Why airplanes crash

Don in SuitEveryone is a #$%^&* expert.  I just received a long dissertation from an “expert” who  “as retired high time international airline pilot, I feel qualified to give you a look at the practices in an airliner cockpit.” He seems to have all the answers. He feels that modern cockpit automation has diminished pilots’ stick-and-rudder skills to a dangerous level. The solution, he says, is “a pilot should hand fly the jet from take-off to 10,000 feet on departures and from 10,000 feet to landing at least twice a month. This will be enough to maintain a satisfactory level of hand flying.”

Do  you really think that will do it? Back in 1988 I helped Delta formulate an automation philosophy for pilots to have a strategy for dealing with the then new automation available to us. Since then the controversy has not abated. On the one side, automation naysayers proclaim that they need all the practice that they can get and that they can do a better job of controlling the airplane than the computers. The automation cool-aid drinkers (I am one of these) say that pilots must have manual flying skills available, but some things are better left to the computers. To reconcile these diverse strategies, the regulators and operators have mandated (promulgated) many rules for the pilots to obey. For example, if the runway visual range (RVR) for an approach is less than 4000 ft., and an autopilot and/or flight director is available, then it must be used. That sounds very reasonable to me. On the other hand, when demonstrating proficiency at my semi-annual simulator torture, a hand-flown, single-engine approach looms. A little manual flying practice seems to be in order, as the aforementioned expert asserts. Yes, but how much and what type? More to come.

Jan 23, 2015

Back in the early  ’80s, I was flying the B-727 when the then highly automated B-737-200 came out. I quickly volunteered to take a more junior position so I could experience the automation. It had a mode control panel, dual autopilots, and a Performance Data Computer, very advanced for the day. Some of the pilots had difficulty managing even that low level of automation. When the B-767 came out, it ushered in a whole new era of automation. Senior pilots were flocking to the higher pay, but many had difficulty in the checkout. Delta backtracked somewhat and started the “Introduction to Aviation Automation” (IAA) program, designed to bring the dinosaurs up the the computer skills of the kids. Fortunately for the dinosaurs, Delta allowed them to fly the 767 like they had done in the 727, if they chose to do so. That, of course, missed the whole point of increasing safety with automation.
On the other side lay the lazy, the geeks, and the arrogant. They never turned the stuff off. “Gear up, flaps up, autopilot on,” was the mantra heard in many cockpits. Later that was followed by “Gear Down, Flaps down, autopilot off, aren’t I wonderful.” Maybe so, but I couldn’t really know if they could fly or not. I once saw a new 757 pilot get cleared for a visual approach from 10 miles out from Louisville, a rare opportunity for those of us condemned to fly the instrument approach most of the time. He proceeded to type his way around the approach with the mode control panel. A sadly lost chance for that manual practice that we covet.
Too little or too much use of the automation obviously can result in less safety and efficiency. Where is the sweet spot where automation reduces cognitive workload when it is needed, and provides guidance accuracy that humans are unable to achieve?

Jan. 24, 2015:                   THE HISTORY

So what did we come up with in 1988? The need for an automation philosophy  became obvious after Delta’s “Summer of Shame.” In a short period Delta pilots narrowly avoided a midair due to a pilot error over the North Atlantic, landed at the wrong airport (no injuries), crashed a 727, and was still smarting from a L-1011 crash. I attended both the Delta 191 and Delta 1141 NTSB hearings as the ALPA Human Factors representative. At the 1141 hearing, the NTSB Investigator In Charge (IIC) was really mad at Delta for not complying with the 191 findings and recommendations. That’s when the airline really took action. The Vice-president of flight operations (later Senior Vice-president of operations), Harry Alger, selected Captain Reuben Black to lead a group that was to create a Cockpit Resource Management (later Crew Resource Management) program for the airline. Alger committed a huge amount of resources from a notoriously penurious company. Black was the consummate diplomat and led by extracting the best that was within each of us. Delta had never hired an outside consultant for anything. We were funded to hire the late Bob Helmreich and his NASA/UT group, the late Earl Wiener at the Univ. of Florida, and Phillip Hackman, a well-known psychologist from Boston.

Delta needed fixing. As a new hire, I was introduced to line flying at the Houston, Texas base. “We are a captain’s airline,” was never so true as it was there. What that really meant was that management was unwilling to devote the resources to develop a meaningful set of operations procedures to guide us. In that void, the cowboy captains ran amuck. Their logic ran something like this: “Since we haven’t had any accidents, the crazy stuff we are doing must be OK.”  I was flying fighters in the Air National Guard at the time and thought I was bulletproof, but they scared me. Their luck ran out in 1985. The fix, was a good flight operations manual, better communications, and most of all, a fully participating crew, committed to doing what was best for the passengers. Imagine the wailing and gnashing of teeth when the old guard was called upon to change. “Holding hands in the hot tub,” they called the class. They planned to co-opt the program and never change. A pilot could not fail a check ride for CRM. However, an angry First Officer might fail to remind the Captain that one of his illegal habits would cause him a technical failure. The younger pilots got it. Management’s choice was just to allow the dinosaurs to retire in time, or to force compliance. It was a bloodbath. Simulator check rides were repeated, line checks were incomplete, pay was lost, it was serious.

In this tumultuous environment, the company wanted to form a policy on the use of automation. After all, Southwest had bought automation and disabled it. American bought automation and demanded that it be used.  Of course, the FAA had previously promulgated rules that required the use of automation. Little argument existed over the notion that Category II approaches were better flown by the autopilot. No argument existed over the notion that Category III – autoland approaches were a spectator event for the pilots.

The problems facing us were similar to the ones we have today: Mode confusion, automation surprises, over dependence/loss of manual skills, and increased workload trying to use the automation that was poorly understood.  Here’s  what I came up with:

1. There is an optimum level of automation for every situation.
2. If the automation is increasing workload, use a lower level.
3. Pilots must be proficient at all levels of automation.
4. Both pilots should be fully aware of the state of the autoflight system at all times.

Optimum levels include allowances for using a low level to maintain proficiency. Maintaining proficiency at all levels of automation requires one to self-manage their training program. That is, enough manual flying to be able to handle the aircraft when the autopilot says, “I quit.”  Both pilots fully aware means that secret typing in the Flight Management System is not allowed.

As of my retirement, this philosophy remained largely intact after eighteen years. Some good stuff was added:

One  pilot should maintain outside visual awareness.
Both plots should maintain a comfortable workload distribution and situational  awareness.
The pilot flying must compare the performance of the autoflight system with the flight path of the aircraft.

Most of us would agree that the aforementioned ideas are pretty good ones, but this devil is in the implementation. What with modern aircraft using Controller to Pilot Data Link Communications (CPDLC) the assigned altitude is automatically set in the mode control panel. How could you screw that up? Well, we still have altitude busts. We still have B-777s crashing for lack of manual flying skills. Correct me if I am out of date, but the last time I checked there had NEVER been a fatal accident following a autopilot-coupled Category III approach. Thus the dilemma: the autopilot can do it better than I can at the moment, but might fail unexpectedly.

I have experienced cognitive overload. I have frequently felt that I was at maximum workload. For instance, on a manually flown  approach: intercepting a localizer, slowing, and configuring (and talking on the radio when single pilot). If a surprise had happened, I would have had to prioritize and do something later. Automation is a wonderful workload reducer in that situation. Asking your fellow pilot for help works too.

I have questions:

How does this apply to flying single-pilot aircraft?
How can I maintain manual flying proficiency when my boss says always use the autopilot?
How can I trap and mitigate the inevitable errors?
The weather is 700 ft. ceiling and 2 miles visibility. Is overall safety enhanced by flying the approach manually today?
Is there room (or need) for different styles of resource management?

Jan. 26, 2015

Flying IFR in a single pilot airplane can be very busy. I remember taking my instrument rating check ride, a long time ago. The examiner asked me to hold at an intersection with a single VOR. I must have done it OK, because I passed. I wouldn’t try to do that today for all the tea in China. I think that is partly because of my concept of risk and partly because I’m moving a little slower nowadays. Fast forward to a naive kid flying a F-106. It was so easy to get behind that airplane that we were all trying to think of something to do to get ahead (of stay up with) the situation. Things don’t happen that fast in an airline cockpit, but it was good preparation for flying the Bonanza. I have owned that airplane for less than a year and have shot approaches down to minimums twice.

I wouldn’t have been there if I did not have a good autopilot. What exactly are my manually flown minimums? I don’t have a formal a set of rules. I know I’m OK with VFR on top and punching through an undercast down to 500/1. What if the autopilot had failed enroute to a destination at minimums? I would go to the alternate. What if the approach coupler failed on the way down to a minimums approach? It’s always an exciting experience when the autopilot hands you the airplane unexpectedly. If the approach were stabilized and no other factors were worrying me, I  would continue. If I were on downwind leg and this happened, well that’s a tough call. Proceed to alternate? Ask for an extended downwind? Admit to an equipment failure to ATC?

There are good reasons that corporate and airline flying is safer than General Aviation (GA). Maintenance, procedures, proficiency, management, and nearly every aspect of the operation receives more focus than GA gives it. Is that to say that we GA pilots should emulate corporate and airline operations? If you can afford to trick out your avionics package like a 777, I say, “Go for it.” Bloody likely though. What we could do is adopt an automation/workload philosophy more like theirs. Statistically speaking, it would certainly be a good idea. If one were to embrace this concept, then there is a wealth of knowledge that draws from their experience and the procedures that were created in response to it.

Feb. 3, 2015

For those of us who believe that Air Asia 8501 and Air France 447 crashes are similar, note the following:

DATE: December 10, 2014
AD #:  2014-25-51
Emergency Airworthiness Directive (AD) 2014-25-51 is sent to owners and operators of Airbus Model A318, A319, A320, and A321 series airplanes. Background:
The European Aviation Safety Agency (EASA), which is the Technical Agent for the Member States of the European Community, has issued Emergency Airworthiness Directive 2014-0266-E, dated December 9, 2014 (referred to after this as the Mandatory Continuing Airworthiness Information, or the MCAI), to correct an unsafe condition on all Model A318, A319, A320, and A321 series airplanes.
The MCAI states: An occurrence was reported where an Airbus A321 aeroplane encountered a blockage of two Angle of Attack (AoA) probes during climb, leading to activation of the Alpha Protection (Alpha Prot) while the Mach number increased. The flight crew managed to regain full control and the flight landed uneventfully.
When Alpha Prot is activated due to blocked AoA probes, the flight control laws order a continuous nose down pitch rate that, in a worst case scenario, cannot be stopped with backward side stick inputs, even in the full backward position. If the Mach number increases during a nose down order, the AoA value of the Alpha Prot will continue to decrease. As a result, the flight control laws will continue to order a nose down pitch rate, even if the speed is above minimum selectable speed, known as VLS.
This condition, if not corrected, could result in loss of control of the aeroplane.
To address this unsafe condition, Airbus ***[has] developed a specific Aircraft Flight Manual (AFM) procedure, which has been published in AFM Temporary Revision (TR)No. 502.
For the reasons described above, this AD requires amendment of the applicable AFM [to advise the flight crew of emergency procedures for abnormal Alpha Prot. 

Well, it appears to me that in the A-320, if the computer thinks that the aircraft is stalled, the nose is coming down, and there is not much the pilot can do about it. I flew the A-330 simulator. Delta was considering the purchase of them and wanted to know if ALPA would go for it or not. It was pleasant to fly, when everything was working. I asked for a scenario in which I had to maneuver to avoid a midair. The aircraft was so gentle in responding to my inputs that we had a simulated collision. The takeaway for a Bonanza pilot trying to be safer is to choose an airline that buys Boeing. I’m just not buying that these very experienced pilots just went stupid under pressure. Remember the cheapest group to blame in a crash is the pilots.

Feb. 18, 2015

AOPA’s Tom Haines weighs in (Pilot Magazine)

One of my favorite aviation publications, “AOPA Pilot,” Feb. 2015 issue contains an article by Tom Haines. He comments that back in 1912 when Sperry developed the first autopilot, some of the pilots probably declared the contraption was for wimps. “Automation can improve safety and reliability, increase situational awareness, and increase redundancy. Yet, despite the progress, we continue to see a high level of accidents where pilots seem too dependent on automation.” From another source, I read about the last moments of Air France 447. After the static system failed, the automation set the throttles at an acceptable place for level flight. If the pilots had just held the nose level for a while, things might have turned out differently.

A few years ago I was asked to comment on Turkish Air 1951 which crashed at Amsterdam Schiphol Airport in 2009. They accepted a slam-dunk approach. With the throttles at idle, they didn’t catch an autothrottle computer failure. The aircraft crashed short of the runway for lack of thrust. I believe that there is a parallel to the Asiana 214 crash in San Francisco bay in 2013. Although they had visual conditions, it was a slam-dunk and lack of thrust became the cause.

I had very little excitement during my airline career. However, the most gut-wrenching feeling I ever had, was the second or two that I thought I had waited too long to push up the throttles, near the ground. Why would a pilot be caught in that situation? When we transitioned to jets, we were always told, “Keep the throttles ‘way up, because jets don’t accelerate as fast as piston engines. ” Good advice, but if you were able to push the throttle(s) up at the last minute, you saved fuel and looked “cool.”

The late Neil Anderson, the famous Convair/General Dynamics test pilot, who conducted many of the F-16 early tests, was my mentor when I was learning to fly airshows in the T-33. I miss him greatly. He told me a story about himself and the MiG-21.  He was “the pilot” when the F-16 was sold to Egypt. President Mubarak asked Neil if there was anything he wanted. Neil replied that he would like to fly the MiG-21, a mysterious aircraft back then. Next morning, there was the aircraft waiting for him, no briefing, no checkout, just a crew chief and a General to answer questions. Asked about his plan, Neil said he wanted to conduct a couple of “touch-and-gos.” The General asked, “What is touch-and-go?” Neil explained that after landing, the pilot advances the throttle and takes off again. The General nodded in acceptance. Upon returning from his flight, Neil did exactly as planned and advanced the throttle, except nothing happened! Halfway down the 12,000 ft. runway, the engine reached 60%. With 2,000 ft. to go, 75% was indicated. After exiting the departure end of the runway and destroying nearly a mile of brush, the engine reached full thrust and the aircraft became airborne. Leaving the landing gear down, he landed and taxied up to the ramp, where the General and crew chief waited.  The flaps, gear doors, and belly had been severely damaged, a tribute to the durability of the MiG. The General asked, you guessed it, “Mr. Anderson, did you enjoy your flight?”

Well, the point of this discussion is that jet engines accelerate slowly and our lack of understanding and  practice of thrust management may be more detrimental to safety than getting rusty in our manual maneuvering skills.

Feb. 22, 2015

(Copy of Correspondence from Bud Landacre, commenting on the Neil Anderson story)

Interesting article. I was always an advocate of hand flying the aircraft. I remember a quote by on old mossback published in an article in BCA magazine regarding automation. He said ” I can’t fly worth a damn any more but I can type 40 words per minute”. I was riding as an observer in the Lear simulator as the crew flew a coupled ILS approach to minimums. As the crew dutifully monitored the autopilot flown approach the sim operator input an aileron trim malfunction (full left aileron trim). The autopilot did a masterful job of flying the airplane with a not too noticeable control wheel offset. Can you guess what happened when the captain clicked off the autopilot at about 150 ft agl in min vis conditions?

Feb. 22, 2015

Here’s me on a recent trip to the Texas Hill Country.

DCIM100DRIFT

Feb. 23, 2015

I’m hoping to find consensus on the use of automation in aircraft. Looking at the discussion and comments suggests one thing that we can agree on is that automation can do some things better than human pilots.

According to the FAA, we must use the autopilot when cruising in RVSM airspace.  The Reduced Vertical Separation Minima was introduced to pack more airplanes into the 28,000 ft. to 41,000 ft. airspace. Formerly aircraft were assigned altitudes two thousand feet apart. With RVSM that restriction is reduced to one thousand feet. However, to be allowed into that airspace, the aircraft and autopilots must be certified to be very precise. This sounds reasonable to me.

I remember a long flight from Taipei to Portland in the MD-11. As the copilot, I had flown  the previous leg; it wasn’t my turn to fly. When all three autopilots failed, it became my leg. The Captain wouldn’t or couldn’t manually fly those long hours going home. I confess that my altitude-holding precision diminished after a while. Yes, the autopilot is better at that.

Regulations tell us that when the runway visibility is less that 3/4 mile, we must use an autopilot if it is available. Also, we must use three autopilots, autothrottles, and automatic landing if the visibility is less than 1,200 ft. Some Category III certified aircraft can land in weather as low as zero ceiling and 75 meters horizontal visibility. These numbers vary across airlines, where their operations specifications are approved by “the authorities” and become regulatory. Again, I have no problem with these regulations. In my 50 years of flying, I have conducted or more precisely, watched the autopilots conduct, only five approaches in zero-ceiling conditions. Three of them were in Zurich. To qualify to do this, the aircraft must be equipped with three autopilots, dual autothrottle computers, dual radar altimeters, and a slew of other gadgets which must all be working properly. One important gadget is GPWS, Ground Proximity Warning System, which compares GPS position to a worldwide terrain database to assure us that we aren’t going to run into a mountain.  The pilots must be trained and current, and the aircraft must have conducted an autoland recently. If any of the required equipment fails early in the approach, better weather must be found elsewhere. Closer to the ground a failure such an one of the autopilots is merely disregarded and the approach is continued with two, since a missed approach from low altitude is considered more risky. The Captain must fly the approach. The First Officer (copilot) makes the callouts. The mode changes are among the most important of these. Near the ground the aircraft goes into align mode for crosswind correction. “Flare arm, flare capture, touchdown, and rollout,” are the only  human sounds in the cockpit . If any of these mode changes don’t happen at the proper altitude, I press the TOGA (takeoff-go around) button and we’re outta there. As the aircraft passes fifty feet from the ground, the copilot says “Flare Arm,” and the radar altimeter announces height every ten feet in its human female voice . “Fifty, …., forty, …, thirty – flare Capture, …., twenty, …., ten, …., touchdown, …, rollout. I still see nothing out the front windscreen. Derotation begins and  the nose wheel is gently landed as I bring the engines into reverse thrust. As the nose lowers, I begin to see the runway centerline lights, but only a few since the visibility is so low.  The alignment is perfect – it always is. The wing spoilers deploy automatically, the brakes slow us automatically, with out any skidding, I disconnect the autopilots as we slow down. I am instructed by tower to continue to where the runway lights intersect the SMEGS or Surface Movement Guidance and control System lights. Since the tower controllers can’t see us, we receive guidance and control with lights embedded in the taxiways. Chuck Yeager might be able to do that without getting wet armpits, but I can’t.

If there’s anyone out there who likes to do this without an autopilot, I would like to hear from you. Absent any disagreement, I would like to establish Automation Tenet No.1:  Automation can do some things better than human pilots.

 

Here’s an MD-11 cockpit. Don’t worry about the gear and flaps, it’s at cruise.  MD-11 panel

Mar. 3, 2015

QFYou might notice something a little strange about the F-102 in this photo. I took some of these from the rear seat of a T-38 while TDY at White Sands Missile Range (WSMR) in New Mexico in 1974. I’m not sure if I took this one or not. The airplane is one I frequently flew while at Keflavik, Iceland. The point, of course, is that no one in in it. No discussion of humans vs. computers in aviation would be complete without getting to UAVs, or Unmanned Aerial Vehicles, or drones. The caution with which we conducted these flights might be indicative of the process whereby we entrust airliners to one or zero pilots in the future.

This is a QF-102, a “man-rated” airplane. That is, it still had all the controls for a pilot in it. It could be flown with or without a pilot. Later versions, called the PQM-102 had no place for a person in the cockpit. Earlier drones, such as the QF-104 were controlled from an aircraft (usually a T-33) flying nearby. The QF-102 was controlled from the ground via a huge radar dish that was not perfectly  reliable. Consequently, WSMR safety insisted that we have a device that would destroy the aircraft if we had a Loss Of Signal (LOS) for more than a few seconds. Harsh stuff. The purpose for the drone was to test our new missiles with a full-scale target. Previously, we had done so by shooting at a Ryan Firebee with radar and infrared augmentation. That was a small aircraft and no one knew if the accuracy of our tests would “scale up” to  real fighters. Thus the QF program. It was a sad day that I watched “my” airplane that I had flown so much in Iceland, get shot down by an AIM-9 missile. Better to die being productive that be chopped up, I suppose.

Later during some of the scheduled shots at the aircraft, the pilots were fully ready to fire more than just the test missile at the drone if it were to have a LOS problem. None ever escaped, to my knowledge. That was a far cry from modern UAVs. Nowadays, GPS and Satellite communication permit lethal drone airstrikes in Afghanistan, conducted by pilots in a bunker in Houston.  With this new-found reliability, is it only a matter of time before airlines go to a single pilot?  The B-777 have a software program in it that sounds an alarm if no switch or button has been actuated for a few minutes. Sometimes when there was an unusually long distance between reporting points over the Pacific, it would fire. Had we been asleep, it would have awakened us. I think the next big controversy will be whether or not to allow a single pilot during the cruise portion of a flight, while retaining two or more for other times. That’s going to be a tough sell for airline management, remembering AF 447. I admit that my prejudice may come from the desire for job security. However, retaining two pilots at all times has some obvious safety benefits. Imagine a single pilot on a B-797 in the future who expires unexpectedly. The airplane detects this and summons the other (sleeping) pilot. Meanwhile some previously unknown software failure mode commands 23 snap rolls. Not a pretty thought. Forgive my ramblings. What I intended to say is: Are there some things that pilots can do better than the automation?

March 6, 2015

Bill Gross commented: I think it might be profitable to look into the events at 3 Mile Island.  The PA Nuclear Power plant that almost lost it in the late 1970s.   From what I recall the plant operation was almost totally automated to the point that the operators lost focus on what was going on.  When indicators started showing the plant was having problems, these ignored because the operators lost that focus.

I think he is exactly right. Many disciplines are experiencing the controversy that we have in aviation. This goes beyond automation. It is a crisis in responsibility. Whether your title is Captain, Nuclear Power Plant Supervisor, or Backup Quarterback, if you are being paid to be ready to do a job, but seldom are called upon to do it, discipline is required. That may be internally or externally enforced. Pilots are usually the first at the scene of the accident, often in a fatal manner. Perhaps this is the reason that most of them who I know, generate this discipline internally. Not so for the backup quarterback. I he does a lousy job, he can take his millions and go home.

March 17, 2015

The computer says it will make it to Tokyo just fine, climb aboard.

DSC03256

In my last post I asked what things pilots do better than the automation. I’ll start by suggesting that pilots taxi, takeoff, prioritize, adapt, fly the visual approach, and evaluate risk better than the computers. Also, and this is a biggie, we check for reasonable answers. Before I retired, we were still putting the flight plan into the Flight Management System manually. Maybe it’s being uploaded by now. When we did that, we would check the total distance against the printed copy. If it was very far off, the legs page usually revealed that we had a typo which resulted in the magenta line going off the page to some faraway place then back to the next waypoint. We are very good at finding and mitigating those unanticipated failure modes, both self-inflicted and computer generated.

We still taxi, takeoff, and fly the visual approach with little automation. During my B-777 checkout, I was asked to fly a V1 cut without the automatic rudder input. I asked, “Why do I need to practice multiple emergencies (loss of an engine, and loss of the autorudder)?” The answer was that it’s not really much of an emergency if you can fly an engine-out departure like a normal one. I will take this as a compliment: an engine failure during takeoff is still too risky to allot to the automation.  I don’t know why we haven’t implemented auto-taxi. Maybe it’s because the low-risk situation doesn’t warrant the expense. I used to say after turning off the runway, “It was a good flight and I don’t see how we could possibly be killed between here and the gate.”

Any comments about what we humans do best? Why aren’t we practicing those things, like visual approaches? Hello, management, are you listening?

June 12, 2015

I just read my June issue of “Soaring” Magazine. In it Rick Eriksen comments on this subject in “Today’s Pilots Depend Too Much on Technology, adding to Human Error.” He says, “Planes fly the same way they flew back when I was flying in the 1970s, ’80s, and ’90s. And we made it work with much more reliability than they do with today’s over-the-top automation.”

I have to disagree in that statistics clearly show that automation has made us safer. I do agree that many of us have checked our brains at the door and let the automation run. However, if we return to rule #3, “pilots must be proficient at all levels of automation,” and we agree that is a good idea, then how do we convince reluctant managers and pilots that it is a good idea? Mr. Eriksen says, “Maybe it is time for the FAA to start to begin to differentiate between flying time and computer time.” That’s a good idea for managers, because training and check rides are so closely monitored. How about the lazy pilot: “Gear up, flaps up, autopilot on. Aren’t I a wonderful pilot?” And then there’s the pathetic airline pilot typing their way around a visual approach with the mode control panel. I think it was an extreme dependence on the autothrottles that nailed the Asiana pilots, after all, the airplane hit the runway.

I regret that many of us in general aviation do not maintain our manual flying skills sufficiently. However, it is completely unacceptable that airlines and other professional pilots fail in this regard. The fix is simple: the regulatory authorities demand that manual flying skills and visual approaches be demonstrated on rating and recurrent check rides. If they tightened down the screws on this, pilots would be out there practicing.

 

Published by

Don

Soloed in 1962. Seven years in USAF flying F-101, F-102, F-106. Got lucky and hired by Delta in 1977. Flew most of theirs, retiring in 2006 off the B-777. Owned and did some airshows in T-33. ALPA's Human Performance guy for 20 years. Helped develop IFALPA and ICAO policy on Automation and Workload. Fly a V-35B Bonanza now.

22 thoughts on “Why airplanes crash”

  1. My experience with automation and crew behaviors with automation is somewhat limited to a small sampling of the larger aviation community. On the other hand, we do have some of the more advanced systems available (sans auto land capability and cat III operations).

    What I observe points to what I consider a cultural issue as it relates to the appraoch one brings to the cockpit. I liken it to what mass media has done to our society unencumbered. Automation introduced to the cockpit without strong cultural and professional dicsiplne has created a whole host of new behavioral norms with potentially destructive outcomes.

    Academia as well as the host of this site has done an outstanding job in quantifying many of these issues and providing reams of literature detailing proper use of automation. In my world, and this is just my opinion, strong leadership in enforcing a culture of professionalism, precision, and cockpit discipline would go a long way in navigating around some of the common failures pilots encounter with automation. This opinion does not suggest we are not professional, nor does it suggest we lack discipline, rather, it suggests, when we experience change (such as when a new technology in the cockpit is introduced) that change needs to be managed so that our group does not lose the skills that made us disciplined professionals. That comes from our leadership, both in our school house as well as our organization.

    1. Tom,
      I agree with your analogy of how mass media tells us what is important. Who is to decide how we integrate new ideas into aviation? How about the aforementioned dinosaurs who could not embrace CRM? When our employer demanded that we fly differently, work got safer. Maybe there is a little narrow mindedness in all of us.

      1. “Who is to decide…” Is that not the 64000 pound gorilla in the room?

        Does it not all start from the top? We would hope our leaders are seasoned veterans with a penchence for doing things right and open to new ideas.

        I have long believed that cockpit professionalism, knowledge growth and learning should be included in our yearly evaluations. Not for punitive reasons but rather to show a commitment to pilot improvement. We can all improve in some aspect of our profession.
        But you are correct in your self reflection about narrow mindedness. I find the older I get, …..

  2. Posted the above prior to the second half of the discussion. Much of what I mentioned above is still germane but, specifically, I think the senario cited with ceiling and vis at 700/2 might be dependent on work load. Might be less inclined to hand fly an RNP 1 STAR with a descend via clearance domestically into a busy termina area or a complex RNAV arrival into Frankfurt or some other congested airspace where there is a lot going on despite fair to good weather. What triggers do you use to determine when enough is enough? I use gut feeling but generally, will use autopilot when departing and arriving busy airspace and hand fly more when conditions are less hectic.

    As for trapping and mitigating errors, I like the “two computers in parallel” rule. Have both crew members concur on critical steps such as parking brake, altitude, clearance change, etc. Ambiguity demands external validation.

    1. Indeed, what triggers when enough is enough. The age of iron MEN in iron machines has passed. We all have workload limits, both cognitive and physical. Being able to admit this and turn on the autopilot, not because we need the practice, but because we need it, is a trait I want to have. Fuel concerns, crosswinds, equipment failures, and yes, even trouble at home impinge on our cognitive capacity. Maybe it’s not only time to turn on the autopilot, but to ask your fellow pilot to take this one.

  3. Great post and I totally agree. I conducted a HF remediation training on 2 pilots regarding pilot monitoring. One of them expressed exasperation at not “just flying”. I told him those days are long gone unless he wanted to buy his own plane. As a professional he’s expected to be fluent in CRM skills, Threat and Error Management skills, Automation skills, Power Distance Index and Pilot Monitoring skills. In debriefing and retraining his incident, he had no clue it was caused by a lack of understanding communication skills and applying those skills as the PM. I pulled up Key Dismukes paper on errors: 3 types; Procedural, Checklist and Monitoring. The data shows pilots only trap about 6% of the Monitoring Errors. He claimed to never have heard this information and when I asked him if he ever read professional aviation journals. Never had but still considered himself a professional.

    1. Michael,
      I reread Key’s paper that you mentioned. I found it by Googling “Pilot Performance, Error, Automation, and Workload.” It’s a great framework for what we are talking about here. That is, procedures, checklists, and monitoring. I suppose that the direction that this discussion is going is to ask the question: “Are there things that single pilot guys can use that the airlines have learned?” Single pilots could get married. No, just kidding, airline pilots aren’t very successful with that. After submitting articles and having them rejected by “Flying Magazine” many times, I learned that they don’t want to hear from the airline community. I think that is wrong, because I can see many benefits of my airline training in my single-pilot flying today. Another question I am hearing from Tom is, “Can corporate flight departments and the airlines learn anything from each other about procedures, checklists, and monitoring?” I hope to hear more from you since you have a wealth of knowledge on this subject.

  4. Thanks Michael. That’s great insight on keeping up with current advances in resource management. It’s pretty spooky flying alone in a little airplane knowing that we only trap 6% of monitoring errors. I’m glad to see that you are still at the forefront of CRM thinking. I hope your golf game is faring so well.

  5. Thank you for sharing superb informations. Your website is very cool. I’m impressed by the details that you have on this web site. It reveals how nicely you understand this subject. Bookmarked this web page, will come back for extra articles. You, my friend, ROCK! I found just the info I already searched everywhere and just could not come across. What an ideal web-site.

  6. POSSIBLE SOLUTIONS TO TWO OF TODAY’S FLIGHT SAFETY DILEMMAS?

    THE “JET UPSET” PROBLEM
    50 years ago when jet airliners began flying in the stratosphere pilots did occasionally hand fly the machines at cruise altitude. One of these occasions was when the aircraft entered thunderstorm activity. This activity often produced violent turbulence with a simultaneous updraft on one side of the aircraft and a downdraft on the other side producing conflicting instrument readings across the cockpit and large changes in pitch attitude and climb and descent indications. The procedure in this situation was to disengage all automatics, autopilot and autothrottle, to hand-fly the aircraft simply to maintain the constant attitude with a thrust setting that was known to produce a speed at the present altitude about the middle of the “buffet boundaries”. Because they knew how to hand fly at altitude these pilots were familiar with the appropriate attitude and thrust settings for the condition.

    It has been said that even test pilots have been caught out by conflicting instruments resulting from lost pitot/static information and crashed, but the above procedure was taught to all airline pilots. Since then the designers have been persuaded to let computers take over what pilots are better at, flying the aircraft, and left pilots to do what computers are better at, monitor conditions for any deviation. It is my understanding that very few airline pilots today ever hand fly the aircraft at cruising altitude so are unlikely to know, to the accuracy needed, the pitch attitude and thrust settings for cruise conditions. If that is the case then we have to find a way to overcome these problems.

    I suggest that all the information is available in the aircraft’s computer’s memories and a program could be constructed comparatively easily to take effective action in this situation. A switch or button to select a new mode could be provided that the pilots would operate when the “jet upset” conditions were identified. The computer program would then take over the flying of the aircraft to new parameters, holding the pitch attitude and maintaining heading and thrust to give a speed between the buffet boundaries, max IAS to Stall, until the pilots can resume normal control. The required information for these settings is already in the computer memories and the weight is known so the only variable in doubt is altitude. This program could use the mean altitude taken over the last ten minutes as a datum to make the calculations and if that is not available in the FMS it could be accessed from the FDR. It might be a little inaccurate but it would serve the purpose for the safety case.
    I have “been there” on two separate occasions in the past and lived to tell the tale but if the pilots are not in practice then the computer solution might just save the day.
    THE FLYING INTO THE MOUNTAIN PROBLEM
    The other problem is loss of Geospacial orientation – not knowing where the mountains are on the descent.
    About 30 odd years ago there was much research into how to prevent pilot disorientation and situational awareness. We have available today glass capable of being transparent and displaying information on the same pane. Isn’t it time we had windscreens made of such glass? We could then take advantage of two technologies. The PC programs showing topographical displays for most of the globe and, in particular, approaches to most of the airfield in the world. This together with the research that started some 30 years ago to display a “Tunnel in the Sky” would give a much better set of information. This could overlay the topographical information already displayed. When IMC the pilot would have a true representation of the topography on the windscreen. Thus because the information does not require such interpretation levels the pilot can see and avoid the mountain. Added to the display without overloading the pilot could be other aircraft traffic, showing position and relative movement, possibly with an ATC tag. The Autoflight system used to fly the aircraft has knowledge of the predicted path of the aircraft. That could be used to show radio aids, flight path boundaries and restricted areas so that little interpretation of Navigation Display icons would be needed. Selection of individual parts of this total display would be available or the total of all the aspects at pilot discretion.
    This all depends on the accuracy of the aircraft position being of a high order. However with the improvements in navigation by GPS and the satellite telemetry this should become available by the time such a set of kit could be produced.

    It may be Pie in the Sky but it could be the way forward.

    1. Paul,
      You make good points. On the hand flying at cruise issue: As I understand the rules, if you are flying (cruising) in RVSM airspace, you must have the autopilot engaged. Therefore practicing manual flying between 28,000 ft. and 41,000 ft. just became impossible. How is a pilot to become, or remain, proficient at manually flying their aircraft at high altitude? I don’t have a pat answer, but it’s pretty clear that it has become more difficult. Also, the assertion seems to be that it’s a bad idea to do so. I can remember flying the MD-11 (now the BMD-11) early on. It has a highly augmented flight control system. The dinosaurs were terrified, but bid to fly it anyway, because of the pay. One of them told me, the First Officer, “You just can’t manually fly this airplane. It was designed and built to be flown by the autopilot only.” When I disengaged the autopilot at 41,000 ft. for a little practice, you can only imagine the response – complete silence, sweating, and that caged animal look in their eyes.

      On the Situational Awareness (SA) issue: The “Tunnel in the Sky” is especially sad to me. When it was first introduced, I participated in some of the test, and had access to much of the resulting data. The consensus of the “experts” was that although the pilots unanimously liked it, they could not show any increase in overall safety from its use. Therefore don’t buy it. I believe that its renewed popularity in the industry proves that the early conclusions were faulty. The experiments were designed around the comparative error rates of highly trained pilots at relatively low workloads. Even when I was flying 700 hard hours a year, I felt a significant reduction in cognitive workload when using it. I think if we were to conduct those same experiments today, focusing on measuring benefits in a high workload situation, rather than error rates at lower workloads, the results would be different.

  7. Tom is so right! I well remember my introduction to the jet engine. 35,000 feet, no pressurization – just 100% oxygen. Instructor says ” hold tight to the port throttle”. He then whacks the starboard throttle fully open. Engine coughs and flame-out ensues! be gentle and aware with jet engines.

  8. I agree with all that is being said about the current state of the art. However, I would like to just make a comment that goes right back to the Captain monitoring the original autoland experiments. Although charged with such monitoring the performance the instrumentation was not showing the same information going to the autopilot. From then we have an even greater discrepancy where the automatic systems are getting not only Rate of rate of change in all planes but algorithms in the software predict the outcome of changes very accurately. If we considered giving pilots better instrumentation that showed, in an easy to assimilate manner, the same information we could probably do just as well – if not better. That problem will have to solved by the engineers who got us into this set of conditions in the first place!

    1. Paul, in the below, I make an indirect point about your notion of auto pilot computers.

      One of the nicest flying family of business jets I’ve had the opportunity to fly are the Falcon Jets. In my F2000 training in Paris, I was paired with a recently retired French Air Force fighter pilot who swore it handled and felt just like the Mirage Fighter. When flying a Falcon, the yoke barely moves, you need only pressure the yoke for the desired flight path.

      In my F900 type ride, after the ride was three quarters over, I decided I better use the autopilot so the examiner could tell I knew how. Not because I was an exception aviator but, because the plane and avionics were so superbly paired. The flight handling characteristics were divine. When a change in configuration was called for from clean to full flaps and gear, there was no hint of pitch change. And this, without any stability augmentation such as stab bias or trim input. With auto throttles engaged, nothing other than some noise and power change were perceptible.

      Interestingly, much to this blog’s participants amazement I’m sure, the training curricula for the Falcon and Cat III to 700 RVR and 50 ft. is for the approach to be HAND FLOWN using the Heads Up Guidance system. Although counterintuitive, it must be that hand flying the profile on the HUD provides better SA than monitoring the autopilot.

      In your quest to find that balance, (hand flown vs automation) I think the flight characteristics of the aircraft and its capabilities plays a significant role. The Challenger 600 series of business jets did not fly nearly as well. While hand flying, I would routinely configure in a turn to avoid having to fight the aircraft and re-trim from level flight. During a turn I’d reconfigure and allow the speed to drop to my new target. When I rolled out, the plane would be trimmed for the new speed and I didn’t have to fight it with pitch. The Lockheed JetStar was a real pussy cat although the trim lacked dexterity. You were always “two up, one down” or vice versa at higher speeds. The Gulfstream is quite harmonious in the vertical profile, you have to work at busting through an altitude. Just pulling back on the throttles (or letting the auto throttles keep your speed while leveling) will assure you nail altitude every time. During configuration changes, there is some pitch change that is biased with stab movement.

      I personally try not to do too many things at once. If the guy in the right seat is off frequency, I put the autopilot on if hand flying. If it’s a mins approach or we are doing an AR approach with less than .3 RNP, it’s a must. If I’m going into a busy terminal area, I use it. On departures domestically, or on a vector departure, I usually hand fly. RNAV departures are busy and require all your attention.

      Although a little outside the scope of the single pilot driver, I think the same basic tenants apply in that if the airplane can get away from you or distract you, such as reconfiguring, use the automation. Once you have things established, take over manually. That might make a good trigger for knowing when to let the other guy fly.

    2. Paul,
      Thanks for your early work on this. I’ve heard pilots say, “I’m not exactly in the loop, I’m not outside the loop, either. I’m sorta flying alongside the loop.” I’ve been curious about some of the goings on in the systems too. In the MD-11, the fuel system computer could do lots of confusing thing simultaneously, like move fuel forward from the tail because it was getting too cold, move fuel around for CG control, and move fuel for balancing uneven engine burns. While watching the process, you would think something was wrong, but it always turned out OK. We said that the MD-11 wore out the fuel before it used it up. As far as information during the approach, I don’t think I could handle much more. The flight path vector does a pretty good job of predicting where the aircraft is going.

  9. Don and Tom
    I have to hold my hand up to never having operated with a “Glass Cockpit”!
    However, in the 1980s I was working at the RAF Institute of Aviation Medicine, the Flight Skills/Psychology Department where research was being done into Displays, Reaction times and particularly Fatigue. That information and my own extensive experience helped when I was dealing with Reporters to the Confidential Incident Reporting Programme being operated at the Institute. At some of the Conferences I attended Charles Billings and I used to comment on how the presenters were often “reinventing the wheel”.
    All that said, I can now see that some of the results have now percolated down into the Industry. So, it is time for this “Old Fart” to sit back and listen/read about things as they now are from those who have “Been there, Done That!”. I’m sure there are still improvements that can be made and I’m eager to know what they might be.

    1. Paul, I feel fortunate to have spent the first twelve years of my career on “round dials and steam gauges”. Not to minimize the advances in the glass I fly today, but below, I will describe something I’ve begun to realized about when computers do work for the human mind.

      Our gracious host states, “I’m hoping to find consensus on the use of automation…”

      I offer a point of discussion to aid in coming to that consensus. Although I can’t backup my observations with hard data worthy of a thesis, I make these observations based on my personal experiences and observation of others.

      I’ve grown to believe automation should unload the operator when things get busy but the operator should be encouraged to become mentally engaged when workload is light. When I look back at how aircraft have evolved, I cringe when I realize how the mind has acclimated to maintain (or not maintain) situational awareness In the current generation cockpit compared to state of the art thirty years ago.

      My primary years of flying taught me to create and maintain a mental picture of where I was and the energy state of the aircraft. My mental picture was created by triangulation, a sense of timing, altitude awareness, ground speed, paper maps, approach charts and familiarity with the airspace I was in. In the current generation of aircraft I’m beginning to believe It is an easy to become dependent on the the automation to know where one is and when to act. Has position in space and time (situational awareness) become a scalable picture presented on a screen rather than something burned into one’s mind as a result of endless (and fatiguing) mental calculations and estimates? With all the visual references and queues, I find that we can determine exactly where we are and what the energy state of the aircraft is at any moment but do we really KNOW where we are, where the airplane is, at any moment?

      I would humbly (in this esteemed audience) suggest, the balance between automation and human interaction must lie in the mind being engaged constantly and predicting rather than observing. When things get busy, the automation has to aid the human (yes, the human should rely on the automation to maintain his or her situational awareness). Conversely, when workload is low, the mind must be active and engaged so it can depict and predict situational awareness. Periods of low workload also offer opportunities to dust the rust off those manual skills. I am beginning to believe that a mind will be made lazy by automation and lose SA very quickly when the automation is reduced where as, if the operator disciplines himself or herself to predict and maintain situational awareness ahead of the automation, he can maintain that SA when the automation is no longer available or when unpredicted events occur. The above statements don’t necessarily suggest that it’s less safe to rely heavily on automation but, rather, the crutch automation plays in providing SA becomes the prosthetic limb. (Organ in the case of the mind).

      For the single pilot flying various levels of automation, I’d suggest staying ahead of the automation. Discipline yourself to imagine what the picture should look like, what your trajectory should be. Stay ahead of the avionics and the airplane. Stay busy during cruise. Be vigilant of contingencies. When the workload heats up, your mind will be energized and you can use all the automation to help you. Just another opinion about the human-aircraft interaction.

  10. I was delighted to read about Three Mile Island.

    The Three Mile Island accident was near and dear to my heart having interned at the Breazeale Nuclear Reactor at PennState while attending College in NUC E. I was there the durning the days preceding and following the accident. (No, didn’t finish that degree, after three years, I went to Parks College and completed the Aircraft Maintenance Engineering Curriculum).

    I can’t speak to the automation although I’m sure it was advanced for the time. When the accident happened, my recollection of the daily briefings detailed that there was a slug of air to a gage causing it to indicate erroneous pressure. This caused the operators to execute procedures with wrong information. This is very simplified. There was a failure of a valve to close that allowed cooling water to vent from the containment. This failure was not detected because the valve did not transmit position to the control room. In reading some history about the accident after reading your comments, one of the NRC findings was that the most crucial state for a reactor is to stay covered in water and yet, there was no direct reading system at the time to tell the operators the core water level.

    But, you are right about losing focus. In the TMI case, I would suggest they did not lose focus because of complacency or lack of professionalism. They lost focus of what the true problem was because the instrumentation was lacking in the one element that could have saved them while they were responding to information that was faulty because of failed equipment. A direct reading containment water level would have focused the operators on the most effective course of action. Keep the core covered with water.

    For the light airplane single pilot operator, it’s the same old saw when things get confusing: “Fly the airplane”.

    1. Tom,
      Thanks for your insight on nukes. From your description of the TMI disaster, my takeaway is that there were several unknown failure modes imbedded in the operation. If we were to turn our brains off and just hand over control of our aircraft to the automation, I feel confident that such unknown failure modes would continue to kill us for centuries to come.

      1. Don,

        I agree 100% with the discipline reference you made above. We touched on this in previous discussions and, for me the question begs, how did organizations you’ve participated in create an environment fertile for participants to maintain and pursue high levels of discipline and professionalism? Also, how did those organizations encourage participation in their safety management efforts?

        1. Tom,
          When I look back at how Delta and I changed over the 30 years that we were together, the answer is, both of us. When I started, I wanted to be a good pilot, and just as importantly, fit in and gain the approval of my fellow pilots. In the ’70’s, approval required me to do the crazy stuff that they were doing, such as ripping to throttles to idle 80 miles out and never touching them again until after touchdown. When I got old, and started “line checking” in the ’90’s, all that was gone. Everyone I encountered had that desire to “pursue high levels of discipline and professionalism.” I saw the change happen, but I still have difficulty explaining exactly how. Certainly, management, leadership, training, goals, etc., etc. are important or essential. I believe that an aspect that is frequently missed is the goal setting in the mind of the pilot. We are very good at achieving our goals. Whether that is to be the biggest risk-taker, or the most professional, we will get there. As I alluded to before, Delta proudly maintained that it was a “Captain’s Airline.” Leadership was invested in the Captains, and they had many rascals in their ranks. The Chief Pilots never disciplined a Captain unless there was a serious incident. Since Delta had not had any accidents, the obvious conclusion was that the crazy stuff that we were doing was OK. Of course, that theory was proven wrong. The trick, I believe, is to convince the new guy that we really do it right when no one else is looking. One captain whom I know said, “I believe in doing it by the book, it’s just easier that way, since no one has to remember what the captain likes.” That sounds reasonable, but unfortunately everyone hated to fly with him because no one can fly perfectly. I even caught him intentionally violating a standard, which rendered his argument void. Did Delta pilots change because they, on their own, realized that their way of doing business was not working, or did they change because management began to establish and reward higher standards. The latter, I believe. This is pertinent to automation, because management must be a part of how we interact with it. When we were learning to fly, we all had those moments of terror when the instructor said, “Forced Landing.” Maybe it’s time for the airline instructor to say, “Automation failure.”

  11. Couldn’t have put it any better. I can see the change and the disaster lurking ahead on the blind use of automation. Experienced its dangers where co-pilots were totally at bay when a part or all of the automation malfunctioned. In fact I was asked, “what do we do now?” I had replied what did people do when there was no automation. Yes automation is great especially on long haul flights and when there is weather or even during night or when flying into unfamiliar terrain, but hand flying skills help when the facility fails or has reached its limits. Yes the good old military training was great to keep one alive. Thanks Don. Saving it to brief the GA lads where I continue to impart what I had learned hoping to pass on the experience to the young aspiring pilots.. Not a bad vocation after retirement. Just a reminder of a Napoleon saying: ‘Oh! God what folly, to give youth to the inexperienced’. Take care.

Leave a Reply to Tom Cancel reply

Your email address will not be published. Required fields are marked *