required tasks and poor communication, and generally results in performance deficiencies like those present during this accident flight. As we conclude in the accident report, the flight crews’ errors, including the captain’s inappropriate response to the activation of the stick shaker and the flight crews’ failure to monitor air speed, adhere to sterile cockpit procedures and adequately monitor the flight, were the causal and contributing factors of this accident. But I also believe that these errors are consistent with fatigue ….

“The failure of the Safety Board to include fatigue as one of the contributing factors in this accident is symptomatic of the Board’s inconsistent [emphasis added] approach to addressing fatigue in transportation accidents. We have developed a methodology to be used by our investigators in our on-going efforts to address fatigue in accident investigations through a fatigue checklist …

fatigue checklist1

fatigue checklist

“There is a consensus at the Safety Board that the flight crew in this accident was likely fatigued, and our accident report makes this conclusion. The factual information in the docket establishes the presence of fatigue for both of these crew members. The captain spent the night before the accident sleeping in the company crew room, where he obtained, at best, 8 hours of interrupted sleep as evidenced by multiple log-ins to the CrewTrac system at 2151 [hours], then 0310 and again at 0726. At worst, it was poor-quality, interrupted sleep of a shorter duration. NASA and other studies show that even in an onboard rest facility with beds available for long haul flight crews, pilots might get three hours of sleep and the quality does not approach ‘home’ sleep. So, conservatively, the captain in this accident obtained 2 fewer hours sleep than his usual sleep and perhaps, significantly less based on the quality of sleep. In addition to this acute sleep loss, he had a cumulative sleep debt of between 6 and 12 hours, which reflected the 2 to 4 hours of sleep debt he accumulated over the course of each of the preceding three nights, two of which were spent in the crew lounge. At the time of the accident, he had been awake at least 15 hours – 3 hours more than the level at which the 1994 NTSB study identified performance degradation in accident flight crews. Finally, the [Buffalo] accident occurred at the time of day when the captain would normally go to sleep.

“The first officer was similarly not properly rested. The night before the accident, she commuted from Seattle to Newark, changing planes shortly after midnight in Memphis, and arriving in Newark at 0630, which was 0300 Seattle time. While she may have experienced cumulative sleep debt, she likely had some acute sleep loss and, in the preceding 34 hours, had only gotten a maximum of 8.5 total hours of sleep – 3.5 hours of which were while travelling overnight cross-country (1 ½ hours from Seattle and 2 hours from Memphis to Newark), and the remaining 5 while resting in the company crew room. However, based on information contained in the docket including an interview of a flight attendant who had a conversation with the first officer during the 1100 hour, the 5 hours of rest in the crew lounge between 0800 and 1300 are questionable. Again, it is not likely that she obtained recuperative sleep in a busy, well-lit crew room.

“Reflective of these facts, the Safety Board accident report concludes that ‘[t]he pilots’ performance was likely impaired because of fatigue…’ However, the report diminishes the significance of this finding when it states that ‘[sic] the extent of their impairment and the degree to which [fatigue] contributed to the performance deficiencies that occurred during the flight cannot be conclusively determined.’ More simply, the report concludes that while fatigue likely impaired the pilots’ performance, because we could not assign fatigue a percent or number, we discount it as a contributing factor of the accident ….

“The tragedy in this accident report [emphasis added; note the focus on the report] is what we uncovered in the investigation, we already knew. The FAA talks about safety being their highest priority. Colgan Air’s slogan was never to compromise safety. The pilots want a safe profession. Yet, if we are serious about safety, we must establish an aviation system that minimizes pilot fatigue and ensures that flight crews report to work rested and fit for duty. Flying tired is flying dangerously, and it is a practice that needs to end.”

No doubt this passionate statement was filed by Chairman Hersman to influence her fellow Board members to be more consistent in their quantification of fatigue as a contributing factor in accidents. In the Lubbock accident, fatigue was cited as a contributing factor. In the Buffalo accident, in which crew fatigue was greater, the probable cause is silent on the matter.

Equally, the FAA must bear the charge of inconsistency. The airplane was not certificated for flight in freezing drizzle, a condition known as supercooled liquid droplets (SLD). Airplanes are certificated for flight in a variety of icing conditions, but not when SLD conditions prevail. For years, the NTSB has urged the FAA to expand the certification envelope to include SLD. The FAA has responded with bureaucratic foot-dragging and pleadings, which translated essentially means that the problem of SLD is “too hard” (not the FAA’s choice of words but one which captures the essence of the FAA’s disclaimer).

The result of the FAA’s inaction is confusion within the airline industry. In Empire’s general operations manual, takeoff and landing in SLD conditions were routinely approved. Based on the manual, the dispatchers at Empire believed the ATR-42 could be dispatched into freezing drizzle.

empire5

As a result, the ATR-42 was operating in SLD conditions with reduced or eliminated safety margins. A flap asymmetry problem, poor crew resource management, and other issues contributed to the crash. The accident was not a direct result of icing; if speed in icing had been maintained, it is likely that a go-around or landing could have been safely conducted.

The issue in this case is the faulty guidance in Empire’s manual — a document which requires FAA approval.

Airframe icing during the flight from Ft. Worth to Lubbock, TX

Airframe icing during the flight from Ft. Worth to Lubbock, TX

During the Lubbock crash investigation, NTSB investigators became aware of an Airplane Performance Monitoring (APM) system developed by the manufacturer, Avions de Transport Régional (ATR).

The system detects effects on the airplane associated with ice and alerts aircrews with a light. Rather than dispatching an airplane based on reported weather, the APM detects effects in real-time on the airplane.

NTSB staffer Timothy Burtch explained, “APM provides crews with very definitive cues about how much icing they are in; it takes the guesswork out.”

As Hersman observed, “APM would have alerted them [the pilots] earlier in the flight.”

The European Aviation Safety Agency (EASA) mandated installation of the APM on ATR-42 and -72 model airplanes in August 2009.

The FAA determined that the APM would not have prevented the Lubbock accident and therefore did not order its installation on U.S. registered ATR-42 and -72 aircraft. In January 2011 the FAA’s Office of Accident Investigation and Prevention provided a “no action” memorandum to the NTSB explaining its decision (extracts follow):

“The APM uses various airplane parameters to determine when airplane performance is significantly worse than expected.

“When a State of Design Airworthiness Authority issues mandatory continued airworthiness information (MCAI) against one of its products, and that product is or is likely to be operated in the U.S., the FAA is obligated to evaluate the MCAI and, prior to issuing a corresponding FAA AD [airworthiness directive], make an independent determination that an unsafe condition exists … As a result of this review, the FAA determined that we will not issue a corresponding FAA AD …

“The APM is not enabled in many portions of the flight envelope. The APM is enabled only when the flaps and gear are fully retracted, and either the ice detector has detected ice or the flight crew has activated the airframe ice protection system …

“Of the three events [of ten used by EASA to justify its AD] where severe icing cues were not noted by the flight crew, in one of the events, two warnings from the APM … occurred simultaneously with the stick shaker … In this instance, not only were the APM warnings too late to be useful, they may also have contributed to confusion by overloading the flight crew with warning messages. In the other two events, an APM alert would not have triggered, had the system been installed.”

The NTSB was not persuaded and recommended that the FAA order retrofit ATR-42 and -72 airplanes with APM “if they are not already so equipped.”

Given the FAA’s stated position on the matter, this NTSB recommendation seems unlikely to be implemented.

Meanwhile, FedEx is designing an APM system for its ATR-42 and -72 airplanes, with installation in 2013. The FAA will be in the position of having to weigh issuance of a supplemental type certificate (STC) for a European system already rejected.

Further, the effort to enhance the certification envelope to include SLD languishes.

All the while, aircraft continue to be dispatched into icing conditions and many in the industry falsely believe they are certificated to safely cope, when in fact there is a great unknown about performance in SLD.

The NTSB and the FAA are both struggling imperfectly to improve safety. The Lubbock crash investigation shows the dimensions of the missed opportunities to correct deficiencies in human fatigue, airframe icing, and other issues for which solutions are evident but not required.

More Than 18 Months to Prioritize Rulemaking Indicates a Low-Importance Effort

How to prioritize rulemaking projects is a new task which the Federal Aviation Administration (FAA) will assign to a committee of experts. This committee, known as the Aviation Rulemaking Advisory Committee (ARAC), will meet behind closed doors, its deliberations not open to the public, according to a 19 April announcement in the Federal Register.

For those wishing to participate in this effort, the FAA must receive the nomination by 9 May 2011.

FAA logo2

This new “Rulemaking Prioritization Working Group” is an outgrowth of another expert panel, the Future of Aviation Advisory Committee (FAAC), which was convened by the Department of Transportation (DOT). The FAAC recommended a process to consider safety, cost, harmonization and “other needs” in prioritizing rulemaking. (See Aviation Safety Journal, February 2011, “Safety Recommendations Fall Short”)

There is no indication as to when the “Rulemaking Prioritization Working Group” will convene or how often it will meet. The announcement does indicate the rulemaking program must be finalized by December 2012 – stately “progress” indeed. The Federal Register announcement states that members must “keep your management chain and those you may represent advised of working group activities and decisions to ensure the proposed technical solutions do not conflict with your sponsoring organization’s position …”.

In other words, if you are an aviation industry representative, do not get off the reservation, as it were, and propose anything truly different or radical from the status quo.

Charging a committee to develop a methodology — or worse, a computer model — to prioritize rulemaking projects is sure to delay and obfuscate needed changes.

Below are four ideas which do not need “massaging” by an advisory committee and are urgently needed:

Priority 1. The FAA is to give all “Most Wanted” safety recommendations issued by the National Transportation Safety Board (NTSB) the very highest priority for consideration and, more importantly, enactment. The “Most Wanted” recommendations address the regulatory gaps or needs identified and carefully evaluated by the members of the NTSB. Here is an already prioritized list, in which the history is one of foot-dragging and excuse-making from the FAA. Even more to the point, here are needs highlighted by the blood of injuries and death.

It is significant to note that the FAA does not invite NTSB participation in this working group effort at prioritization. The NTSB is an agency which has already prioritized its many recommendations, down from hundreds to seven on the “Most Wanted” list. These seven recommendations (e.g., reduce accidents and incidents caused by human fatique in the aviation industry) are all characterized by the NTSB as either red, for an unacceptable response, or yellow, for progressing slowly.

It is time for the FAA to accord reaction and action on these “Most Wanted” recommendations. Giving the response the force of regulation (requirements) would eliminate some of the worst gaps in FAA oversight.

Priority 2. In recent years, the FAA has issued a number of so-called “Special Conditions” covering new aircraft designs for which existing standards are either outdated or inapplicable. In some instances, more than a dozen special conditions have been issued for a new design. The regulations are clearly out-of-date and need to be upgraded/modernized. Also, many “Special Conditions” read suspiciously as if they have been written by the manufacturer affected, making the thoroughness and rigor of the “Special Conditions” suspect.

For priority 2: upgrade the certification regulations such that all extant “Special Conditions” are rendered unnecessary and redundant.

Priority 3. The FAA ordered the industry to review the safety of its fuel tank designs (this was well after certification, mind) and it provided a list of some 80 airworthiness directives (ADs) to eliminate potential ignition sources of the type that blew up TWA Flight 800 in 1996. These ADs have been issued in what can only be described as a slow drip, with the last half-dozen or so issued this year. This delayed issuance process flies in the face of the FAA’s professed fealty to safety. These ADs, when they are issued, contain words like “an unsafe condition exists justifying issuance of this AD”, so when the FAA has a tidy schedule of delayed release, there is a list in the agency of a known safety of flight hazard for which the corrective action has been delayed. One reason, no doubt. for the delayed publication is to minimize the industry’s apprehension of cost, since each AD-mandated corrective has a detailed accounting of compliance costs.

The flip side to all of this is that it might be convenient to obfuscate the total costs; delayed issue of ADs covering the same problem (in this case, fuel tank safety) means that the industry is denied a picture of the total amount of work involved and to be scheduled. All such linked ADs should be issued at the same time for the industry to fulfill them promptly and in a coordinated fashion.

All related ADs are not to be issued one at a time or two at a time or in small batches separated by months or even years. Issue them all at the same time.

Priority 4. The FAA is to evaluate non-binding publications foisted on the industry. Any publication, such as a Special Airworthiness Bulletin (SAIB) or Information for Operators (InFO), which contains the caveat “This is information only; recommendations aren’t mandatory” needs to be reviewed for appropriateness. Non-mandatory publications are an FAA exercise in “feel good oversight”. They have published something that is really toothless and can claim that whatever the problem might be, it has been resolved.

In some cases, the FAA has published a non-binding SAIB or other such meaningless document in lieu of an AD, which requires compliance. From 5 April of this year, here’s an SAIB on a subject which appears to require AD action:

“The airworthiness concern is not an unsafe condition [but] if not corrected, the incomplete weld in these fuel nozzles may lead to … eventual uncommanded in-flight shutdown of the engine.”

This surprise eventuality is not an unsafe condition? If not, the FAA has needlessly issued hundreds of ADs in recent years covering equivalent situations.

Furthermore, the NTSB has criticized the FAA for publishing non-binding advisory circulars when its recommendations called specifically for regulatory action. With justification, the NTSB seeks binding, non-voluntary responses.

These four priorities, in descending level of importance, would invigorate the FAA’s presently moribund rulemaking process. Will these recommendations be made by industry insiders appointed to the committee? One can always hope that the answer is yes, but there is a heavy sea-anchor of doubt. The last time the ARAC was given an important task – fuel tank safety – it concluded that filling the void spaces in fuel tanks with inert gas was too expensive and the technology did not exist. Yet committee documents showed that inerting would cost about 25 cents a ticket, and Boeing had already patented (but not deployed) an inerting system for airliners.

The sick joke inside the FAA is that ARAC stands for “All Rulemaking Activity Ceases”. Pending that null outcome, four ideas have been recommended for energizing and prioritizing the rulemaking process.

Memorandum an Affront to Air Safety

For a perfectly useless document, look no further than the latest Information for Operators (InFO) published by the Federal Aviation Administration (FAA).

InFO 11007 issued on 10 March 2011 concerns “Regulatory Requirements Regarding Accommodation of Child Restraint Systems”. The title suggests that the FAA is doing something meaningful about requiring infants and toddlers to have a child restraint system (CRS). As explained acerbically in this publication, coffee pots and laptop computers must be secured for takeoff and landing, by regulation, but children weighing 40 pounds or less can be held on their parent’s lap where there is nothing to restrain them from being hurled about the cabin should anything go wrong.

The National Transportation Safety Board (NTSB) urged the FAA to require a CRS and put an end to lap children. The FAA rejected this entreaty. (See Aviation Safety Journal, January 2011, “Advisory Group Punts on ‘Lap Children’ in Airliners”)

What the NTSB does not want -- lap children

What the NTSB does not want -- lap children

 

Now the FAA has issued this InFO declaring no operator (i.e., airline) may prohibit a child who has not reached 18 years of age from using an “approved” CRS when the child is going to occupy a separate seat and is accompanied by a parent or guardian.

There is no explanation regarding how a teenager is going to be safer in a CRS than in the basic airline seat with a lap belt.

The InFO provides a number of helpful tips which appear to be quite obvious:

“A CRS with a base that is too wide to fit properly in a seat with rigid armrests can be moved to a seat with moveable armrests that can be raised to accommodate the CRS.”

There is not one word in the InFO about how some CRS’s might be suitable for automobiles but are not certified for airplanes. These auto-only CRS’s are not prohibited on airplanes. A baby or toddler could, in fact, be endangered by the use of a non-aircraft certified CRS.

Some airlines do not allow for the use of non-aircraft certified CRS’s, on the grounds that the seats might not stay in place and, therefore, the occupants may be endangered. The InFO takes a step backward for safety by not making any distinction between aircraft-certified and non-aircraft certified CRSs.

If anything, the InFO is likely to add to the confusion concerning CRSs. The InFO goes into detail about harnesses, detachable and non-detachable bases, forward-facing and aft-facing CRSs, but it fails to mention the essential qualifications: a CRS must be approved for aircraft use, and every child 40-pounds or less must be in a CRS – not held on an adult’s lap.

Turbulence -- another reason for having CRS

Turbulence -- another reason for having CRS

The header to the InFO announces this advisory:

“An InFO contains valuable information for operators that should help them meet certain administrative, regulatory, or operational requirements with relatively low urgency or impact on safety.”

To the dismay of the NTSB and child safety advocates, there is no “regulatory” requirement for an airplane’s littlest passengers to be secured in an aircraft-certified CRS. As far as “relatively low urgency”, the need for child restraints was the NTSB’s highest priority, featured for years on its “Most Wanted” list of safety improvements.

What the NTSB wants -- an FAA requirement for all babies and toddlers to be in their own aircraft-qualified CRS

What the NTSB wants -- an FAA requirement for all babies and toddlers to be in their own aircraft-qualified CRS

The InFO, published by FAA’s Flight Standards Service, is not only a shoddy piece of work, but it is also an insult to those who have recommended proper CRSs aboard airplanes for years. This need still exists.

Response to Controller-Fatigue Issue Largely Symbolic

With ever more reports of air traffic controllers sleeping on the job, those responsible for their work schedules are in full damage control mode.

Within the past 30 days, there have been seven reports of sleeping controllers, beginning with a lone controller dozing in the tower shortly after midnight at Washington Reagan Airport, forcing two airliners to land without benefit of tower permission and guidance. The most recent incident involved a controller in Miami who fell asleep during the midnight shift on 16 April at the Miami Air Route Traffic Control Center (ARTCC).

The situation has become the butt of jokes

The situation has become the butt of jokes

It is not clear if there is a real upswing in these events or if more such sleeping incidents are being reported, forcing officials to react. In any event, their actions thus far are reactive and tactical. They fall well short of the kind of comprehensive assessment – and corrective action – which is necessary.

After the incident at the Reagan National tower, Transportation Secretary Ray LaHood ordered that two controllers be on duty at all times – at this one airport. The practice of assigning one controller during the midnight shift is routine at almost 30 other airports. (See Aviation Safety Journal, March 2011, “Sleeping Controller Unaware of Airplane Landings”)

Secretary LaHood: "We are taking swift action to ensure the safety of our aviation system."

Secretary LaHood: “We are taking swift action to ensure the safety of our aviation system.”

After a medical ambulance flight was unable to contact a dozing controller at Reno-Tahoe airport 13 April, the pilot contacted the Terminal Radar Approach Control (TRACON) of Northern California and landed safely. Following this incident, the Federal Aviation Administration (FAA) banned only one controller on duty at 27 airports where this practice was permitted during the “graveyard shift” when activity is low. (See Aviation Safety Journal, April 2011, “One-Controller Shifts at Airports Stopped”)

On 14 April, following the fiasco at the Reno-Tahoe Airport, Hank Krakowski, the head of the FAA’s air traffic system, was forced to resign. The FAA’s general counsel, David Grizzle, was appointed as acting head of the Air Traffic Organization (ATO) until a permanent replacement can be found.

krakowski-grizzle

This action did not stop the flood of bad news about controllers. Anecdotal reports surfaced about controllers arriving for the midnight shift with bedrolls. During the early morning hours of 17 April, a controller at the Cleveland ARTCC was watching a movie on a portable player while working a radar position. His microphone was accidentally activated and a military pilot heard the movie playing in the background. The controller and the front-line manager were suspended, with pay, pending yet another FAA investigation into controller sleepiness, inattention and misconduct.

Meanwhile, FAA senior managers were meeting with officials from the controllers’ union, the National Air Traffic Controllers Association (NATCA), to work out the details of efforts to apply a tourniquet and cut off the hemorrhage of bad news.

Three main actions were announced. First, a schedule change so that the minimum of 8 hours between shifts will be extended to 9 hours. Second, the head of the FAA, Randy Babbitt, and NATCA president Paul Rinaldi, will co-host a series of “Call to Action” meetings with controllers around the country. Those meetings started Monday, 18 April. Third, the FAA will convene an independent inquiry into its controller training practices.

On 19 April an airplane carrying Mrs. Obama and Mrs. Biden was involved in a “go around” incident at Andrews AFB as a result of a C-17 cargo jet being on the runway. The National Transportation Safety Board (NTSB) will investigate. This is curious, as orbiting the field is not that unusual and no damage or injury resulted. One wonders if the White House was involved in getting the NTSB involved out of concern that the Department of Transportation and the FAA do not really have the air traffic control situation in hand and glib protestations of outrage will no longer suffice.

The FAA’s announced initiatives are neither meaningful nor likely to get to  the root problem of controller fatigue.

Consider the first action, evidently worked out in concert between the FAA and NATCA over the weekend: extending from 8 to 9 hours the time between shifts. This is a whopping 12% increase in the time between shifts. It is not an hour of increased between-shift sleep. Whether it is 8 or 9 hours before the next shift, the controller has to drive home, eat, attend to family business, and sleep. If he has eight hours to accomplish these tasks, it is the fortunate controller who can negotiate the commute to and from work and manage 6 hours sleep. The extra hour does not fundamentally alter the pernicious practice of cramming the shifts into four days so that many controllers are free to enjoy three-day weekends.

Instead of cramming all watches into a four-day schedule, one might suggest that every controller be scheduled for two consecutive periods off duty. This schedule could be instituted from the baseline of the 16-hour shift, so such that every controller would be free from duty for 16 hours, and there would be sufficient time for commuting to/from work and getting adequate sleep (7-8 hours minimum).

The schedule might interfere with the controllers’ coveted three-day weekend. However, such a really revised and sensible schedule would mean time off on a rotating basis. A controller’s “weekend” might start Saturday, or Monday, or Thursday. Equivalent weekend time-off would be built into the schedule.

The stability provided by one-shift-on and two-shifts-off would avoid the current practice of sliding each shift into a different beginning time, which guarantees maximum disruption of the body’s circadian rhythm.

As for the 8-hour “graveyard” shift during the early morning hours of the human body’s natural “circadian low”, there is a straightforward solution: break this shift into two 4-hour duty periods.

More than two decades of research into shift work documents that working a backward rotation (day to night to evening) or a compressed schedule (40 hours in fewer than five days) causes a sleep debt which impairs physical and mental functioning. Tweaking the schedule by one hour is a token modification, not the kind of meaningful change required to effectively counter controller fatigue.

Such obvious solutions as splitting the midnight-to-dawn shift into two 4-hour segments have apparently either escaped the FAA, or NATCA objects. In these times of massive joblessness, controllers with $100,000+ salary should be pleased with the remuneration. Expecting a three-day weekend in addition appears to be a bit much in terms of perquisites.

ARTCC Washington DC

ARTCC Washington DC

The second initiative, the “Call to Action”, might be challenged as a repeat of a similar effort two years ago. That Call to Action in 2009 was conducted in the wake of the Colgan Air Flight 3407 crash in Buffalo. It was discovered that the captain and first officer had commuted hundreds of miles to their base station and catnapped there in the ready room. Embarrassed by these revelations, the FAA Administrator, Randy Babbitt, travelled around the country in July/August 2009 meeting with pilots. The FAA issued press releases which positively bubbled with enthusiasm over these conclaves (sample title of one press release: “Call to Action Leads to Improvements in Pilot Training and Better Access to Pilot Records”).

Testifying before the House Aviation Subcommittee in September 2009, Captain John Prater, President of the Air Line Pilots Association (ALPA), offered a view that was less overly enthusiastic. “Action was notably absent,” he declared.

For insight into these regional meetings, consider the following reactions from the pilots present:

Minneapolis – I don’t think everyone was as forthcoming as they wanted to be. Some people were very honest, but many felt that if they spoke up they might be singled out later on … I felt that many of the industry [airline] managers were putting too much of the fatigue onus on the pilots. More than once I heard the comment, “If you are too tired to fly, it is up to you to say that.” While I agree accountability lies with the pilot, it is the responsibility of the company to make schedules that allow for rest …

Atlanta – Sadly, though a myriad of concerns and complaints were aired, none received any further discussion, debate or prioritization … There were no conclusions, or resolutions, or even ideas labeled as worth a second look.

Dallas – I fear we may have participated in well-orchestrated window dressing. We spoke several times and made several points. They included:

We are done with the tired refrain of “if it’s legal, it’s safe”.

The reason why a crew scheduler feels comfortable with demanding a pilot fly a fatiguing schedule is because the FAA allows them to.

Don’t call us together and ask our opinion and then ignore us like the FAA has done in the past.

Here’s betting that Administrator Babbitt did not get any feedback like the above in gung-ho after-action reports submitted by his FAA minions.

One pilot’s characterization of the 2009 Call to Action as “well-orchestrated window-dressing” might well apply to the 2011 round of activity – skeptical, concerned controllers meet with glib, superficial officials from FAA headquarters.

The FAA announced that it will conduct an “independent review” of the air traffic control training curriculum to make sure new controllers are properly prepared. The last time the FAA convened an “independent review” was in 2008. In the wake of the scandal surrounding certification of the Eclipse EA-500 business jet, in which the FAA approved the EA-500 design with “IOUs” from Eclipse to correct items not meeting standard after certification was granted.

This practice prompted an astonished reaction from Rep. Jerry Jerry Costello (D-IL), then chairman of the Aviation Subcommittee:

“One of the most disturbing things to me … is that instead of mandating that problems be resolved, the FAA accepted ‘IOUs’ from Eclipse to resolve the problems at a later date … to use an ‘IOU’ on the avionics system that is used to run the EA-500 which has no stand-by instruments from a new manufacturer who has no prior experience and on a system so critical to the aircraft is unbelievable!”

Stung by such criticism, the FAA produced the “independent” report, which concluded: “The team did not identify any unsafe conditions needing immediate attention within the areas reviewed.”

Note the careful caveats: “within the areas reviewed” and “immediate attention”.

How convenient. The purported independence of the team’s review is questionable. Of the eight members of the review team, six were from the FAA. The seventh was from the Department of Transportation, which had already conducted its own review and mildly suggested that “some adjustments” to FAA certification practices were in order.

The eighth official was a former Boeing executive who was also the former head of the FAA’s Atlanta Aircraft Certification Office. This individual could not be expected to find fault with a certification process which had signs of FAA-industry collusion written all over it.

This eight-man panel hardly meets the test of a hard-bitten, thorough and independently qualified team of experts entirely free of the system under examination.

Given the sordid history of these puffball analyses, one should be rightly skeptical of the “independent” commission to be appointed to examine air traffic control scheduling and training practices.

To recapitulate:

* The addition of a mere 1-hour to the time-off falls far short of two full shifts off watch.

* The Call to Action might allow for an airing of controller concerns, but these meetings are more likely to avoid any creative scheduling solutions.

* The independent review might not be independent at all.

What seems to be taking place is a lot of activity designed to placate the public that safety is Job One at the Department of Transportation and the FAA. What is not taking place is a realistic and effective response to a shift schedule which guarantees fatigue.

Wing Clipping Incident Underscores Need For Cockpit Collision Alert

Based on the collision of an Air France A380 super-jumbo with a Comair regional jet on the evening of 11 April 2011 at New York’s JFK International Airport, this “Most Wanted” recommendation issued in 2000 by the National Transportation Safety Board (NTSB) will doubtless receive added impetus: “Give immediate warnings of probable collisions/incursions directly to flight crews in the cockpit.”

The recommendation to the Federal Aviation Administration (FAA) has been color-coded by the NTSB as red for “Open – Unacceptable Response.”

There are eight pages of fine print notes summarizing letters back-and-forth between the FAA and the NTSB since the recommendation was first issued. The last letter from the FAA, in 2009, indicated that a pilot project “will support development of requirements and an acquisition strategy …” etc. etc. The FAA response was neither timely nor promising.

It may be useful to compare the aviation industry to the automobile industry. During the past decade, automobile manufacturers have developed collision-avoidance cruise control and hands-free parallel parking. Both applications involve the detection of obstacles (e.g. cars and curbs).

The FAA, in concert with industry, is developing the Next Generation (NextGen) air traffic control system. Built around ADS-B (Automatic Dependent Surveillance – Broadcast), airplanes will broadcast their positions to air traffic control. This is known as ADS-B Out. A complementary application, called ADS-B In, would broadcast information into the cockpit. Under ADS-B In, the two aircraft involved in the collision at JFK would have been broadcasting their location to one another, providing the essence of a collision avoidance system. Under the initial concept of NextGen, ADS-B Out will be featured but not ADS-B In.

As the essence of collision avoidance the NTSB seeks, ADS-B In remains a distant dream. Application of automobile collision avoidance to taxiing aircraft as a “good enough” solution has not been even considered.

The NTSB justifiably concluded in 2009:

“This recommendation is now 9 years old, and it has been on the Most Wanted list almost since the recommendation was issued … technologies have not yet been finalized nor scheduled for deployment ….”

runway2

There has been no update since. Now the NTSB is investigating the incident at JFK and will doubtless take the opportunity to reiterate its stalled safety recommendation.

Back at the gate after colliding with the regional jet

Back at the gate after colliding with the regional jet. Photo Attribution: © Antoine FLEURY-GOBERT / Wikimedia Commons / CC-BY-SA-3.0

The Air France A380 was taxiing from the boarding gate to the runway for a flight to Paris. A Comair CRJ700 operating as Delta Connection was pulling into its gate, but had halted, waiting for ramp personnel to marshal the small commuter jet the final few yards into the gate. The CRJ700 had arrived from Boston.

The huge Air France A380, its 262-foot wingspan overhanging the 75-foot taxiway, struck the much smaller CRJ700. The impact spun the CRJ a full 90 degrees, just missing a person on the ramp who was walking out to escort the small jet to the gate. In a video of the collision, the ramp person can be seen jumping back as the CRJ700 rotated violently approximately 90 degrees. The 62 passengers aboard received quite a scare.

Grainy photograph showing the CRJ700 being spun 90 degrees

Grainy photograph showing the CRJ700 being spun 90 degrees

A pilot aboard the CRJ700 radioed the tower: “Roll emergency trucks. We’ve been hit by – uh – Air France.”

The larger jet halted after being seemingly unaffected by the collision. However, the left wingtip of the A380 was damaged and the jet returned to the terminal to offload its 520 passengers and await repairs. The CRJ700 had been struck on the vertical fin, which also required repair.

Damage to the A380

Damage to the A380

Damage to the CRJ700

Damage to the CRJ700

The A380 is equipped with a closed-circuit television system (CCTV), which apparently was of little use in alerting the pilots to the presence of the CRJ700. The CCTV features a panoramic camera mounted high in the tail and four additional cameras mounted below the fuselage to track the landing gear. The system is intended to help prevent the landing gear from rolling off the taxiway when the A380 is making wide, off-center turns. Since the A380 was engaged in straight line taxiing at the time of the incident, the pilots may not have been looking at the video feeds.

With a restricted field of view from the A380 cockpit, preventing the pilot from viewing the wing clearly past the outer engines, the pilot taxiing the A380 clearly did not see the much smaller and closer-to-the-ground CRJ700.

One pilot remarked:

“With the large aircraft, it really does not matter if you are on the center line of those taxiways – their width at JFK is 75 feet. The A380 has a 260-foot wingspan. To me that means the pilots have to be extra careful to ensure wingtip clearance.”

The role played by the tower controllers will most definitely be examined by NTSB investigators. Additionally, if the A380 was on the center line of the taxiway, what was the responsibility of the Comair pilots on the ramp to ensure proper clearance?

In automobile terms, who had the right-of-way?

JFK and other airports serving the A380 have had taxiway turns modified to allow the landing gear to negotiate the wider radius without departing the paved surface. Terminal gate areas must meet a box 262 feet on each side, or template, to ensure adequate clearance from structures.

Had the NTSB’s 2000 recommendation been adopted by the FAA, the A380 cockpit would have featured a warning of the threat that likely would have enabled the pilots to take action and prevent the collision.