by Palmer, Bill
In June 2009, coincidentally right after the AF447 accident, the International Committee for Aviation Training in Extended Envelopes’ (ICATEE) group was formed under the Royal Aeronautical Society. The group consisted of more than 80 specialists from around the world. Their goal was to develop improvements in airline pilot training to prevent loss of control accidents in the future.
LOC-I accidents had been highlighted due to several recent high profile crashes: a Colgan Air Bombardier Q400 in Buffalo, NY, and a Turkish 737 crash in Amsterdam, Netherlands. They both occurred in February 2009, and both had been the result of improper pilot action that lead to stalls, though under different circumstances. Though they did not know it at the time the group convened, AF447 is obviously in that same category.
Results from more than three years of work by the group are due to be available in mid 2013, and are said to include a training matrix and an upset prevention and recovery manual. The group identified a list of shortcomings in training, including the limited environment pilots are exposed to in training, simulator realism at the edges of the envelope, g-force awareness, and the ability to create a “startle and surprise” environment in the simulator.
Sunjoo Advani, an aerospace engineer that headed the ICATEE, said, “As it turns out, one of the biggest problems is startle and surprise during unexpected and unforeseen events. LOC exposes [the pilots] in such a way that they have to go from a low state of arousal to a quick an effective response; and those responses can be counterintuitive.” Included in those responses may be such actions as pulling on the yoke (or sidestick) after being startled, even though stall warnings are taking place.
In the case of AF447, we see the crew going from a “low state of arousal” (cruise flight) to the sudden and simultaneous loss of reliable indications, flight director guidance, and autopilot control, combined with no outside visual reference. Bonin’s actions are often described as “inexplicable.” In light of the work of the group seem almost predictable.
Advani said that simulator training can be improved by teaching pilots to recognize and recover at various stages of the development of an upset. “For high-altitude stall training you should not be putting the pilot in the simulator and saying ‘recover.’ Pilots need to recognize the signs, the buffet, the stall warning, the stick pusher, and learn not to fight those systems. These are basics that we have not adequately or consistently trained for.38”
The training technique improvements are thought to be able to achieve about 75% of the goal in training improvements. The other 25% could be accomplished with improvements in the training devices themselves. The envelope of the simulator should be extended beyond approaching the stall, as the airplane’s actual stall characteristics are not accurately represented in the simulators. The actual airplane’s behavior tends to have a more violent buffet, and be less stable in terms of roll and yaw. One suggested method is the incorporation into simulators of a ‘representative model’ of a transport category aircraft’s stall behavior. While it may not match the individual airplane model’s stall characteristics exactly, it will be far better than the non-data the current simulator behaviors are based on today.
Additional simulator improvements could be functions that provide a clogged pitot scenario, wake turbulence encounter (which can often induce a rapid rolling motion), and other realistic models, in addition to the current menu of wind shear scenarios that modern airline flight simulators offer.
But there are limits to what can be done, even in the most advanced simulator, as it remains bolted to the floor. G-load sensation is difficult or impossible to represent. Some degree of positive g’s and accelerations are achieved by pitching the simulator back, but negative g’s (lightness in the seat), and high accelerations are not possible to create.
To answer these demands, a real airplane can be used, and is being used. Aviation Performance Solutions (APS), in Mesa AZ, uses a fleet of aerobatic aircraft to teach upset recovery training. Their clients are largely corporate and private customers, but there has also been some airline interest as well. One curriculum offered by APS involves a multi-day, multi-flight regime. You can practice these maneuvers all day long in a simulator, but it takes on a whole new level when the airplane is pulling down on your seatbelt and objects are floating or flying around the cockpit.
In the aircraft, the trainees feel the real-life forces and cues, experience actual upset attitudes and need to recover. Then they are placed in the simulator again and can compare the best the simulator has to offer with real forces, and make the correlations.
Randall Brooks, in his paper Loss of Control in Flight, Training Foundations and Solutions39 states:
Although there is no technical challenge in creating a visual scene of a 110° bank attitude with the nose 30° below the horizon, the learning experienced while viewing that scene from the security of a simulator bay has no relation to the knowledge and attitudinal changes received from viewing that very same attitude strapped into an aircraft.
The development and acquisition of skills related to correctly and appropriately responding to the psycho/physiological reactions inherent in confronting undesirable aircraft states is fundamental to executing a safe recovery from an unexpected aircraft upset. The required learning cannot be achieved absent from the consequences faced in actual flight.
What this means is that some training in an aircraft is required to fully prepare a pilot for an aircraft upset encounter.
The addition of airplane training adds some additional risk. But the psychological impact of being in a real airplane in an actual unusual attitude that must be recovered from enhances the training experience, and hopefully its effectiveness. The additional risk is mitigated by specially trained instructors, in a structured training program, in an aircraft suitable for this maneuvering. While the addition of aircraft training will increase the risk for that training, it should increase the safety of airline operations staffed with those trained pilots.
In the decade of 2000-2011, almost 1500 people died in loss of control in-flight accidents.40 If the fatality rate could be reduced by any meaningful measure by applying the risk to the pilots in training instead of the traveling public, it seems to be a reasonable thing to do. There are, of course, the cost and logistical factors of adding a completely new type of training, that is not widely available, any applying it to tens of thousands of airline pilots. It will not come without resistance from those paying for it.
ICATEE believes the current airline pilot population should receive dedicated simulator sessions in upset recovery training, “including specific elements that can create surprise in the simulator.” It should be followed by recurrent training every 3-5 years.41
Creating an element of surprise in simulator training will not be easy. Nobody expects to go to a training or checking session and sit at cruise for 8 hours. The subjects to be covered are known to the trainees, even if they were not well briefed immediately prior to the training session. A degree of randomness in checking scenarios is often currently used, but the simulator’s programming and the instructor’s ‘bag of tricks’ contains only so many possibilities.
In 1985 we did not know how to train crew-resource management (CRM), threat-and-error management (TEM), or how to incorporate other human factors elements. All of which are integrated into flight crew training now. Perhaps techniques will be developed to better prepare pilots to deal with startle, surprise, working under high stress situations.
Enhancements to the simulators themselves to add additional faults (e.g., clogged pitot scenarios) and simulations of post-stall behavior will neither be easy nor inexpensive. Detailed analysis of incidents and accidents like AF447 by simulator manufacturers and regulatory authorities will go a long way toward making the simulators of the future better than today’s.
Chapter 10: Lessons Learned
There is much to be learned from almost every accident and the loss of AF447 is no exception. This accident centered around a loss of
control at altitude. According to the British Civil Aviation Authority, loss of control events have been identified globally as the current most serious risk to flight safety - and the biggest single cause of commercial air accidents over recent years. Loss of control often follows a partial or full stall to an aircraft.
Many of the largest threats of the past such as controlled flight into terrain, wind shear, and mechanical failure have been very successfully reduced with improved Ground Proximity Warning Systems (GPWS), improved airborne weather radar, wind shear detection and recovery guidance, and improved engineering.
High Altitude Stalls
Clearly this is a stall accident. All of the major aircraft manufacturers have updated their stall recovery procedures to emphasize reducing angle of attack as the immediate and primary means of stall recovery, with power application only after control is assured. These revised procedures also acknowledge that high power settings on airplanes with low hung engines may in some instances be contrary to the ability to reduce angle of attack effectively. We have seen, in this case, how at one point the reduction of power caused the nose to pitch down and angle of attack to reduce. Unfortunately, the pilots were acting contrary to the required inputs to complete the recovery.
Primary flight students are taught that an airplane always stalls at the same angle of attack. That is true enough within the operational envelope of a single engine Cessna. However, when the effects of high speed flight are concerned, where speed is measured in Mach number, we find that airplanes do not always stall at the same angle of attack. The stall angle of attack at high speeds due to the compressibility of the air at high speeds (and some egghead fluid-dynamics factors) is significantly lower, on the order of 5°—6° at Mach .80, where the cruise AOA is about 2.5°. This means the maneuver margin is significantly reduced. You cannot yank on the stick like you can at 5,000 feet.
This narrowed stall margin is reflected in what jet pilots refer to as the “buffet margin.” At low altitudes we have a 2.5 g limit and can maneuver freely within that range with no stall warning. The 2.5 value is also a structural load limit, in many scenarios the stall limit would be higher. At altitude we see only 1.3 or 1.5 g margin is available before stall. (Thus, a .3 g margin from normal 1 g flight, vs. 1.5+ g margin at low altitudes and speeds - a factor of five!) Pilots must be gentler on pitch maneuvers at high altitudes to avoid stall.
For Airbus pilots, Normal Law normally provides protection, but not Alternate Law. As a result, Airbus has increased the stall warning margin a bit in this regime to provide adequate warning. As explained earlier, there is a very narrow angle of attack margin between cruise and stall warning. One result of this is that when flying in Alternate Law in turbulence, the stall warning may sound momentarily with vertical gusts. It should warn the pilot to continue to maneuver with care, as a stall is not far away, even though recovery action is not necessary for these transient warnings.
Pair this concept with the fact that there is significantly less "excess" power available at altitude. In cruise there is little difference between cruise power and full power. Contrast this with the low altitude regime where application of TOGA thrust imparts a significant power addition and allows the possibility of "powering out" of a stall situation. No such ability exists in the high altitude/high Mach arena. At a given point on the drag curve, it is impossible to accelerate in level flight with the available power alone. Therefore, stall recovery MUST be accomplished with a reduction in pitch to lower the angle of attack. If airspeed has been lost, there is little excess power to regain it with, the only available source of energy, even once the AOA has been reduced, is to trade altitude for airspeed.
There is a reason that pilots are taught stall recognition and recovery from incipient stalls. We do not take airliners into a full stall, even in a simulator. The point is to recognize the warning signs (stall warning, buffet, sloppy control response) and recover before a full stall is reached. In the AF447 case, all the warning signs were ignored. Once the angle of attack was exceptionally high, it would have taken a large prolonged nose down movement to correct that, perhaps exceeded 35° below the horizon to get the AOA back in the normal range. This crew fought nose down attitudes of 8° below the horizon with full back stick.
Once the AOA is corrected, if a significant nose down attitude is required, the pilot must be careful in bringing the nose back up to level flight. The stall margin is small, and as the speed increases, the stall margin narrows further; therefore, the pull up must be made gently enough to avoid a secondary stall.
Understanding the Flight Control Laws
Pilots must understand their airplane. Not just enough to pass the test, but every day.
For the Airbus pilot, he must understand what the sidestick is commanding in whatever flight-control law the airplane is operating in. My experience is that, when asked, most Airbus pilots need to think about this one for a few seconds before answering.
In Alternate 1 the roll control is also the same as Normal Law (roll rate demand). When the sidestick is centered, the flight control system will attempt to maintain the current bank angle (even if 0). That doesn't mean that the airplane can instantly respond. It is still a large heavy wing with inertia to overcome. If rolling into or out of a turn, centering the sidestick does not instantly stop the roll motion. It is still possible to get a pilot-induced oscillation by moving the sidestick in a fashion that the airplane simply can't keep up with.
In Alternate 2 the roll axis is in direct aileron and spoiler control, with increased roll sensitivity. Two pair of spoilers are disabled to help keep the roll rates from becoming excessive. In Alternate 2, it is completely the pilot’s job to maintain the desired bank angle. The airplane will not counteract any external forces (such as turbulence) that may tend to change the bank angle. We see evidence of this in the first few seconds after the autopilot disconnected, where the bank changed from wings level to 11° right without pilot inputs.
There is no annunciation telling which version of Alternate Law is active. Perhaps there should be due to the differences cited above. However, from the pilot’s point of view it is virtually the same: if the bank angle is not what is desired, he must correct it. In Alternate Law, all maneuvering should be done with care. The difference is that Alternate 2 will require more pilot attention.
Bonin's 30 second initial fight for control in the roll axis, with what appears to be some pilot induced oscillation, may have diverted his attention from the pitch control, which eventually led to the stall and loss of control.
In both versions of Alternate Law, the pitch control law is exactly the same as in Normal Law (g-load demand). However, the flight control law may mask what the elevator is doing, because the elevator can move independently of the sidestick - because the pilot is not commanding elevator position, but g load. I believe this to be a key point in understanding how the airplane became so deeply stalled. If the protections are lost, even in the case of a stall the airplane wants to maintain the same g load. The normal pitching-down action, associated with positively stable civilian aircraft when below the desired speed, is counteracted by the flight control law's attempt to maintain the commanded g load. When the g load was lessened by an increasing descent rate due to the stalled condition, the elevator/stabilizer added more nose-up input in an attempt to compensate, which caused the descent rate to increase further.
Take a look at this section of the flight data recorder tracings outlined in blue showing g load, sidestick position, elevator, and stab position:
Note how the g load is less than 1. The sidestick commanded a pitch up (below the line commands a g load greater than 1). While the elevator position remained virtually unchanged, the stabilizer position was actively driving more nose-up for a total nose-up input greater than a direct sidestick-to-elevator relationship. At the right side of the outlined excerpt, the stabilizer was near its full-up position which left the elevator alone trying to fulfill the g-load command.
In anot
her example, the elevator position is full up for a great deal of time near the end of the flight, despite the sidestick NOT being full up. At this point the descent rate had stabilized at approximately 12,000 ft/min, and the g load was approximately 1g. There were long periods of time where the pilot had moved the sidestick back, but not fully back, but the elevator was full up anyway. This was because the sidestick does not command elevator position, but g load. The elevator was trying to satisfy a g-load demand of greater than one and was doing everything it could to do so. The only thing it could do to increase the g load was more up elevator!
The full-up elevator was in addition to the stab position being full nose up at this time as well. A full-up stabilizer position will also reduce the elevators' pitch-down authority. Therefore, for a successful recovery with a full nose up stabilizer, a pitch down command for a longer period of time might be required. In extreme cases the pilot may have to manually move to trim to gain back pitch-down authority. The application of TOGA thrust (and its associated pitch-up moment) will also slow any pitch down action, as the engine’s thrust vector would be acting in the opposite direction of the elevator’s limited pitch down moment.
The elevator reached full nose up about the time that the AOA exceeded 30°. The airplane was falling (no better word to describe it) at a constant rate, and therefore maintaining about 1 g. Sidestick displacements were causing some elevator movements, but they were not held long enough to successfully reduce the angle of attack, which increased to 45°. While there is no guarantee that a recovery was possible (the final reports states that it was not recoverable at this point), full nose down control, for as long as it takes, was required to reduce the angle of attack.