Summary
Advances in aircraft automation have significantly improved aviation safety; however, Loss of Control In-flight (LOC-I) remains a threat. In fact, in some ways our reliance on the magic of automation exacerbates the LOC-I problem. Understanding the implications of automated flight and targeting pilot training to address the gaps will lead to a reduction in LOC-I related fatalities in both automated and manually controlled aircraft.
The Reality of LOC-I
Advances in aircraft automation, including fly-by-wire flight envelope protection systems, have helped aviation to achieve the highest overall level of safety it has ever enjoyed. Aircraft utilizing fly-by-wire flight control systems have a record of safety that is at least ten times better than those of classically controlled aircraft.
Despite this fact, Loss of Control In-flight (LOC-I) has continued to increase as an overall factor in airline fatalities, and is identified by the NTSB as the leading cause of fatalities in every sector of aviation. In 2015 the International Civil Aviation Organization (ICAO) found that only 3% of accidents were attributed to LOC-I, but they accounted for 33% of all fatalities. The LOC-I situation continues to get worse as a percentage of overall fatalities, though not in the overall number of events or fatalities. The most recent data from Boeing and the Commercial Aviation Safety Team (CAST) now show that 47% of all airline fatalities worldwide are a result of LOC-I.
It is clear that as good as our modern flight control and automation systems are, they can occasionally fail, causing problems which can be extremely challenging. In 2008 an Airbus A330 experienced incorrect air data values which caused the flight control primary computers to command nose-down pitch inputs that were unable to be directly overridden by manual control inputs. In 2011 a fly-by-wire Falcon 7X experienced an uncommanded pitch up that resulted in a 4.6 g pitch up to a 40 degree climb.
It is not always uncommanded flight control inputs that are the problem. In some instances the pilots’ interaction with the system itself creates the problem. In the well publicized case of Air France 447, or the lesser known crash of AirAsia 8501, pilots stalled aircraft which had functioning controls, but were operating in degraded modes and had lost the stall protection normally provided through technology.
The result is that despite our amazing advances in flight control protections, we find ourselves facing the fact that the leading cause of loss of life in aviation is from the lack of pilots’ ability to retain control of their aircraft. What is the solution?
Why LOC-I Persists
The first thing we must understand is that there may be a problem with the quest for absolute safety itself. In the paper “The Paradoxes of Almost Totally Safe Transportation Systems”, the author argues that continuing to look for a technological “Silver Bullet” that will protect us from all failures can create a threat of its own. Seeking a technological solution for protection creates diminishing returns, and creates a human factors issue itself. By putting all of our hopes in the belief that system design will save us, it prevents us from seeking other, more wholistic, solutions. By combining training which may combine with technological solutions in a synergistic way, a ‘belt and suspenders’ approach is created, which results in greater overall safety than the single-sourced, technical solution alone.
Our overall safety in aviation has never been better. What is it about this ‘LOC-I problem’ that is slipping through the gaps? Let’s look at the four accidents mentioned earlier to see if we can identify any relevant factors.
In the first two incidents the flightcrews faced the thorniest of problems: their flight controls were not responding appropriately to inputs; yet both airplanes landed successfully. The aircraft were compromised by failure of the same sophisticated flight controls that had been designed to protect pilots by keeping them safely in the normal envelope. Yet, the captains of both these stricken aircraft found ways around the flight control failures they faced to reach a successful conclusion to their predicaments.
In the second two cases, which resulted in crashes, control was lost despite having flight control functions that were capable of retaining the aircraft in the normal operating envelope. Though the flight control protections which were normally in place may have been degraded, the pilots were unable retain control without normal levels of protection.
Let’s take a look at the training of the successful pilots versus those which lost control. The flightcrews of the surviving aircraft both had experience with flight operations which took place outside of the domain of normal transport category operations. The pilots of the two accident aircraft did not. Certainly, this correlation does not imply causation. Just because you have all-attitude/all-envelope experience does not always mean you will be successful, and just because you don’t, certainly does not mean you are doomed, but it does bring us to a larger point.
Our current civil licensing training assumes that the aircraft we are flying will remain in the normal envelope, and that the current training pilots receive will be adequate to keep the aircraft in the normal envelope, or return it there in the event of an unanticipated aircraft upset. Facts tell us otherwise. In the first two events, aircraft departed the normal operating envelope without any failure, inputs, actions, or omissions on the part of the pilots involved. Recent accident statistics tell us that although pilots may never have been better at flying aircraft safely in the normal envelope, in instances where they find themselves outside of the realm where we normally train, they are not equipped with the full range of skills necessary to regain control. Some of the knowledge and skills required in the upset domain are highly counterintuitive; no amount of experience in the normal envelope will necessarily inform you of the correct actions required once outside of those parameters. Some of the “rules” change.
The Solution: Mitigating LOC-I
Both pilots of the aircraft whose flight controls ‘went rogue’ and executed uncommanded excursions were former fighter pilots. This is not a “military vs. civilian” discussion, which includes multiple differences, but strictly limited to whether or not prior experience prepares pilots for unplanned events. Of course it does. There is no doubt that the attitudes and accelerations encountered when the fly-by-wire flight controls in discussion went haywire were beyond those required or seen in standard civil licensing. The fortunate pilot’s familiarity with flight outside the normal operating envelope was, by their own admission, helpful in their recoveries. The required training for all pilots should extend beyond the normal envelope to provide them with effective skills for responding safely to departures from the normal envelope when they occur. Even though rare, aircraft upset events are often catastrophic.
The broader lesson to be applied here is that with the inclusion of Upset Prevention and Recovery Training (UPRT) we can arm pilots with knowledge that complements the protective flight control systems and enhanced automation found on today’s aircraft. This is why the FAA Loss of Control Avoidance and Recognition Training (LOCART) Aviation Rulemaking Committee called for providing UPRT to all pilots prior to commercial licensing. This recommendation was accepted by ICAO, who changed their pilot licensing guidelines to include UPRT in actual flight for all pilots worldwide prior to receiving a commercial license.
From autoland to flight envelope protection, today’s highly automated aircraft have capabilities and features that seem nearly magical, but redundancy is a major contributor to aviation safety. Given the prevalence of LOC-I, providing UPRT would ensure pilots have the essential knowledge and skills they need and can rely on even when the magic fails.
Comments: