Black swans

“We have become complacent by thinking that technology will solve all the problems,” Meshkati said. In a 2009 article Back to Basics, published in Air Transport World three days before the tragic loss of AF447,Meshkati warned that the gee-whizz technology “may be masking a deterioration and deskilling in basic flying ability and that the lessons learned by generations of pilots may be lost to the new breed of pilots. ”

Wake up call

Meshkati sees AF447 as the aviation industry’s Three Mile Island. “Business as usual is over,” he cautions, saying that many regulators do not yet fully understand the problem of technology, automation and the pilot interface, and are behind the industry because of manpower and funding issues.

And Meshkati is well credentialed to make that observation, being a Jefferson Science Fellow and Engineering Advisor to the US Secretary of State, and a member of the committee which analysed the BP Deepwater Horizon disaster.

Speaking more generally about technology with Australian Aviation, Meshkati notes that “human ingenuity can now create technological systems whose accidents rival in their effects the greatest natural disasters, sometimes with even higher death tolls and greater environmental damage. ” “The effects of human error on these systems is often neither observable nor reversible, therefore error recovery is often too late or impossible,” he said.

Meshkati says we must go back to basics and rethink how we interface with and train for today’s cockpit.

“Many technology systems failures implicated in serious accidents have been traditionally attributed to operators and their errors. Consequently for the problem of technology systems safety, an engineering solution has been suggested. For instance many systems designers postulate that removing humans from the loop is the most convenient alternative for the reduction or even elimination of human error and therefore consider automation the key to the enhancement of system reliability. ” But Meshkati warns that in many cases automation only aggravates the situation and becomes part of the problem rather than the solution.

“In the context of aviation, studies have shown that automation is even more problematic because it amplifies crew individual differences and it amplifies what is good and what is bad. Furthermore, the automated devices themselves still need to be operated and monitored by the very human whose caprice they were designed to avoid. Thus the error is not eliminated but only relocated. ” Flight Safety Foundation president Bill Voss agrees that AF447 is a wake up call.

“If AF447 had happened elsewhere in the third world to a lesser airline, the industry might have glossed over it. But Air France is a sophisticated and proud airline, the A330 a state-of-the-art aircraft flying between two major cities. We really have to step forward now for the cause is far, far deeper and we must build the skills. It is time to fix it,” Voss said.

He sees the problem as a failure to adjust training to the real demands with the void being filled by incomplete information and assumptions.

“Pilots think that they can get into a high speed situation as easily as you could in the 707 and that is absolutely not the case. Aircraft are totally different aerodynamically today,” he said.

He also notes that while a standard stall recovery is increased power and nose down, it is also true for an Airbus that half stick back and TOGA power will also recover the aircraft because of the envelope protection.

“The aircraft will do remarkable things,” he explains.

Voss, who spent time at Airbus in the A330 simulator after BEA’s interim report was published, commented that what is lost in the transcripts of the accident is “how hard it is to get the aircraft into the position that the Air France pilots did and then hold it there.

“You have to really strive to do what these pilots did. The initial pull-up was 7000ft a minute –this wasn’t minor. ”

The right stuff

Voss sees another aspect to the training that needs close attention.

“It’s just not the training for that can be overridden by the person they sit next to on the line within a few months. Training doesn’t make a seasoned captain, other captains do,” he said.

“We need to put procedures and processes in place so that it isn’t degraded on the line. ” Voss notes that with RSVM airspace in place with 1000ft separation, pilots are not allowed to hand fly an aircraft over 24,000ft.

“Skills are being lost. We must go back and look at our training for it is not consistent with what the real world circumstances are. There is a much higher risk of loss of performance at high altitude or degraded performance like on QF32 than engine failures,” Voss said.

“And regulators need to give up some of the sacred cows –which they are reluctant to do. ” Introducing a fascinating perspective on training is Qantas A380 Check Captain David Evans, who was on the flightdeck training another check captain when QF32 suffered a catastrophic failure of its number 2 engine shortly after takeoff from Singapore on November 4 last year.

“One of my other roles is a volunteer ab initio instructor with 2 Wing RAAF Air Cadets at Amberley west of Brisbane. ” “I see young cadets training to PPL standard through the Air Cadets missing some basic skills as they self supplement their training using PC based Flight Sim,” Evans said.

“With Flight Simulator most don’t buy the rudder pedals and thus their flying skills in the real world become lacking. ” Evans also points out that many flying courses today only teach pilots about the onset of a stall. “When I learnt to fly myinstructor took me into a deep stall and a spin and you experienced all the sensations and had to recover.

“Reintroducing some basic aerobatics to the training would go a long way to solve this. In fact that is what we are currently discussing at 2 Wing. ” Evans has also found that because many pilots learn on Flight Simulator on a desktop PC they are focused only on what is in front of them and “peripheral skills are lacking and they don’t look out the window. ” Another fascinating observation made by Evans relates to the modern glass cockpits that are appearing on light training aircraft.

“When I am training young pilots they are often transfixed on the primary flight display and do not scan other instruments such as the engine. They just don’t look around. ” This strikes a chord with Captain Robert Sumwalt, former chairman of the Air Line Pilots Association’s Human Factors and Training Group, and now a board member of the NTSB.

“The NTSB has found that lack of monitoring of instruments is still a major factor in accidents,” Sumwalt said.

In 2002 Sumwalt co-authored a paper Enhancing Flight-crew Monitoring Skills Can Increase Flight Safety, which found that “effective crew monitoring and cross-checking can literally be the last line of defence. ” At the time Sumwalt cited NTSB’s examination of 37 accidents, which found that 84 per cent involved inadequate crew monitoring or challenging.

Sumwalt added in the report that research conducted to support the Flight Safety Foundation’s Approach and Landing Accident Reduction (ALAR) efforts revealed that 63 per cent of the reviewed approach and landing accidents involved inadequate monitoring and cross-checking.

Additionally, inadequate monitoring was a factor in 50 per cent of the CFIT (controlled flight into terrain) accidents reviewed by ICAO.

QF32

According to Evans the near disaster with QF32 raised a number of scenarios that the airline hadn’t trained for such as cabin communication and the events after landing which were as potentially serious.

When QF32 was nursed back to Singapore after nearly two hours with the crew dealing with 53 ECAM error messages after landing the number 1 engine could not be shut down because of damaged wiring.

At the same time fuel was spewing from the damaged wing only yards away from brakes that were red hot indicating 900⁰.

Complicating matters all the air conditioning had failed and the aircraft electrical system reverted to essential power, leaving the crew with one serviceable VHF radio.

“We had never trained for this scenario,” Evans said. “We also had our cabin crew on high alert for two hours in the cabin, ready to initiate a full evacuation if circumstances deteriorated. ” Commenting on a standard recurrent training set by the regulator, Captain Evans noted that he cannot remember any Qantas aircraft ever losing an engine at V1.

“But this is now changing to take in black swan [extremely unusual] events,” he said.

Reflecting on his QF32 experience compared to AF447, Captain Evans notes that the Qantas crew of five, with over 70,000 hours of experience including two check captains, had time to deal with the 53 ECAM messages.

“We had time but AF447 was descending at 3000ft a minute,” he said.

Captain Evans commented that the sheer volume of information presented to the modern aviator means he must prioritise his or her time between the presented information and the “real world”.

“Modern technology is inherently very reliable, however, it’s very reliable nature can lure an unsuspecting aviator into a false sense of security. “Adding blind faith into this information stream, especially if you are a Gen X or Y ‘technology native’ can have catastrophic results. ” “AF447 may be an example of this. Two young pilots were at the controls of a state-ofthe- art aircraft and faced with a loud and inyour- face false warning of an overspeed. This would have taken all their attention and was therefore reacted to. There were other cues present that were not reacted to, simple things like aircraft attitude and thrust settings. ” The BEA report said that the Air France pilots were confused by multiple warnings in the cockpit, and chief investigator Jean-Paul Troadec said black box data showed the crew only had 4. 5 minutes during which they could have corrected the aircraft stall, and that if they had responded quickly, the “situation was salvageable”.

Captain Evans noted that ECAM warnings can be confusing, but said pilots can cancel everything and simply go to the status page. “There is a short cut,” he said. “I did a simulator session the other day involving volcanic ash taking out all four A380 engines and ash getting into the cabin, like BA9. Multiple fire warnings in the cargo holds and cabin toilets were put ahead of the ‘Multiple Engine Flameout’ in the ECAM priority system. Logic dictated that these warnings were false and caused by the ash around the fire detectors.

However, we had to absorb and then delete these nuisance warnings to get to the real priority, which was to re-start the engines.

This took up valuable time, especially when you are rapidly descending towards high ground. ECAM wasn’t helping and added to the confusion. It taught us some lessons. ”

Automation insecurity

While there is strong debate over the interim reports into AF447 between some of the parties, it seems clear that there was a level of confusion as to what was happening, which is in line with a NASA study.

The study, completed by the NASA Research Center, was based on Royal Air Force Institute of Aviation Medicine data by Dr Marianne Rudisill in 1995 that surveyed more than 1000 pilots from 20 airlines and aircraft manufacturers about pilots’ attitudes and experience with flightdeck automation.

The strength of the study was that most respondents had flown aircraft from basic cockpit types like 727s through to Glass 2 types such as A320s and 747-400s. It found the general consensus was that “safety is increased with automation but automation may lend a false sense of security, particularly with inexperienced pilots. ” Pilots reported that there was a higher sense of “insecurity” during an automation failure and a general temptation to ignore raw information. The most worrying aspect was that pilots said their colleagues were “becoming complacent and relied too much on the automation, but that was often because airline SOPs mandated reliance on automation. ” In May the FAA took a major step forward to improve flying training, demanding greater emphasis on using full-motion flight simulators with crews working together in handling real world emergencies in a Supplemental Notice of Proposed Rulemaking.

According to FAA administrator Randy Babbitt, the proposal represents the most significant shift in philosophy and training in 20 years.

“The new rule will require flightcrews to demonstrate they can apply the skills, not just master them,” Babbitt said.

The key aspect of the change is that all flightcrews will receive training in recognising, avoiding and recovering from stalls and upsets.

“This new type of training will provide a more robust evaluation of pilots in [simulated] real-life scenarios,” Babbitt said.

The proposal came after the NTSB investigation and a congressional inquiry into the February 2009 stall and crash of a Colgan Air Q400 that killed 50.

Babbitt said the pilot training emphasis will shift to focus more on comprehensive competence rather than mastery of “individual” skills. “The new training will require a more realistic and coordinated effort among the crew [being trained]. It will be a lot more like flight. ” “I think the key piece here is that some of the simulation ability [now available] allows us to go past [training for] recognition and avoidance of a stall. Now you can actually put someone in a stall scenario and let them recover,” Babbitt said.

The proposed change would require that pilots be trained as a complete flightcrew, coordinate their actions through crew resource management, and fly scenarios based on actual events.

At the same time the BEA has set up a human factors working group to analyse “crew actions and reactions during the last three phases of AF 447, particularly in relation to the stall warning, cockpit ergonomics, and man-machine interface. ” The group comprises three BEA investigators specialising in human factors, a human factors aviation consultant, a psychiatrist specialising in risk analysis, an A330 test pilot and a type-rated A330 pilot. It will also consult with Airbus and Air France.

Evidence based training

In 2007 IATA launched its Training and Qualification Initiative (TQI) to update and modernise the training of existing and future pilots and engineers to accurately reflect the needs of current and future flightdeck operational procedures.

IATA, the airlines and manufacturers are working closely and in collaboration with ICAO, and the final draft program is expected to be ready for sign-off by ICAO in November and be applicable from 2012.

According to CASA’s manager flying standards Roger Weeks, who is CASA’s representative on the TQI initiative, the group has examined a host of data over the past four years, both accident and operational, to gain precise trends and problems with all generations of aircraft to tailor training to changing demands and issues.

“For instance we have studied flight data for over three million flights, examined the NTSB database from 1962 and examined 22 aircraft types and looked at over 20,000 simulation evaluations.

“A major test had been to identify criticalities in each generation of airliner,” Weeks said.

The program is looking at the following areas for pilot training: flight operations; evidence based training; instructor qualification; multi-crew pilot licence; selection criteria; and flight simulation training devices.

However, Weeks cautioned that it will be up to individual states to adopt the new training regime.

Much of what is being canvassed was adopted in Australia 20 years ago under Competency Based Training, which puts the emphasis on performing rather than just knowing.

Weeks added that since QF32 and AF 447, CASA and the Australian airlines have been working on training for more black swan events.

The last word goes to Captain Evans.

He reflected that pilots need to build in a “healthy scepticism of the information and an ability to see through the instrumentation and take in other less prominent cues to enhance the big picture. ”

The near disaster with QF32 raised a number of scenarios that the airline hadn’t trained for.