Saturday, February 14, 2015

Only a Fraction of TransAsia's Pilots Pass Post Crash Exam

In the wake of the crash of TransAsia GE-235, the airline tested all 68 of the pilots currently flying the ATR 72 aircraft at the recommendation of Taiwan's Civil Aeronautics Administration. Of those pilots given an oral examination, 39 passed, 10 failed and 19 others were grounded until they take the exam. All of the pilots will be given additional simulator training as well.

Foremost in any accident investigation is an effort to identify the primary cause of the accident and to suggest changes which will forestall any recurrence. In the case of TransAsia GE-235, the pilots' erroneous decision to shut off their remaining good engine appears to be the primary cause. The subsequent testing and failure of a number of pilots seems to provide a smoking gun that poor procedural knowledge is the culprit.

Of those who failed the exam, they will most likely be retrained and retested before being allowed to fly again. Sounds like the problem has been quickly and easily identified and solved. We can all go safely back to our phones. Or can we?

In any investigation, care should be taken to also identify underlying trends which may contribute to the obvious causes of any accident. A facile determination of the cause and a quick and easy palliative certainly serves corporate and political interests, but not necessarily those of the flying public.

This can be especially true if the underlying problems prove to be stubborn, or expensive to fix, or if the political will to fix them is lacking. I believe that all three of these things are happening here.

If Possible, Blame the Pilots

Airline crashes, besides being human tragedies of the highest order, are also both economic and political tragedies.

The economics involve not only the expected payment of upwards of a million dollars per fatality, and the loss of a revenue producing asset worth perhaps $20 million in this case, but also the lost revenue from the inevitable drop in bookings which follows any air disaster. Findings of fault with training, maintenance or procedures can increase any liability or punitive damage awards.

The political tragedy is more subtle but no less real in that questions involving regulatory oversight and preventative actions will be asked of government oversight entities. In the US, the FAA is occasionally referred to as being a macabre sounding "tombstone agency". This term refers to a perception that nothing of substance gets changed until some bodies pile up, and that the agency is essentially reactive.

In the meantime, after any crash, regulatory agencies will engage in a bureaucratic circling of the wagons to deflect any political blowback concerning regulatory oversight or lack thereof, which may have somehow contributed. The words "FAA Approved" which must appear on each and every page of the many volumes of manuals, checklists, and documents used by all US airlines, provide ample incentive for investigators to fault pilots' failures to follow guidance, and not the guidance itself.

In many countries with less stable governments, an air disaster can be a useful cudgel to be used by an opposition political group with which to criticize a currently ruling party or government.

There has been some speculation for instance, that a possible motive for the captain of MH370, the Malaysian airliner which disappeared last year, was to embarrass the Malaysian government which had recently brought charges against an opposition leader towards whom the captain had strong sympathies.

So in consideration of both corporate and political needs, incentives are well aligned to find some measure of incompetence or malfeasance with the people who always arrive first at the scene of any crash, the pilots. Dead pilots, conveniently unavailable to defend themselves, are useful for this effort.

How Stupid Could They Have Been?

As has been widely surmised through the release of the flight recorder data, it appears as if the pilots of GE-235 misidentified which engine had failed, and then shut off their remaining good engine. For this they are being pilloried in the comments sections of various blogs and social media as incompetents, idiots and worse.

Yes, it was a boneheaded thing to do, and it cost them their lives, but does anyone believe they did it on purpose? Or couldn't tell their left from their right? The gauges on an aircraft panel are fairly straightforward. Each gauge corresponds to the engine on same side of the aircraft as the gauge. The left RPM gauge or fire warning is lit? That means it's the left engine. Seems simple.

Adrenaline Can Make You Stupid

Anyone in law enforcement will tell you that in a real gun fight, fear and the adrenaline that will be dumped into your bloodstream as a result, can nearly incapacitate. The same can be true for stage fright or any other high stress situation. Fine muscle control and reasoning can evaporate. Concert pianists, police, figure skaters, and pilots all have the same need to practice what they do until it becomes second nature. It counteracts the effects of fear and surprise.

An old adage in aviation says that the first step of any emergency procedure is to first wind your watch. What this really means is that you should first take a moment and contemplate what is actually happening for there is very little in flying that requires instant reaction. An engine failure at 1000 ft certainly isn't one of those times.

So how did they screw it up?

The only way that that question will be definitively answered will be through a thorough analysis of the cockpit voice recorder to see who said what to whom. Someone identified the wrong engine as failed, and someone shut down the good engine. It may have been the same person. There was a high time instructor sitting in the cockpit jumpseat who may have had some influence.

While I have no way of knowing for sure, my guess is that the pilots of TransAsia GE-235 allowed the surprise of an engine failure on takeoff to cloud their judgement so much that they rushed and made a simple, yet fatal error. But in a high stress environment and under the influence of an adrenaline dump, human judgement can go out the window.

I know this because I've seen it happen. Lots of times. With students.

Training is Good but Experience is Better

Being an Air Force flight instructor is probably one of the least glamorous, yet one of the most rewarding jobs a young company grade officer can have. The T-37 was loud, hot and slow but an incredible amount of fun to fly. It was the students, though, that made the job a kick. They were beyond enthusiastic about being where they were.

But while they worked hard and leaned forward, they knew that a few bad rides in the jet could bust them out of the program, and for many, their life's dream. That kind of pressure amps up the desire to do everything correctly to a fever pitch.

This meant that when I'd pull an engine back in the jet or simulator, there were plenty of times when the student would jump on the wrong rudder. They'd overthink it and literally knee jerk the wrong foot. I also saw this plenty of times during spins. When the airplane is falling 10,000 ft a minute, the stress is palpable.

I even had a student attempt to pitch his aircraft into mine on a formation flight when his intention was to break the other way. I was ready for him, and pushed my jet over to avoid a collision. He had telegraphed his intent by looking the wrong way while clearing.

What these students were lacking was a deep and ingrained foundation of experience. They had no cushion to fall back on. This is what hours of training and repetition are designed to establish. My contention is that while the TransAsia pilots had satisfactory hours totals on paper, they were lacking real experience in actual hands on flying. This is a byproduct of automation.

But Weren't They Experienced Pilots?

A pilot's flight hours used to be the badge of experience. Old heads could regale young bucks with the stories of how they obtained their thousands of hours hand flying a 707 around the world. This is no longer the case. Once a real measure of experience, automation can easily hide the measure of true experience that was once contained in a pilot's total hours count.

For example, in a 14 hour trans-oceanic flight, pilots today may only actually hand fly the aircraft for a total of a few minutes or less. And it's not because they're lazy; this is usually corporate policy. The use of automation is becoming if not completely mandatory, then highly recommended.

Automation saves fuel, and it standardizes the operation of the aircraft which managements like. And let's be honest, it's also safer. But it also allows the placement of low time pilots with little actual aviation experience in cockpits thereby staving off some of the effects of the pilot shortage. Pilots with many thousands of hours in their logbooks may have as little hand flying time as my former students.

And the dirty secret about all of this is that airlines are just fine with barely qualified pilots staffing their cockpits. The alternative is to park airplanes. And should one crash, blame the pilot, make a public showing of retraining and get back to normal operations.

Ab Initio, Automation, and the Pilot Shortage

There is currently a worldwide pilot shortage which is expected to grow progressively worse in the next few years. This shortage is most acute in the Asia-Pacific region which is experiencing extremely fast growth in the aviation sector, and yet lacks a robust private aviation sector from which to draw pilots. The demand for pilots is so acute in India, they are experiencing a rash of fake pilots passing themselves off as the real thing. From Aviation Week:

The potential problems could be particularly acute in the Asia-Pacific region which Boeing projects will need 41% of the more than one million new pilots and maintenance technicians it forecasts will be needed by the world’s airlines over the next 20 years. The combined worldwide requirement is expected to include 533,000 pilots and 584,000 maintenance personnel.

Airlines outside of the US are resorting to a number of strategies to provide the numbers of pilots needed to fill their schedules. These include ab initio training and automation.

Ab initio training refers to a type of training program used mostly overseas which takes prospective pilots off the street and trains them from a pedestrian all the way to their placement in an airline cockpit. It typically involves a rudimentary flying training program in a simple trainer to the point where the student amasses several hundred hours and a $100,000 bill before being placed in an airliner. The emphasis is on airline operations as opposed to actual stick and rudder proficiency.

Run in conjunction with participating airlines, the tab is then paid back over some number of years with the hiring airline. Graduating with only several hundred hours of total time, a prospective student then starts in the right seat of one of today's highly automated airliners. While proficient in running an automated cockpit, an ab initio pilot never has a chance to gain a solid foundation of "stick and rudder" or hand flying.

A pilot with this type of background may fly for an entire career with nary a hiccup. Highly automated cockpits are designed to be flown from just after takeoff to just prior to landing in the control of the autopilot and autothrottles controlled by a flight management computer preprogrammed with the entire route. They work just fine for most of the time but on occasion things go wrong. And when things go wrong and the automation quits, a qualified pilot should probably be on hand to actually fly the airplane.

Coming to a Cockpit Near You

Well, you might say, I'll simply avoid flying on small, obscure Asian airlines and should be just fine. Maybe. But consider that the pilot shortage is a worldwide phenomenon and airlines even here in the states are starting to curtail their schedules due to a lack of pilots. The FAA, in recognition of the hazards of low time pilots, recently raised the hours requirements last year from 250 to 1500 hours. This has only served to exacerbate the problem in that personally financing the required hours before being qualified to get a job is nearly impossible for most aspiring pilots.

Add in the coming deployment of commercial drones which will take the few non-airline jobs available to aspiring pilots such as pipeline inspection or banner tows, and you can see the dilemma that even domestic airlines face.

Will drones eventually replace airline pilots and make the whole problem moot? Absolutely. But in the interim, which may be a while yet, pilots should still probably be able to fly their aircraft when the automation, or an engine, quits.

A Way Forward

There is a way to cut this Gordian knot of a need for both greater numbers of pilots and pilots with actual flying skills. It will cost money of course and require some bureaucratic and corporate risk taking, but the alternative will be more preventable accidents like Air France 447 and Asiana 214 where nominally experienced pilots flew good airplanes into the ground for no reason.

The US Air Force and US Navy have been running the equivalent of their own ab initio flight training programs for decades. In both services, pilot candidates with no previous flight time at all are trained in an intensive year and a half program and graduate to fly everything from transport aircraft to jet fighters. The difference between these military programs and their civilian equivalents is an immersion in nothing but stick and rudder flying to include aerobatic training even for transport pilots.

If I recall, I graduated from USAF undergraduate pilot training with about 175 hours of total time and after a checkout in my follow on aircraft, was placed in the right seat of a KC-135 tanker which is a military 707. But every hour of that 175 was hand flown and involved aerobatics, spins, stalls, and formation flying. Expensive? Sure. 

Could such a program be modified for civilian use? I have little doubt that such a solution must, because the alternative will be either parked airplanes, or more likely, additional dramatic dash cam videos of crashing airplanes.

Sunday, February 08, 2015

Cessna T-37 Single Spin Recovery Bold Face

For those who might have forgotten, I think it goes like this:

Throttles – Idle

Rudder and Ailerons – Neutral

Stick – Abruptly full aft and hold

Rudder – Abruptly apply full rudder opposite spin direction (opposite turn needle) and hold

Stick – Abruptly full forward one turn after applying rudder

Controls – Neutral after spinning stops and recover from dive

(43 words as I remember)

And if that doesn't work there was always this:

Handles - Raise

Triggers - Squeeze

The above bold face items were two of the  memory items required in the Air Force's undergraduate pilot training program while in the T-37 phase of instruction. The first is the spin recovery, and the second is the ejection sequence.

The course ran for about a year and successful completion would result in the award of silver wings and the aeronautical rating of pilot.

Bold face memory items were required to be committed to memory and recalled verbatim. Every morning, a briefing was conducted to go over items pertaining to the day's flying. One of the segments of the briefing was known as the "stand up".

A designated instructor would present an emergency scenario and then call upon a student to stand and verbally walk though all the steps required to resolve the emergency. Should the event require the use of a memory item, the student was expected to recite the bold faced item perfectly as a first step. Incorrect recitation would be followed by a command of "sit down".

This meant that the student was grounded for the day. This morning dog and pony show probably induced more stress in the students than would an actual emergency in the aircraft, and came to be widely hated by all.

Wrong Engine Shut Down?

The data readout from TransAsia's flight data recorder has been made available. The first warning in the cockpit was associated with the right hand engine (No. 2). The crew next discussed a failure associated with the left engine (No. 1). The left engine was then throttled back and shut down.

Shortly thereafter the right hand engine auto-feathered. This is an automatic feature on the ATR 72 which feathers the propeller (aligns it with the windstream to reduce drag) when the power from the engine falls below 18%. This is essentially an engine failure of the right hand engine and though it continued to run, it was not producing thrust.

The crew then discussed and attempted a relight of the left hand engine. Engine data suggest that the relight on the left hand engine was successful though perhaps too late to recover the aircraft.

The ATR 72 also features an automatic yaw compensator which would automatically apply rudder to counteract any adverse yaw resulting from an engine failure.

All these automatic features are designed to reduce the workload on the pilots in the event of an engine failure on takeoff. What they cannot do is counter basic airmanship mistakes such as misidentifying and shutting down the wrong engine.

There has been some discussion that perhaps there were miswired engine indicators. This is not an unknown occurrence, but pilots should use all available resources to make a determination of a failed engine. This would include other gauges such as fuel flow and exhaust temperature and also the performance of the aircraft itself. The aircraft will always yaw towards the failed engine.

In any event, miswired engine indicators should be noticed on engine start. If starting the left engine and the right hand RPM indicator spins up, that would be a big clue. At this point there is no evidence of miswired gauges.

An engine loss of thrust at 1000 ft agl (above ground level) should be no cause to take rash action. The aircraft is flying and will continue to fly well with only one engine. In this event, a proper course of action would have been to continue to fly the aircraft to altitude and then to methodically proceed through engine failure checklists.

Saturday, February 07, 2015

AirAsia 8501 May Have Entered a Spin Over the Java Sea

As of today, 93 bodies have been recovered from the fuselage of QZ8501 with 68 of them being identified. There have also been reports of a body being recovered wearing a pilot uniform from the cockpit area.

The mystery that still remains is the exact nature of the events which caused the aircraft to stall and to apparently depart controlled flight. As detailed in an earlier post, the aircraft climbed at a very high vertical speed to nearly 38,000ft followed by sounds of stall warnings being heard on the cockpit voice recorder.

Additional data released indicate that the aircraft changed heading twice during this climbing event and then started a rapid descent after which two more heading changes occurred. Data then indicate that the aircraft entered a "spiral" according to an article in the Wall Street Journal. (Paywall)

Modern airliners are not supposed to stall. All transport category aircraft certificated for commercial service are equipped with elaborate stall warning systems which are designed to give clear audio and tactile (stick shaker) warnings for even an approach to a stall.

Some aircraft manufacturers have gone even further in designing flight controls and other automated safety systems which will not even allow an aircraft to be flown into a stall. Airbus, the manufacturer of the A320 flown as QZ8501, is one of those aircraft builders. Airbus, a consortium of European aircraft manufacturers, revolutionized the industry by introducing the first "fly by wire" commercial airliner, the A320, in 1987. 

"Fly by wire" means that there is no mechanical connection between the controls in the cockpit and the wings as has historically been the case. With this aircraft, the cockpit control stick merely provides electronic signals to a computer (actually a series of computers) which interpret the pilot's intent. The computers then generate commands for the hydraulic servos which actually control the ailerons, elevators, and rudder. 

A Brief History of Flight Controls

The world's first successful heavier-than-air powered airplane was the Wright Flyer. The Wright brothers developed a system to steer the aircraft which actually warped the wood and cloth wings using cables fastened to the body. They later developed and patented a system of hinged flight controls which still provides the basis for aircraft control today.

As aircraft size, speed and complexity grew, new systems of mechanical linkages were employed to connect cockpit controls to flight control surfaces. Hydraulically powered flight controls were introduced in the post WWII era when aerodynamic forces became too great for human strength to overcome. These controls were, however, still controlled through direct mechanical linkages to the cockpit.

An ongoing objective of aircraft designers over the years has been to find ways to reduce the weight of their designs. A lighter aircraft can carry more payload, more fuel, has increased range and is more economical to operate. 

In the 1980s, Airbus felt that computer technology was mature enough for them to design a commercial aircraft with a fully digital flight control system. This system would replace all the pulleys, cables and other mechanical linkages between the cockpit and the wings with electronically controlled servos to command the hydraulic flight controls. There would be no direct mechanical linkage between pilot and wing. It would also save thousands of pounds of weight.

An "Un-stall-able" Airplane

Airbus went even further in their revolutionary design realizing that with computer control, they could design an aircraft that could not be mishandled by an errant or distracted pilot. In effect, the pilot was no longer in direct control of the aircraft but merely got a "vote" in how the aircraft was to be flown. And his vote could be overridden by the computer if a preprogrammed rule was violated.

So should a pilot inadvertently attempt to fly the aircraft into a stall, the computers would intervene to lessen the angle of attack to prevent the wing from stalling. You can theoretically pull fully back on the stick all day in an Airbus and the airplane won't stall. At least that's how it should work.

Faulty Computers

And in a normally functioning airplane that is how it does work. But something was amiss in the cockpit of QZ8501. News reports from the investigation now indicate that there might have been a problem with the aircraft's flight augmentation computer (FAC). There have been unconfirmed reports that the FAC had had recent mechanical difficulties, and that Captain Iriyanto, the pilot in command that night, may have been aware of the problems.

Data from the cockpit voice recorder now indicate that at some point just prior to loss of control of the aircraft, Captain Iriyanto transferred control of the airplane to First Officer Remy Plesel and got out of his seat for the purpose of pulling the circuit breaker controlling power to the FAC. This is considered a highly unusual course of action as a more normal procedure would be to reset the computer from a switch on the overhead panel if it was warranted. For some reason the captain felt that a reset was not appropriate and that the computer should be depowered.

Now as I've mentioned above, the Airbus's flight controls are completely computer controlled. But pulling the breaker on the FAC didn't mean that the airplane was now uncontrollable. There are multiple computers and redundancies in the system, but it does mean that the functions provided by the FAC were no longer available.

Now Vulnerable to a Stall

And one of those functions is what is known as "flight envelope protection" or more simply stall protection. Without flight envelope protection, the aircraft's computers would no longer automatically guard against a low speed condition or stall. Keep in mind that this vulnerability currently exists in all non-digital flight control airplanes flying today including the Boeing aircraft I fly. Their old school philosophy is that the pilot is the best stall protection.

What exactly happened next is still unclear but reports suggest that First Officer Plesel may have been startled by the loss of the FAC. Or he may have been trying to avoid a storm. But whatever the reason for it, he then placed the aircraft in a very steep climb which ran the airspeed down below flying airspeed at an extreme altitude.

At this point Captain Iriyanto was able to retake his seat and assume command of the aircraft, but the aircraft may already have been well into the now unprotected stall regime.

F/O  Remy Plesel

A Spin

Some data that has been made available from the DFDR indicates that there were multiple heading changes both before and after the stall warning sounded. It is possible that the aircraft entered a spin after stalling at high altitude from which the pilots could not recover.

A spin is a species of stall whereupon one wing is stalled and the other is either not stalled or is stalled less severely. When this happens, the more highly stalled wing has more drag than the partially or un-stalled wing and the aircraft starts to auto-rotate and drop.

Many aircraft can enter and exit spins should the correct procedures be applied. Airliners are not counted among those type of aerobatic aircraft. It is doubtful that Airbus even wind-tunnel tested the original design of the A320 for it's spin characteristics. The ability of an aircraft to exit a spin is also highly dependent on it's center of gravity (CG) and beyond certain limits no control input will be successful.

Captain Iriyanto had been a military F-16 pilot and was certainly familiar with unusual aircraft attitudes, and may even have had experience in spinning trainer aircraft. But a spinning airliner would certainly test the mettle of the best pilot ever to fly one even if recovery had been possible.

I've intentionally spun jet trainer aircraft many dozens of times during my instructor days, and it is a violent maneuver. Doing it at night in the weather in an airliner is the stuff of nightmares.


The events I've spelled out here contain a measure of conjecture based on the admittedly sparse data available from various news reports. The reality of what actually happened to QZ8501 may be remarkably different once the full report is made known. It is not yet known what the actual maintenance status of the aircraft was nor its proximity to the nearby thunderstorms. These details should be known when the final accident report is released.

TransAsia Synopsis

This is a video from the Wall Street Journal which succinctly summarizes the events leading to the crash of TransAsia 235. It may be behind their paywall.

View video.

Friday, February 06, 2015

TransAsia Aircraft Lost Power

By now everyone has seen these dramatic images of the TransAsia ATR 72 that crashed into a river shortly after takeoff from Taipei. 15 of 58 passengers aboard survived the crash but neither pilot survived. The data recorders have been recovered and are being analyzed. 

So far it is known that the aircraft reported engine problems at an altitude of 1200ft, 37 seconds into the flight. One of the pilots radioed the word "flameout" shortly before the crash and apparently an automated maintenance reporting system also sent a signal indicating that one of the engines had suffered a flameout according to an aviation investigator.

The term "flameout" is used by pilots to indicate that an engine has stopped producing thrust. While the ATR 72 is a propeller driven aircraft, its engines are technically known as turboprops. This type of engine is actually a turbine, or jet engine attached to a propeller. This means that if fuel is interrupted or some other malfunction occurs, the "flame" in the hot combustion section can go "out", and the engine stops producing thrust.

This particular ATR 72 was relatively new having been delivered in April but had suffered engine problems previously. The malfunctioning engine had been replaced according to reports. News reports did not mention which engine that was.

The latest reports now indicate that the right engine had not flamed out but had inadvertently entered "auto-feather" mode meaning that the propeller blades themselves are rotated on their axis so as to stop producing thrust but that the engine itself continued to run. This was apparently an uncommanded anomaly which would present itself to the pilots in the same fashion as a flameout.

Furthermore, the data recorders also indicate that the left engine was manually shut down. This suggests that there was confusion in the cockpit as to which engine had suffered a loss of thrust and the wrong engine may have been chosen to attempt a restart.

Expect the Unexpected

There was a time in aviation when things would routinely go wrong. Engines were unreliable, instruments were rudimentary and inaccurate, and pilots were pretty much on their own. Those days are decades gone and modern commercial transports almost never suffer the catastrophic failures of the past but that doesn't mean bad things don't happen. 

They still occasionally do, but the odds of say an engine failure on takeoff, one of the most challenging things that can happen, are becoming vanishingly small. At the current reliability rates of aircraft engines, the expected statistical occurrence of any engine failure let alone one at takeoff over a career of flying, is in the low single digits.

This is a really good thing, but it does present the problem of how to keep pilots from becoming complacent. Luckily, modern day simulators have capabilities that are so true in fidelity to actual aircraft that the FAA allows new pilots to complete a full training program and check ride entirely in a simulator. The first time a pilot may fly a newly assigned aircraft is now routinely on a revenue flight with paying passengers. The sims are that good.

You Are Only as Good as Your Training

Not only do all pilots train for normal operations in the sim, but we are routinely checked on emergency procedures such as engine and other system failures. One of the most common (and nerve wracking) events is known as the "V1 cut". In this scenario, during takeoff the instructor will fail an engine almost immediately after reaching our go/no-go decision speed known as V1.

This is the most critical point to lose an engine as you are committed to take off but have barely any flying speed. You won't know which engine will fail or how but you have an idea that something bad is going to happen. You're in the sim after all, and it's a required item, so it's coming. Not so true during everyday flying.

When the engine fails, the first thing you notice is that the aircraft will yaw, meaning the nose will swing towards the failed engine. (The thrust from your good engine on the other side is now pushing the nose towards the failed one.)  What must be immediately done then is to apply rudder to realign the aircraft with the runway so you don't go off the side into the grass. This is also your best clue as to which engine has failed without even looking at the gauges. It's an instinctual response. The nose goes left, you step on the right rudder.

If you're already airborne when the engine fails, the best indicator of which engine failed will more likely be the instruments, especially at night. I always instructed my students to "step on the good engine" and it seemed to work for them.

Don't Shut Down the Wrong One

I should probably also mention now that while an engine failure on takeoff is a serious event, it is also an eminently survivable one. All commercial transport aircraft are designed to fly perfectly well with the loss of an engine. Back in my military days, we'd fail two engines on one side of a four engine plane and get it to the runway with no fuss. In fact with no other system malfunctions, a single engine airliner won't fly as high or fast with a failed engine but landing is not a particular challenge.

The procedures to be followed after getting airborne and cleaned up with a failed engine are to determine what went wrong, attempt a restart of the failed engine if warranted, and to plan a return to the departure airport. Under certain conditions such as no apparent fire, and no internal damage or seizure, a restart may be attempted. If a restart is not warranted due perhaps to a seized rotor, the engine should be secured.

Here is where mischief can occur.

Checklists for both an emergency restart and also for securing a failed engine both usually involve taking the fuel control to off. For a restart attempt, this resets the fuel control unit and for a shutdown, you don't want fuel flowing into the dead engine. 

You have two engines with two fuel control levers right next to one another. This is the time to be very careful to choose the correct one. Choose unwisely and you're a glider. At my airline, as I suspect at most, this is a two person job with one person designated to guard the good engine lever while the other person shuts down the failed engine.

Again the key to all of this is to not rush. A single engine airplane will fly just fine all day, so rushing will only increase the likelihood of  mistakes.

There is actually precedent for the shutting down of a wrong engine causing a crash. In 1989 a British Midland Boeing 737-400 crashed when the pilots shut down a good engine having misidentified which engine had suffered an internal failure. There were 47 fatalities.

As I mentioned above, things almost never go wrong in commercial aviation, but when they do, you will be presented with multiple alarms sounding and a profound sense of confusion as you attempt to figure out what just happened. Simulator training is invaluable to be prepared but nothing tops a mental preparation to always expect the worst.

Friday, January 23, 2015

The First Clues from AirAsia 8501 are Emerging

Now that both the digital flight data recorder (DFDR) and cockpit voice recorder (CVR) from AirAsia 8501 have been recovered from the Java Sea, a picture of the fate of the aircraft is starting to emerge. 

The Airbus A320 with 162 passengers and crew was enroute from Indonesia to Singapore when it went missing in an area of heavy thunderstorms over the Java Sea. Just prior to the disappearance of the aircraft, a request was made for a climb which was denied by air traffic control.

Two pieces of information which have been obtained from the recorders are that the aircraft climbed at a rapid rate and that multiple alarms were sounding in the cockpit including a stall warning. At this point it is still too early to speculate exactly what happened to the aircraft but some pieces of the puzzle are available.

Data from the DFDR indicate that the aircraft at some point was climbing at a rate of 6000 feet per minute (FPM) which is considered excessive. This is generally true, especially for a fully loaded aircraft at altitude. A modern transport aircraft actually can achieve such a climb rate under normal circumstances when it is lightweight and closer to the ground, but certainly couldn't sustain such a climb rate without quickly bleeding off airspeed.

The question yet to be answered is whether the climb was initiated by the pilot as an emergency measure to avoid a looming storm cell, or rather caused by the aircraft inadvertently entering a storm and being buffeted by the strong updrafts in the cell. Or perhaps it was a combination of both storm action and pilot input.

A rapid climb for whatever reason appears to have caused the loss of airspeed to a point below the stall speed for the aircraft, which would explain the stall warning being heard on the CVR.

Investigators will need to correlate the position of the aircraft at that time with radar and satellite imagery to determine if the aircraft was actually in a storm cell. Acceleration data from the DFDR will also help determine if the aircraft was experiencing high G forces or severe turbulence which would indicate whether it had entered a storm cell. I don't know if the DFDR on the A320 records imagery from the aircraft's airborne radar, but if it does it will be helpful.

Climb or Turn?

If the rapid climb was initiated by the pilot, another question that needs to be asked is why did he choose to climb as opposed to turning to avoid the storm? 

A common misconception among the public concerning storms is that aircraft can simply climb over them. There is some truth to this. As with most things in aviation, the answer to this question is it depends. Storms come in many shapes and sizes and smaller ones can be topped. The biggest ones however can easily exceed 40,000 ft and should be deviated around and not over.

Even should a storm not exceed the altitude capability of an airliner, (about 41,000 ft for most) it's not a good idea to try to top the larger ones as turbulence can exist well above the actual storm cell. Larger storms with strong updrafts can even eject hail out of the top which can then travel for many miles. Hail will ruin your day.

Presumably, the captain of 8501 knew all this. One possible scenario might have been if they had been searching for a hole in the storms to fly through which then closed in front of them, or they flew into a radar shadow and were confronted with an unseen storm. In this case choices are limited.

The turn radius of an airliner at altitude can be five miles or more depending on speed. If the crew needed to immediately avoid a storm cell but were too close, climbing is the only option. You may not top the storm but it might be less turbulent higher up. Ideally, this is a situation to be avoided by early planning for storm avoidance.

What is a Stall Anyway?

I'm going a bit down the rabbit hole here but please bear with me.

Airplanes can fly through the application of fluid dynamic principles first discovered by Daniel Bernoulli and enshrined in his Bernoulli Principle:

\tfrac12 \rho u^2 + P = \text{constant}  

For the math-phobic, this equation means that as the velocity of a fluid increases, its pressure decreases. As applied to an airplane wing, the air (a fluid) travelling over the top of the wing must travel faster than the air travelling beneath. The faster moving air above the wing then has a lower pressure than the slower moving air beneath and hence lift is generated.

There is one caveat to this process and it's a biggie. Lift is only generated when the airflow over the top of the wing remains laminar meaning smooth. Should the airflow become turbulent, the relationship no longer exists and lift is destroyed. This is known as boundary layer separation and is the technical definition of a stall.

A stall will happen when the airflow over the wing is too slow to generate enough lift to support the weight of the aircraft. When this happens the boundary layer separates, the laminar flow is disrupted by turbulent flow, lift is destroyed and the airplane drops like a stone.

You may have noticed tiny fins and tabs attached to the top of the wing on an airliner. They are there to facilitate laminar flow. Look for them next time.

This means that all airplanes have a minimum speed below which they cannot fly and stay airborne. And as you might suspect this airspeed, called stall speed or Vs, is dependent on aircraft weight. (It is also dependent on many other things such as the width and length of the wing and even the smoothness of the paint, which is why we deice for even a coating of frost.)

It sounds scary but it really isn't. Stalls need not be feared but they should be respected. Once in a stall, every pilot should know how to get out of it. The first step is recognition. A stall may feel very similar to turbulence but a glance at the airspeed indicator will be an immediate tell.

The next step is to simply reestablish laminar airflow over the wing by lowering the nose and trading some altitude for some airspeed while helping with added thrust. Low altitude stalls are the most dangerous as there may be no altitude to trade with. Empty bank account as it were. In this case airspeed must be regained through thrust alone. (In thrust we trust!)

All airline pilots routinely practice stall recovery in the simulator and as an instructor pilot I personally stalled or had my students stall and recover a real airplane on a daily basis for years. It's a basic aviation skill.

Making the Tradeoff

So getting back to AirAsia, why would the pilot climb at such a high rate of vertical speed knowing that there was a possibility of stalling the aircraft? He was possibly trading his available energy for altitude in hopes of avoiding a storm cell.

A major component of flying airplanes is what is known as energy management. This means being aware of and managing the aircraft's mix of potential and kinetic energy. Anyone who has ever ridden a roller coaster or perhaps played with Hotwheels cars and track will understand.

As a roller coaster tops the first big hill, kinetic energy is low (in speed) yet the potential energy stored (in height above the ground) is high. This situation is reversed at the bottom of the hill with high speed thrills and then reversed again at the top of the next hill.

Trading speed for altitude can also be done in an aircraft. Only unlike a roller coaster, an airplane has to maintain a speed above stall speed to stay airborne. The energy available to trade is expressed in the difference between current airspeed and stall speed.

This type of energy tradeoff is also done routinely in airline operations. Say for instance we're cruising along at 280 kts and are given instructions to climb. Air traffic control may also ask for an expedited climb for converging traffic or some similar reason. 

Advancing the engines to climb thrust and climbing at 280 kts is the normal climb profile, but by also pulling the nose up somewhat more and letting the speed bleed off to say 250 kts, the airplane will climb quite smartly, trading the energy in that extra 30 knots of airspeed for a higher vertical velocity. Then once level, you accelerate back to your original 280 kts in level flight.

Be Careful When Slow

If an assumption is made that the captain climbed rapidly by trading his airspeed for altitude but then unsuccessfully avoided a storm cell, the situation might be potentially worse than entering the storm with lots of airspeed. Once available airspeed is traded for altitude, the aircraft is closer to stalling and the gusts found inside a storm can easily cause the airspeed to fall below stall speed.

Once stalled, control of the aircraft can also be compromised by gusts preventing a successful stall recovery. In the case of Air France 447, the pilots never recognized that they were in a stalled condition and never applied the correct recovery procedures.

What happened in the AirAsia cockpit is as yet unknown or unrevealed, and the situation may well have been unrecoverable by any method. Concern for the families of the deceased and other political considerations may impact the timing and method of the release of more information.

Hopefully further analysis of the DFDR and CVR will eventually reveal the actual events surrounding the fate of QZ8501.

Thursday, January 15, 2015

Thunderstorms in Action

Here's a cool little video showing Atlanta Intl arrival radar tracks with some thunderstorms passing through the area.

Notice how the aircraft at first deviate around the storms followed by going into holding for a while.

Wednesday, January 14, 2015

Pilot Shortage: Solved!

Automation may just mean less competition on the layover!

I jest with the title of this post, but only slightly. Automation is here, and in the future, jobs will be either heavily involved with automation or simply replaced by it.

This trend will present some new social problems concerning what to do with all the displaced workers as explained in this video. It's also the reason that efforts to increase the minimum wage will simultaneously succeed and fail at the same time: Those workers who remain will make more. The rest will make nothing.

The piloting profession is ripe for change due to automation. The pilot shortage is real and projected growth rates for the world's airlines far outstrip the projected numbers of pilots being produced. The replacement of pilots with automation is a long term goal of many stakeholders in commercial aviation.

This won't happen today or tomorrow, but it will happen eventually. Boeing's technology cycle runs about 15 to 20 years. The first generation of aircraft automation was introduced in the late 1970s followed by the 777 and 737NG technology introduced in the late 90s. The latest technology cycle for aircraft automation is the newly released 787 to be closely followed by the 737 Max aircraft.

Both of these new technology aircraft still need at least two pilots to be flown so we won't see single pilot airliners until at least the next technology cycle in perhaps 15 years from now at a minimum, but probably many more years than that.

But they're working on it.

In an article in C4ISR, a company called Aurora Flight Sciences has been contracted by DARPA to investigate the feasibility of an automated copilot:

C4ISR&Networks, January 12, 2015 
Aurora Flight Sciences has been awarded a $6 million DARPA contract to develop cockpit automation. 
The contract, for Phase I of DARPA's Aircrew Labor In-cockpit Automation System (ALIAS) program, calls for Aurora to develop "an automated assistant capable of operating an aircraft from takeoff to landing, automatically executing the necessary flight and mission activities, checklists and procedures at the correct phases of flight while detecting and responding to contingencies," said a company news release. "At the same time, the human pilot would be continuously informed through an intuitive interface of which actions the automation is executing, and take back control if so desired." 
Aurora is collaborating with the National Robotics Engineering Center and Duke Engineering Research Institute. "The ability to reassign cockpit roles, allowing humans to perform tasks best suited to humans and automation to perform tasks best suited to automation, represents a potential paradigm shift compared to how flight operations are currently conducted," said Jessica Duda, Aurora's ALIAS program manager. "One of our key challenges is to develop a system that creates trust between the pilot and the automated assistant."

I am actually gratified to read in this article a recognition that future automation should find things for humans to do that they actually can do.

Today's deployment of automation is the worst of all possible worlds as bored pilots are expected to sit on their hands and watch the machine fly the airplane but be ready to jump in and save the day should the machine screw up.

This model is not working. Rusty, bored and distracted pilots are uniquely unqualified to monitor the performance of machines which nearly never screw up but when they do, do so in a big way.

Using the currently flawed model, we should expect to see more accidents such as the Air France crash into the Atlantic by confused pilots and crashes like the Asiana accident in San Francisco made by pilots who weren't competent to fly a simple approach in clear weather, but rather relied heavily on the automation to stay safe.

Automation is here to stay, and overall, that's a good thing. Like any new technology, it needs to be carefully deployed for the maximum benefit and should enhance human capabilities rather than replace them as the current technology attempts to do (poorly).

Sunday, January 11, 2015


One of the black boxes from Air Asia 8501 has been found. It should be a just a short while until the other recorder is found which will give a complete picture of the fate of the aircraft should they yield good information.

My speculation is that the aircraft wandered into a thunderstorm which then either compromised the structure of the aircraft, or placed the aircraft in a position from which the pilots could not recover before hitting the water. A stall scenario similar to the Air France crash over the Atlantic may have occurred.

It should only be a short while until more is known.