Thursday, December 22, 2016

The Crash That Made Your Airplane Safer

Terrain is now displayed on primary flight displays
Enhanced GPWS display showing terrain (in green)

Any airplane crash is a tragedy, but in the investigation following a crash, it is always hoped that something can be learned which will aid in the prevention of a future crash. Commercial aviation is now one of the safest modes of transportation available, but it has only become this way through dogged investigation of aircraft accidents and the application of lessons learned. Such was the case of American 965.

On December 20, 1995, American 965, a 757-200, crashed in the mountains of Colombia while enroute to Cali. 151 passengers and eight crew were killed while five passengers survived the impact. The investigation into the crash concluded that the primary cause was a navigational error made by the flight crew resulting in terrain impact.

There were, however, some unique aspects of this accident which highlighted contributing factors. One of these was found to be several errors in the aircraft's navigational computer database which led the crew astray.  Also unique to this accident investigation was the method in which investigators were able to reconstruct the events which led to the crash. As it happened, one of the 757's flight navigation computers was found in the wreckage with its internal battery and volatile memory still intact. 

This allowed investigators to reconstruct electronically what the aircrew saw as they were descending through the mountainous terrain that night in Colombia. This finding revealed the true cause of the errors that were made by the flight crew which had until then eluded investigators. And this, in turn, directed investigators to the errors in the onboard database.

Increasing reliance on automation meant that aircrews were becoming more dependent on onboard electronic systems used for navigation rather than on the printed paper charts and radio beacons which had been the mainstay of airborne navigation since the dawn of aviation. Uncritical trust in this system, however, turned out to be deadly.

The aftermath of this crash resulted in new safety systems that are now installed on virtually all commercial airliners to aid in terrain avoidance as well as new procedures to be used with automated aircraft navigation systems.

Let's take a closer look at the causes of this accident and some of the changes resulting from the investigation.

Where is it Taking Us?

Alfonso Bonilla Aragón International Airport, which serves Cali, lies in a valley with mountainous terrain rising to over 12,000 ft on either side of the north-south running Cauca Valley. The arrival path of AA965 had the aircraft descending through this valley to pass over the airport and then reverse course to land to the north.

At some point though, the controller, who had no operable radar due to terrorist activity, offered the crew a straight-in approach to land to the south on the north-south runway. The crew accepted this clearance but were now high on profile without the turn around to lose the excess altitude. Thus they were expediting their descent with the aircraft's speed brakes being extended.

There was also some confusion in the instructions given to the crew by air traffic control with the aircrew finally asking to proceed directly to a radio beacon near the airport. This beacon, really just a radio transmitter, was named "Rozo NDB". It is here where a database error and a lack of situational awareness caused problems.

The paper charts which the crew was using listed the Rozo beacon by its identifier as the letter "R". That meant that typing that identifier into the computer should have caused the aircraft to fly to the Rozo beacon straight down the valley. The database installed in the aircraft, however, had an error and differed from the paper charts the crew was using, The identifier of the Rozo beacon in the electronic database was "ROZO" and not the letter "R" as the crew believed.

Thus when the crew typed in "R", the aircraft turned left towards another beacon located 130 miles to the east in Bogota named "Romeo". This beacon actually did have its identifier listed as "R" in the electronic database. This turn to the east took the aircraft directly into the mountains on the east side of the Cauca Valley.

Maintain Situational Awareness

If the above description is confusing for you to read, imagine what was going through the minds of those pilots as they tried to sort out where they were and why their airplane was mysteriously turning when it should've been going straight south to the runway. It took the crew about a minute to sort out that the airplane shouldn't be turning and another minute to start a turn back to safety. But even though they eventually got terrain warnings and had started an emergency climb, they had descended too far into the mountains and hit a ridge at an elevation of about 8900 ft.

One of the prime directives of aviation, drilled into all pilots from the beginning of their careers, is to maintain situational awareness. This means knowing what is going on around you at all times. It is a fundamental skill in aviation. This crew was set up by a database error, but should have had an idea that any turn off their course down the valley was ill advised. They should also have known that they had descended below the altitude of the mountains bordering the valley.

One of the luxuries that US based airlines enjoy is a first rate air traffic control system which is unparalleled in not only maintaining traffic separation, which is their main objective, but also in providing terrain avoidance. They're so good at it in fact, that it is easy for pilots to become complacent about the need to always be vigilant about terrain if for no other reason than they (and their passengers) will suffer the consequences of any such complacency.

The same, unfortunately, cannot be said for many countries without the superb infrastructure found in most first world countries. While most controllers are excellent at what they do, the Colombian controller had no radar with which to warn American 965 that they were in danger. It is the pilot's sole responsibility to maintain awareness of any terrain clearance problems.

Not in Vain

The story does not end here. The fallout from this accident was wide ranging. The database error which led the pilots to make a wrong turn into the mountains prompted a thorough review of the navigational databases which are used by commercial aircraft, including safeguards to ensure that the information printed on charts matches that in navigational databases. Flight crew procedures were also changed to ensure that a "common sense" check of any computer commands were made before those commands were executed in the navigation computers.

It also became apparent that faster and more capable computers coupled with GPS receivers would be able to provide a whole new level of protection against controlled flight into terrain (CFIT). Ever since the crash of Eastern Airlines 401 into the Florida everglades in 1972, commercial aircraft have had a system installed that is known as the Ground Proximity Warning System (GPWS). Pronounced "jip whiz", this system warns pilots of approaching terrain through a downward looking radio altimeter. 

GPWS is the source of the electronically generated "PULL UP" command you may have heard in movies or when the system is tested at the gate. The limitation of this system is that there is no way to reliably warn pilots of very rapidly rising terrain as the system can only look straight down at what is directly below the airplane. In fact, the GPWS system on American 965 did warn the pilots of danger but not until it was too late.

Enhanced GPWS

A new system called Enhanced GPWS has since been designed to use a database of all the terrain an aircraft is expected to encounter either regionally or globally. When coupled with GPS location, this system can give pilots enough warning to avoid any possible terrain conflicts well in advance of encountering any high terrain. It generates a terrain map on the primary flight display. This display looks somewhat like an old fashioned topographic map but terrain is displayed in green, yellow, or red depending on the height of the terrain in relation to aircraft altitude.

The system is proactive and will also generate cautions and warnings based on the current aircraft trajectory and any terrain that may be a danger. Pilots are warned well in advance of any projected terrain encounters. The system finally gives pilots real time feedback on exactly where they are in relation to high terrain, a problem which has always plagued aviation.

Aviation is safer now than at any time in history but this is no accident. Many accidents are caused by carelessness or complacency on the part of crews or maintainers, but occasionally something is learned that materially affects the safety of the entire industry. American Airlines 965 was a tragedy for everyone aboard that fated airliner as well as for their friends and families, but at least in this one case, real changes were made which will make a recurrence of this accident much less likely.

The next airplane trip you take will also be safer because of lessons learned from the crash of American 965.

Addendum: Counterfeit Parts and Aircraft Design

Two other issues were brought to light in the aftermath of American 965. One that was highlighted was the existence of an international network of counterfeit aircraft parts as some of the parts from the wreckage began to show up on the black market. Aircraft parts are built to exacting and expensive standards, so an incentive exists for unscrupulous actors to sell counterfeit and stolen parts. Parts with serial numbers from AA 965 did make their way into this network.

A second issue was that of cockpit design. When the pilots realized that they were near the terrain, they initiated an emergency climb, but neglected to retract the speedbrakes which they had been using to descend. Because the aircraft hit the ridge only a few hundred feet below the summit, speculation was made as to whether the speed brakes should automatically retract when the throttles are pushed up and whether doing so would have saved the aircraft. Some aircraft have this feature while others do not, but highlighting the issue should make pilots aware of the potential problem.

Friday, December 02, 2016

How Does an Airliner Run Out of Fuel?

LaMia 2933 ran out of fuel

While the investigation into the crash of the LaMia RJ-85 airliner in Columbia is still ongoing, it is becoming apparent that the aircraft ran out of fuel. Investigators at the crash site noted that there was no post-crash fire or fuel spillage. Other evidence suggesting fuel starvation is that photos of the fan blades on the engines appear to show them to be mostly intact. A spinning engine often throws its blades upon impact suggesting that the engines were not operating.

Other significant factors affecting this flight were the length of the leg, an arrival delay imposed due to another emergency aircraft, and the status of the pilot as a part owner of the charter airline. Also of note is that the first officer was on her first flight as a commercial pilot.

How Much Fuel Did They Need?

Any airline will be subject to the regulations of the country in which they are based, but most countries' rules conform to guidelines published by the International Civil Aviation Organization (ICAO). ICAO rules state that any aircraft must have enough fuel to travel to its destination and any alternate airport plus an additional 45 minutes for reserve. The investigation will determine if the LaMia aircraft departed with sufficient fuel.

Remember, though, that winds aloft, weather, payload, and even temperature can affect the fuel range of any airplane. There is no hard and fast mileage number to apply. The investigation will need to reconstruct all the planning data that the LaMia pilots had.

Two Ways to Run Dry

The first and perhaps most common way to run out of gas is due to simple human error. This can result in an aircraft being mis-fueled or having an erroneous fuel reading due to a bad gauge. Call it inadvertent...when it gets quiet while still airborne, the pilots may be surprised the most. This can take multiple errors by fuelers, mechanics, or pilots who can be extremely inventive in finding ways to circumvent procedures designed to catch fuel errors, but it has been known to happen.

The second way to run out of fuel is to have a lapse of judgement, or what we in aviation call airmanship.

This Has Happened Before

Part of the essence of being a pilot in command of a commercial aircraft means internalizing the fact that 1) you're on your own and 2) that everyone aboard is depending on you. Of course you aren't literally on your own as you have resources such as your first officer, air traffic control, and dispatch, but no one will be there to hold your hand or pull your chestnuts out of the fire if things go wrong. The nature of the job means that you will be made, in some way or another, to own the decisions you make.

Keeping your eye on your fuel state is one of those "Aviation 101" things that every pilot gets pounded into them from day one. Running out of gas is something you just don't do if you're aware of the two precepts above. It is rare but it happens.

In 1978, a United Airlines DC-8 crashed outside of Portland, Oregon after running out of fuel. The pilots had become preoccupied with a bad gear indication and flew around until the fuel ran out. The engineer was not assertive enough to communicate the plane's dire fuel state to a distracted captain. As the engines quit, the captain implored the engineer to "keep them running". He forgot that it was his job to land before the fuel ran out.

Again in 1990, an Avianca Boeing 707 crashed after running out of fuel on approach to New York's JFK airport killing 74 passengers and crew. The cause was determined to be a language barrier and misunderstanding by the crew in communicating their fuel state to air traffic control. Specifically, air traffic controllers will not give priority handling to any aircraft unless the word "emergency" is used. The Avianca crew did not use that term and ran out of fuel after extensive traffic delays.

In both of these cases, the pilot in command failed to take appropriate actions to land before the fuel ran out. It really doesn't matter what air traffic control says or what state the landing gear are in. It would've been better to belly in or to disregard controller instructions than to crash. Making uncomfortable choices between two potentially unpleasant options is a big part of being a pilot.

Was This Careless Flying?

While the investigation is far from complete, a picture is beginning to emerge. LaMia, which only owned this one aircraft, was known to be one of the cheapest charter operators available for hire in the region. A takeoff delay also meant that a potential refueling stop was not available due to the closure of that field. It also turns out that the pilot in command was a part owner of the company who may have let financial concerns cloud his judgement. 

Lastly, his copilot, Sisy Arias, was on her first ever commercial flight as a pilot. This is important because in her very inexperienced state, she may not have been aware of the fuel situation nor was she likely to intervene even if she was.

There's an old aviation aphorism floating around which states that the definition of a superior pilot is one who uses their superior judgement (proper fuel planning) to avoid situations requiring their superior skill (doing a night dead-stick landing into mountainous terrain). 

Aviation is a profession that calls for strict adherence to unmalleable rules. Behaving recklessly is bad enough, if that is indeed what happened here, but the real tragedy is in betraying the trust of your passengers and crew.