Human error can never be reduced to a zero-probability event; therefore, the notion of an accident-free airline transportation system is nothing more than a feel-good myth, especially if corrective action follows rather than precedes a mishap.
The August 5, 2013, nighttime landing of Korean Air Lines flight KAL763 at Niigata Airport on the west coast of Japan is an excellent case in point. After the accident, KAL instituted additional procedures and pilot training to forestall a repeat — the word “prevent” is not used here because the human mind can foul up in an infinite number of ways.
The serious incident investigation report of January 29, 2015, by the Japan Transport Safety Board (JTSB), will serve as documentation of the event.
The KAL aircraft was a B737-900 with 106 passengers aboard, seven flight attendants and a cockpit crew of two pilots. The captain was the pilot flying; the first officer was the pilot monitoring.
It was an uneventful one-hour and 45-minute flight from Inchon, South Korea.
The Niigata tower controller cleared the airplane to land on runway 10, which the KAL 763 crew acknowledged. From the opposite direction, the tarmac is designated runway 28.
The autopilot and autothrottle were disconnected at an altitude of 1,000 feet.
The flight crew made all the necessary call-outs, acknowledgments and read backs. The landing was stabilized; touchdown was at a normal and nominal 143 knots (165 mph).
Thrust reversers were deployed. Brakes were applied at 69 knots (79 mph).
Niigata tower radioed the aircraft: “Korean Air seven-six-three, turn right end of runway Bravo One (B1) and taxi to spot cross runway two-four/two-two (04/22).” This was the instruction to exit the runway and make another right turn and cross 04/22 again while taxiing. Runway 04/22 crosses runway 10/28.
The first officer radioed acknowledgment to the tower: “Cross runway 04/22, end of runway right turn.”
The captain noted, “Cross runway 04/22.”
The first officer wondered, “Cross runway?”
Events rapidly started to go downhill.
Neither pilot had been to Niigata in some months, and it was the first officer’s first night landing at the airport.
The airplane roared through the intersection of runway 10/28 and runway 04/22. Braking was insufficient to stop the airplane from running through the runway 10/28 threshold lights. The airplane tore up a bunch of lights and screeched to a stop with its nose wheel dug into the grass and the main landing gear right at the paved edge.
Not according to plan; it could have been worse
No one was hurt, but no doubt there was much embarrassment in the cockpit.
The first officer later said he was confused about whether the red lights looming ahead were the stop bar lights for runway 04/22 or the threshold lights at the far end of runway 10/28.
The captain said he assumed the lights signified the stop bar for runway 04/22; not realizing the lights marked the threshold for runway 10/28, he tried unsuccessfully to brake before running out of pavement.
The air traffic controller had radioed “turn right end of runway Bravo one …” indicating the B737 was to exit runway 10 after crossing runway 04/22, as that exit was right at the end of runway 10 and past the intersection of the two runways.
The first officer had read back the clearance in inverted sequence, indicating the intersecting runway first and then the taxiway exit. The tower controller did not catch that the flight crew might have misinterpreted his instruction to turn off runway 10 at the B1 exit and then cross runway 04/22 on the way to the terminal.
Schematic of runways 10/28 and 04/22, with tire skid marks exceeding 500 ft as the crew tried to stop
As the investigation report theorized, “It is highly probable that the Captain and the F/O did not have enough time to confirm with the Niigata Tower or discuss among them [sic] about the meaning of the instruction of ‘cross runway 04/22’ at this point.” However, the crew had been cleared to use the entire length of runway 10 before landing. In telling the crew that they were cleared to cross runway 04/22 after landing, the tower controller was being doubly assiduous.
There was no illuminated sign indicating the juncture of runways 10/28 and 04/22, nor was there a requirement to have such a sign in place.
The investigation report concluded that the tower instruction had been misinterpreted and that the flight crew was short of the intersecting runway during the landing roll out, at too high a speed to stop before the end of pavement.
For Niigata airport, procedures were subsequently changed to have the tower controller radio “Affirm” upon receipt of a correct read back. For example:
Upon vacating runway 10
Controller: (Call Sign), turn right end of runway Bravo One (B1).
Pilot: (Call Sign), roger, turn right end of runway Bravo One (B1).
Controller: (Call Sign), affirm.
KAL changed its procedures. Among them, “The aircraft must be decelerated to an appropriate safe taxi speed (maximum 30 kt) before 1,000 ft from the planned runway exit point.”
A few observations are in order.
The wrong comforting assumption or a moment’s unvoiced doubt can have dire consequences.
Intersecting runways are common to many airports. An illuminated sign marking the intersection should be required.
The controller’s confirmation of “Affirm” (or not affirmed) should be the standard procedure at ALL airports worldwide, not just at Niigata.
Decelerating to a minimum safe speed 1,000 feet from the planned runway exit point should, likewise, be a prudent procedure at all airports around the globe.
Here are three latent hazards that combined to produce an overrun (the JTSB report has more). There is no indication that they will be shared among airports or airlines for their universal applicability.
One fears that each airport and each airline must experience similar events to correct after the fact.
Neither the airline industry nor government regulatory bodies take a pro-active approach — that is, before incidents or accidents occur — to safety.
Ten passenger planes have gone missing without a trace since 2000, according to Harper’s magazine Index in the March 2015 issue of the magazine. The Aviation Safety Network, based in the Netherlands, shows 85 aircraft — including passenger airliners, corporate jets, cargo and military — have utterly disappeared since 1948.
Hundreds of lives have vanished. Officials have some idea of the location (ocean, country), but beyond that, no specifics.
The most recent disappearance was Malaysian Airlines Flight 370, with 239 aboard. The airplane is believed to have plummeted into the sea off the west coast of Australia after exhausting its fuel on March 8, 2014. Authorities mounted a great search — patrol planes in the air, ships on the water’s surface, and submersibles deep in the depths — and they have not found a thing. The critical flight data and cockpit voice recorder (FDR/CVR), mounted in the tail of the aircraft, remain hidden in their watery grave. Without these recorders, details of the B777’s disappearance remain an abiding mystery.
A visual search, hoping to find floating debris from MH370
Below the waves, the search area off the coast of Australia; 3,000 foot depressions and summits that make the European Alps look like foothills complicate the search for the wreckage of MH370
Even though it was a foreign airliner lost far beyond the borders of the United States, the U.S. National Transportation Safety Board (NTSB) has recently urged the Federal Aviation Administration (FAA) to undertake technical improvements that would make a disappearance of Malaysian Flight 370 a thing of the past. The January 22, 2015, letter also urges the FAA to mandate additional flight recorder improvements, to include a closed-circuit television recorder to capture the scene in the cockpit during the last moments of crisis.
“Technology has reached a point where we shouldn’t have to search hundreds of miles of ocean floor in a frantic race to find these valuable boxes,” declared NTSB Acting Chairman Chris Hart, referring to the FDR/CVR. “In this day and age, lost aircraft should be a thing of the past.”
Indeed, technology to preclude utterly losing the whereabouts of a crashed plane has been available since at least 2000 but has not been ordered installed on airliners by that sleepy backwater of aviation safety, the FAA.
Maybe the NTSB’s recent letter will goad the FAA to rise from its regulatory torpor and take action, although the record of the FAA’s dilatory and partial response to such letters from the NTSB is, frankly, discouraging.
Nevertheless, details of the NTSB’s letter warrant scrutiny.
All scheduled and charter airliners operating over water and more than two hours from a diversionary airfield should be equipped with the capability to transmit to a ground station “sufficient information to establish the location where an aircraft terminates flight as the result of an accident within 6 nautical miles of the point of impact,” the NTSB recommended.
Restricting the recommendation to extended flights over water leaves out flights over trackless areas on land that are not covered by ground based radars. The Amazon River basin in South America, for example, has vast areas not covered by radar. An airplane traversing this huge wilderness could crash and be swallowed up by the watery muck and jungle; the remnants could be extremely difficult to locate.
It would have been better to word the applicability of the recommendation to all transport-category aircraft operating over regions not covered by ground surveillance radar.
Transmitting the location of the crash site within six miles of the point of impact was taken from the French investigation into the June 1, 2009, Air France Flight 447 crash into the Atlantic Ocean on a flight from Rio de Janeiro to Paris. It took almost two years of searching to recover the flight recorders. The French accident analysis authorities (Bureau d’Enquêtes et d’Analyses, or BEA) determined that it is feasible with current technology to broadcast an aircraft’s location to within a six miles circle of the point of impact. The NTSB sensibly piggy-backed on the French finding.
Significantly, the NTSB recommendation does not include a timeline for accomplishment. Without a deadline, the FAA will dilly-dally and stretch out any action for years. The absence of a deadline is unfortunate, as the technology for broadcasting the location of crash and key recorder information already exists, and in a form that is commercially applicable to the airlines.
A small company in Canada, FLYHT Aerospace Solutions, has been selling a system that beams flight recorder information to orbiting satellites when trouble with the aircraft is sensed. The airplane’s location, its flight attitude, and other essential parameters captured on the flight recorders would then be beamed to a ground station; the information would be available almost instantly to those on the ground searching for answers. Known as the Automated Flight Information Reporting System, or AFIRS, a Canadian operator of B737s and DHC-8s has already bought and installed the system, as the carrier operates in the northern reaches of Canada. The wilderness is frequently beyond the coverage of ground-based radars.
With a requirement to equip their jetliners with an AFIRS-like technology, FLYHT could license its system for production by major avionics companies and installation could proceed on an accelerated basis. An NTSB deadline would spur this activity.
The NTSB letter reprises an earlier sensible recommendation already rejected by the FAA. The January 22 NTSB letter offers additional information; if unlucky in its recommendations, the safety board is nevertheless persistent. The subject: cockpit videos. The camera would record crew actions in the moments before a crash, key instrument displays, switches and flight control positions. The Safety Board was careful to note that the faces of pilots would not be recorded. Rather, the camera would be mounted above and to the rear of pilots, capturing only their arm and hand positions and the instrument panel.
The cockpit of the B777, essentially showing the view to be captured by the cockpit image recorder. Pilots’ faces would not be seen, but their manipulation of knobs and flight controls would be captured, as well as displays on the instrument panel (or displays obscured by smoke).
The FAA had opposed this recommendation in January 2000, largely due to pilots’ concerns that the videos would find their way onto the Internet as voyeuristic “snuff films”. Although the FAA rejection of that date did not specifically mention pilot union opposition, that was part of the overall criticism at the time of the NTSB proposal. The FAA simply said, “The FAA has no rulemaking underway at this time to mandate the installation of cockpit image systems as described in this safety recommendation.”
The NTSB offered new arguments in favor of cockpit videos:
“In its final report on the Air France Flight 447 accident, the BEA cited difficulties in reconstructing critical instrument panel indications that were available to the flight crew. Consequently, the BEA recommended that ICAO [International Civil Aviation Organization] require public transport flights with passengers be equipped with a cockpit image recorders that can record the instrument panel and also that guidelines be established to guarantee the confidentiality of the recordings.”
“On September 3, 2010, a Boeing 747-44AF, operated by United Parcel Service (UPS), crashed while attempting to return to Dubai International Airport following an in-flight cargo fire. Some critical information, such as flight instrument indications, switch positions, and aircraft system conditions, could not be confirmed by the available evidence. The final report, prepared by the United Arab Emirates General Civil Aviation Authority … specifically cited the lack of cockpit imagery as a detriment to the timeliness of the investigation and delivery of critical safety recommendations …
“Further, in the Air France and UPS crashes, the accident aircraft were equipped with FDR’s that greatly exceeded the minimum parameter requirements. However, in these accidents, critical information related to the cockpit environments conditions (for example, crew actions and visibility [e.g., smoke from the cargo fire]), instrument indications available to crewmembers, and the degradation of aircraft systems was not available to investigators. The NTSB concludes that image recordings would provide critical information about flight crew actions and the cockpit environment [e.g., smoke filled] that has not been provided by CVRs and FDRs.”
And, the NTSB glumly noted:
“(A)fter 15 years the FAA still has not mandated installing cockpit image recorders … Therefore, Safety Recommendations A-00-30 and -31 are classified ‘Closed — Unacceptable Action/Superseded.’ “
The NTSB’s recommendation letter of January 2015 supersedes all previous frustrating correspondence with the FAA on this issue.
The dismal history of cockpit image recorders does not bode well for prompt and sustained action on broadcasting the airplane’s location and key FDR parameters in the moments before impact.
To gauge the FAA ‘s willingness and commitment, the NTSB should have recommended the broadcast capability be installed within three years. Absent a mind-focusing deadline, the FAA is quite likely to dawdle, taking 10 or more years to solve the problem (if at all), when the capability already exists.
How might the aviation accident investigation process be improved? That is the question the National Transportation Safety Board (NTSB) asked for public comments in an August 24 announcement posted in the Federal Register. Comments must be submitted not later than October 14; that is not much time, given the importance of the subject.
But, then, from the NTSB’s 18-page notice, it is obvious that substantive changes to the current process are not envisioned. The NTSB proposes sundry technical edits to existing regulations. Left intact is the direct affront to the NTSB’s charter as an independent investigative body, the so-called “party” system. Under this existing arrangement, airlines, manufacturers, air traffic controllers, pilots and mechanics unions and, not least, the regulator — the Federal Aviation Administration (FAA) — are accorded an official role in the investigation. A representative for the killed or injured passengers is not included. However, those involved in the deaths or injuries of passengers are official members of the investigation.
The official definition of a party is “a person, government agency, or association whose employees … or products were involved in the accident or incident and who can provide suitable qualified technical personnel to assist in the investigation (49 Code of Federal Regulations, paragraph 831.111(a)(1)).
This arrangement has come about partly because the NTSB is a small agency, without enough investigators to do the job. The agency has about the same number of aviation investigators as the equivalent strength of a Marine Corps rifle company. That is 130 Marines which, in NTSB “uniform”, are charged with airline accident and incident investigations, which includes air charter operations, plus investigating the same for the nation’s private, general aviation, fleet of aircraft. All told, the Safety Board has to investigate about 2,500 aviation accidents and incidents yearly with an extremely limited staff.
The party system supposedly has evolved to allow the Safety Board to leverage resources to meet its broad and complex mission.
This may be so, but the parties are hardly impartial. Airplane manufacturers have an interest in minimizing any design flaws in their aircraft that either caused or contributed to the accident. Airlines have in interest in downplaying pilot training or maintenance deficiencies. Pilots’ unions have an interested in demonstrating that the pilots in the accident were not at fault and, indeed, were let down by inadequacies in airplane design or airline practices. The FAA has a vested interest in obfuscating any shortages in its oversight of the airline or shortcomings in its certified approval of the airplane’s design.
Richard Kessler, who lost his wife in an airline crash, takes a dim view of the party system. “As one who has experienced accident investigations first-hand … it is my view that the current process is shot through with conflicts of interest.”
“We can do better,” he maintained.
While parties are not involved in analysis and the determination of probable cause, their intimate involvements is spelled out in the NTSB’s Aviation Investigation Manual. A few extracts from this seminal document serve to highlight the parties’ deep involvement in the warp and woof of the supposedly “independent” investigative process:
“The IIC [NTSB Investigator in Charge] will … meet daily with the party coordinators ….These meetings should be used as a way of determining the parties level of satisfaction with the investigations and their ability to cooperate with each other and with the Safety Board … Guidance and input should be provided to them, as needed, to prevent potential problems from escalating.” The parties’ level of satisfaction is a sure give away that the NTSB will accommodate party wishes.
“The [Safety] Board’s administrative practice regarding the conduct of public hearings is to ensure that before opening the accident file to the public, all parties to the investigation are given the opportunity to record in writing whether or not they want a public hearing to be conducted on the accident.”
“[The] IIC should also e-mail a ‘warning memo’ to the parties notifying them that the docket will likely be opened on the date selected by … the Office of Public Inquiries.”
“The IIC/hearing officer should inform all parties of the details of the hearing and the prehearing conference well before both are held … The IIC/hearing officer should allow sufficient time (at least 2 weeks) for the parties to receive and review the items critical to the hearing before the prehearing conference. These include exhibits, issue list, areas of questioning, and relevant exhibits for each witness.” The public is not accorded this generous courtesy.
“The witnesses may be from the parties to the investigation or can be suggested by one or more of the parties.” If ever there was a set up for friendly testimony, this section of the manual is a dead give away.
“The prehearing conference allows the parties to review plans for the hearing and provides them with a final opportunity to make suggestions on its conduct.” To “make suggestions” and the party’s “self interest” are evident.
“The IIC will write each party … informing him or her of the opportunity to present party submissions. It should be explained that the submissions should contain their proposed conclusions, probable cause, and recommendations relating to the accident … The party submissions will be considered during the development of the final report.” Note the term “will be” taken into account as the final NTSB report is written.
Parties (foreground) participate in an NTSB accident investigation. Why?
In 2005, the RAND corporation submitted a report to the NTSB on its investigative process, a report requested by the NTSB, and observed: “The party process presents inherent conflicts of interest for entities that are both parties in an investigation and ‘parties defendant’ in related litigation.”
This incestuous arrangement can be dispensed with. The party system ought to be expunged entirely. If the NTSB does not have enough staff to handle the workload and the often arcane technical issues involved, there are two remedies, both of which should be adopted:
First, the NTSB should not be involved in the great majority of general aviation accidents. Most of these involve pilot error and/or poor judgment (e.g., taking off with inadequate fuel or persisting in a flight where the weather is worsening). This one step would reduce the NTSB’s workload from 2,500 investigations to about 500 yearly.
Second, it should be noted that the NTSB has frequently gone past the parties, hiring small, expert companies, consultants and university professors to fulfill needs for specific technology and knowledge beyond the ken of the NTSB’s professional staff.
The parties no more would be involved in negotiating the issues to be investigated or not to be explored, as is the case at present. The parties now submit a statement of probable cause or suggested recommendations. This astonishing practice would end.
Unfortunately, in its August 12 announcement, the NTSB takes the opposite course, actually liberalizing the role of parties, allowing them to “release information within party organizations as needed to implement prevention [or] remedial action” as a result of disclosure during an accident investigation. Note, this activity is proposed even before the NTSB has concluded its investigation. To be sure, it is useful to accelerate the pace of remedial action, but the real problem is the glacial pace of FAA correctives when in receipt of the final investigation and its many recommendations.
The NTSB proposal abets the status quo, when that arrangement itself is deeply suspect. The status quo needs to be blown up. The often devious and manipulative parties can be dispensed with entirely. If the present parties have a comment, they can submit a letter to the Safety Board, just like any other member of the public. And if the NTSB wants them to testify, a subpoena will serve.
NTSB independence and impartiality as an aviation accident investigation body finally would be assured.
Following the downing of Malaysian Airlines flight MH 17 over the Ukraine on July 17, the airline’s website featured senior officials with hang-dog looks offering condolences to the families of the 298 passengers and crew blasted to oblivion, likely by a surface-to-air missile fired by Ukrainian separatists.
Captain Izham Ismail, the airline’s Director of Operations, vowed a week later, “Safety has always and always will be our utmost priority.”
If so, one has to ask what the airline was doing flying at 33,000 feet over an active war zone where the antagonists were equipped with SA-11 missiles capable of striking jets flying as high as 49,000 feet. At least ten aircraft and helicopters had been shot down in the three months leading to the missile hit that destroyed the airliner. A Ukrainian military jet was shot down just the day before.
Other airlines had chosen to re-route their flights, accepting the slight increase in fuel consumption for the assurance of a flight outside the missile-striking envelopes of the combatants.
Before the missile attack, the Ukrainian government had closed airspace below 32,000 feet because of security concerns — note that flight MH 17 was cruising just 1,000 feet above. Eurocontrol, the air traffic controller for Europe, had banned flights below 26,000 feet since July 1, after rebels shot down a Ukrainian military aircraft. Some other airlines had already elected to avoid Ukrainian airspace, at any altitude, and were routing their airplanes to skirt any possible threat from the fighting below.
Belatedly, Malaysian Airlines now touts its avoidance policy, declaring it flies around Ukrainian airspace altogether. The once-popular aerial east-west highway is now empty.
Malaysian Airlines now faces liability estimated in excess of $1 billion. The lives lost are incalculable. Captain Ismail’s fervent commitment to safety is not only belated, it lies in tatters.
His words are not the only ones bereft of real meaning.
The International Civil Aviation Organization (“ICAO”) proclaims safety first and efficiency third in its priorities:
“ICAO sets international standards necessary for the safety, security and efficiency of air transport…”
Consider the Articles of Association listed by the International Air Transport Association (‘IATA”), of which Malaysian Airlines is a member:
“The mission of IATA is to represent, lead and serve the airline industry. In carrying out this mission IATA shall: 1. Promote safe, reliable and secure air services for the benefit of the peoples of the world; 2. Provide means of collaboration among Airlines in compliance with applicable law; 3. Cooperate with the International Civil Aviation Organization and other relevant international organizations.”
Each — Malaysia Airlines, IATA, and ICAO — failed to fulfill its of safety role, as the burned, twisted remains of flight MH 17 mutely attest.
The distancing from accountability was noteworthy for its brazenness. On July 18, Malaysia Airlines asserted on its website and on Twitter that MH 17’s flight plan was approved by Eurocontrol, which is solely responsible for determining flight paths over Europe, and further asserted that MH 17’s route was approved by ICAO. Contemporaneously, IATA issued a statement that “it is important we are very clear: safety is the top priority” and “[a]irlines depend on governments and air traffic control authorities to advise which air space is available for flight, and they plan within those limits.” ICAO President, Dr. Olumuyiwa Benard Aliu, was blessedly more circumspect, stating only that “ICAO strongly condemns the use of weapons against international civil aviation.”
At a fundamental level, the international community appears to be in agreement that whoever launched the missile bears responsibility for the crime of slaughtering the innocents 33,000 feet above. Who, though, bears responsibility for the conditions that allowed this civilian airplane to enter an area of active conflict? Further, how does this accident get prevented in the future?
1. Malaysia Airlines and IATA Knew Or Should Have Known
On July 14, three days prior to the MH 17 missile strike, an Antonov An-26 belonging to the Ukrainian government similar to the one pictured below was shot down by a missile at a reported altitude of approximately 21,325 feet.
An Antonov An-26 in Ukrainian military colors similar to the one shot down on July 14, 2014 near the village of Davido-Nikolsk, in the Luhansk region
An Antonov An-26 in Ukrainian military colors similar to the one shot down on July 14, 2014 near the village of Davido-Nikolsk, in the Luhansk region
The news of this event was widely reported in the media, including the altitude at which the airplane was struck. However, the significance of such an event escaped appreciation by officials at Malaysia Airlines, KLM (which stuck to the preferred fuel-saving route) and IATA. Lost was the understanding of the weaponry be used to bring down an aircraft from such an altitude. Lost was the understanding of the of the escalation of hostilities in the area, and lost was the understanding that the flight plan for MH17 “threaded the needle” between the restricted air space over and near Crimea to the south, and that of the Luhansk region to the north where the An-26 was shot down earlier that week.
However, the hostilities in the region were appreciated by several other IATA member airlines. Take for example, Korean Air which experienced the shoot down of KAL Flight 007 in 1983 at the hands of the Russian military. Korean Air, an IATA member airline, ceased flights over Ukrainian air space on March 3, 2014, or more than four months prior “due to the political unrest in the region.” Reportedly, Asiana Airlines, Qantas Airlines and China Airlines, all IATA members, had diverted flights around Ukraine well prior to July as well.
2. IATA and ICAO Lacked Redundant Security Intelligence
Counter-intuitive to its mission of promoting secure air services for the peoples of the world, it appears IATA never set up a system of intelligence sharing between its members relating to route-of-flight safety and security, including threat assessments. Instead, IATA rejected responsibility for any such thing on its part or its member airlines in a position paper submitted to ICAO which included the statement:
“IATA believes that governments have direct responsibility for aviation security and its funding. This responsibility includes protection of its citizens in the air and on the ground…”
Under such a position, safety and security would only be as good as the worst government upon whose information the flying public is expected to rely. Ukraine is a signatory to the Chicago Convention and should have followed its provisions and those in its annexes. Annex 17 to the Convention contains a provision that “[e]ach contracting state should constantly review the level of threat to aviation in their territory and establish any new procedures accordingly, as well as notify ICAO of the changes.”
So, did the Ukrainian government appreciate the threat that existed to civil aviation over its air space? Apparently not. Ukrainian controllers approved MH 17 to travel along the route and at the altitude it did. Again, only as good as the worst, and precisely why ICAO cannot solely rely on the provisions of Annex 17.
Certainly, ICAO has the personnel and expertise to have appreciated the threats that existed over Ukraine prior to the downing of MH 17. However, there was no system in place to independently gather and assess such available information. It seems that even with the report run by the CBC television in Montreal on July 14, where ICAO’s headquarters are located, no one at ICAO believed they were expected or empowered to do anything with the information published on the downing of the An-26 or the escalating violence in the region.
Nevertheless, the flying public was led to believe that the MH 17 route-of-flight was safe because, as Malaysia Airlines stated, it was an ICAO approved route. The reality is the ICAO approval of the route was not an endorsement of its safety on July 17, 2014 or at any other time.
The evasiveness and rationalizations are astounding.
Contrary to its mission, ICAO eschewed the duties of its self-proclaimed role as coordinator for international cooperation in all areas of civil aviation
3. Safety of International Civil Aviation is a Mutual Responsibility
The courts will eventually sort out the legal responsibility for the tragic downing of MH 17, but the airlines, industry and governments around the world know now where the systemic vulnerabilities to safety and security exist. Empty words in mission statements and vague declarations that safety is the highest priority are not enough when airliners are routed over active conflict zone.
Regulatory bodies, Eurocontrol, and airlines might take a page from the procedures used to avoid volcanic ash.
When Iceland’s Eyjafallokull erupted in 2010, ejecting huge amounts of ash into the upper atmosphere — and right into the path of international flights — jetliners were either grounded outright until the hazard had passed, or they were re-routed into safer climes by air traffic controllers.
The 2010 eruption of Iceland’s Eyjafallokull volcano disrupted international flights
In just three days the volcano spewed 100 million tons of fine particulate matter into the atmosphere. The fine ash, not detectable by radar, scours windshields and gums up engines, causing them to wind down to a stop as the ash collects like glass on turbine blades and other components (See “The Hazard of Flying Through an Ash Cloud”, Aviation Safety Journal, May 17, 2010; see http://asj.nolan-law.com/2010/05/the-hazard-of-flying-through-an-ash-cloud/.
For volcanic ash clouds, the international aviation policy is strict avoidance with a 100 mile buffer for uncertainty.
Such a standard would make eminent sense as well for flying jetliners over the world’s conflict zones. The standard could be a part of an airline’s standard operating procedure (SOP), utilized by both dispatchers and pilots. It could be written into air traffic control procedures. The policy could be codified by ICAO and IATA. Certainly the policy should be enforced by government regulatory bodies.
As in the case of volcanic eruptions, flying trusting passengers over a conflict zones just begs the question: Why wasn’t the airspace banned (at all altitudes), and what was the airline thinking? The absence of caution invited disaster.
The Federal Aviation Administration (FAA) proposed a $12 million fine July 28 against Southwest Airlines for sloppy repairs to fuselages on its B737 jets. What appears as significant regulatory action appears distinctly as another tardy and weak effort to assure the safety of the flying public.
“The FAA views maintenance very seriously, and it will not hesitate to take action against companies that fail to follow regulations,” vowed FAA Administrator Michael Huerta.
Tough talk and a proposed fine that are both years late, when timely FAA oversight might well have made a difference. The whole announcement of this “civil penalty” against the airline appears scripted for public consumption.
The FAA says it seeks financial disciplinary action based on Southwest’s maintenance lapses from 2006 to 2009. Note that it is now 2014, five years after the closing window of alleged shortcomings. Financial penalties and mandated procedural and personnel changes would have made eminent sense in 2010; now, years after the fact, the FAA’s belated action is too late to impact procedures, or to make a meaningful imprint on the minds of those responsible.
Not to mention that had the FAA acted in a timely manner, the sudden 60-inch tear in the upper fuselage of a Southwest jet cruising at 34,000 feet in April 2011, forcing an emergency landing of the planeload of terrified passengers, might not have occurred.
<a href=”https://nolan-law.com/wp-content/uploads/2014/08/hole.jpg”><img class=”size-medium wp-image-2869 ” alt=”Hole blown in the aluminum structure of a Southwest jet when the lap joint failed ” src=”https://nolan-law.com/wp-content/uploads/2014/08/hole-300×169.jpg” width=”300″ height=”169″ /></a> Hole blown in the aluminum structure of a Southwest jet when the lap joint failed
The FAA says that proper procedures were not taken when fuselage skins were repaired on Southwest’s jets. Specifically, that the airplanes were not placed on jacks to stabilize them for the repair work; sealant was applied between overlapping skin panels, but not all rivet holes were affixed with fasteners within the time allowed to assure a good bond and corrosion-free service.
The repairs, according to the FAA, were not performed in accordance with airworthiness directives (ADs). However, the FAA adds that it approved the repairs after the airline provided proper documentation. So, did the FAA subsequently okay the repairs even though they were made on airplanes that had not been first placed on jacks, and rivets were applied in the time allowed after sealant was applied? And it took five years for the FAA to determine that the paperwork was sloppy and to issue a proposed fine? Where were the FAA’s on-site inspectors when the repairs were first made?
Lots of questions. No answers.
<a href=”https://nolan-law.com/wp-content/uploads/2014/08/faa.jpg”><img class=”size-full wp-image-2870 ” alt=”Looks official, but the globe should be a pillow until the agency acts like a rigorous regulator ” src=”https://nolan-law.com/wp-content/uploads/2014/08/faa.jpg” width=”261″ height=”192″ /></a> Looks official, but the globe should be a pillow<br />until the agency acts like a rigorous regulator
Now begins a period of negotiation between the FAA and Southwest Airlines, in which the likely outcome is a dramatic reduction in the fine.
A fine against American Airlines for $162 million was subsequently whittled down to $25 million — an 85% reduction.
For Southwest’s lawyers, this 2013 precedent will surely provide a stimulus for vigorous argument.
Previous maintenance lapses do not seem to result in increased fines. From 2005 to 2013 the FAA levied $1,155,000 in proposed penalties against various airlines for maintenance lapses. Three forfeitures were announced against Southwest, the largest being $45,000. Eight penalties were proposed against Alaska Airlines, one of which was a measly $5,500. You would think that with eight proposed penalties from 2006-2007 there would be a special inspection of the Alaska’s maintenance practices across-the-board, especially when the airline came within a hairsbreadth of losing its FAA-issued operating certificate after the fatal crash in 2000, a direct result of maintenance deficiencies.
Each proposed penalty is viewed in isolation, not as part of a pattern warranting scrutiny as to the root causes of the maintenance violations. The flying public is unaware of these penalties; that is, unless the FAA decides to make a show of toughness.
The penalties would put a crimp in a household budget. For a corporation, they are not even as irritating as a minor hangnail.
Southwest earned a net profit in 2013 of $804 million. The proposed penalty of $12 million represents a mere 1.5% of 2013 profits. Negotiated down by 85% — as in the American Airlines case — will result in a penalty of just $1.8 million, or about two-tenths of one percent of Southwest’s 2013 profits.
These thoughts occur:
1. FAA action regarding AD noncompliance should occur within 12 months of discovery.
2. A forfeiture should be meaningful. Say, 5% of annual profits for each instance, times the number of airplanes affected.
3. The FAA should not be in the business of negotiating with the airlines what they will actually pay. The FAA is the regulator; if irregularities have been documented by the FAA’s principal maintenance inspector, the airline should be fighting to retain its operating certificate, not the amount of a reduced fine.
4. If the FAA were serious about safety and accountability, it would annually publish for the flying public each airline’s ranking using a star system similar to that used for automobile crashworthiness. For aviation, a three-star rating system would apply:
One star (¶): the airline meets FAA standards. If the airline is not meeting these admittedly minimum regulations, it should not be operating.
Two stars (¶¶): the airline more than meets FAA standards and has in place some voluntary safety programs.
Three stars (¶¶¶): all of the above, plus the airline has a pro-active safety culture with a non-punitive program to encourage employee reporting of deficiencies.
A civil penalty of less than $1 million would knock down an airline’s star rating by one star for six months. If already at the minimum one-star level, the airline would have its rating reduced to just a half-star. For penalties equal or greater than $1 million, the airline would be penalized by one star for a full year,
In pretty short order, we would see airlines scrambling to achieve a three-star rating and to make this ranking a feature of advertising, annual reports, and even on the corporate letterhead. Imagine a little logo on a proud airline’s web site and in its advertising: the great seal of the FAA emblazoned with three gold stars and a motto like, “Top ranking for safety, for five years and still improving.”
The flying public would have a ready measure; the airlines would have a meaningful incentive to avoid fines.
The aviation industry is now facing direct actions to abate the growing effects of climate change. The implications for the industry are profound: fewer flights with more passengers, higher ticket prices to offset the costs of environmental pollution, and perhaps even a reduction in the size of the industry as a draconian step to limit air pollution.
With weaker carriers driven out of operations, the result could be a smaller but safer airline industry.
The latest environmental impact on aviation comes from the European Union (EU). Starting in January 2012, the EU is demanding all carriers that land or take off in the 27 nation block would emit no more than a set amount of carbon dioxide (CO2). Under the cap-and-trade concept, carriers can buy extra credits from each other if they exceed the limit, or they can sell credits if they emit less.
Transport contributes about 13% to global CO2 emissions, of which aviation involves a 13% share
The cap for 2012 is set at 212.9 million tons of CO2 – about 3% less than the average emitted by the airlines between 2004 and 2006. In 2013, the cap will drop another 2% — to around 208 million tons of CO2 – remaining at this level until 2020.
According to the EU, aircraft CO2 emissions account for only 3% of the global total but they have increased by 87% since 1990. Moreover, the real impact on global warming is amplified 2 to 4 times because airliners flying at high altitude leave condensation trails which add to the greenhouse effect.
Contrails contribute to the greenhouse effect
The EU estimates the cost of the program at $10 to $15 per ticket. The European airline industry warned earlier this year that it would have to spend over $65 billion between 2011 and 2022 buying up credits from more fuel-efficient industries to meet the aviation quotas.
The EU’s carbon trading plan will only exempt airplanes with CO2 emissions that add up to 10,000 tons annually. Thus, a B777 airliner flying from Shanghai to London, a distance of approximately 5,500 miles, will emit 222 tons of CO2. If the airliner has three flights to Europe each week, the exemption quota will be used up in three weeks.
International flights represent approximately 62% of global aviation's fuel consumption
Airlines from non-EU member states flying to or from Europe will be affected by the law.
“This is already adopted legislation and we are not backing down,” declared Isaac Valero-Ladron, an EU spokesman. “We knew what we were doing in 2008 when we adopted this and we are not changing our legislation.”
The EU has banned some carriers deemed unsafe from landing in Europe; now the same is to be applied to airliners that emit too much greenhouse gases.
London's Heathrow Airport is the biggest single source of air pollution in Western Europe, aggravated by an average of more than 50 take off's and landings each hour
The EU mandate reflects frustration with the International Civil Aviation Organization (ICAO), which has studied the environmental effects for years but has not come up with a mandatory program. Rather, ICAO has developed voluntary goals for leveling aviation’s total emissions by 2020 and halving them by 2050. The ICAO plan artfully side steps the voluntary nature of its intentions:
“The ICAO Program of Action on International Aviation and Climate Change, agreed in 2009 … is the first and only globally-harmonized agreement from a sector on a goal and on measures to address CO2 emissions. ICAO continues to pursue even more ambitious goals for aviation’s contribution to climate change.”
Noble and toothless rhetoric.
In Europe, other energy-hungry industries have been under a cap-and-trade system since 2005; the exemption for aviation stood out.
Even though the EU program could be seen as an eventuality five years ago, only now are airlines and industry representatives outside the EU really making their complaints noted. The Chinese government has threatened to review its contracts for the purchase of Airbus airliners if the emissions caps are applied to Chinese airlines flying to EU states.
The U.S. Government has not yet weighed in, but the U.S. Air Transport Association (ATA), representing the vast majority of U.S. airlines flying to Europe, asserts the emissions cap-and-trade is illegal.
“Our position is that the EU ETS [Emissions Trading System] as applied to U.S. airlines is contrary to international law and bad policy,” claimed ATA’s Nancy Young.
ATA, American Airlines, United and Continental Airlines have taken their case to the European Court of Justice. Hearings were held this week and the judges are expected to issue a ruling by winter.
EU airlines insist that if they have to join the carbon trading market, their U.S. competitors should be forced to jump in as well. The European carriers say if they must spend $65 billion buying carbon credits over the next 15 years, and non-EU airlines are not forced to do the same, it would amount to a massive tax on European aviation.
On the safety side, if airlines are forced to retire their old fuel guzzlers, the new airplanes that replace them are safer. There could be a net safety benefit.
On the other hand, if peak oil has been passed or is about to be, the cost of travelling by air is likely to go up far more than it may under the emissions limiting scheme. A radar plot of airplanes flying to/from North America-Europe shows over 600 airplane symbols crowded over the Atlantic in a 24-hour period. That number could shrink by 200 or more if fuel prices air travel out of the reach of casual tourists.
The controversy over the EU cap-and-trade policy has spawned numerous comments on the Internet. Herewith, some of that commentary:
“I fail to see how carbon trading decreases emissions. I’m not a big fan of this system, as it still allows for people to continue to belch out as much pollution as before; they just have to buy credits from someone else.”
“It is well known that the impact of CO2 by airlines is greater than the same amount of CO2 by other means of transport because the airline exhaust is in the upper atmosphere whereas car exhaust is easily absorbed by the vegetation.
“It is environmentally illogical to exclude air transport. It will make flight more competitive compared to car or train and the CO2/passenger km is worse than for any other type of transport. Hence, excluding air transport will result in a negative effect in the end. Including air transport in the system is only a step to bring the different means of transport on the same level.”
“In the 1960s and 1970s some cars got maybe 7 mpg. With little government laws and many other big factors today for Chevrolet 7 out of 17 models get 30+ mpg. No model (other than trucks) gets lower than 20 highway mpg. Now imagine if Europe and the U.S. required Airbus, Boeing and others to have a similar increase in efficiency and maybe also somehow helping the airlines change to these newer, hopefully better planes. This would affect the entire market, reducing prices for customers and increasing business for the air industry.”
“To work any such system has to include any flight in and out of the EU. Otherwise you might get a situation where a plane starts in Greece and does not fly directly to Spain, but makes a short landing in North Africa and then continues to Spain just to declare the flight as ‘not within the UE’ and avoid the carbon tax. That way, you would have made the flight even worse than before … If the flight to Africa and from Africa are treated as flights in the EU, there is no incentive to ‘cheat’.”
“A general CO2 tax would be the first transnational tax in history.”
“You want a better way than a cap-and-trade system? How about a carbon tax on jet fuel and all other fossil fuels? Surely a carbon tax is more efficient and equitable than a cap-and-trade, and a lot easier to manage as well. And you don’t even have to get in an [argument] with head-in-the-sand Americans to make it work. That is, unless they don’t plan on refueling in Europe once they land.”
“As some have observed, yes, the cost of carbon credits will be passed on to the passenger. That’s the whole point!
“People will travel less, or rather shorter distances, when price goes up. More CO2 efficient means of travel can better compete with less efficient ones. Train may be preferred over plane or car. All this will cut emissions, which is the central objective.
“Europeans will go less to the U.S. as Americans go less to Europe; tourism will change to the home market. As a whole, I don’t think tourism on either continent will suffer …
“The carbon trade system is brilliant in that it allows countries to earn credits by investing in CO2 efficient tech [which] will be employed where the effect is greatest.”
“The so-called market approach will not, and cannot, solve airline emissions for a very simple reason: operating an airliner imposes a cost on the environment that the airline doesn’t have to pay! Since the airline can stick the rest of society/the world with the cost of its operation, there is no market incentive for it to curb emissions. Claiming that regular market incentives to reduce fuel consumption (to lower costs the airline DOES have to bear) amount to ‘dealing with’ the emissions problem is disingenuous because, again, the cost of the fuel paid by the airline does not include the cost its use imposes on everyone else in the form of environmental damage. The best way to factor in that cost is with a carbon tax. Cap and trade is just a way to spread the pain equally among participants in the industry being regulated.”
“Operating those B767s and B757s on transatlantic routes is about to become more expensive.”
“It is hardly a development that is hostile to the aircraft design and construction industries.”
“It’s pretty simple: no EU airline can avoid this tax. It will apply, without exception. on 100% of heir flights as, obviously, 100% of their flights come to, from or through the EU …
“The same won’t be true of, say, a U.S. airline, which may only have 3-4% of their flights coming in our out of the EU and thus will only be subject to this tax on a tiny portion of their network …
“3-4%. 100%. The difference is huge.”
“Microsoft took the view that the EU would back down. It looks like costing them $690 million in fines. It’s a high risk strategy unless you can play Brussels politics really well.”
“When the U.S. introduced anti-terrorism regulations, they forced the entire industry to comply or else lose the ability to land in the States. Why wouldn’t the EU do the same for global warming?”
The “Most Wanted” list of safety improvements has been upgraded to reflect a more contemporary appearance, but no effort has been devoted to making the list more effective. Result: recommendations deemed especially critical languish on the list for years then disappear into a black hole of unrequited initiatives.
The National Transportation Safety Board (NTSB) revealed its new “Most Wanted” format on 23 June 2011 to reflect the most critical issue that need to be addressed this year to improve safety and save lives. Of the 10 critical changes, 6 deal with aviation; the others deal with busses, motorcycles, teenage driver safety, and alcohol impair driving.
The new format dispenses with the color coding of recommendations. A green circle was used to denote an acceptable response. A yellow circle was used to signify untoward delay; a red circle was used to mark an unacceptable response from the FAA. Since the vast majority of “Most Wanted” recommendations in the past were characterized with yellow or red circles – a potential embarrassment to the NTSB and the FAA – this feature has been dropped from the “new look”.
NTSB Chairman Deborah Hersman
Regarding the new format, Deborah Hersman, NTSB chairman, said:
“The NTSB’s ability to influence transportation safety depends on our ability to communicate and advocate for changes. The ‘Most Wanted’ list is the most powerful tool we have to highlight our priorities.”
If the “Most Wanted” list is the “most powerful” vehicle available to the NTSB, one must conclude that it really comprises a fairly weak tool. Improving the format of the list is not the same thing as getting the recommendations implemented.
Recall that the issue of child restraint systems was on the NTSB’s “Most Wanted” list for years. When the Federal Aviation Administration (FAA) refused to implement rulemaking that would mandate an end to infants and small children being held in an adult’s lap, the NTSB simply dropped its 1996 call for child restraints from the “Most Wanted” list in 2006.
Regarding fuel tank safety, the NTSB had a “Most Wanted” recommendation that all airliner fuel tanks should be inerted. That is, the void space in the tank should be filled with an inert gas to preclude an explosion if a spark or lighting discharge found its way into the tank. The FAA decided that only center wing tanks (inside the fuselage) with adjacent heat sources (e.g., air conditioning packs) need be inerted, and to a higher level of oxygen (12%) than earlier estimated (10%). The NTSB hailed the FAA action as a great leap forward for safety when in fact it fell considerably short of the NTSB’s goal: all fuel tanks inerted (heated, unheated, center wing tanks, wing tanks, auxiliary tanks, and tanks in the empennage).and to 10% or lower of residual oxygen. Finally, airplanes with heated center wing tanks will be permitted to fly without modification until 2018. This date is fully 22 years after TWA Flight 800, a B747, was destroyed in 1996 by a center wing tank explosion.
Not to mention that recommendations often reside, unrequited, on the “Most Wanted” list for years, then are implemented only partially if at all.
We have agued that the “Most Wanted” list has been carefully crafted by the NTSB to significantly improve aviation safety and, as such, the recommendations ought not be slow-rolled and halfheartedly implemented by the FAA. Indeed, the FAA should be required, under force of a court order, to explain its dilatory action. Under a writ of mandamus (Latin for “we order”), a court can direct a government body like the FAA to implement a recommendation when it has neglected a refused to do so. (See Aviation Safety Journal, February 2010, “Time to Revamp ‘Most Wanted’ System”)
The effect of taking the FAA to court would have a number of salutary effects:
1. The NTSB would not be seen as toothless and ineffectual.
2. The NTSB would have to convincingly explain why a particular recommendation rose to the level of “Most Wanted”. Concurrently, the FAA would have to explain why implementation was delayed.
3. The mere threat of such legal action may stimulate the FAA to more seriously consider the price of inaction.
4. Such court proceedings would certainly interest the oversight committees in Congress as to why the FAA was being dragged before the bar to explain itself (with obvious implications for FAA staffing and funding).
The NTSB has a clear choice: either take steps to ensure that its “Most Wanted” recommendations are implemented (not just “accepted” by the FAA), or drop the program as an unfortunate annual reminder of the toothless pleading for progress. Dressing up the “Most Wanted” list in a new format is akin to putting the proverbial lipstick on a pig – it’s still a pig, and the “Most Wanted” recommendations remain not acted upon, or poorly and tardily implemented by the FAA. As the saying goes, “Safety delayed is safety denied” and the phrase applies with particular force to the “Most Wanted” list.
Herewith, the aviation recommendation on the 2011 list (NTSB position followed by an Aviation Safety Journal comment in italics):
Addressing Human Fatigue
What is the issue? Airplanes, trucks, buses, and ships are complex machines that require the full attention of the operator, maintenance person, and other individuals performing safety-critical functions. Consequently, the cognitive impairments to these individuals that result from fatigue due to insufficient or poor quality sleep are critical factors to consider in improving transportation safety …
What can be done? Since its creation, the NTSB has issued more than 180 separate safety recommendations to address the problem of human fatigue in all modes of transportation … Because “powering through” fatigue is simply not an acceptable option, fatigue management systems need to allow individuals to acknowledge fatigue without jeopardizing their employment.
ASJ comment: the NTSB has 12 aviation-related recommendations outstanding in this area. In other words, dating back to 1994 the FAA has been dithering. In September 2010 the FAA published a long-awaited Notice of Proposed Rulemaking (NPRM) addressing the subject. Interspersed throughout the NPRM are questions for which the FAA “seeks comment”. The FAA seems more interested in cost than safety, as indicated by this remark:
“We are particularly interested in receiving recommendations that would provide the same or better protection against the problem of fatigue at lower costs.” [Emphasis added]
In other words, ideas that entail hiring more pilots or providing sleeping facilities in ready rooms (or adjacent thereto) are not desired.
Many pilots commute to their bases across multiple time zones and/or hundreds of miles. For example, the two pilots killed in the crash of the Colgan Air Dash 8-Q400 turboprop in February 2009 had spent the night before commuting to their duty station at Newark, NJ. Capt. Marvin Renslow commuted from Florida. F.O. Rebecca Shaw commuted from the West Coast.
The FAA response in the NPRM to the issue of commuting features plenty of rhetoric and no proposed regulation:
“The FAA … believes it is inappropriate to rely on existing requirements … to report to work fit for duty. The FAA believes a primary reason that pilots engage in irresponsible commuting practices is a lack of education on what activities are fatiguing and how to mitigate developing fatigue. The FAA has developed a draft fitness for duty AC 9advisory circular) that elaborates on the pilot’s responsibility to be physically fit for flight prior to accepting any flight assignment, which includes the pilot being properly rested. Additionally, the AC outlines the certificate holder’s responsibility to ensure each flightcrew member is properly rested before assigning that flightcrew member to any flight.”
Let the record reflect that an AC does not have the force of regulation. There is nothing in the AC that restrains poorly-paid pilots from residing in low cost-of-living areas and commuting to their bases, such as Colgan’s in Newark. There is nothing in the AC that requires Colgan – or any other operator – to minimize the effects of commuting.
In short, there is nothing in the NPRM to prevent a repeat of the crew fatigue strongly suspected as having played a role in the Colgan Air crash. If the NTSB were still color-coding responses from the FAA, this one would rate a prominent red blot. (See Aviation Safety Journal, September 2010, “Rule Proposed on Pilot Rest Requirements”)
General Aviation Safety
What is the issue? The United States has not had a fatal commercial aviation accident since February 2009, but the story is very different in the world of general aviation (GA). Each year hundreds of people – 450 in 2010 – are killed in GA accidents, and thousands more are injured. GA continues to have the highest accidents rates within civil aviation: about 6 times higher than small commuter and air taxi operations and over 40 times higher than larger transport category operations. Perhaps what is most distressing is that the causes of GA accidents are almost always a repeat of the circumstances of previous accidents.
What can be done? Reducing GA fatality rates requires improvements to the aircraft, flying environment, and pilot performance. Maintenance personnel need to remain current in their training and pay particular attention to key systems, such as electrical systems. Aircraft design should address icing. GA aircraft should also have the best occupant protection systems available and working emergency locator transmitters to facilitate timely discovery and rescue by emergency responders …
ASJ comment: The NTSB lists 10 extant GA recommendations, indicating – at best – a yellow color code. General Aviation and the word “safety” should not be used in the same sentence.
It should be noted that the DHC-3T airplane in which Sen. Ted Stevens and others were killed in August 2010 had the very latest terrain warning technology, which the pilot had switched to the “inhibit” mode. The crash probably could have been avoided if that system had been activated. The pilot was killed in the crash, but the NTSB did not question other pilots in Alaska about their propensity to inhibit this life saving system.
The GA fatal accident rate is equivalent to a B747 loaded fully with passengers, and the toll at this rate continues year after year. GA safety deserves to be on the “Most Wanted” list but the NTSB should have developed further the notion that even with technological improvements to the flying environment, those systems need to be used. (See Aviation Safety Journal, “Crash in Alaska & Lack of Probing About Key Safety System”)
Safety Management Systems
What is the issue? For over three decades, the NTSB has expressed concern about the lack of safety management and preventive maintenance. NTSB accident investigations have revealed that, in numerous cases, safety management systems (SMS) or system safety programs could have prevented loss of life and injuries …
What can be done? Aviation, railroad, highway and marine organizations should establish SMS or system safety programs …
ASJ comment: The NTSB has 11 aviation-related recommendations in this area awaiting full implementation. The FAA has indicated it will relegate SMS to one of voluntary compliance by the airlines. In Canada, SMS implementation has been required by the FAA’s equivalent agency, Transport Canada.
What is the issue? Takeoffs and landings, in which the risk of a catastrophic accident is particularly high, are considered the most critical phases of flight … In the United States, the deadliest runway incursion accident occurred in August 2006 when Comair Flight 5191, a regional jet, crashed after attempting to take off from the wrong runway, killing 49 of the 50 people on board.
What can be done? Reducing the likelihood of runway collisions is dependent on the situational awareness of the pilots and time available to take action –often a matter of just a few seconds. A direct in-cockpit warning of a probable collision or of a takeoff attempt on the wrong runway can give pilots advance notice of these dangers …
ASJ comment: the NTSB has 5 open recommendations in this area. None of the FAA’s proposed actions provide a direct warning to the pilots but rather focus on warning the tower controllers, who will in turn relay the impending hazard to the pilots.
Pilot and Air Traffic Controller Professionalism
What is the issue? Recent accidents and incidents have highlighted the hazards to aviation safety associated with departures by pilots and air traffic controllers from standard operating procedures and established best practices. NTSB aviation accident reports describe the errors and catastrophic outcomes that can result from such lapses, and – though the NTSB has issued recommendations to reduce and mitigate such human failures – accidents and incidents continue. The cost of these events extend beyond fatalities, injuries and economic losses: they erode the public trust …
What can be done? The industry can provide better guidance on expected standards of performance and professional behavior … And, though there is no way to guarantee that every pilot and controller will make the right choice in every situation, monitoring performance and holding them accountable will reinforce the absolute importance of maintaining the highest level of professionalism.
ASJ comment: The NTSB has 7 outstanding recommendations in this area. The head of the FAA, Randolph Babbitt, said in August 2009, “We can’t regulate professionalism.” No regulatory action can be expected in this area. Before the revised “Most Wanted” format, this area would be color-coded bright red to denote an unresponsive FAA. (See Aviation Safety Journal, August 2009, “We Can’t Regulate Professionalism”, May 2010, “Definition of Professionalism Not Coming Anytime Soon”)
What is the issue? Over the decades, new recorder technologies have been developed, increasing the likelihood of identifying the cause of an accident that 20 years ago would have gone unsolved. However, certain categories of aircraft … are not equipped with some of these technologies, which would aid in identifying crash causal factors by providing critical information on vehicle dynamics and occupant kinematics.
What can be done? Most of the difficult work has already been accomplished by the industry. Low-cost, compact image recorders capable of storing several hours of information are readily available. We simply need the regulations to require their use, where the expectations for promoting safety are higher and therefore outweigh some privacy concerns. Other low cost data/audio/image crash resistant recorders are also readily available and can be easily installed in [aircraft] that currently do not require crash hardened recorders (such as aircraft cockpit voice recorders).
ASJ comment: the NTSB lists 9 recommendations to the FAA awaiting action. On the issue of low cost image recorders, the FAA has indicated it has no intention of mandating these for GA aircraft. Deployable recorders and real-time downloading of recorder data remain far back in the swampy backwaters of regulatory activity. (See Aviation Safety Journal, February 2011, “The Case for Deployable Recorders”)
Expansion of the icing envelope for aircraft certification purposes, as proposed by the Federal Aviation Administration (FAA), will not cover all the icing conditions likely to be encountered by an airplane during its service life. The envelope needs to be expanded, claim a group of distinguished atmospheric scientists.
In 2010, the FAA proposed an Appendix O to cover supercooled liquid droplet (SLD) conditions. (See Aviation Safety Journal, July 2010, “Significant Regulatory & Related Activity”) This new appendix would theoretically cover icing conditions not defined in Appendix C of the regulations.
The icing conditions in the 1994 accident at Roselawn, IN, involving a twin-turboprop ATR-72, prompted the National Transportation Safety Board (NTSB) to recommend the FAA include much larger droplets than defined in certification regulations. This recommendation is the rationale for the belated publication of the Notice of Proposed Rulemaking with Appendix O in 2010, fully 16 years after the Roselawn crash.
Supposedly, Appendix C covered only 99% of the water and droplet sizes in so-called “cloud icing” conditions. Appendix O was intended to cover the conditions of freezing drizzle and freezing rain produced by other distinctly different processes of formation that are not part of the cloud icing conditions. Thus, an airplane certificated to both appendices should be able to cope successfully with any icing encounter while airborne.
Not so, claim the scientists. After examining the data used as a basis in the proposed Appendix O, and comparing these data to other data collected by instrumented research aircraft, they conclude in their submission:
“We therefore are concerned that adoption of these rules will lead to a false sense of security that they will protect against the icing hazard of freezing drizzle and freezing rain, when we have evidence this will not be the case.”
The essence of their argument is familiar to students of Statistics 101 and those gamblers who frequent craps tables at casinos. It is similar to the way two dice can land, showing a total count of seven on the top surface. There are six combinations: 1 & 6; 2 & 5; 3 & 4; 5 & 2; and 6 & 1. The average number of spots for all six combinations is 3½. The corollary in icing is what is referred to as the mean volumetric diameter (MVD), a hypothetical diameter characterizing all the sizes of droplets in the cloud for which half the mass of water is in droplets larger, and half is in droplets smaller. A dice has no face with 3½ dots and there need not be any droplets with the exact MVD.
The scientific evidence is that MVD, similar to the 3½, bears no relation to hazard. There are icing cases similar to rolling a 6 and a 1 that are the real hazards (and the other five combinations not so much). The way the icing envelopes are defined date back to the 1940s, but evidence now shows that other metrics are warranted. Scientific evidence supporting the need for reexamination has existed from multiple studies beginning in 1984 and revisited in the late 1990s.
Yet, as “nature abhors a vacuum’, the aviation industry abhors a change – and that is the seminal message in the scientists’ letter.
Extracts of the scientists’ submission to the docket follow:
June 21, 2011
Docket Operations, M-30
U.S. Department of Transportation
1200 New Jersey Avenue SE
Room W12-140, West Building Ground Floor
Washington, DC 20590-0001
Re: Supplemental Comments to Docket Number FAA-2010-0636
Dear Sir or Madam:
The following comprise our supplemental comments to the Docket with respect to the Notice of Proposed Rulemaking (NPRM) … published in the Federal Register June 29, 2010 … We recognize that the comment period has closed. However, the following has taken substantial time and effort to thoroughly review the data that the proposed Appendix O was based upon, compare it to our results, and prepare substantive comments.
On the basis of independent measurements of the icing hazard, obtained with a research aircraft while supporting research projects that studied icing environments, we argue that the proposed rules will not provide adequate protection against some of the most serious icing hazards. [Emphasis added] We explain the reasons for this assertion below …
Our main concern is that … the draft regulations implicitly assumes that the icing hazard is represented adequately by … liquid water content (LWC) and the droplet size distribution (DSD) selected from one of two average distributions on the basis of the median volume[tric] diameter (MVD). No justification has been offered to relate the plotted parameters to performance in icing. Incorporating these figures into the regulations will imply that the icing hazard is determined by these properties, so it is only necessary to demonstrate ability to encounter conditions characterized by these values. However, we suggest that for a given LWC and MVD there actually can be great variability in the icing hazard because real size distributions vary substantially from those shown in Fig. 2 for freezing drizzle and Fig. 5 for freezing rain. Those figures result from averaging many different size distributions, all of which can have different effects on performance, and that averaging can obscure the icing hazard …
We have experience and data to support these assertions. A summary of the effects of icing on performance of our Beechcraft Super King Air 200T (operated by the University of Wyoming and henceforth called WKA), first published in 1984 … concluded that there was no observed correlation between MVD and the impact of icing on performance. This same conclusion was arrived at and published in all the subsequent articles based on a much larger data set … The fundamental reason MVD is not correlated with performance is MVD represents cloud droplets rather than drizzle drops … Indeed, the most hazardous encounters in that data set and in subsequent studies in which we were involved had the same LWC and MVD as many other encounters that led to much smaller effect on performance. (We had the benefit of a continuous measure of the effect on performance of the aircraft to accompany our measurements, something that was not developed for the data set used as the basis for Appendix O, so we can defend the preceding statement with performance data.) We therefore are concerned that adoption of these rules will lead to a false sense that they will protect against the icing hazard of freezing drizzle and freezing rain, when we have evidence that this will not be the case.
The substance of our argument is that the proposed envelopes for LWC vs. temperature and average drop size distributions mask the most adverse conditions that have been measured by combining them with conditions that pose only a minor hazard. The envelopes in the draft Appendix O focus on average properties of the supercooled drop size distribution and do not represent the important effects of variations from that average distribution, but those variations often lead to variations in ice roughness and in the locations of accretion. Certain forms of icing with very adverse distributed ice roughness from freezing drizzle can accrete in a few minutes and can quickly create significant drag and associated controllability problems for airplanes, even in cases where the visual appearance of this ice accumulation is not remarkable …
In our measurements, performance (as measured either by potential rate of climb or by increased drag on the airframe) exhibited no correlation with MVD, further leading us to question the usefulness of this measure of icing severity …
Post-accident forensic weather analyses of icing-related accidents by scientists specializing in these phenomena support the occurrence of the icing conditions that we assert are not accounted for in the draft of Appendix O, and those analyses have pointed to the likely involvement of a particular type of freezing drizzle in the accident record of various airplanes. These conditions tend to produce ice features having distributed roughness that do not have significant thickness or mass …
We suggest that additional steps to address these problems and guard against the most serious icing hazards are needed before new envelopes are inserted into the regulations. The proposed new regulations could delay efforts to address the problems raised in these comments and would lead to unnecessary effort to meet inadequate requirements.
The crux of the matter now rests with the FAA in the rulemaking process. Does the FAA proceed with the proposed Appendix C and Appendix O envelopes or revisit them? Given the pre-eminent stature of the commentators above, the FAA will have some important decisions to make. Ignoring the comments above is one option, but that course does nothing for the safety of aircrews and passengers flying in icing conditions.
The notion of supersonic airline flight keeps popping up, like a perennial weed. The latest concept comes from Airbus, which envisions of all things an eco-friendly supersonic jet that will fly 100 passengers at hypersonic speeds. The Airbus concept for such an airplane was revealed at the Paris Air Show, to great excitement among the aerospace cognoscenti. The flying public may take a different, more ho-hum view.
The grim legacy of the supersonic Anglo-French Concorde jet seems all but forgotten. Recall that Concorde was retired in late 2003, primarily because of the airplane’s range/payload limitations and its high operating cost. An Air France Concorde suffered a spectacular takeoff crash in 2000. The jet struck a piece of metal debris on the runway at Charles de Gaulle airport; the debris strike resulted in cut wires in the landing gear well and a punctured fuel tank. The airplane, on fire, crashed into a nearby hotel.
The accident was the last and grimmest of a long line of landing gear tire failures that punctured holes in fuel tanks. French investigators into the crash identified 57 incidents of Concorde experiencing deflated or blown tires. In 1979, an Air France Concorde on takeoff from Washington’s Dulles airport experienced punctured fuel tanks. The airplane’s magnesium wheels struck the runway, broke apart and hurled metal shards into the wing fuel tanks. With fuel dribbling from the punctured tanks, the airplane returned to Dulles. Passengers could see through the holes in the wing to the ground below.
With longer takeoff runs, higher speeds and stressed tires, the Concorde was 60 times more liable that the subsonic A340 jetliner to a tire burst. The comparison is apt, as both the A340 and the Concorde are four-engine airliners.
The energy from a burst tire is equivalent to approximately 4-5 sticks of dynamite. Yet, to save weight on the Concorde, electrical and hydraulic lines in the main landing gear receptacle were not shielded. Despite easily-punctured metal skin (about the thickness of a piece of cardboard backing a pad of paper), the fuel tanks were not protected with self-sealing rubber.
In service from 1976 to 2003, Concorde was built to a lower safety standard than subsonic airliners; will ZEHST repeat this legacy?
Why were such practices tolerated? Because Concorde was not certificated to the same standard as subsonic airliners. Every ounce of weight that could be pared from the airframe was critical if the Concorde was to haul 100 trans-Atlantic passengers and their luggage. Thus, instead of being designed to the 1-in-a-billion standard against catastrophic failure, Concorde was designed to a lesser standard. About 10 times lower, as a matter of fact. The waivers, deviations and special provisions necessary to yield an airplane with acceptable weight meant that passengers were flying in an airplane where the risks of failure were greater. The fatal crash occurred at approximately 75,000 flights – far less than a million, much less a billion flights.
Concorde was never an economic success. The airlines could not afford to buy it, so the Anglo-French consortium that built Concorde basically gave the airplanes to Air France and British Airways. To fly supersonically across the Atlantic, Concorde burned a ton of fuel per passenger. A subsonic airliner consumes about a quarter-ton of fuel for the same distance.
Sometimes, the Concorde’s need for sufficient fuel was so great that the passengers’ luggage made the trip across the Atlantic in a subsonic jet.
Aircraft manufacturers Boeing and Lockheed toyed with supersonic airliner designs, but the operating costs and the environmental and noise challenges proved insurmountable. Their designs never progressed beyond full-scale mockups.
Enter Airbus; at a briefing a day before the 20 June opening of the Paris Air Show the manufacturer’s executives presented their vision. Jean Botti, the manufacturer’s head of technology, said the project’s success depends on cost containment and whether or not buyers for the plane can be found.
On both counts, the effort seems doomed.
The Airbus concept is known by the acronym ZEHST, for Zero Emission High Supersonic Transport. The airplane is envisioned to carry 100 passengers (like Concorde) while cruising at 2,600 mils per hour (faster by 1,000 mph than Concorde) at an altitude of 100,000 feet (twice as high as Concorde).
While Concorde was powered by four turbojet engines, the ZEHST concept features three separate types of power.
The ZEHST concept. Remember, the Space Shuttle was supposed to feature a shirt-sleeves environment for the crew and ended up with the crews wearing bulky pressure suits for launch and recovery
The airplane would climb to approximately 40,000 feet using turbofan engines, whose fuel would be derived from seaweed or algae (thus satisfying the environmental dictates). At 40,000 feet, ramjet engines would take over, powering the airplane to approximately 100,000 feet, where yet another set of engines would propel the airplane at four times the speed of sound (Mach 4).
The airplane would be geared towards business travelers, who supposedly could afford the cost of a ticket. That cost would be first class plus a premium. The question is how many business travelers would be willing to pay two, three, four or more times the cost of a subsonic first-class ticket for the privilege of arriving a few hours earlier.
Given the highly public demise of Concorde, ZEHST will have to be built to a 1-in-a-billion standard, which means no slipping around or sidestepping certification requirements. Those standards are independent of the cruising speed of the airplane.
To borrow a somber nautical term, ZEHST seems dead in the water.
Even now with the benefit of the flight recorders, French investigators seem quite flummoxed about the circumstances which led to the crash of Air France flight 447 in the South Atlantic on 1 June 2009. The answer to one question seems clear: Is the pilot training to combat automation anomalies and their inherent malfunction complexities adequate enough to prevent further disasters similar to AF 447? The answer appears to be – in a word – no.
The flight recorders were recovered from the wreckage in May of this year, ending repeated and frustrating searches.
A photo released by the BEA showing the plane's landing gear at a depth of some 12,000 feet
The digital flight data recorder and the cockpit voice recorder (DFDR/CVR) were flown to accident investigators at the Bureau d’Enquêtes et d’Analyses (BEA) in France. From the downloaded recordings and data, BEA produced an update of its investigation. This latest update follows two BEA interim reports of 2 July 2009 and 17 December 2009.
The cockpit voice recorder at the bottom of the Atlantic
The interim report of July 2009 clearly focused on the A330-200’s three Thales-manufactured pitot probes and how they feed speed information to the airplane’s computerized engine and flight control systems. It can be credibly argued that the pitot probes on the accident airplane became clogged with ice while flying high over the Atlantic on the journey from Rio de Janeiro to Paris. When the airplane flew into a broad front of clouds, ice crystals – or supercooled water which turns into ice on impact — rammed into the pitot probes and overpowered their electric heating. (See Aviation Safety Journal, August 2009, “Prompted by Crash, Airworthiness Directive Issued on Pitot Probes” and for replacement of the pitots see February 2011, “Significant Regulatory & Related Activity”)
With ice crystals clogging the pitot tubes, the aircraft computers “sensed” from these duff readings that the airplane was flying slower than it actually was. Auto-thrust quietly added power incrementally as supercooled ice crystals overcame the limited pitot-heating capabilities and ice gradually accumulated as a granular filter inside each pitot – clogging drain and tube equally. The pilots failed to notice the minor power additions or fuel flow increases, as it is common for pilots to manage the fuel management display’s synoptic screen, which focuses on fuel remaining, not on the flow rate.
The three pitots on the A330
A simplified schematic of a pitot tube blocked by ice
It is not difficult to imagine the scene in the cockpit if the airplane was being buffeted by a raging storm (although ice crystals can accumulate while cruising in relatively smooth Cirrostratus-type layer cloud, interspersed with a few bumps from embedded Cirrocumulus; it is not necessary to be embroiled in a localized thunderstorm for the pitot probes to be clogged by ice). At the altitude and speed the airplane was flying, it was near “coffin corner” or that top right-hand portion of the flight envelope where the speed-band between controlled and uncontrolled flight is inherently constricted. Long-haul airliners must fly at those heights for best range (e.g. air nautical miles per pound of fuel expended). If, as is suspected, the speed sensors were progressively feeding a false reading of lower than actual airspeed to the automation, the airplane could well have experienced a departure from controlled flight. Equally likely is that the size of the airspeed or trim discrepancy may have triggered an “air data disagree” as the air data inputs fell outside system parameters, causing an auto-pilot disconnect. Whatever the trigger, the unalerted auto-pilot disconnect began the mayhem for AF 447.
From the latest BEA update, this situation appears to be the case.
The captain, Marc DuBois, was on a rest break and not in the cockpit. The first officer, Pierre-Cédric Bonin, and the relief first officer, David Robert, were at the controls. One of them contacted the cabin staff on the intercom and advised that the airplane might experience some turbulence: “In two minutes we should enter an area where it’ll move about a bit more than at the moment…” His reassuring communication did not convey the drama of the situation in the night sky before him. The airplane was using its weather radar to weave a course between the tops of thunderstorms containing black, electrically charged clouds which were roiling up to 41,000 feet at 100 miles per hour – typical seasonal weather for the oceanic InterTropic Convergence Zone (ITCZ).
As the airplane flew into turbulence, the auto-thrust and auto-pilot disengaged. The pilot flying (PF), Bonin, said, “I have the controls.” He applied a nose-up input and the stall warning sounded.
The pilot not flying (PNF), Robert, said, “So, we’ve lost the speeds” and then remarked “alternate law”. [In alternate or direct law, the computerized angle-of-attack protections are no longer available; thus, whatever pitch, yaw and roll inputs the pilot commands will be executed by the fly-by-wire system.]
Pitch attitude increased beyond 10º, and the pilot flying made nose-down and left/right roll inputs. The airplane climbed from its planned cruising altitude of 35,000 feet to 38,000 feet; pitch attitude increased to 16º.
The captain re-entered the cockpit to help trouble shoot the situation. The BEA update report stated, “During the following seconds, all of the recorded speeds became invalid and the stall warning stopped.”
With a nose-up pitch, the airplane began a plummet of 10,000 feet per minute to the inky dark ocean below. The airplane rolled left and right up to 40º and engine power was reduced to idle.
The BEA put a positive spin on the frightening scenario: “The engines were operating and always responded to crew commands.”
All 228 people aboard were killed when the jet pancaked into the water at an unsurvivable high rate of descent but, quite extraordinarily, with a forward speed of only 107 knots.
3: The airplane made a slight turn to the left to avoid clouds and turbulence; 4: Auto-pilot and auto-thrust disengaged; 5: Stall warning was triggered again; 6: Captain entered the cockpit
Despite the benefit of the DFDR/CVR data, the 4-page BEA update is scant on analysis.
Presented below are the thoughts of John Sampson, a retired Royal Australian Air Force pilot. His thoughts are easily the most profound on this accident:
BEA report: “The stall warning sounded twice in a row. The recorded parameters show a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS)”.
Sampson: The fall off in speed is to be expected in a total pitot clog. The DFDR was of course recording exactly what the pilots were seeing but meanwhile the aircraft’s auto-thrust had actually been increasing power to maintain the programmed speed. The programmed speed was actually exceeded by a considerable margin, as a result of the gradual ice-crystal blockage in the pitot tubes. Speed was headed towards critical Mach [airliners are not designed to fly near critical Mach; at this speed shock waves are sufficient to stall the wing and massively increase drag; from the location of the shock wave on the airfoil, there is laminar flow forward and boundary layer separation aft].
What triggered the auto-pilot disconnect? Was it the critical Mach encounter or was it that the auto-pilot could not hold the increasing elevator force of a system-driven (by an invalid low indicated airspeed) trimmable horizontal stabilizer (THS)? Or, was the auto-pilot disconnect caused by the sudden clog of the pitots and the erroneous speed readings causing an “air data disagree”?
BEA report: “At 2 hr 10 min 51 sec the stall warning was triggered again. The thrust levers were positioned in the TO/GA [take off/go around] detent and the PF maintained nose-up inputs. The recorded angle-of-attack, of around 6º at the triggering of the stall warning, continued to increase. The [THS] passed from 3 to 13º nose-up in about 1 minute and remained in the latter position until the end of the flight.”
Sampson: Over time, as the pilots cruised in the cloud’s ice crystals, the pitot heating was overpowered – a known anomaly for that particular model of pitot. The gradually clogging pitot system resulted in the auto-thrust incrementally applying power to stop the “apparent” speed decay. Similarly, the auto-trim maintained the nose-up trim for that programmed speed – and the auto-pilot offset the elevator trim to hold height – as the aircraft was actually flying faster than shown. When the design pitch-holding limit was reached (i.e. the maximum nose-down force gradient the auto-pilot could hold), the auto-pilot gave up, and the handling pilot had an instant unalerted surprise handful of an aircraft in Alternate Law (or perhaps Direct Law) with nearly full nose-up trim and near to full power. It is not clear from the BEA update if the DFDR faithfully recorded the precise dangerous sequence of arcane events that resulted in a surprised pilot (and the inevitable “startle” reflex). Or did the BEA just conveniently conclude the aircraft’s pitch-up Direct Law behavior had resulted from an aberrant aft side-stick input by the pilot?
When it comes to high speed protection, under the Airbus philosophy, should a flight crew attain an attitude likely to exceed (or undershoot) a design flight envelope speed, they will attract an automatic pitch to a “safe” altitude, and the airplane will try to maintain minimum maneuvering speed plus a few knots. It should be noted that the pilots decided to reduce speed – due to expected turbulence – only two minutes earlier.
Therefore, it is not unusual, following the auto-pilot and auto-thrust disconnect, for the PF to instinctively add TOGA power (a standardized response known as a Standard Operating Procedure). That power addition induced pitch-up, reinforced by the nose-up trim, initiating the unintentional “zoom” of 3,000 feet. It should be noted that the true airspeed (TAS) at cruise height is twice that at sea-level. The effect of this “doubling” is an apparent increase in aircraft inertia and a seemingly quite disproportionate response to a minor pitch attitude change.
RVSM (Reduced Vertical Separation Minima) only became possible a few years ago with the same sort of precision in avionics and barometric altitude maintenance that permitted a business jet and a B737 on the same airway to collide head-on over the Brazilian jungle in September 2006. (See Aviation Safety Journal, January 2009, “Complacency & Computer Perversity Lead to Brazilian Mid-Air Collision”) Until RVSM became technically (although not humanly) possible, the likelihood of large altitude “excursions” (even on auto-pilot) was high enough to predicate a 2,000 foot height separation between cruising aircraft (i.e. a prior separation standard of twice that now allowed under RVSM).
To a pilot not used to hand-flying at high altitude, it would be quite easy to be caught out by this TAS and pitch-up phenomenon and inadvertently gain a few thousand feet while distracted. Additionally, there is the “handling novelty” stemming from nil exposure in training to manual flight at high altitude. Moreover, the non-moving (detented) Airbus throttles mean that urgent power is more easily attained by selecting TOGA. Therefore, the combination of too much power, a nose-up trim at disconnect and the TAS/inertia phenomenon took them up to a ballistic stall at an attitude and height they should never have reached at their weight – let alone at stall speed. A much safer SOP would dictate a deliberate Flight Idle unpowered descent entry at a mild 10º of nose-down pitch (i.e. a safe instant “departure” from coffin corner).
These may only be speculative considerations, based upon a knowledge of the factors involved, but they are likely to be supported by analysis. One cannot fill a cockpit suddenly with failed instruments, alerts and alarms, and expect relatively inexperienced and bewildered pilots to confidently assume precise manual flight at high altitude. The Federal Aviation Agency (FAA) has ongoing concerns about pilot proficiency at high altitude, as evidenced by an advisory circular (AC 61-107A) about this very subject; a PowerPoint slide presentation in an appendix to the AC provides information relevant to the case of AF 447.
From the FAA's high altitude upset recovery, guidance for pilots; for the full PowerPoint, go to www.tinyurl.com/64bc346
We can theorize that they were actually at an initially higher airspeed than indicated – although this would not have been recorded by the DFDR. However, the engines’ parameters were recorded and the aircraft’s weight is known, so an interpolation of the speed to within a few knots of actual speed should be possible. After the pilots’ involuntary zoom climb (perhaps due to the trim state at auto-pilot disconnect), the static pressure changes in the pitots would have had a considerable additive effect on the blocked pitots’ trapped pressure and thus the displayed airspeed. This further confusing effect is intimated by the BEA report: “The speed displayed on the left side increased sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the recorded angle-of-attack was around 4º”.
BEA report: “The angle-of-attack exceeded 40º”.
Sampson: The pilots would not have known the angle-of-attack, as there is no such display to them of it. The angle-of-attack vane sits in the relative airflow and directly advises stick-shaker, stall warning, and fly-by-wire protective systems of any incipient exceedance. However, like a wind vane atop a chimney, once the relative wind-speed drops off, the angle-of-attack vane can weathercock uselessly. In the A330, its contribution cuts out at 60 knots. It has been argued that this is necessary to cover the takeoff case; however, a weight on wheels switch would normally inhibit false low speed warnings in such systems. The fact that the angle-of-attack system is not “there” at very low speeds and very high (>30º) angles of attack would be fatally pertinent to what happened later as AF 447 passed 10,000 feet in its deep-stall condition.
By the time the airplane reached the apex of the ensuing pitch up and following the auto-thrust/auto-pilot disconnect, it was actually on a ballistic trajectory and entering into a deep stall with a forward speed of approximately 60 kt and a high angle-of-attack –ultimately resulting in the 10,000 ft per minute rate of descent at a sustained high angle-of-attack – reportedly an astounding 40º (most airfoils stall at just over 16º angle-of-attack). The pilots had initially responded correctly to the stall warning with TOGA power. But, because of the underslung engines, did that coupling also contribute to their pitch-up moment? Sometimes, if you don’t concentrate solely upon flying the airplane in such dynamic situations, it will just “fly you”.
However, the validity of that initial pilot response was soon to change. Why? This is where the startle factor and the understandable inability to identify and interpret Airbus flight control mode changes cuts in.
In Direct (or plausibly even Abnormal) Law, which they should now have been in, holding the side-stick back will maintain the stall. The PF might have persisted in holding back-stick to attain/maintain level flight – in the confusion of the situation (with its alerts and alarms), perhaps quite unaware of the airplane’s height gain into even more rarified air. If the fly-by-wire software was now in Direct Law, “kid gloves” for control inputs would have been required.
Why shift the throttles from TOGA thrust to idle? There is a possible clue; in the subsequent descent with static pressure increasing and the pitots still blocked, even though the airplane was actually stalled (complete with stick-shaker) the indicated airspeed could be rising alarmingly – courtesy of increasing static pressure. I have personally experienced this with frozen trapped water in the static lines (i.e. the opposite effect of trapped dynamic pressure). There is a report from the Irish Accident Board about a B747 on a test flight with uncapped static lines due to a maintenance error. It is an elucidating gaelic tale that shows just how confusing the compromised pitot-static scenario can be. Ask any instrument technician how much a 1,000 feet of altitude change is worth in terms of “displayed knots”. He’ll demonstrate this for you on his test bench. An airspeed indicator will wind down from 250 knots to zero over a 3,400-foot climb band – and do the opposite on descent. This phenomenon all depends upon whether the pitot ports were blocked and the pitot drain holes were not.
The other possibility is that the captain, upon re-entering the cockpit, saw a high descent rate, inappropriate airspeed and TOGA power and misinterpreted what he saw as a gyrating loss of control and selected idle thrust (after all, there was no stall warning or stickshaker at this point, because they were, angle-of-attack wise, well above the regime where the angle-of-attack vane functioned). How could the captain know at night that they were stalled? The only clue, of a nose-high attitude, was missing. The captain might not have been able to see what the PF was doing with his side-stick control. Courtesy of the trimmable tailplane, stuck at 13º nose-up (but not advertising its status), AF 447 was now descending rapidly, but in a quite normal flight attitude.
As somebody said, “All this will probably come down to crew composition, very high workload, in adverse weather conditions, having to manually hand-fly an aircraft which suddenly found itself in alternate law at high altitude due to spurious information being fed to not only the flight displays, but also to the flight control guidance computers simultaneously”.
Suddenly? Do not underestimate the power of surprise.
Spurious information? When you are taught to believe your instruments, that is what you react and respond to. You see a high and increasing airspeed and you apply back-stick in an attempt to control it. You idle the throttles for the same reason.
The effect, unbeknownst to the pilots, was to embed themselves in a deep-stall condition. Will the stall warning simply cease once the airplane is embedded in a deep stall at 40º angle-of-attack? That is my guess. From the limited dialogue on the CVR, it is evident they were nonplussed by developments. Even the captain was struck dumb by what he saw. No solution was apparent in the time available. The airspeed could have been seen to be much more than just “adequate” (perhaps even high, and higher as static pressure increased inexorably on descent), so how could they be stalled? Unthinkable, so it wasn’t even considered? They just ran out of ideas in a very distracting and dynamic circumstance for which they had never been trained.
Someone also said, “You are not only dealing with conflicting airspeed information. You are also presented with multiple spurious ECAM [Electronic Caution Alert Module, or the Master Warning Display] warnings and cautions – many of which are irrelevant, yet are persistent and therefore impossible to ignore; also depending on the Alternate Law protection loss, which would mean direct side-stick to flight control input without any load protection, leading to control overload.” Isn’t automation wonderful? Only when it works.
A pitot-static system’s pneumatic airspeed data output relies wholly upon very accurate dynamic pressure and static (i.e. ambient atmospheric) pressure inputs – and the latter changes rapidly during a descent at 10,000 feet per minute. No digitizing the source of that information; it is all air pressure analogue. Falsify either one (via blockage or leak) and zoom up or descend and the story will be ever more confusing to the pilots. The totally bewildered pilots in the fatal crashes of the Birgenair and Air Peru B757s found that to be the case.
In the case of AF 447, a frozen static pressure can mean the airspeed will wind back from 250 knots to zero over as little as 3,400 ft of climb at 250 knots indicated airspeed. BEA investigators may be assuming that the zoom was the result of pilot input and not an aerodynamic pitch-up as a result of possibly hitting critical Mach with auto-pilot disconnect and a very nose-down trimmed horizontal stabilizer (3º nose-up, increasing to 13º nose-up due to the pilot’s aft side-stick inputs after the top of zoom climb). Do I think they hit critical Mach? No; more likely was the excessive elevator force gradient that kicked out the auto-pilot and kick-started the fatal zoom sequence. Perhaps the answer will be evident from the DFDR, but maybe not, as the DFDR was being fed erroneous speed information.
A pilot said of the AF 447 crash, “Direct Law is there to give the pilot more direct control of the aircraft but it still has some protection to offer. BUT the protection on offer is only as good and accurate as the information provided to the computers involved. Much more information is needed before one can create a valid picture of what went wrong when it comes to the decisions the pilots made in the last few minutes of the flight.” However, the change in static pressure resulting from the zoom into ever more rarified air and the instinctive attempt to maintain level flight and use backstick to reduce the possibly ever higher displayed airspeed indicated during the ensuing descent after zoom climb are key factors dictating an inevitable entry into the unrecognized deep-stall condition. Add the dearth of information the pilots had to work with, little prior exposure to degraded flight control laws, at night and hurtling into the turbulent clouds below, and the makings of disaster are evident.
BEA report: “The airplane’s pitch attitude increased progressively beyond 10º and the plane started to climb. The PF made nose-down control inputs and alternately left and right roll inputs.”
Sampson: Perhaps the left and right roll inputs were the PF’s insufficient attempts to get the nose to drop. When you’ve got a stuck elevator, or an aircraft pitching up of its own volition due to a runaway elevator pitch-trim, roll the beast onto its wingtip to get the nose to drop. Pity the pilots didn’t think of that, or were trained to think of that, during the January 2003 Beech 1900 stuck elevator take-off accident at Charlotte, NC (52º nose-up at 1,200 feet above the ground). The PF’s nose-down control inputs? They would have been his opposition to the pitch-up of trim and power.
According to the BEA’s interim report, the horizontal stabilizer moved from 3º to 13º, almost the maximum. In doing so, it forced the airplane into an increasingly steep climb. The airplane “remained in the latter position [i.e. 13º nose-up] until the end of the flight,” the report notes.
As pointed out earlier, with underslung engines, maximum thrust can result in an aircraft’s nose rising on its own, exacerbating any incipient control difficulty. Manufacturers have recognized this pitch-up phenomenon. In a 12 May 2010 post-crash Flight Operations Telex, Airbus quietly removed the maximum thrust instruction from its flight manuals (for loss of control and stall scenarios).
An explanation for the A330’s rising nose could also be provided by that innocuous line in the BEA report referring to the trimmable horizontal stabilizer (THS). If the THS had trimmed itself to 13º nose-up prior to the auto-pilot disconnect, as a result of perceived slowing, it would have boosted the pitch-up effect of the pilot’s TOGA power input. The timing of this THS change should be clearer on the DFDR readout.
Gerhard Hüttig, a professor at the Institute of Aeronautics and Astronautics at the Technical University in Berlin, considers the high angle of the THS to be a failure of the Airbus’ electronic flight control system. Hüttig, a former Airbus pilot himself, calls it “a programming error with fatal consequences.” The THS, and not the side-stick controlled elevators, has the real pitch authority at low speeds.
“No matter how hard the crew tried to push down the nose of the aircraft, they would have had no chance,” Hüttig maintains. He is demanding that the entire fleet of Airbus A330’s be grounded until the phenomenon is adequately explained. The PF was never aware of that 13º nose-up THS (or he might have manually trimmed it out – yet another completely unnatural input for a fly-by-wire Airbus pilot). There was nothing to stimulate any awareness of the extreme position of the THS. Hüttig pointed out that Airbus published a detailed explanation of the correct pilot behavior in the event of a stall in the January 2010 issue of its internal safety magazine. “And there, all of a sudden, they mention manually trimming the stabilizers,” he recounts. A November 2008 crash of an XL Airways A320 had served to alert Airbus to the hazards of a “stuck” (i.e. non auto-trimming) THS in preventing stall recovery.
In the stall, would there have been any tell-tale buffeting? In a word, no. The buffet in a level entry 1G stall is provided by the disturbed airflow over the wing hitting the tailplane. At the BEA’s stated 40º angle-of-attack, the disturbed airflow would not have impinged on the tailplane. Everybody aboard was going down in an express elevator at around that self-same 40º angle that was being presented to the relative airflow. Thus, airflow and airframe buffet would not have been a player, alerting the pilots to their airplane’s stalled condition. Indeed, the interior was probably quieter than the ambient noise in cruise, even with the engines at TOGA power.
By design, in Direct or Abnormal Law, there is no auto-trim (it disconnected after reaching 30º angle-of-attack, leaving the THS stuck at 13º nose-up), no ALPHA FLOOR PROT or ALPHA max (i.e. no maximum selectable angle-of-attack), so the aircraft can be stalled in extremis. I daresay this is a consideration that is alien – even bogus, anathema or heretic – to most Airbus pilots.
AF447’s stall occurred probably in a regime beyond the imagination of Airbus designers or test pilots, at the apex of a ballistic zoom climb with a lot of power set on the throttles, at or above the ceiling for the airplane’s weight. A design in which blockage of the pitots not only loses airspeed data but also (because the system believes speed is less than 60 knots, regardless of the truth of the matter) disables the stall warning? Well, prima facie, it seems at least “unwise” – and may have been conclusive.
Much is inconclusive, but one fact ultimately killed the pilots’ last chance of recovering the aircraft. It is very ironic that it was likely due to one of the systems meant to have saved them. The BEA report states, “At 2 h 12 min 02, the PF said, ‘we have no valid indications’. At that moment, the thrust levers were in the IDLE detent and the engines’ fan speed was at approximately 55%. Around 15 seconds later, the PF made pitch-down inputs. In the following moments, the angle-of-attack decreased, the speeds became valid again and the stall warning sounded again.”
At the sudden sound of the stall warning, the PF was likely deterred from any further initiatives, even though he was on the right track with his pitch-down inputs. Instead, he promptly handed over the controls to his more senior PNF. A stall warning that sounds off as the airplane exits a deep-stall condition? Not a great idea at all; it is likely to have the opposite of the desired effect. The overwrought pilot might easily assume that his action is initiating a stall. A much safer, and saner, proposition would be a Doppler-based stall warning whose pitch and volume varies, dependent upon the degree to which the airplane is embedded in the stall. Military fighter aircraft have had such aural calibrated stall warnings for years.
Having read through all of the above, whether it is precisely accurate or just roughly right, one has to ask, “Is the training to combat automation anomalies and their inherent malfunction complexities adequate?” Note how quickly the situation described above can become completely and incomprehensibly unglued. The AF 447 crew was caught out by a little known pneumatics phenomenon and reacted understandably to what they saw. They died clueless as to their actual predicament. The pilots are blameless. As one of them said, “We have no valid indications”.
His futile statement was correct. Man can easily be defeated by automation unwinding haphazardly, and it is a burgeoning problem, especially in this era of decreasing pilot experience and economically abbreviated training.
The captain of an A330-200 endorsed Sampson’s analysis:
“That scenario is horribly plausible. That it was erudite and technically accurate certainly add validity. As a current A330-200 pilot, I can envisage just such a sequence and can now perhaps understand the confusion and fear that must have reigned.”
This encomium notwithstanding, it seems that pilots need to be trained in scenarios where automation failures combine to yield an instant crop of false instrument displays and alerts sprinkled with few clues – and they must cope successfully. To be sure, this will cost the industry in pilot down time, classroom and simulator sessions, flight manual upgrades, and so forth. Adjustments must be made when automation confuses rather than enlightens the pilots’ attempts to resolve deviant and seemingly irrational aircraft behavior.
A post script:
As early as 2005, the pitot tube manufacturer, Thales, was well aware of the catastrophic consequences of the speed sensors. At the time, the French company concluded that such a failure could “cause plane crashes.”
A total of 32 cases is known in which A330/A340 aircrews got into difficulties because the speed sensors failed. In all 32 cases, Thales pitot sensors were involved. These particular sensors were significantly more prone to failure than a more sophisticated later model produced by American manufacturer B.F. Goodrich.
Yet none of the responsible parties saw any urgency in the dilemma. In 2007, Airbus “recommended” that the Thales sensors be replaced. Air France relied upon that underwhelming recommendation as a justification for not carrying out the modification – and had this course signed off as approved by the regulator. The regulator, the European Aviation Safety Agency (EASA), wrote back to Air France that it identified “no unsafe condition that warrants a mandatory modification of the Thales pitot tubes.”
This indemnifying letter was sent on 30 March 2009, almost two months to the day before AF 447’s demise ushered in a new level of distrust in airliner automation. “Mistrust” would suggest vague doubts. “Distrust” is rather more emphatic, suggesting positive suspicions and even a complete lack of trust. Mistrust was the status quo ante. As evidenced by numerous pilot comments, distrust is now in force.