312.630.4000   |   contact@nolan-law.com

Comment on Air Safety

Pilot Traps’ In The Cockpit

When walking aboard an airliner, the cockpit door is usually open, and passengers get a glimpse of the seemingly rational and error-proof array of technology.

Would that it were so. In truth, the cockpit of a modern airplane is a minefield of what might be called “pilot traps” that can cause confusion or worse at precisely the wrong moment.

For example, consider the throttles on the Eclipse EA-500, a new Very Light Jet that carries four passengers. Last June, in a landing at Chicago’s Midway Airport, the pilots found that the engines would not respond to throttle commands, had no emergency procedures, and were only able to successfully land the airplane by shutting down one of the jet’s two engines. It turns out that when the engines are firewalled, the computer logic assumes the last command dominates, and so left the engines at full power while the pilots pulled the throttles to idle. The case is under investigation by the National Transportation Safety Board (NTSB) and Eclipse has already rushed a fix to the field.

Another, more subtle pilot trap pertains to the attitude directional indicator (ADI), which basically tells the pilot which way the airplane is headed with respect to the horizon. The instrument is critical when the view out the windscreen is nil, as is often the situation at night, in fog, snow, over terrain with few ground lights, over water, and so forth. In such conditions, the pilot is at real risk of becoming disoriented and must rely on the ADI.

There is a long list of fatal accidents and near-catastrophes in which misinterpretation of the ADI played a role. One would think that the science of ADI design would be resolved. This is not the case.

In Western-built jets, a little aircraft symbol is superimposed over a horizon line that separates the sky from the ground. The airplane symbol is fixed, with its wings level with the cockpit, and the horizon line moves in concert with aircraft pitch and roll. When the pilot begins a climb, the horizon line behind the airplane symbol moves down the ADI. If the pilot rolls his aircraft, he will see the horizon rotate around the miniature aircraft.

In Soviet or Eastern-designed jets, the opposite convention applies: the horizon line remains fixed and the little airplane symbol moves. In other words, the horizon line, not the airplane, stays level with the cockpit. Thus, when a pilot trained on the Russian ADI makes a control input, he will see the miniature aircraft respond by moving on the ADI. If he initiates a climb, the little aircraft in the foreground will rise above the fixed horizon line.

One would think that the proper display, the one with minimal chance of confusion, would be a long-settled issue. Not so. Back in the late 1920s and 1930s, the famed Jimmy Doolittle, and other pilots of his day, reportedly experienced difficulty in remembering that the moving bar represented the horizon and not the airplane. It was realized there was a problem. A few radical thinkers advanced the notion that the horizon should be fixed and the airplane symbol should move, just as the pilot perceives his own airplane moving against the horizon. The Russian design followed that philosophy.

Problems result from having the two displays in use throughout the world. In the Western-style display, there is an initial tendency – particularly among inexperienced pilots – to roll the horizon bar back to wings level, which puts the airplane into a steeper bank. In a steep bank, the nose drops. To maintain altitude, the pilot pulls back on the stick, which tightens the turn and steepens the spiral dive.

In the Russian-type display, rolling left aligns the wings in the ADI with the horizon, helping to avoid control reversal and spiral dives.

Pilots initially trained on Russian equipment, who find themselves later flying Western-built jets, have occasionally become confused, particularly when faced with the need to instantaneously interpret a dynamic unusual attitude in a loss of control upset. When this happens, there is a 50% chance that a pilot will react instinctively and wrongly, a development that usually equates to a 100% chance of a subsequent accident.

There is a third display, propounded by some, in which both the airplane symbol and the horizon line move. (See box below)

Attitude Indicators: What Moves?

The three display modes all indicate a bank to the right. On the left above, the widely-used Western convention, in which a bank to the right is indicated by the horizon line moving counterclockwise and the aircraft symbol remains fixed. In the middle, the Eastern convention, the horizon remains fixed but the airplane symbol rotates clockwise. On the right side, both the horizon line and the airplane symbol move. With this display, pilots maintain wings-level flight merely by aligning the airplane symbol with the horizon line, a natural response.

If the airplane rolls to the right, the horizon bar rolls left. The pilot notices this, and applies left aileron to align the airplane symbol with the horizon bar, causing the plane to start rolling back to wings level. As this is going on, the pilot gradually reduces the left aileron input until wings are level. The display, if you will, is a more natural and realistic depiction of what is going on.

This improved display cannot easily be incorporated into the old mechanical cockpit instruments, but certainly can be fitted to the new “glass cockpit” displays, where the imagery is generated entirely electronically.

Some industry trainers claim that the display in which both airplane and horizon move would be a simple, affordable way to save hundreds of lives worldwide, every year. This idea has been around since about 1975, which makes the deaths since all the more inexcusable.

Out of the Clouds of Incest & Into the Clear Skies of Accountability

The process by which airplanes are certified for production has taken some withering fire of late, prompting the Federal Aviation Administration (FAA) to issue what might be called a “no fault found” report.

Unfortunately, the Special Certification Review (SCR) that a study team convened by the FAA produced takes a narrow, mechanistic approach. The report argues that the certification of the Eclipse EA-500 Very Light Jet was entirely proper, that there were some communications problems between FAA field offices and Washington headquarters, but these issues can be tweaked and everything will work out fine. (See Aviation Safety & Security Digest, ‘Special Certification Review Comes Up Short,’ home page.)

This predictable and safe prescription from an SCR comprised almost entirely by FAA officials appointed, one suspects, because of their malleability to the existing order, is not likely to abate the anger in Congress over the appearance (and the reality) of collusion between the FAA and the airlines and manufacturers.

Recall the 3 April hearing of the House Aviation Subcommittee, which aired complaints of local mid-level FAA officials that Southwest and American Airlines were able to delay compliance with airworthiness directives (ADs) because of a “cozy relationship” with seniors at FAA headquarters. Especially criticized by the Congressmen at that hearing was the FAA’s Customer Service Initiative (CSI), which described the airlines and the manufacturers as the agency’s clients – not the traveling public the FAA theoretically exists to serve. (See Aviation Safety & Security Digest, ‘Committee Vows to Legislate Changes to Strengthen Oversight of Airlines,’ home page.)

The CSI came up again at the 17 September hearing by the same subcommittee into the Eclipse EA-500 certification. (See Aviation Safety & Security Digest, ‘Airplane Certified by FAA Despite Concerns,’ home page.) Rep. James Oberstar (D-MN), Chairman of the full Transportation & Infrastructure Committee, summed up the situation:

“There are disturbing similarities between the testimony we will hear today, and the hearing we held on April 3rd involving regulatory abuses at the FAA office charged with overseeing Southwest Airlines. Once again, we will hear how the FAA’s ‘Customer Service Initiative’ mistakenly treats those who are the subject of regulation as the ‘customer,’ and how it has the potential to create conflicts with the FAA’s one and only mandate – safety.

“I fear that complacency may have set in at the highest levels of FAA management, reflecting a pendulum swing away from vigorous enforcement of compliance, toward an industry-favorable, cozy relationship. This time it involves a manufacturer instead of an airline.

“In this case, the FAA remains steadfast in its assertion that no federal regulations were violated. However, when the findings of this investigation are viewed in total, there is a disturbing suggestion that there was another ‘cozy relationship’ and reduced level of vigilance on the FAA’s part during the process of approving the type certificate and the production certificate of the Eclipse EA-500.”

At both the 3 April and the 17 September hearings the senior FAA official present was Nicholas Sabatini, the associate administrator for safety. His office has overall responsibility for airline and manufacturer oversight.

He came under sharp questioning at both hearings by Oberstar. At the 17 September hearing, Oberstar asked, “The [Eclipse] production certificate was approved with 13 deficiencies. How can that be, Mr. Sabatini?”

Sabatini: “Our inspectors were engaged in an ongoing process to get them rectified …”

Oberstar sniffed that adjustments were made in accordance with the “Customer Service Initiative.” He indicated bluntly that the “Customer Service Initiative” may be abolished legislatively, even if the FAA strikes it.

Given that almost six months separated the two hearings, one would think FAA bureaucrats would have gotten the message and changed the wording of the “Customer Service Initiative” in the interim – to reflect the Congressional concerns expressed last April.

No matter; there may be a better course. It seems that the mere moniker of a “Customer Service Initiative” is misguided, as the FAA has no customers. It should be titled a “Public Service Plan,” which could summarize in plain language statutes and administrative regulations governing the operation of the FAA – which is to ensure the safety of the flying public.

By this simple adjustment, the use of FAA personnel and resources could better be applied to maintenance oversight and to certification issues, as opposed to marketing efforts.

And with regard to certification, the totality of evidence – of which the Special Certification review is but the latest example – is overwhelming: the process is not transparent. That could be rectified. It seems that the Department of Transportation Inspector General (DOT/IG), who offered devastating testimony at both hearings, could examine the certification process separately. This would go a long way towards ensuring future impartiality.

If that means the DOT/IG has a representative on the FAA headquarters certification team for direct oversight, and untrammeled access to all paperwork, that could only be a good thing. To be sure, “outside the loop” externalized oversight would be a blow to the pride of FAA’s senior leadership, but the short-term embarrassment might give way to an appreciation for the virtues of independent checks and balances. Imagine having to get a DOT/IG signature of approval before Sabatini or his successor issues a type or production certificate.

With a “Public Service Plan” and approval required first by the DOT/IG, the “cozy relationship” may give way, over time, to one routinely meeting the regulations, instead of whining for relief or special treatment.

Besides which, the FAA would then be in a role the flying public mis-perceived the agency was playing all along – assuring safety.

Ignored Warnings About Warnings

The fatal takeoff crash in August of a Spanair MD-82 unfortunately is the second bookend, as it were, to over 20 years of Federal Aviation Administration (FAA) inaction. I should add here that the National Transportation Safety Board (NTSB) has apparently condoned a non-response to its safety recommendations.

The first bookend occurred August 1987, when a DC-9 crashed on takeoff at Detroit, in part because the Central Aural Warning System (CAWS) failed to warn the flight crew that the airplane was not configured properly for takeoff. The slats and flaps were not deployed, as a result of which the airplane entered a stall, struck a light pole and crashed.

The MD-82 is a direct descendant of the DC-9 design and has many elements in common, including the CAWS and its associated circuitry.

It’s too soon to know whether the CAWS on the Spanair MD-82 did or did not alert the crew to the fact that their flaps and/or slats were not deployed before the ill fated takeoff run. However, there was work on an electrical circuit that controls CAWS functioning before the aircraft left the gate, after it had returned to the ramp for a malfunctioning heating element in the ram air temperature (RAT) sensor. The RAT sensor is on the same circuit breaker that controls the CAWS.

After the 1987 crash at Detroit, the NTSB issued a voluminous report in which, among other things, it recommended the FAA conduct a “directed safety investigation” into circuit breakers that can disable vital operating systems. The NTSB also recommended that a fail light be installed on the overhead panel, to illuminate in the event of a CAWS power loss.

What was the result of those recommendations? Apparently, a perversion of the English language, such that the NTSB classified these two recommendations as CLOSED – ACCEPTABLE ALTERNATE ACTION.

With regard to the “directed safety investigation,” the last input the NTSB received from the FAA on this recommendation was hardly reflective of a sense of urgency or priority. The FAA told the NTSB it was “gathering data from both the airplane and circuit manufacturers to determine what, if any, action should be taken.”

Wait a minute. There shouldn’t have been any doubt about action to be taken: a thorough review of circuit breakers, the systems they were connected to, and corrective action if systems critical to flight safety, like CAWS, were hooked up to the same circuit breaker that controls a non-essential item like the RAT sensor heating element.

Regarding the CAWS fail light, the NTSB said, “While the FAA did not require the recommended modification to the DC-9 CAWS fail light circuit, the Safety Board accepts the actions taken by the FAA.”

What were those actions? Not to install a fail light, but to eliminate nuisance CAWS warnings so pilots wouldn’t be tempted to deactivate the system.

The FAA did not take action on either of the recommendations, yet the NTSB classified the responses as ACCEPTABLE.

By this standard, the FAA doesn’t have to do much, if anything, to satisfy the NTSB. The whole process of the NTSB issuing recommendations and the FAA responding is something of an elaborate minuet. Evidently, generating correspondence – rather than implementing the recommendations – is sufficient to placate the NTSB even when a warning light is not installed and a “directed safety investigation” is not conducted.

The FAA is derelict for tolerating a known design flaw – pulling a circuit breaker for one reason leads to another consequence, the flight-critical CAWS being rendered inoperative. The NTSB is culpable for characterizing the FAA’s inaction as acceptable.

Why Must The Critical Variable Be Discovered By Accident?

When TWA flight 800 blew up in 1996 from a fuel tank explosion, the word around the aviation industry is that not much was known about basic properties of the fuel loaded aboard the airplane. Needless to say, the accident spawned a whole lot of research into fuel properties and flammability limits, not to mention wholesale fuel system design reviews that led to costly efforts to mitigate ignition sources and explosive vapors.

The Federal Aviation Administration (FAA), and the airline industry, has a habit of closing the barn doors after the horses have stampeded out, causing catastrophic loss of life.

Now the UK’s Air Accidents Investigation Branch (AAIB) is investigating the January 2008 crash of a British Airways B777 at London’s Heathrow Airport. The airplane experienced a loss of thrust at the same time increased engine power was needed to compensate for the deployment of flaps and extension of the landing gear. With the increased drag, and without the added thrust to compensate, the airplane smacked into the ground short of the runway. Fortunately, everyone aboard escaped. But the airplane was deemed damaged beyond economical repair. (See Aviation Safety & Security Digest, ‘Ice Blocked The Heat Exchanger, Leading To Crash,’ home page.)

The AAIB issued an interim report on 4 September 2008 into the crash, indicating that ice in the fuel is the leading suspect in the engines’ failure to produce more power at the critical moment it was demanded.

The AAIB said that it compared the fuel loaded aboard the accident airplane (registration G-YMMM) to other samples of the same Jet A-1 fuel:

“The fuel sampled from G-YMMM was compared with 1,245 batches of Jet A-1 tested in the UK during 2007. With regard to the distillation range, which is the boiling range of the fuel, the fuel from G-YMMM was approximately in the middle of the sampled range. The freezing point of the fuel sampled from G-YMMM was -57ºC (-71ºF), which was slightly below the average freezing point but within the normal range for Jet A-1.”

So far so good; the samples complied fully with the specifications for Jet A-1. But elsewhere in the interim report, we read:

“As the fuel temperature is further reduced, it reaches the Critical Icing Temperature, which is the temperature at which the ice crystals will start to stick to their surroundings. When the fuel temperature reduces to approximately -18ºC (0ºF), the ice crystals adhere to each other and become larger. Below this temperature little is known about the properties of ice crystals in fuel and further research may be required to enable the aviation industry to more fully understand this behavior.”

Unbelievable. More research is needed on a basic fuel property. Let’s recall that on its flight from Beijing to London the accident airplane flew through ambient temperatures as low as -76ºC (-105ºF).

It is becoming obvious that water, even at the parts per million level and well within the fuel’s specification, can be a problem. By the way, polar flights like this one were authorized a few years ago, apparently without consideration of freezing temperatures on fuel.

With TWA flight 800, it was fuel tanks blowing up. Fuel-tanks freezing up seems to be a risk of equal magnitude at the opposite end of the spectrum.

The question is, why does it take an accident to uncover the critical variables?

Instead of Frustration, Take the Agency to Court

The easy things have been done now 10 years after the Swissair flight 111 accident and 12 years after the TWA flight 800 disaster, which together killed 459 people. But real improvements to air safety remain dead in the water.

The proximate cause of both crashes: flawed electrical wiring. The two crashes provide ample evidence that wiring failures can cost lives. In 1996, TWA flight 800, a B747-100, went down off the coast of Long Island because of the ignition of fuel/air vapors by an electrical arc in fuel tank wiring. Two years later, in 1998, Swissair flight 111, an MD-11, went down off the coast of Nova Scotia after a fire, caused by electrical arcing, spread through insulation blankets above the cockpit ceiling, shutting down the electrical systems that controlled the plane.

What has happened since? The U.S. National Transportation Safety Board (NTSB) issued 15 recommendations as a result of the TWA flight 800 crash. Only six recommendations have been closed with an “Acceptable Action” rating – for an overall implementation rate of some 40%. But how some of these recommendations were closed with an “Acceptable Action” rating is something of a mystery, and a close reading of the voluminous correspondence concerning the whole set of recommendations reveals a Federal Aviation Administration (FAA) pattern of delay, partial measures, and outright obstructionism. (See Aviation Safety & Security Digest, ‘Twelve Years of Half Measures,’ home page.)

The Canadian Transportation Safety Board (TSB) has fared even worse with recommendations it issued as a result of findings in the Swissair crash. Only five of 23 recommendations have been fully implemented, for a success rate of just 21%. (See Aviation Safety & Security Digest, ‘A Decade of Minimal Action’ and ‘Canadian Investigators Decry Failure to Enact Safety Recommendations,’ home page.)

TSB Member Jonathan Seymour noted that as a result of the Swissair crash the FAA ordered the removal of metallized Mylar insulation blankets from about 700 Douglas-built aircraft, but his take on the current situation is revealing:

“Substantive action has not been taken to comprehensively review the remaining types of insulation currently in use … Instead, regulators [meaning the FAA] are relying on in-service performance to be the catalyst for further safety action. In other words, a material has to fail [burn] before action is taken.”

Since the fire was started by electrical arcing in a bundle of electrical wires, Member Seymour was even more distressed about the lack of action on realistic qualification tests:

“[A]ction has not yet been taken to address our recommendation to establish a test regime that evaluates aircraft electrical wire failure characteristics under realistic operating conditions … Testing a single [unpowered] wire does not necessarily predict what will happen when that wire is bundled and carries a load …”

Make no mistake, the Swissair and TWA accidents may have occurred a decade or more ago, but due to FAA lassitude, the danger remains. On 29 June of this year a B767 freighter operated by Airborne Express experienced a fire on the ground that looks remarkably like the one that downed the Swissair jet. (See Aviation Safety & Security Digest, ‘Cargo Jet Fire Seems a Replay of Deadly Inferno,’ home page.)

And in August 2007 a China Air Lines B737 was destroyed on the taxiway by a fire that originated in a wing fuel tank.

I believe there are two related reasons why both the NTSB and the TSB have achieved such a low compliance rate with their recommendations. The first is that these investigative agencies may be issuing too many recommendations. A passel of recommendations may simply overwhelm the FAA. The NTSB highlighted the most direct cause of the TWA flight 800 crash: the presence of flammable vapors in the fuel tanks. About four or so recommendations, instead of 15, would suffice to address and eliminate that hazard.

Similarly, the TSB noted that if flammable materials were not present, airliners would not be victims of runaway fires. About a half-dozen recommendations, instead of 23, strategically worded, ought to suffice.

Second, the recommendations lack teeth – if the FAA sits on them, other than potential embarrassment, there is no penalty for inaction. Nobody at the FAA has ever been replaced for failing to enact a safety recommendation.

Thus, my second recommendation: the NTSB (acting for itself and on behalf of the TSB) could take the FAA to court. Under a writ of mandamus (Latin for “we order”), the court can order a government body like the FAA to implement a recommendation when it has neglected or refused to do so.

The effect of taking the FAA to court would have four salutary effects: (1) the NTSB would not be seen as toothless and ineffectual, (2) the NTSB (and by implication the TSB) would restrict recommendations to the most important ones worth taking the FAA to court for an explanation as to delayed implementation, (3) the mere threat of such legal action may stimulate the FAA to more seriously consider the price of inaction, and (4) such court proceedings would certainly interest the oversight committees in Congress as to why the FAA was being dragged before the bar to explain itself (with obvious implications for FAA staffing and funding).

Oh, and there is a fifth reason for threatening or taking the FAA to court: a recommendation delayed is safety denied.

Comment on Air Safety Archives