Wake-Up Call

University of Southern California engineering professor and aviation safety expert Najmedin Meshkati’s summation of cockpit automation has a sobering ring as the aviation industry comes to grips with the interim accident reports of Air France flight 447, the Airbus A330-200 that crashed into the Atlantic Ocean on June 1, 2009, killing all 228 people onboard.

The latest interim report, issued by the French BEA in late June, prompted particular focus on cockpit automation and flight crew interface after detailed analysis of the cockpit voice and flight data recorders that were recovered earlier this year. The report, though emphasizing that BEA does not assess blame, indicated that the pilots were inadequately trained and failed to properly identify a stall situation or react promptly to it. While BEA reiterated that a key factor in the crash was the inconsistent speed measurements from the aircraft’s pitot probes, once an emergency situation arose and the autopilot disengaged, the two on-duty copilots conducteed “no explicit task-sharing,” BEA said. Even though a stall warning alarm was triggered, “neither of the pilots made any reference to the stall warning” and “neither of the pilots formally identified the stall situation,” BEA stated. At one point, it noted, the stall warning “was triggered continuously for 54 seconds.”

BEA recommended that “regulatory authorities re-examine the content of [air transport pilot] training and check programs, and in particular make mandatory the creation of regular specific exercises aimed at manual airplane handling [including] approach to and recovery from stall, including at high altitude.”

So while the investigation and the debate on pilot-cockpit interface and appropriate training continue, there is a new focus on how automation has changed flight crew training procedures.

 Meshkati warns that the aviation industry and its regulators have become “star struck by technological solutions” as a result of modern aircraft like the Boeing 777 having fatality-free records in commercial service.

“We have become complacent by thinking that technology will solve all the problems,” Meshkati said. In an ATWarticle Back to Basics (ATW, 6/09, p. 51), published just three days before the loss of AF447, Meshkati warned that gee-whizz technology “may be masking a deterioration and de-skilling in basic flying ability and that the lessons learned by generations of pilots may be lost to the new breed of pilots.”

Meshkati sees AF447 as the aviation industry’s Three Mile Island. “Business as usual is over,” he said, adding that many regulators do not yet fully understand the problem of technology, automation and the pilot interface, and are lagging industry because of manpower and funding issues.

Meshkati, a member of the committee that analyzed the BP Deepwater Horizon oil disaster off the US Gulf Coast, notes that “human ingenuity can now create technological systems whose accidents rival in their effects the greatest natural disasters, sometimes with even higher death tolls and greater environmental damage.”

“The effects of human error on these systems is often neither observable nor reversible, therefore error recovery is often too late or impossible,” Meshkati said.

Meshkati says the aviation industry must go back to basics and rethink how pilots interface with and are trained for the modern cockpit. “Many technology systems failures implicated in serious accidents have been traditionally attributed to operators and their errors. Consequently, for the problem of technology systems safety, an engineering solution has been suggested. For instance, many systems designers postulate that removing humans from the loop is the most convenient alternative for the reduction or even elimination of human error and therefore consider automation the key to the enhancement of system reliability.”

When automation is the problem

But Meshkati warns that in many cases, automation only aggravates the situation and becomes part of the problem rather than the solution. “In the context of aviation, studies have shown that automation is even more problematic because it amplifies crew individual differences and it amplifies what is good and what is bad. Furthermore, the automated devices themselves still need to be operated and monitored by the very human whose caprice they were designed to avoid. Thus the error is not eliminated but only relocated.”

Flight Safety Foundation president Bill Voss agrees that AF447 was a wake-up call. “If AF447 had happened elsewhere in the third world to a lesser airline, the industry might have glossed over it. But Air France is a sophisticated and proud airline, the A330 a state-of-the-art aircraft flying between two major cities. We really have to step forward now for the cause is far, far deeper and we must build the skills. It is time fix it,” Voss said.

Voss sees the problem as a failure to adjust training to the real demands linked to a gap that is filled by incomplete information and assumptions. “Pilots think that they can get into a high speed situation as easily as you could in the 707 and that is absolutely not the case. Aircraft are totally different aerodynamically today,” he said.

Voss also notes that while the standard stall recovery procedure is to increase power and put the nose down, it is also true for an Airbus that half stick back and takeoff-go around power will recover the aircraft because of the envelope protection.“The aircraft will do remarkable things,” he explains.

Voss, who spent time at Airbus in the A330 simulator after BEA’s interim report was published, said that what is lost in the transcripts of the accident is “how hard it is to get the aircraft into the position that the AF pilots did and then hold it there.

“You have to really strive to do what these pilots did. The initial pull-up was 7,000 ft. a minute—this wasn’t minor.”

Voss sees another training aspect that needs close attention. “It’s just not the training for that can be overridden by the person they sit next to on the line within a few months. Training doesn’t make a seasoned captain; other captains do,” Voss said. “We need to put procedures and processes in place so that it isn’t de-graded on the line.”

Voss notes that with reduced vertical separation minima at 1,000-ft. separation means that pilots are not allowed to hand-fly an aircraft over 24,000 ft. “Skills are being lost. We must go back and look at our training, for it is not consistent real world circumstances. There is a much higher risk of loss of performance at high altitude or degraded performance, like on QF32, than engine failures,” Voss said. “And regulators need to give up some of the sacred cows—which they are reluctant to do.”

Lessons of QF32

Qantas Airbus A380 check captain David Evans was on the flight deck training another check captain when QF32, an A380,  suffered a failure of its No. 2 engine shortly after takeoff from Singapore Nov. 4.

According to Evans, the near disaster with QF32 raised a number of scenarios that the airline had not trained for, such as cabin communication. Events after landing were potentially almost as serious as those in the air.

After QF32 was nursed back to Singapore nearly two hours into the flight and with the crew dealing with 53 electronic centralized aircraft monitor (ECAM) messages, the No. 1 engine could not be shut down because of damaged wiring and had to be drowned on the ground by the Singapore Airport fire fighters. At the same time, fuel was spewing from the damaged wing only yards away from brakes that were red hot indicating 900˚C. Complicating matters, the air conditioning failed and the aircraft electrical system reversed to essential power, leaving the crew with one serviceable VHF radio.

“We had never trained for this scenario,” Evans said. “We also had our cabin crew on high alert for two hours in the cabin ready to initiate a full evacuation if circumstances deteriorated.”

Commenting on recurrent training set by the regulator, Evans notes that he cannot remember any Qantas aircraft ever losing an engine at V1. “But training is now changing to take in black swan [unusual upset] events.”

Reflecting on his QF32 experience compared to AF447, Evans notes that the Qantas crew of five, with 70,000 hours of experience including two check captains, had time to deal with the 53 ECAM messages. “We had time, but AF447 was descending at 8,000 ft. a minute.”

Evans said that the sheer volume of information presented to the modern aviator means he must prioritize his or her time between the presented information and the “real world.”

“Modern technology is inherently very reliable. However, its very reliable nature can lure an unsuspecting aviator into a false sense of security. Adding blind faith into this information stream, especially if you are a Gen X or Y can have catastrophic results.

“AF447 may be an example of this. Two young pilots were at the controls of a state-of-the-art aircraft and faced with a loud and in-your-face false warning of an overspeed. This would have taken all their attention and was therefore reacted to. There were other cues present that were not reacted to, simple things like aircraft attitude and thrust settings,” Evans said.

 “I see young pilots coming through Royal Australian Air Force air cadets that lack basic skills because they learned to fly using Flight Simulator,” Evans said. “With Flight Simulator most don’t buy the rudder pedals and thus their flying skills once they get into the real world are degraded.”

Evans also points out that many flying courses today only teach pilots about the onset of a stall. “When I learnt to fly my instructor took me into a stall and a spin and you experienced all the sensations and had to recover. We need to have aerobatics as part of the course,” he said.

Evans has also found that because many pilots learn on Flight Simulator on a desktop PC, they are focused only on what is in front of them, so “peripheral skills are lacking.”

Another observation by Evans relates to the modern glass cockpits that are appearing on light training aircraft. “When I am training young pilots, they are often transfixed on the primary flight display and do not scan other instruments such as the engine. They just don’t look around.”

This strikes a chord with captain Robert Sumwalt, a former chairman of the human factors and training group at Air Line Pilots Association, International, and now a board member of the NTSB.

“The NTSB has found that lack of monitoring of instruments is still a major factor in accidents,” Sumwalt said.

In 2002, Sumwalt co-authored a paper Enhancing Flight-crew Monitoring Skills Can Increase Flight Safety, which found that “effective crew monitoring and cross-checking can literally be the last line of defense.”

At the time Sumwalt cited NTSB’s examination of 37 accidents, which found that 84% involved inadequate crew monitoring or challenging.

Sumwalt added in the report that research conducted to support the Flight Safety Foundation’s approach and landing accident (ALA) reduction efforts revealed that 63% of the reviewed ALA accidents involved inadequate monitoring and cross-checking.

Additionally, inadequate monitoring was a factor in 50% of the controlled flight into terrain accidents reviewed by ICAO.

The BEA AF447 report said that the pilots were confused by multiple warnings in the cockpit and chief investigator, Jean-Paul Troadec, said black box data showed the crew had 4.5 minutes during which they could have corrected the aircraft stall, and that if they had responded quickly, the “situation was salvageable”.

Evans notes that ECAM warnings can be confusing, but says pilots can cancel everything and simply go to the status page. “There is a short cut,” he said. “I did a simulator session recently involving volcanic ash taking out all four A380 engines and getting into the cabin, like BA9. Fire warnings went off in the cargo hold and cabin, but ECAM logic puts fire ahead of the engines. We of course knew there was no fire, but I had to get rid of six fire warnings before I could get to the engines which were the priority. ECAM wasn’t helping and added to the confusion. It taught us some lessons.”

While there is strong debate over the AF447 interim reports, it seems clear that there was a level of confusion as to what was happening in the cockpit in those last minutes, which corresponds with a NASA study on aviation automation.

The NASA Research Center was based on Royal Air Force Institute of Aviation Medicine data by Marianne Rudisill in 1995 that surveyed more than 1,000 pilots from 20 airlines and aircraft manufacturers about pilots’ attitudes and experience with flight deck automation.

The strength of the study was that most respondents had flown aircraft from basic cockpit types like 727s through to glass 2 types such as A320s and 747-400s. It found the general consensus was that “safety is increased with automation, but automation may lend a false sense of security, particularly with inexperienced pilots.”

Pilots reported that there was a higher sense of “insecurity” during an automation failure and a general temptation to ignore raw information. The most worrying aspect was that pilots said their colleagues were “becoming complacent and relied too much on the automation but that was often because airline standard operating procedures mandated reliance on automation.”

In May, FAA Supplemental Notice of Proposed Rulemaking called for greater emphasis on using full-motion flight simulators with crews working together in handling real-world emergencies in its.

FAA administrator Randy Babbitt said the proposal represents the most significant shift in philosophy and training in 20 years.

 “The new rule will require flight crews to demonstrate they can apply the skills, not just master them,” Babbitt said.

The key aspect of the change is that all flight crews will receive training in recognizing, avoiding and recovering from stalls and upsets.

“This new type of training will provide a more robust evaluation of pilots in [simulated] real-life scenarios,” Babbitt said.

The proposal came after the NTSB investigation and a congressional inquiry into the February 2009 stall of a Colgan Air flight 3407, a Bombardier Q400, that crashed in Buffalo, N.Y., and killed 50.

Babbitt said the pilot training emphasis will shift to focus more on comprehensive competence rather than mastery of “individual” skills. “The new training will require a more realistic and coordinated effort among the crew [being trained]. It will be a lot more like flight.

“I think the key piece here is that some of the simulation ability [now available] allows us to go past [training for] recognition and avoidance of a stall. Now you can actually put someone in a stall scenario and let them recover,” Babbitt said.

The proposed change would require that pilots be trained as a complete flight crew, coordinate their actions through crew resource management and fly scenarios based on actual events.

BEA, meanwhile, has set up a human factors working group to analyze “crew actions and reactions during the last three phases of AF 447, particularly in relation to the stall warning, cockpit ergonomics, and man-machine interface.” The human factors group comprises three BEA investigators specializing in human factors, a human factors aviation consultant, a psychiatrist specializing in risk analysis, an A330 test pilot and a type-rated A330 pilot. It will also consult with Airbus and Air France.

Evidence-based training 

In 2007, IATA launched its training and qualification initiative to update and modernize the training of current and future pilots and engineers to accurately reflect the needs of flight deck operational procedures. 

IATA, airlines and manufacturers are working closely and in collaboration with ICAO, and the final draft program is expected to be ready for sign-off by ICAO in November and to be applicable from 2012.

Civil Aviation Authority of Australia’s manager, flying standards, Roger Weeks, who is CASA’s representative on the TQI initiative, says the group has examined a host of data over the past four years, both accident and operational, to identify precise trends and problems with all generations of aircraft so that training can be tailored to changing demands and issues.

“For instance we have studied flight data for over 3 million flights, examined the NTSB database from 1962 and examined 22 aircraft types and looked at over 20,000 simulation evaluations,” Weeks said.

“A major test had been to identify criticalities in each generation of airliner.” The program is looking at the following areas for pilot training: Flight operations; Evidence based training; Instructor qualification; Multi-crew pilot license; Selection criteria; Flight simulation training devices.

However, Weeks cautions that it will be up to individual states to adopt the new training regime.

Much of what is being canvassed was adopted in Australia 20 years ago under competency-based training, which puts the emphasis on performing rather than just knowing.

Weeks said that since QF32 and AF447, CASA and the Australian airlines have been working on training for moreblack swan events.