Having voiced concerns about the effect on pilot competence of high levels of automation, I am about to sing the praises of even more automation that Airbus is testing for its A350XWB, which is due in service in 2013.
I was sitting with experimental test pilot Peter Chapman in a simulator which Airbus calls "A350 aircraft minus one", trying the new systems out, which is what that particular simulator is for.
Actually these new ideas are not a routine kind of automation, which is why I like them: they are more like applications that are available to use rather than a system that does everything for you while your skills fade and your brain dies. But the main thing is that these three applications address real problems.
The first is called "take-off securing". It's a FMS function that recognises take-off performance data that does not make sense when the pilots enter it, and all it does is warn them. They then have to check their own figures and enter the corrected data. In the last few years there have been plenty of incidents and some accidents that resulted from incorrect aircraft weight entry. These were not all specific to an aircraft type or manufacturer, but just today the UK AAIB has reported on one such incident involving an A340-600.
The second is an en-route function: if there is a failure that forces the aircraft to descend, such as loss of an engine or pressurisation failure, the FMS will provide the crew with drift-down data and, if the aircraft is over mountains, safe escape routes.
If the pilots specify a chosen diversion, the FMS will suggest a detailed flightplan and do all the calculations. If the pilots want to be mentally prepared for an eventuality, they can ask the FMS "what if" questions and review the proposed solutions.
Finally, there is the runway overrun protection system (ROPS). Runway overruns are the most common of all airline accidents, and this could put a stop to them.
Before or during descent to a destination airport, pilots can specify the runway in use, and review what the aircraft's landing performance will be under the current conditions.
The pilots are shown, on the navigation display, a graphic of the chosen runway with two magenta lines across it, the first showing where the aircraft would stop if it is dry, the second if wet. If the runway is too short a warning is generated.
The photograph below is the display being tested in an A380. The pilots have chosen the runway by moving the chevrons over the runway threshold - in this case Toulouse runway 14L - and clicking to designate it. Then you get the response you see here:
![Thumbnail image for Illustrations BTV doc3_2_far3c2 [Converti] copie.png](http://www.flightglobal.com/blogs/learmount/assets_c/2009/06/Illustrations%20BTV%20doc3_2_far3c2%20[Converti]%20copie-thumb-500x677-37216.png)
For a more complete narrative on ROPS, with more illustration, go to one of my earlier blogs here.
If Airbus can make take-off performance data entry safer, and reduce the risk of overruns, the future will see far fewer events in which aluminium gets seriously bent.
And if you do suffer an engine failure over the Himalayas one day, the new FMS function that shows the best escape routes during drift-down should be good for your blood pressure.
on July 8, 2010 4:37 PM | Reply
An 'Oh Sh*t' button would be good, like the ones currently employed in the Tiffie that make and automatic recovery possible (or maybe also a brief max climb based on EGPWS data). Could be employed by Pilot or co-pilot. I bet they've thought about this and kicked it into the long grass...
on July 9, 2010 12:49 AM | Reply
Once again I am forced to comment on the apparent level of concern for safety in the aviation community versus the concern displayed on a daily basis in the trucking industry. (driver on-duty and rest hour regulations being one glaring example)
Indeed this incident could easily have turned into a fatal accident, and some similar incidents have done so.
A $100,000 USD cargo truck can easily (and many are) be equipped with a real time gross weight monitor which gives the driver 9and loading crew) a diretct readout of overall gross weight as well as weight on each axle (since most highway authorities limit both overall gross and individual axle weights).
These systems cost, a few thousand dollars, and easily attain a an ROI by avoiding overloading fines while maximizing the available payload on every trip. They really do not cost, they pay.
And yet multi-million dollar airliners "run naked" in this area. A slip-up in weight calculations can kill, and unlike some in-flight some unpredictable circumstances, is trivially easy to prevent. Why can't air transport look for lessons from the rest of the transportation industry.
(Oh, and by the way? If you weigh all axles, you can easily (and accurately) calculate actual CG values before takeoff, instead of blindly heading into another very significant danger area. Why are we still using "stubby pencil" technology?)
If the idea of adding safety systems directly to the aircraft doesn't appeal, consider this. In the US at least, cargo vehicles are routinely "weighed in motion" to enforce highway regulations and collect taxes.
These 'scaling events" also give individual axle weights, also allowing for CG reasonableness checks.
Why not "weigh in motion" sensors and readouts at key taxiway intersections as an airport service (similar to airport authority-provided deicing facilities) and use the results to calculate sliding scale use fees for the airport authority (thus paying the purchase and operating costs) while yielding the important by product of safety?
Food for a few "weighty" thoughts?
on July 10, 2010 2:02 AM | Reply
As you allude David, total automation is optimal up to the point of UAV Drone ops in the AFPak and Hamastan theatres. For less mission specific and far broader strategic and tactical civil-commercial ops, a few steps back are optimal in general to prevent skill fade and brain death, as you say. The prize for FMS PERF INIT page finger stroke error is still retained by Singapore Airlines for it’s B-744 VMU demo taking off from Auckland for Singapore on March 12 2003. The Captain in that case accepted the FO’s erroneous takeoff weight, but actual forecast landing weight V-ref speeds as the TO REF and overwrote the balanced field V 1,R,2 REF-speeds computed by the FMC after generating those V-speeds from adding the ZFW to it’s calculated fuel weight giving a GR WT. It’s tailor tail made registration was 9V-SMT, now known in the trade as “Very-Sore My Tail”. What was left of that screaming cutaway, certainly was.
The ROPS, you mention, is very timely, putting the STOP in overruns, so to speak, as you said. The Virgin A-346 potential overrun mentioned of December 2009 at London Heathrow, is a mirror image of an Emirates A-346 near-overrun multiple tailstrike in Melbourne in March 2009.
Both of these were in essence, same movie, different cinema. With regard to the Singapore Airlines B-744 aluminum standard. They were honest mistakes of a just culture, as all humans shall ever make. We all fail in every way, every day, we can only hope to fail better from the first. However, a just culture is not universally just, in a paradoxical sense. The SIA captain left the company with union and company assistance and went back to flying the A-343 after realizing that an A-343 powered by 4 hair dryers and appearing to climb because of the earth’s curvature is less flattering of FMS finger trouble than a B-744. He learned well, clearly an offer he could not refuse.
All of the incidents, from the sluggishly slight to the scraping serious used “rated” TO or “derated” D-TO ,FLEX TO REF thrust, using an assumed temperature or fixed derate or both, as actual weight was far less than maximum. Assumed temp/FLEX temp, assumes rated VMCG, so in a panic, a pilot can increase thrust without worrying about going, yaw-like, off the edge, so to speak. A TO 1, 10% derate is considered an EPR/N1 limitation, so do not advance thrust levers in a panic, as the rudder may not have enough bite to stop you biting off the edge more than you can chew. D-TO, lower V 1 is predicated on a lower thrust limit, so a departure from a shorter runway is permitted.
The legal jurisprudence is far more divergent in it’s execution between the UK and UAE and other jurisdictions of democratic and autocratic DNA and all shades in between. The non-union, sorry-ASSOCIATION !, Emirates crew found themselves receiving assumed resignation letters from the actual airline, for an “assumed weight” takeoff written by themselves before they arrived back in Dubai. The letters assumed that they were de-facto totally guiltily at fault before any de-jure investigation. Result ?, they left Emirates with a “no incident/accident” record and in a seller’s market, with a takeoff bonus, minus union politics of stress, duty-time, training etc. An assumed holiday on the beach possibly cleared the collective minds with no company or unionist peripheral distractions. The “just culture’ in this case is “just take it easy” and wait for the sand storm to abate.
Now consider the virtual identical Virgin crew. They are suspended from operational duty pending an ACTUAL LEGAL AAIB investigation of acute clarity with no sandy grey areas and without fear or favour. In due digestive time the investigative due diligence is executed, report published, procedures amended, lessons learned, crew reinstated with “just culture” union representation and airline support. But they are now married to the airline through fault or no fault of their own for the rest of their careers. As a reference point, look no further than the Jan 2008 “UNDERRUN” of the BA B-777 at London Heathrow of BALPA’s Captain Peter Burkill. His fate after his inspired decision to raise the flaps from 30 to 25 without a call, avoiding a stall, having been rendered with a gross thrust deficit merits sober reflection. His ONLY mistake was long after the fact, in resigning from BA for no good reason apart from collegial peripheral gossip and other personal issues. His then SOP should have been, “READ THE AAIB REPORT AND THEN I’LL ENTERTAIN YOUR IGNORANT MUPPETRY !”. Peter Burkill resigned from BA of his own volition in August 2009 in expectation of a flood of offers after application, justified in my view. His instincts were PDQ and clearly he is an optimal professional crew asset, by all metrics to any objective airline. It is sad that airlines do not recognize assets objectively, in particular, human assets. This is reflected on their dismal return on invested capital by all metrics. I suspect Sully of the Hudson of Jan 2009 would face the same “Hudson’s Choice” dilemma as Peter, if he chose to continue flying in general and outside of US Airways in particular. Unfortunately Peter’s expected flood turned into an actual drought because applied airlines like Emirates, among others wanted to have nothing to do with him as he answered in the affirmative to the question “Have you ever been involved in any accident or incident ?”
The great bent metal irony was and is thus , To wit : Had Peter been flying EK-407 instead of BA-038, his “disassociated non-union” resignation would have been assumed and automated without an objective external report and he would be free to apply without any drama of being party or privy to any peripheral incident or accident.
ROPS and other laudable technology will never outrun humanity’s failure to learn from history with it’s innate ability to shoot itself in both feet with one bullet in perpetuity in expectation of a striding forward alternate result while barely hobbling, a mad world indeed. None are so blind as those that WILL NOT see. A pessimist is indeed a well informed optimist and if I were not so sarcastic in general, I’d be a lot more cynical of HR myopia in particular. QED !
on July 26, 2010 3:40 PM | Reply
very simple "Gross Error Check" might go some way to ensure that such errors do not find their way into the automated systems that give pilots their takeoff weights and thereby enable takeoff performance to be calculated. Errors like these did not seem to occur when loadsheets and balance charts were manually produced by a dispatcher or load controller (well, they did, but they had a high prospect of detection when the crew, at preflight briefing, reviewed the estimated payload against the expected passenger and cargo weights). Using the rule of thumb of 100kgs (roughly) for every passenger gave you one tonne of payload for every ten pax. Add to that the estimated cargo weight (and remember that until the flight is closed out all weights are estimates) and the crew could state a fuel requirement and establish weight/altitude/temperature-restricted takeoff speeds.
This process, gradually refining an estimated figure until you had an actual payload weight about 30 mins before departure enabled the crew to stay in the loop and - if suddenly presented with an inconsistent figure - enabled them to ask the necessary question. A typical example would be a lot of no-shows, where perhaps a connecting feeder flight was delayed, or the offloading for whatever reason of a heavy piece of palletised freight. These would produce a final figure that was inconsistent with the estimated used for flight planning.
It seems to me that the automated system while enabling the progressive elimination of skilled non-flying jobs and lower handling costs does not present the crew with the progressive validation of takeoff weight that the manual system invites - and indeed requires -if it is to be as safe as it was proven to be over decades of safe operations.
It's only a matter of time before this all ends in tears, and unquestioning acceptance of the takeoff data generated after insertion of an erroneous payload kills an aircraft full of trusting passengers.
on August 20, 2010 10:49 AM | Reply
IMHO, Burkill's decision to retract flaps was a wrong one and the fact that the a/c managed to reach the runway (short of it anyway) is just luck. In my flying experience I have met fabulous pilots, I mean those with natural skills for flying, and I am sure that the manoeuvre decided by Burkill (flap retraction at short final, especially for the reasons stated by him) would have never been imagined, let alone adopted. What followed was all PR stunts by BA and "friends". His peers realized that and they didn't like it because professional pilots steer off publicity where their skills are concerned. That is why Burkill never found another company to fly with and that's that!
As for the "Safest Flightdeck" experienced by David (Learmount), I remain of the opinion that full automation remains dodgy for the simple reason that one of the parameters in the data input could turn out to be erroneous (foor whatever reason), which would lead to a wrong or difficult way out of an unpredictable dangerous situation. This means that at the end of this craze on automation, the pilot and only the pilot As for the "Safest Flightdeck" experienced by David (Learmount), I remain of the opinion that full automation remains dodgy for the simple reason that one of the parameters in the data input could turn out to be erroneous, which would lead to a wrong or difficult way out of an unpredictable dangerous situation. This means that at the end of this craze on automation, the pilot and only the pilot with his experience, must decide to follow or not the computerized solution on offer. shall decide to follow or not the proposed computerized solution.
on August 21, 2010 10:31 AM | Reply
David Nicolas makes some good points, but apparently fails to even consider what may be my most important. For a few thousand dollars an aircraft can be equipped with a direct readout digitalscale for each landing gear leg which, without any potential computerized weight and balance checking automated system would still give the crew an instant, unequivocal all up weight and a direct CG reading with a simple calculation.
All the many other factors of human error, tolerance stack-up, last minute details etc. would thus be obviated, and no human knowledge/experience would be taken away from the equation.
Yet we aren't even willing to think this through without launching off into the"a trained, experienced captain is the supreme safety tool, etc., etc.
No one disagrees regarding the importance of the experienced captain,m but why do we argue so strongly against giving him/her the same information a freight truck driver has at his/her fingertips?
"Wrong Weight/Wrong CG" takeoff accidents are virtually 100% preventable with technology available on the open market today ... how many more years will the industry debate rather than adopt the obvious better solution?
Perhaps if we took the already built off the shelf systems and put a Boeing or Airbus part number label over the exiting data, and raised the price 10 fold someone would catch the drift?
on September 22, 2010 1:41 PM | Reply
I concur with Dave. I have a lot of experience in the automation of bulk vehicles in the petrochemical business. At most of the depots a simple load sensor weighbridge was installed with large LED displays that allowed a driver to stop on the pads, view the mass over each axle and determine whether his configuration was unsafe or not before embarking on a trip. The procedure took 20 seconds at most.
A simple system on a taxi-way would allow pilots to confirm takeoff weights. There would be no modifications required to aircraft as long as the displays are large and placed correctly.
All in the name of safety.
on October 26, 2010 2:14 AM | Reply
Not trying to negate Layman's comments, but his solution misses the point of something simple, light-weight and cheap that could be on every commercial airliner in months, not decades.
A commercial 'weighbridge" service as Layman describes would be way better than letting gross weight and center of gravity related accidents "just happen" ... but it would be costly, take years to implement, and would impose yet another significant "choke point" in the departure process .. similar to a queue for deicing.
Also, what if an aircraft taxied out, got to the weighing point and was found to be loaded in error? Good. A potential accident averted. But at what cost?
Back to the gate to correct the problem and then taxi out again and check to make sure a second error wasn't made, etc. Good for safety, very bad for airline efficiency and thus profitability.
Put the weighing device on the aircraft itself so that every takeoff, from every airport can be made with accurate, real time decision information available to the aircrew for their all-important decision making. In my view, we've been operating intentionally in a "partial panel" mode regarding this very real problem for far too many years now.
All modern commercial aircraft have air over hydraulic suspension (Oleo struts). It's very simple to connected sensors to each strut and have the aircraft's actual weight, Both gross and weight per strut (from which accurate CoG data can be instantly derived) read out on a simple, small and cheap panel-mounted gauge. The connection, BTW can be wireless, obviating the need for long cable runs and signifacant wiring modifications.
One glance, at the end of the loading process, before push back, could assure a pilot that his/her aircraft was loaded not only below maximums and within CG limits, but also as efficiently as possible for the expected takeoff runway and planned mission.
Take a look at
http://www.ccjdigital.com/technology-7/
for just one example of a very affordable proven commercial system ... which incidentally can easily tie digitally to airline yield management systems and promote even more efficiency. (I have no connection with this company and no monetary axe to grind here, the link is for informational, thought-provoking purposes only.)
Even absent the obvious safety factor, direct real-time loading information on a per airframe, per dispatch basis would pay for itself in maximizing load efficiency. The safety aspect would ride along for free.
I'm only a (very) junior pilot, but I have observed the business with a critical eye for nearly 60 years and one message comes across to me loud and clear.
Resistance to adopting proven real-world safety devices and proven safety practices becuase they did not originate in the aviation world (the NIH issue) is the Achilles heel of commercial aviation.
Sometimes the most important safety device on an aircraft are the hours in the captain's log book. Other times? Not so much.