Saturday, April 27, 2013

So You're on Fire. What Now, Genius?

Actually, that was a trick question. You're always on fire when flying in a jet. Two fires are always (or should be) burning on an airborne 737, three if you've got the APU running. Burning fires are how a jet engine works. No firee, no workee. Unlike the engine in your car, which needs the fire to be relit by the spark plugs at every cycle of the piston, the fire in the hot section of a turbine engine is lit once when the engine is started, and is then self sustained with no external ignition source until the fuel source is cut off at engine shutdown. 

Of course there are safety systems in place to relight the engine should the flame go out for some reason, but this system would only be used in an emergency. But what kind of things might make the fire go out or cause a flameout as we say in the biz? As any boy scout can tell you, a fire needs three things: fuel, oxygen, and ignition. Obviously, running out of fuel would be one reason to cause a flameout. In 1978, a United Airlines DC-8 crashed for just that reason. The crew became preoccupied with a landing gear problem and simply ran the jet out of gas and crashed. The only silver lining was that relatively few people were killed due to no post-crash fire. The fuel tanks were empty. Extreme rain ingestion has also been known to cause engines to flameout though modifications to intakes have minimized this problem by diverting rain away from the hot section of engines.

But getting back to fire, it is very useful when it is controlled and stays where it's supposed to. What happens when it escapes? On an airplane, nothing good. The short answer is you either land, put it out quickly, or die.  An uncontained fire on an airplane is probably the worst thing that can happen to any pilot short of hitting the ground. Besides all of the usual problems associated with fire such as smoke and heat, on an airplane you can't escape and the clock is ticking as the fire destroys the systems used to control the airplane.

On May 11, 1996, ValueJet 592, a DC-9, crashed into the Florida Everglades after catching on fire shortly after departing from Miami. The accident report stated that the cause of the fire was improperly loaded oxygen generators stored in the cargo compartment which caught fire shortly after takeoff. What is notable about this accident is that the crew became aware of a problem just six minutes after takeoff, and crashed into the swamp about three minutes later. It took that long for the intense fire to sever the control cables. In the aftermath, airlines were required to install cargo fire warning and suppression systems though they would not have saved that fated airliner due to the burning oxygen generators providing their own oxygen.

On September 2, 1998, Swissair 111, a McDonnell Douglas MD-11, crashed into the North Atlantic just off of Nova Scotia after a fire broke out in the space between the cockpit and the fuselage killing all 229 passengers and crew. The investigation revealed that insulation installed in the walls of the aircraft likely caught fire from a wiring defect. Aircraft systems were quickly compromised by the fire and the aircraft hit the water 21 minutes after noticing odors from the fire and only 30 miles from Halifax. The crew was faulted for taking time to dump fuel and run checklists, but it's not clear if a direct route to Halifax would have mattered as the flames spread so quickly. The pilots' flight manuals were found to have been melted indicating that they were using them to beat back the flames before hitting the water.

On July 17, 1996, TWA Flight 800 crashed off the coast of Long Island shortly after takeoff from JFK Airport enroute to Paris. All 230 passengers and crew were killed. While the aircraft was not technically brought down by a fire, the investigation focused on the possibility fuel-air explosion in the center wing fuel tank after discounting terrorist activity. The mixture of fuel fumes and air in the space above the fuel in that tank, or ullage, was believed to have become volatile due to heating from the air conditioning pack which had been used extensively on the ground due to a delayed departure. It was believed that ignition was provided by a voltage anomaly or short circuit which was then transmitted to the tank through the fuel quantity measuring system. The takeaway from this accident has been the introduction of nitrogen gas inerting systems designed to keep the fuel ullage non-volatile. 

Ironically, an uncontained fire on a pod-mounted engine, which most airliners have, is not as serious a situation as a fuselage or cargo compartment fire. All airliners are equipped with engine fire suppression systems consisting of bottles of fire retardant which can be discharged into a burning engine. But should the engine fire not go out, it will simply stay in the engine. The slipstream will likely keep the fire from travelling up the engine strut to the wing. Fuel and hydraulic fluid can be cut off to a burning engine using fire control switches in the cockpit. The extinguishing agent used in these systems, a type of Freon, is no longer manufactured due to environmental concerns about ozone depletion, but enough supplies remain for current needs.

We've covered a variety of causes of and reactions to aircraft accidents caused by onboard fires. While extremely rare, an airborne fire is an extremely serious event. It's one of the reason's that aircrews have so little sense of humor when passengers smoke in restrooms, and toss smoldering butts into the trash. That reinforcement you see around the trash container door is designed to contain an explosive fire. There are also smoke detectors and extinguishers in restrooms for that reason. The latest concerns about fires have concerned aging wiring bundles which can explode rather dramatically when they get moist. Aging or flammable insulation is also a concern.

While flying remains one of the safest modes of transportation, all pilots are aware of those who have gone before and done battle with this particular demon. It is not one which takes many prisoners. The ill-fated Concord in the above photo hit a piece of debris on takeoff which shredded a tire that punctured the fuel tank. The leak was then ignited by the engines. There were no survivors. If you're ever unlucky enough to be on an airplane which catches fire, expect a rough ride because the folks up front know the clock is ticking.

Monday, April 22, 2013

Airliners Today Just About Fly Themselves, Don't They?

Well, they kind of do. Until they don't. Then what happens is either a pilot flies the aircraft or there's a worse outcome.

The first autopilots date back to 1912, barely a decade after the Wright Brothers first flew, and the capabilities and complexity of these devices have been growing since. The earliest autopilots were simple affairs designed to keep the aircraft straight and level to reduce the pilot's workload. In modern transport aircraft, the autopilot is just one of many systems which can be categorized under the heading of flight management. Today's flight management systems which include the autopilot, auto throttles, air data and navigation computers are designed to control and optimize the operation of the aircraft from takeoff through landing.

When autopilots were first introduced, their purpose was simply to reduce the workload on the pilot so he could tend to other duties such as navigation, radio communications, and engine monitoring. As the size and range of aircraft grew, autopilots were later recognized as way to reduce pilot fatigue to allow longer flights. Flight duty rules even today restrict length of flight duty time a pilot can be required to fly without an autopilot. Since the early 1980s, though, the focus of flight management systems has been on fuel efficiency.

Like an automobile, the consumption of fuel in an airplane can be greatly affected by how it is operated. For any given weight and air temperature, there is an optimum speed and altitude which will produce the greatest efficiency. Flying even a few knots either faster or slower than optimum speed can result in  "over burn" or wasted fuel. Just a thousand or so feet above or below optimum altitude can also have the same deleterious effect on fuel consumption. There have even been cases of overseas flights getting into trouble because of a pressurization problem requiring a descent, only to find that the aircraft didn't have enough fuel at the lower altitude to make its destination.

Navigation has undergone a similar transformation. Long gone are the days when pilots would use a radio receiver to fly from ground based radio station to station. Inertial reference systems, ring laser gyros, GPS navigation, and performance based navigation systems such as RNP now allow pilots to fly from any point on the planet to another in the most direct route independent of ground based navigation aids. Precise guidance systems allow for extremely accurate approach guidance even in mountainous terrain with little visibility, the bane of many an aviator over the years. The fuel and time savings using direct routing have greatly increased efficiency and would astound ancient mariners who had only the stars and sextants for guidance.

Determining when to climb and descend also has a significant effect on fuel efficiency. Flight management computers can determine the winds at altitude and adjust for a very precise descent point. These systems fly complex flight profiles with far more precision over a longer period of time than can humans. The fuel savings are significant and easily justify the many millions of dollars spent on these systems.

"Hand flying" or manual control of an aircraft then, has become actively discouraged as the machine simply does it better for longer. Any decent pilot can fly as well as an autopilot for a short while, but doing it for hours on end is neither feasible nor desirable. Automation has changed the very nature of piloting over a relatively short period, but as with any transitional change, there have been some unintended consequences not all of which are good. These problems include the atrophying of piloting skills which on occasion are still needed, complacency as pilots are reduced to system monitors, and a disturbing trend of  people who are simply unqualified occupying cockpits with some disastrous results. We will address all three of these issues.

An inevitable result of the increase in automated flying and reduced manual control by pilots has been a concurrent loss of piloting or "stick and rudder" skills. Whether or not this is a good thing is somewhat of an open question. All major airlines have now fully embraced all facets of automation, but have also included the following admonition in a typical flight manual for pilots to maintain their stick and rudder skills:
Pilots must hand fly the aircraft periodically to maintain proficiency. This will only be accomplished when flight conditions permit, procedures do not require the use of automation, and the dictates of safety, service, and efficiency are not compromised.
So what was once the bread and butter of the profession, a skill which was a pilot's stock and trade and took years to acquire, is now only expected to be practiced periodically. Rather than a lament by pilots who see their skill set made superfluous by technology, the question needs to be asked whether the stick and rudder skill set is still needed. Apparently the FAA thinks so and has data from actual incident reports to support that position. Another recent FAA report also notes that training for human interface with technology is lacking as well. Our opinion is that while automation is steadily improving, it has a long way yet to go until real pilots are made completely anachronistic. In the meantime, we let raw piloting skills deteriorate at our peril.

On February 12, 2009, Colgan Air Flight 3407 crashed in Buffalo, NY with the loss of all lives on board. The NTSB, in its report, faulted the captain of that flight for improperly responding to a low airspeed situation that occurred on approach. The Q400 aircraft they were flying had been delivered new to Colgan in 2008 and had the latest avionics suite to include an autopilot, glass panel displays, and stall warning systems. Further investigation into the captain's aviation background revealed that he had failed multiple flight examinations and had needed remedial training to be brought up to standards as recently as two years before the accident. In this case, the captain was simply unprepared to salvage a bad situation in spite of all the automation systems at his disposal.

There is an adage concerning computers which states that one of their chief benefits(?) is that they allow humans to make mistakes at a much faster and efficient rate. It should be to no one's surprise that the addition of computers to airplanes has proven the enduring wisdom of this aphorism. As mentioned above, while automation demotes the use of hands on flying, the programming of flight computers becomes ever more critical. A mis-programmed route will result in an airplane flying a precise GPS guided, auto throttle speed controlled path to a place that neither the pilots nor controllers expect. Entirely new classifications of gross navigational errors have had to be created to account for the mis-programming of automated flight systems.

The nature of skills needed to manually pilot an aircraft involve a constant feedback loop of control inputs, followed by results delivered by instrumentation, followed by corrections to achieve a desired flight state. The automated cockpit, however, requires intense programming prior to flight followed by a hands-off monitoring of the aircraft as it executes the programming.This is a classic mismatch of skill sets. A pilot trained from the beginning of his or her career to be "in the loop" and to "fly the jet" is now reduced to the job of monitoring of a system that almost never makes a mistake, assuming it was programmed correctly.

The operative word here is "almost". For automation does fail and on occasion fails spectacularly. The nature of irregular operations or system failures is that they don't generally pre-announce their arrival. It is during these times that the pilot has to step in to manually fly the airplane during a critical phase of flight without the benefit of having warmed up. A well known human reaction characteristic, the startle response, which can temporarily disrupt a logical response to an unexpected situation, further complicates an attempted recovery when automation fails. We can't help but think that bringing all attention and skills to bear on an unexpected situation or system failure will be exacerbated when the ground state was from one of semi-disinterested monitoring vice being an active participant in the flight feedback loop.

On December 20, 1995, American Airlines Flight 965, a Boeing 757 employing state of the art automation, crashed while descending for landing at Cali, Columbia. The accident report implicated improper programming of the aircraft's navigation computer. Specifically, a database discrepancy between the on board electronic navigation database, the controller's instructions, and their charts resulted in the crew typing in an incorrect instruction. While the crew thought the computer would take them to a beacon near their destination, they had inadvertently typed instructions to fly to a point in nearby Bogota. The resulting turn in mountainous terrain to the errant point, and the crew's failure to monitor their position, caused the aircraft to hit a mountain resulting in the loss of 159 passengers and crew and the aircraft.

While the previous two examples of problems with automation are associated with pilots who currently have or at one time had the requisite piloting skills for their responsibilities, a trend of pilots being placed in cockpits who never developed the appropriate skill level is equally disturbing. On June 1, 2009, Air France Flight 447, an Airbus A330-203, departed Rio de Janeiro for Paris, France. The aircraft was last heard from at 01:35 UTC and was never heard from again. A search later revealed wreckage, though it appeared that the ocean had swallowed whatever evidence there was of the cause of the accident. It wasn't until nearly two years later when the flight and voice data recorders were recovered from the ocean floor, that a chilling picture of the fated airliner's last minutes emerged.

While the captain was sleeping on his break, copilots 32 year old Pierre-Cedric Bonin, and 37 year old David Robert entered an area of turbulence. For an unknown reason, the autopilot and auto throttles disconnected leaving the yeoman aviators to manually fly the aircraft. This should not have been a problem to any experienced pilot. Several rookie airmanship errors, however, such as pulling back on the control stick while in a stall, failing to understand the indications the instruments were relaying, and a profound lack of situational awareness doomed the aircraft and its 228 passengers and crew to a watery grave within three minutes. It is chilling to read the transcript of the last words of two pilots who clearly did not know how to fly their aircraft out of danger.

The two young copilots of Air France 447 were likely given only rudimentary stick and rudder training before graduating to automated cockpits. We'll refer to them as automation babies. It is expected that any time an aircraft automation system places the aircraft in an undesirable state, the pilot is expected to recognize the situation, and to take proper action to return the aircraft to a desired state. From our experience as a military flight instructor, it is far more difficult to take an aircraft which is out of a normal state and return it to within proper parameters than it is to maintain that aircraft within the proper parameters in the first place. The skill level required to fix a bad situation is far and away greater than that needed to maintain the figurative middle of the lane. Couple the need for a greater skill level needed for recovery with the startle effect, and the potential for disaster seems uncomfortably close when the automation decides to take a powder.

We are now transitioning from a time when nearly all commercial pilots cut their teeth on aircraft with either rudimentary or no autopilot, to one of where after a short initial period of hands-on flying, all flying is done using automated systems. Automation babies will not have the skills to fall back on when things go awry. When Chelsey "Sully" Sullenberger glided his Airbus A320, one of the most highly automated aircraft flying today, into the Hudson river after both engines had failed, he was relying on the skills he had acquired manually flying Air Force trainers and fighters. No automation system exists that could even pretend to do what a well trained stick and rudder pilot did that day.

We honestly have no quarrel with the overall philosophy of using technology to enhance aviation safety and efficiency. The airline industry is under tremendous cost pressure and technology holds the key to a safe and profitable future for airlines. Care must be taken, though, to ensure that automation is employed wisely, and that piloting skills are maintained at least until such time when automation can truly fly the airplane under any circumstance. Pilots are expensive to train and with the cost pressure on airlines due to rising fuel prices and the expense of training pilots on complex automation systems, basic piloting skills have unfortunately come to be considered expendable. This is folly. Our fear is that the gap between the time where automation is truly robust, and where the reservoir of old school piloting skills dries up may allow more Air France 447s to hit the water.