June 2009 Archives

The following statements apply to all accidents involving all airlines flying all types of aircraft, whether people in them were hurt or not:

1. If the accident involves a big Western-built jet airliner with lots of people on it, it will either be an Airbus or a Boeing, because they are the only Western aircraft manufacturers left on the planet that make big jet aeroplanes.

2. Accidents do not happen because the aeroplane is an Airbus or a Boeing (or an Embraer or a Tupolev), they happen because of a combination of circumstances that often involves natural phenomena like bad weather or darkness (or both), sometimes involves a technical problem, and almost always involves human mistakes or frailties (plural).

3. The humans who made the mistakes will either have made errors of commission or omission (or both), and the errors can become contributory factors or directly causal - usually the former. The list of people (not exhaustive) who might have made a contributory mistake includes:  aircraft and aero-engine manufacturers: airframe, engine and avionics maintenance engineers; airline operations personnel; airport handling agents; cargo or baggage  managers; air traffic controllers; or pilots.

4. The part played by the corporate or departmental managers whose employees made the front-line errors or omissions might prove to be critical in an accident if the mistakes were the result of inadequate employee selection, training, supervision, or management communication (two-way).

5. Pilots are "the system's goalkeepers". Their main job may be to aviate, navigate and communicate, but they also have to deal with the results of any failure at any point in the organisation upstream of them (see item 3). If the system bangs enough fast balls at them, they will eventually let a goal through, and the media will call it pilot error.

6. Prof James Reason (who invented the "Swiss cheese" model of organisational safety management) was right. Humans will inevitably make some mistakes, so to imagine you can prevent them completely is delusional. The optimum answer is to build a system that is error-tolerant, with multiple layers of defences that will identify and correct a mistake before it combines with other circumstances to become dangerous. That applies to both companies and to aircraft design. Pilots are the last line of defence against errors in either.

7. It is not at all rare for the cause of an airline accident to remain a mystery for a long time, especially if human factors are involved, which they usually are.

8. Accident investigators tend to establish lots of individual facts very quickly because it is easy to see what the result was, but the cause is usually not evident.

9. The flight data recorder and cockpit voice recorder ("black boxes") are both very important to gaining a full understanding of precisely what happened and why it did. But if most of the wreckage, including critical parts like the flight deck, the engines and the control surfaces, is recovered, a great deal can be deduced without them.

If Paul-Louis Arslanian, the BEA's chief investigator in charge of the AF447 probe, says he does not have any answers yet, how can the rest of the world be so sure of its many theories?

Arslanian has more direct access to information than any of us has, and an international team of the best analysts available. But you can tell by his demeanour that he doesn't have answers yet. Not of the causal variety, anyway.

Like the rest of us who want to understand what happened, I'm certain he has fears about what he might find but, as he reminded journalists firmly at a press conference today (17 June), it is his job at all times to deal only in established facts. He is clearly very tired of the out-of-control speculation about AF447 which, he says, only serves to create "confusion".

I believe that the reason Arslanian called the press conference today, despite not having any more technical information to impart since the last time he spoke about a week ago, was because it was an opportunity he could not afford to ignore. The global media was gathered for the Paris Air Show on the doorstep of the BEA's Le Bourget headquarters, so he thought he would do his best to paint a picture of the task his team faces, and to describe in detail the nature of the search for evidence. 

The search so far, and the plans for the next few weeks of the search, will shortly be revealed on Flightglobal. They are impressive, multinational, and a testimony to the industry's determination to do what it takes to ensure that mystery is dispelled.

AF447 is like other accidents in many respects. It's absolutely normal not to have a clue, for months, about what was likely to have caused a recent accident, even if it took place at a major international airport. Only a little less than three weeks have passed since AF447's loss, but because of where it took place, nothing truly meaningful has been recovered yet. 

What has made this accident feel somehow different is the fact that we have been tantalised by the ACARS data. That is a first. We are not used to it. The trouble is the ACARS data is incomplete, generating questions but providing no answers. It only supplies symptoms and doesn't identify the disease. As a result, the field of plausible possibilities remains almost endless.

The interrupted ACARS data provides no evidence of why and how the aircraft got from a high cruising altitude to contact with the sea. It provides us with no aircraft structural data, and absolutely no information about what the crew saw, felt, thought, said and did.

Nature abhors a vacuum. Information vacuums are just as unpopular. Intelligent people will not be able to resist rehearsing "what if" scenarios, and there's nothing intrinsically wrong with that - unless the people doing it forget that they are just guessing.

This group has just disembarked after a 27 May A380 flight from Airbus' Toulouse base.

The flight was mounted to demonstrate two really clever and seriously useful avionic advances that Airbus is just about to see certificated. One will make airborne collision a little less likely, the other will prevent runway overruns. Overruns are the most common type of aircraft accident, and one of the most expensive.

The team in the picture (above) consists of some technical journalists - including me (on the far left) - and numerous Airbus engineers and test pilots all of whom have played their part in bringing these development programmes to fruition.

The skipper on this flight - he's the 6th person from the left wearing the blue tie - was experimental test pilot Claude Lelaie.

Lelaie

 During the flight we carried out a number of full-stop landings to demonstrate the aircraft's brake-to-vacate (BTV) system, but also to show off an amazing extrapolation of the BTV's inherent capabilities which - for me - was the day's showstopper: it was ROW/ROP - the runway overrun warning and protection system.

And, finally, we witnessed  - in action - a new way of making TCAS resolution advisories (RA) more manageable for pilots. More of that later. 

BTV allows the pilot to pre-set the runway exit at which he wishes to turn off, so the aircraft's braking system arranges smooth reduction of runway speed down to 10kt with 50m to go to the exit - unless the pilot wants to intervene because it's a fast-exit taxiway and he doesn't need to exit that slowly. 

This may sound a like the ultimate in unnecessary optional extras, but it would be incredibly useful, especially in poor visibility, for minimising runway occupancy time.

How does the aircraft's braking system know where the exit is? GPS, of course.

Now, imagine you're flying your A380 and you are on short final approach to runway 32L at Toulouse. I'm sitting in the back watching your performance on these two displays (below) on a rack of monitor instruments. At the moment you're doing nicely:

The right image shows split shots from two video cameras, one beneath the belly and another on the fin. In the former, the nose-gear is obscuring the runway threshold.

The left image, absolutely contemporaneous with the video, shows the aircraft's position relative to the runway (the magenta aircraft symbol). Sorry I didn't get a video of this because if I had you would be seeing the two images - the real world and the runway plan - moving in synch. 

Here's a picture of the same scene taken from the flight deck, but from a little further out:

...and here's me (below, left) keeping an eye on you from the back (I can see all the flight deck activity - you're on video):

Now let's have a look at ROW/ROP and what it will do for you. Here's the control that will enable you to tell the aircraft what you want the brakes to do:

If you want BTV, you select it. If you just want a normal landing you select the braking action you want.

Now here's a picture that will enable us to identify the essential offerings available:

Just before your top of descent briefing you've called up this image on your navigation display so you can choose the landing you want at Toulouse. You've toggled the cursor (magenta chevrons) onto the threshold of runway 14L and clicked. That has designated the runway, and up comes the magenta crossbar that tells you where your landing roll would come to a full stop if the runway was dry, and a second - further on - if it was wet. That's ROW/ROP working for you. If the runway was too short the crossbars would be in the overrun.

If you had selected BTV for the brakes, you would get the same display, but having designated the runway, you would have then to move the cursor over the image of the exit you want, and click to designate that.

Smart, eh? But it's also easy to use.

The Southwest pilots who overran at Midway on a snowy night would have given a lot for something like this.

But it gets better.

When ROW/ROP gives you those stopping point designators for your top of descent briefing, it assumes you will fly a standard profile at standard reference speeds, crossing the threshold at 50ft and putting the beast down in the touchdown zone. But it still works if you don't do any of those.

If you are high and fast on approach, ROW/ROP knows, and the stopping point designators move away from you down the runway. If you then carry out an extended flare as well, they may move beyond the runway end and, if they do, you will get two warnings: one scripted on the primary flight display saying "runway too short", and a recorded voice saying the same words.

What I tell you now is not strictly relevant, but I was struck by it just the same: the voice that tells you "Runway too short" (or alternatively "If wet, runway too short), is highly compelling because it's different: it's not one of those dead-pan, mid-tone, American-accented voices. It's a male voice, but pitched-up, and with an exquisitely English English accent. Your invisible guardian sounds as if he is looking over your shoulder and is genuinely worried about what he sees.

It would make anyone go-around.

But if you elect not to go around, when you touch down the system gives you absolutely maximum braking for the conditions.

Anyway, ROW/ROP is fantastic, and the same capabilities and logic that generated it could be used to create a take-off performance monitoring system, something lots of people have tried to do before and failed. My guess is that Airbus will go there, but they are certainly not admitting it.

Now let's look at the TCAS (traffic alert and collision avoidance system) improvements. Project leader for the programme, Paule Botargues (below), is explaining the system to us before the flight:

Botargues

Botargues and her team haven't tampered with TCAS itself, they have just integrated TCAS with the autopilot and the flight director. It's easy for me to say, blithely, that the team had merely to integrate these functions, but the task is actually very complex because it entails so many systems, inputs and so much software.

Remember that, at present, if the crew receives a TCAS RA, they disconnect the autopilot and fly the vertical RA trajectory manually.

Now the result of Airbus' work is that, if the autopilot is engaged when an RA is generated, unless the pilot disengages it the autopilot will fly the RA trajectory precisely as demanded. If the pilot is flying manually at the time, he does not have to transfer his attention to the TCAS RA indicator and fly according to that, he just follows the flight director in the normal way and thus performs a perfect RA trajectory.

To test and demonstrate the system, the  the team has rigged up a system that generates virtual conflicting traffic on the TCAS display, causing it to provide the usual sequence of visual traffic proximity awareness, followed by a traffic advisory and finally a resolution advisory. This picture I took in flight is not very good, but on the nav display you can see the yellow aircraft symbol (our A380) and the red "conflicting aircraft" just ahead of it that has generated a "climb" RA. 

Studies show that pilot reaction to RA is frequently slow, but when the action finally comes it is almost always an over-reaction, occasionally dramatically so, resulting in altitude deviations that are hazardous in their own right.

The TCAS RA indicator (see on the right of the image below) is not easy to fly accurately, especially when the pilot is psychologically aware that failure to follow it may result in a terminal collision:

So this new system, which Airbus calls AP/FD TCAS mode, makes sublime sense.

Just before I sign off I'll share a little anecdote about this demo flight.

One of the technical journalists that had come along to test-fly the new systems was a recently retired Delta Air Lines Boeing 777 pilot called Earl Arrowood who had never flown a fly-by-wire Airbus of any kind in his 30,000h career. And like the three other journalist/pilots there that day who were taking turns in the left hand seat, this hoary old Georgian aviator was given no simulator time to prepare for the experience, but blithely carried out several approaches, full-stop landings and take-offs.

You want to know what he thought about flying this giant, sidestick-controlled Airbus after a lifetime of McDonnell Douglas and Boeing? I asked him afterwards - although I didn't really need to because he was so enthusiastic about it. He told me he loved it, and it took him "less than a minute" for him to forget he was flying a sidestick.

Air France has just admitted that it cannot hold out hope any longer of re-establishing contact with flight AF447. By now, the company says, this Airbus A330-200 from Rio de Janeiro to Paris would have run out of fuel if it were still airborne.

At present, information is very sparse. According to the airline, the last report from the aircraft provided evidence of an electrical short circuit that occurred shortly after encountering turbulence, and possibly a lightning strike. Aircraft are designed to be able to survive lightning strikes. They have to be, because they occur often, usually causing minor damage but, very rarely, serious damage to electrical or control systems.

Modern aircraft are so reliable and have so many backups for every system that a single electrical fault, or even the loss of an entire circuit, would be easily dealt with if that were all that had occurred. If the fault has been correctly interpreted as a short-circuit, that raises the spectre of an electrically-caused fire, and fire is always serious in an aircraft. But at this point there is no access to evidence of that type.

An event like this is the kind the aviation world hoped it would not see again, because it involves a world class carrier flying the latest generation of airliner, and it occurred en route, not during take-off or landing in difficult weather. It's a chilling reminder that nothing is impossible, however unthinkable.

For anyone who doubts that a certain type of electrical fault could start a fire that could bring an aeroplane down, whether the fault was initiated by a lightning strike or something else (this example was something else), look at the Canadian Transportation Safety Board's report on the Swissair 111 Boeing MD-11 accident at Peggy's Cove, Halifax on 2 September 1998.