Today, air traffic control officers (ATCOs) on each side of the North Atlantic can see the aircraft they are controlling as they fly between Europe and North America.
It is almost impossible to convey the huge significance of this boring and apparently obvious piece of information, because most people don’t know that – yesterday – the same ATCOs couldn’t see the aircraft they were responsible for. They never had been able to see them, because the machines were outside radar range.
When flying between North American and Europe, until now aircraft of all kinds have always been invisible to air traffic control from the time they were about 350km off the coast on either side.
Under yesterday’s system, ATCOs knew approximately where each aircraft was because the pilots reported their position, their height and an estimate for the next reporting point every 15min or so. This worked safely because aircraft were painstakingly released into their pre-cleared, one-way oceanic tracks at specific heights, time intervals, and speeds, so they would maintain separation vertically and horizontally.
That system is a well-tried air traffic management (ATM) technique known as procedural control, and most of the world will continue to control air traffic procedurally over almost all oceanic and wilderness areas for some years yet.
In fact only 30% of the earth’s surface has radar coverage enabling aircraft surveillance for air traffic management (ATM) purposes.
But now, a new global constellation of 66 low-earth-orbit smart satellites – launched over the last decade by satcoms company Iridium Communications – each carries a device that links aircraft ADS-B datalink signals to ATM centres. Aircraft-mounted ADS-B (automatic dependent surveillance – broadcast) streams information about the aircraft’s position, height and much more. This enables ATCOs to track the aircraft in real time, with a radar-like update rate of 8 seconds.
Here’s the history (this announcement should really be preceded by a trumpet fanfare!): US-headquartered communications technology company Aireon yesterday announced that its space-based air traffic surveillance system was switched on, and active surveillance trials involving ANSPs (air navigation service providers) Nav Canada and UK NATS have begun on the busy North Atlantic routes that each manages from its respective oceanic base either side of the sea.
Aireon CEO Don Thoma was able to boast that “For the first time in history, we can surveil all ADS-B-equipped aircraft anywhere on Earth.”
Well, it’s true that they are set up to do so, but not all the world’s ANSPs are ready for it yet. Those who are ready include Nav Canada and NATS, but also the Irish Aviation Authority, Italy’s Enav, and Denmark’s Naviair.
The European Aviation Safety Agency (EASA) is in the process of certificating the provision – by Aireon – of space-based surveillance over the whole continent. That will be another first: the provision of surveillance capability by an organisation that is not an ANSP nor the military.
Yesterday the US Federal Aviation Administration joined most of the rest of the aviation world in grounding the Boeing 737 Max series of aircraft, the very latest version of the established 737 series. What took it so long?
Having entered service in May 2017, by early March this year the Max had suffered two fatal crashes within five months. This is extraordinary for a new commercial airliner today.
Evidence from the preliminary report on the earlier of the two accidents suggests a technical failure precipitated it. The first event, in October 2018, involved a nearly-new 737 Max 8 belonging to Indonesian carrier Lion Air. It crashed into the sea near Jakarta within about 10min of take-off. The second accident, on 10 March this year, involved an Ethiopian Airlines aircraft of the same type, and it plunged into the ground within six minutes of take-off from Addis Ababa. Pilots of both aircraft radioed that they were having trouble controlling the aircraft’s height, and this was evident on flight tracking systems.
The FAA issued its grounding order on 13 March. This was three days after the Ethiopian crash, two days after China, Ethiopia and Singapore had banned Max operations, and a day later than the influential European Aviation Safety Agency – and many other states – had done the same.
Does this demonstrate that there are different safety standards – or safety philosophies – in different countries? Or does it suggest that the relationship – in this case – between the safety regulator and the manufacturer is too close?
On 12 March, resisting calls to ground the aircraft, the FAA said: “Thus far, our review shows no systemic performance issues and provides no basis to order grounding the aircraft.”
The next day it stated: “The FAA is ordering the temporary grounding of Boeing 737 MAX aircraft operated by U.S. airlines or in U.S. territory. The agency made this decision as a result of the data gathering process and new evidence collected at the site [of the Ethiopian crash] and analyzed today. This evidence, together with newly refined satellite data available to FAA this morning, led to this decision.”
The safety principle behind aircraft design, for more than half a century, has been that all systems should “fail safe”. This means that any one critical system or piece of equipment, if it fails, will not directly cause an accident. This is achieved either by multiplexing critical systems so there is backup if one of them fails, or by ensuring that the failure does not render the aircraft unflyable.
The preliminary report from the Indonesian accident investigator NTSC suggests that a factor in the sequence of events leading to it was a faulty angle of attack (AoA) sensor. This device, says the report, sent false signals to a new stall protection system unique to the Max series of 737s, known as the manoeuvring control augmentation system (MCAS). According to the report, these signals wrongly indicated a very high AoA, and the MCAS triggered the horizontal stabiliser to trim the aircraft nose-down. Finally, the crew seems not to have known how to counteract this nose-down control demand.
The implication of the NTSC report – not the final verdict – is that the MCAS was not designed according to fail safe principles: a single unit failed, causing a software-controlled automatic system to motor the powerful horizontal stabiliser to pitch the aircraft nose-down, and it kept on doing this until the crew could not overcome the pitch-down force with elevator.
At that point disaster could still have been prevented if the crew had been familiar with the MCAS, or with the drill for a runaway stabiliser trim. But the MCAS would not have been expected to trigger at climb speeds during departure. The result was that in this case the crew failed to act as the final backup safety system.
In the months immediately following the Indonesian crash some pilot associations in the USA whose members operate the Max publicly claimed that there was a widespread ignorance among Max-qualified pilots of the very existence of the MCAS, and also many assumed that a runaway trim could be dealt with in exactly the same way as it was for all the earlier 737 marques. Actually the drill is quite different for the Max, as Boeing and the US Federal Aviation Administration (FAA) have pointed out. There is more detail on the MCAS in the preceding item in this blog – “This shouldn’t happen these days”.
Somehow, therefore, many 737 Max pilots in Boeing’s home territory had found themselves un-briefed on a system that was unique to the Max. They claimed lack of detail in the flight crew operations manual (FCOM), which described the system’s function but did not give it a name. US pilots who converted to the Max were all 737 type-rated and had flown the NG marque, but their conversion course to the Max consisted of computer-based learning, with no simulator time.
This ignorance among US pilots was soon corrected because the issue got plenty of intra-industry publicity, so if a US carrier pilot suffered an MCAS malfunction the crews would have known to apply the runaway trim checklist, and select the STAB TRIM switches to CUT OUT. Was this confidence about US crew knowledge the reason the FAA was able to maintain its sang-froid over grounding for longer than the rest?
On the other hand it is not a good principle to use a pilot as the back-up for a system that is not fail-safe.
In the 1990s there were several serious fatal accidents to 737s caused by what became known as “rudder hard-over”. This was a sudden, uncommanded move of the rudder to one extreme or the other, rendering the aircraft out of control, and unrecoverable if it happened at low altitude. The problem was ultimately solved by redesigning the rudder power control unit, for which there was no backup, thus no fail-safe.
If a Boeing product has a fault the responsibility is Boeing’s, but it is equally the FAA’s. The FAA is the safety overseer, and should satisfy itself that all critical systems are fail-safe and that the manufacturer has proven this through testing.
If America has an image it is that of the can-do, the entrepreneurial risk-taker. Why would Boeing or the FAA be different? One of the FAA’s stated values is this: “Innovation is our signature. We foster creativity and vision to provide solutions beyond today’s boundaries.”
The world has benefited from the USA’s risk-taking culture which has driven some aviation advances faster than they would have occurred in other more risk-averse cultures like that of Western Europe. An example of this is the massive extension of ETOPs (extended range twin engine operation) with the arrival on the market of the Boeing 777, which ultimately drove the four-engined Airbus A340 out of the market and influenced the early close-down of the A380 line. Boeing and the FAA took the risk together, and together they got away with it.
Is the 737 Max going to prove to be the one Boeing didn’t get away with? Time will tell.
But is certain Boeing will find a fix that will get the Max back in the sky. And although this episode, if it runs the course it seems likely to follow, will damage Boeing, the damage will be far from terminal. The company has an unbreakable brand name by virtue of being so good for so long, but trust will have suffered.
In the world at large, the art and science of safety oversight is changing dramatically. Technology is advancing so fast that the traditional system of close oversight by the regulator cannot work without stifling innovation, so “Performance-Based Regulation” (PBR) is the new watchword. Basically this means that the regulator prescribes what performance and reliability objectives a system or piece of equipment should meet, and the manufacturer has to prove to the regulator that it meets them. This is fine, providing that the regulator insists on the testing and the proof, and has the expertise and resources to carry out the oversight.
Although lack of oversight resources in the FAA seems unlikely, it would be a global disaster if it occurred. The same would be true of other national aviation agencies (NAA) in countries where aviation manufacturing takes place.
That risk of under-resourcing NAAs is a serious worry for the future, because all the signs are that most countries consider it a very low political priority, especially at a time of budget austerity.
In the last five years, statistics for fatal accidents to commercial passenger jets were so low they looked set to prove that a permanent zero fatal accident target was achievable.
Technology is accepted to be the main contributor to these remarkable safety performance improvements. The superb engineering and smart systems in the latest jets made them as different from their predecessors as today’s generation of automobiles is from cars of the 1970s.
But, on 29 October 2018, Lion Air flight JT610 crashed only about 12min after take-off from Jakarta, Indonesia. The aircraft was a Boeing 737 Max 8 that was delivered by the manufacturer to the airline less than three months before, one of 11 of this new marque in its fleet.
That was a shock, but when on 10 March this year another almost new 737 Max 8 also crashed within a few minutes of take-off from Addis Ababa, Ethiopia under circumstances that appear similar, a chill went through the entire aviation community.
Ethiopian Airlines has grounded its 737 Max fleet, Singapore has banned Max operations in its airspace, and the Chinese aviation authority CAAC has grounded all Maxes registered there – almost sixty of them. And on 12 March Australia, Ireland, France, Germany and the UK added themselves to the rapidly growing list of those who had banned operation of the type. Late on 12 March the biggest blow fell: European Union body the European Aviation Safety Agency has banned all 737 Max 8s and 9s from its skies except to fly, empty, to maintenance bases. The agency argued that it cannot be ruled out that the Ethiopian accident was caused by the same failure as that which appears to have caused the Lion Air crash. And, shortly before midnight, India had joined the doubters.
Now Latin America has begun a wave of groundings and, as a result, by the end of the Western European day on 12 March more than a third of all Maxes in service around the world had been affected by effective groundings. There has never been an event like this, where the original certificating authority has declared an aircraft airworthy but much of the rest of the world has decided it is not so confident.
Back to the accident issues. The two take-off airports couldn’t have been more different, one at sea level, the other at an elevation of more than 7,000ft, but in both cases it was daylight and the weather conditions were benign.
Both aircraft were seen to dive to impact.
The Indonesian investigator (NTSC) issued a preliminary factual report that doesn’t pretend to provide a verdict on the cause of the Lion Air crash, but suggests that a factor in the sequence of events leading to it was a faulty angle of attack (AoA) sensor. This device, says the report, sent false signals to a new stall protection system unique to the Max series of 737s, known as the manoeuvring control augmentation system (MCAS). According to the report, these signals wrongly indicated a very high AoA, and the MCAS triggered the horizontal stabiliser to trim the aircraft nose-down. The crew seems not to have known how to counteract this nose-down control demand.
The NTSC did, however, provide fine detail about malfunctions on same airframe on the previous day (28 October), when almost exactly the same sequence of events occurred, including the signal from the faulty AoA sensor to the MCAS. But on that occasion the captain stopped the nose-down stabiliser trim rotation by selecting the STAB TRIM switches to CUT OUT, and then proceeded safely to the scheduled destination.
Some pilot associations in the USA whose members operate the Max have professed publicly that there was a widespread ignorance among Max-qualified pilots of the very existence of the MCAS, and also among them was an assumption that a runaway trim could be dealt with in exactly the same way as it was for all the earlier 737 marques. Actually the drill is different for the Max, as Boeing and the US Federal Aviation Administration (FAA) have pointed out.
The MCAS was developed for the Max because its more powerful engines are heavier and fitted further forward than those on earlier marques, affecting the aircraft’s centre of gravity and thus its behaviour at low speeds approaching the stall, so the manufacturer wanted to boost stall protection. It looks as if Boeing had either not foreseen the potential effect of a false high AoA indicator input to the MCAS, or it had failed to warn pilots clearly what that effect could be and how to react. The FAA also, it appears, had not anticipated this.
After the Lion Air crash the FAA put out an emergency airworthiness directive requiring operators of the Max to make clear to pilots the procedures for dealing with a runaway stabiliser trim. Boeing maintained that information was already available.
Pilots converting from earlier 737 marques to the Max are not required to undergo a new full type rating course or simulator sessions, because all 737s are deemed to have sufficient commonality to operate under the same type rating. Thus 737-rated pilots being prepared for the Max are required only to undergo a brief academic “differences course”. For example Southwest Airlines pilots had done their differences course entirely online, and American Airlines the same.
On 11 March, a day after the Ethiopian crash, the FAA revealed it has required Boeing to solve the software problem – and if applicable the hardware – that at present means that a false AoA input can trigger the MCAS stall protection when it is not needed, effectively causing a stabiliser pitch trim runaway. Meanwhile it has declared that the 737 Max series is airworthy.
But if it were to be found that there is a common cause of these two Max crashes – whatever that cause is determined to be – the implications for the manufacturer and the airlines are significant, given the massive size of the order book for 737 Max series aircraft.
Pilot Andy Hill, who flew the Hawker Hunter that crashed during the Shoreham air display in 2015 killing eleven people on the ground, has been judged not guilty of manslaughter by a jury.
My feelings on this are irrelevant in the grand scheme of things, but I am glad he was not convicted of the criminal offence of manslaughter by gross negligence.
I believe he was careless in his conduct of the display, having made a series of misjudgements leading up to the fatal manoeuvre, some of which must have been made consciously. His principle sin, shared by many pilots who have crashed during air displays, was to think he could push his luck just beyond the guidelines and get away with it. He has learned the the hard way that the guidelines are set where they are for good reason. Unfortunately his lesson was fatal for eleven other souls.
Any professional pilot knows that Andy Hill has probably died a thousand deaths since the accident, and he will live to die a thousand more.
Meanwhile the air display business in particular, and British aviation in general, have had cause to do some deep soul-searching. As a result of being put under the Air Accident Investigation Branch’s microscope, air displays will be different now, mostly by virtue of sticking to the rules that already existed instead of treating them just as guidance.
Some displays, like the Farnborough Air Show, with its airfield today surrounded closely by residential and industrial development, are already much more pedestrian than they used to be.
In the future, the most exciting air displays will be at rural aerodromes, or coastal displays where the action takes place over the sea and the audience watches from the beach front.
Has justice been done? Certainly change has already been the result of this intense scrutiny of the UK’s air show culture.
A radical change in pilot training philosophy is being implemented in Europe over the next four years, overseen by the European Aviation Safety Agency (EASA).
A few airlines and approved training organisations (ATO) are ahead of the curve, but most are struggling to keep up.
The present systems for airline pilot training and recruitment have been under scrutiny for many years, and for good reason: they were designed for an earlier era.
Despite the scrutiny, however, nothing much has changed. But it is about to.
When airline accidents happen these days it is the result – more often than not – of a mistake or misjudgement by a person. Often by the pilot. But airline pilots are the product of the system that trained them and the airline that conducted an assessment before hiring them.
The fact that a new pilot has passed the existing exams and flying tests to win a commercial pilot licence (CPL) means he or she can be legally hired by an airline, but it does not mean he or she is a good pilot. It just demonstrates that a minimum legal standard was achieve on the days the tests were taken.
EASA puts figures on the relationship between pilots and accidents: “An analysis of fatal aircraft accidents worldwide for the period 2010–2011 shows that in more than 50% of these accidents the actions of the flight crew were the primary causal factor. This analysis shows that flight crew handling skills were a factor in 14% of the accidents, whereas flight crew non-technical skills were a factor in more than twice as many (32%).” Non-technical skills, basically, are knowledge, understanding and problem-solving.
Since 2011 the fatal accident rate has slightly decreased, but human factors causality in the accidents that occurred is as strong as it was in the earlier EASA study results.
During training for the commercial pilot licence and instrument rating (CPL/IR), some pilots pass the theory exam with the minimum score in the multiple-choice exam questions, and marginally pass the flying test – perhaps on the third attempt – but at a time of pilot shortages the temptation to hire anyone with a licence will inevitably increase.
Everyone in the industry knows this, but solving the problem will entail a cash investment in additional training. Few people – whether self-financing cadets or sponsoring airlines – are prepared to pay. It is easy to argue that accident rates are low, the attrition rates are therefore acceptable, and accidents happen to other people, so there is a temptation to do nothing.
In Europe the option to do nothing is evaporating. In January this year EASA triggered its plan for phasing in a total change in pilot training philosophy over four years, and by 31 January 2022 “at the latest” all airline training departments and ATOs in EASA countries must have implemented the changes. By that date, successful pilots will be graduating with their theoretical knowledge tested against a completely updated question bank.
The training philosophy changes entail moving away from “silo learning and testing” toward competency-based training, and from rote learning toward scenario-based teaching that confers understanding, not just factual knowledge. A new EASA concentration on “Knowledge, Skills and Attitudes” (KSA) embodies this philosophy change, the reference to “Attitude” indicating the need to select students for their approach to the learning process, which may speak volumes about their personal suitability for the job.
EASA observes: “Current teaching and learning tools are not sufficiently developed to encourage future pilots to use analytic and synthetic thinking or to challenge student pilots to enhance their decision-making skills, their problem-solving ability, and their level of understanding of assimilated knowledge.”
These are massive attitudinal changes. The preparation for them has been set up at ICAO level, but the practical changes EASA is overseeing have been driven, above all, by changes that have their origin in Ryanair’s training department. That airline’s head of training, Capt Andy O’Shea, also chairs EASA’s Aircrew Training Policy Group (ATPG), which has been working with the agency, the airlines and the training industry for several years now, and it has driven the changes now in the pipeline.
Now the largest European carrier by most measures, and still growing rapidly, Ryanair has a voracious appetite for new pilots, and became aware some years ago that there were problems obtaining the high quality crew they insisted upon. O’Shea revealed publicly that more than 50% of pilots who applied for Ryanair jobs were simply not good enough, whether ab-initio trained or even with airline experience. EasyJet has since confirmed it has had a similar recruiting experience.
A few years ago, despite this failure rate, Ryanair could still find enough good pilots among the applicants to meet its needs, but this is no longer true. It couldn’t wait for EASA and the industry to come up with solutions, so it set up its own in-house enhanced training schemes at entry for newly licensed pilots, simply because the raw CPL/IR product was not good enough, and even many of those who had added a standard multi-crew cooperation and jet orientation course (MCC/JOC) to their CPL/IR were not proving ready for a Ryanair Boeing 737 type rating course.
The result of Ryanair’s experience has been the evolution of a course – approved at EASA via the ATPG – called the Airline Pilot Standard MCC. O’Shea describes it as an enhanced MCC/JOC which takes in the KSA philosophy, and consolidates knowledge, skills and understanding through scenario-based learning. It adds about 20h to the training pilots get but, says O’Shea, a successful APS graduate is more or less guaranteed to pass the 737 type rating, and become a quality line pilot.
In the last few days Ryanair has gone further, and set up a mentored cadetship programme, working with Cork, Ireland-based Atlantic Fight Training Academy, which will produce 450 Ryanair-ready copilots over the next five years.
O’Shea says Ryanair will be announcing more such alliances with European ATOs soon, driven by the need for large numbers of new flight-deck-ready pilots.
Meanwhile back on the line, Ryanair the employer is having to change too. It is evolving from the rabidly anti-union carrier it has traditionally been, into a company that recognises retention is as important as recruitment. Pilot and cabin crew union recognition is gradually being set up. This is not taking place without some hitches, but it looks as if they will get there in the end.
The year is 2035, and an RAF fastjet pilot walks across the pan to her Tempest aircraft.
Externally it looks quite like today’s latest stealth combat aircraft, but internally it isn’t. It can be operated pilotlessly from the ground and has massive autonomous operating capability.
So why is the pilot walking out to it?
Anyway, she climbs the ladder to the cockpit, the patient groundcrew perched there ready to help her strap in. But what she steps into is a featureless hole with an ejection seat in it. The seat has the usual harness, a pair of tube connections for oxygen and the G-suit, and cable jacks to connect to her helmet systems. The only sign of anything to interact with are two physical input devices, one for each hand, with just a few mode-selector buttons and a scrolling ball on them. There are no instrument displays, avionics or switches.
When she connects her helmet to the aircraft, a virtual cockpit suddenly surrounds her, projected on her visor so its components – and the outside world – are delivered in collimated visual form (infinity-focused) wherever she looks .
The mission, from brakes off to chocks-in is conducted by gesture-control in a synthetic visual world, with 360deg directional sound and vision in all three planes, so she can “hear” approaching threat cues as well as see them in the holographic world within her helmet. Directional sound cues enhance her awareness of battlespace threats – colour-coded on the visual display as friendly, hostile or unknown. The canopy above her head is perspex, but the need for eyeball contact with the real airspace environment and its occupants is debatable.
The computing power available to the pilot is formidable. With advanced artificial intelligence (AI) capacity provided by chips that imitate the human brain’s neural processes, the aircraft has the ability to take decisions autonomously on behalf of its commander – like setting electronic warfare modes, zapping inbound missiles, adjusting mission priorities, selecting targets, arming appropriate weapons, firing them, and controlling the aircraft trajectory.
Flight trajectory guidance no longer relies on GPS – it’s too easy to jam or corrupt – so it’s directed by quantum sensors, the precision successor to inertial navigation systems.
Back to the original question: what’s the pilot doing there in this deadly environment?
“Team Tempest” is an experimental programme designed to find out the answers to questions like that, to push technology to its limits and above all to innovate, on the basis that innovation is the most effective way to keep military capability ahead of the enemy.
Team Tempest is led by BAE Systems in partnership with MBDA (weapons systems), Rolls-Royce (propulsion) and Leonardo (sensor systems), backed by the UK Ministry of Defence. It was unveiled on the first day of the Farnborough Air Show last week at BAE’s showroom there, creating considerable industry interest and signaling that BAE intends to be a major player in future combat air systems (FCAS), albeit with partners – almost certainly European ones.
The projected aircraft would have a stealthy design augmented by electronic warfare capability intended to keep it invisible in its airspace while able to track, identify and target traffic, operating as part of a battle group that has surveillance capability.
This provides a formidable task for the human at the centre of it, even aided by AI.
The fact that AI is able to control a formidable weapons system is arguably the reason for needing to put a pilot in the decision-making and control loop. The science-fiction nightmare of intelligent robotic systems taking over powerful weaponry means that limits have to be set as to what AI-managed systems are capable of doing. Presumably the pilot could elect to remove the limits. Warfare is not just technology.
Prof Nick Colosimo, in charge of “disruptive technologies” at BAE Systems, qualifies the use of AI in future combat air systems, saying it will be “trusted, scalable, human-in-loop”. His approach has a tentative, experimental feel to it.
Meanwhile, if the RAF is going to put its pilots in charge of the Tempest in 2035, whether in the aircraft or remotely controlling the system from the ground, what training will they need, and what tools will enable them to stay in full cognitive control of the aircraft’s mission while allowing AI to direct it? Can the human brain keep up with the AI?
Team Tempest’s task is to provide answers to those questions to enable significant system upgrades for the Typhoon and Lightning through their service life, and eventually replace them with the next generation of combat air systems.
Keeping humans in effective control is the parallel task.
It is not exactly news that UK–based airlines are nervous about the form future commercial air transport bilateral agreements with the EU will take after brexit.
This not so much a fear that no agreement can be reached, but more a fear of the lack of clarity about potential agreement choices, and the relentless ticking of clocks as the March 2019 deadline looms.
The UK will have to set up bilateral aviation agreements with the EU as a whole, not individual member states, because the EU system works as a single air travel market.
Much less clear at this stage is how British airlines like EasyJet will be able to win clearance to continue flying between points in continental Europe. In fact EasyJet has set up an Austria-based subsidiary to deal with this, and depending on what kind of agreement the UK eventually makes with the EU post brexit, that may supplant the carrier’s Luton headquarters as its de facto administrative hub.
But it is not only airlines that are nervous about the situation. The UK’s aerospace trade association ADS has just stated that the industry is “counting on [UK government] negotiators to make sure the UK remains in the European Aviation Safety Agency” (EASA) following its exit from the EU.
The release of this statement was prompted by a speech in Vienna on 20 February by David Davis, the UK’s Secretary of State for Exiting the European Union, ostensibly clarifying the kind of relationship with the EU the UK anticipates having with the European Union and the rest of the world after brexit,
Clearly aiming his statement at the UK government, ADS Chief Executive Paul Everitt explained: “Aerospace is a global business that benefits from international regulatory convergence, which both ensures passenger safety and offers frictionless access for companies of all sizes to markets around the world. Regulation of the aerospace industry across Europe by EASA has served passengers and industry well. With the UK an influential member of EASA, companies in the aerospace sector continue to benefit from requiring only a single set of certifications for their personnel, facilities and products.”
Meanwhile EASA’s executive director Patrick Ky, replying to a question about the kind of relationship that EASA is able to have with the UK if the latter becomes “a third country” by leaving the EU, has said that Britain has choices: it could have a close relationship with EASA like Switzerland and Norway where regulatory alignment is complete, or like the USA and Canada in which the parties meet regularly for the purpose of maintaining regulatory harmonisation, and having done so generally agree to respect most of each other’s regulatory standards.
Everitt added: “Continued regulatory harmonisation is a necessity and the UK must remain in EASA after Brexit to put ourselves in the best possible position to benefit from growth opportunities as the international aviation market continues to expand.” US FAA standards and those of EASA are the two most widely accepted – and imitated – aviation standards globally.
In his speech, Davis acknowledged a fact rarely mentioned by UK pro-brexit politicians, which is that industries and nations are increasingly agreeing global standards. The fact that many of those standards were set by the EU is politically unpalatable for the hard-line pro-brexit lobby. Davis also used his speech to deny firmly that Britain would lead a “race to the bottom” in industrial standards and employment rights, insisting instead that it would lead a “race to the top”.
The UK Civil Aviation Authority has been reluctant to comment on its role in a future relationship with EASA, saying it is a question for the Department for Transport. Ky says that EASA has no plan to diminish the oversight role of individual national aviation authorities, but he worries that governments appear to see the high standards of industry safety performance being achieved today as a chance to cut back on oversight resources, which they are doing. One result of this, says Ky, is that – increasingly – NAAs are approaching EASA to ask the agency to provide them with support.
After an apparently near-impeccable year for airline safety in 2017, the traditional accidents are returning. In the last week a Russian carrier has fatally lost a twinjet, and an Iranian airline a twin turboprop.
It would be closer to the truth to say these accidents – or at least the risk they represent – never went away, it’s just that a year is too short a time in which to measure the true safety performance of an industry.
The previous story in this blog sequence investigated the part that luck plays in airline safety, and it concluded that it still plays an unacceptably big part in an industry that confidently tells its passengers it has high standards.
The Russian loss involved a Saratov Airlines Antonov An-148 regional twinjet. It had taken off from Moscow Domodedovo airport in snow, bound eastward for Orsk, but after about 6min its climb became a rapid descent and it hit fields at high speed.
Early data from the investigation suggests the trigger for the fatal sequence of events was a disparity in airspeed indicator readings, probably caused by ice build-up in the external sensor because its heater had failed. The crew saw the disparity developing between the airspeed indicators and tripped out the autopilot, but failed in their attempts to fly the aircraft successfully relying on instruments that included misleading airspeed data.
Less detail is known about the Iran Aseman Airlines ATR72, but it was on a flight from Tehran to Yasouj among Iran’s south-western mountains. The destination is cradled in a valley, and the aircraft hit mountains about 30km north of the city in its early descent. The mountainous terrain was under complete cloud cover and snow.
The Saratov case provides more evidence of pilots’ unpreparedness for “limited panel” instrument flying. Air France 447 was the most famous example of pilot inability to cope with instrument flying when the airspeed sensors were temporarily compromised by ice, but the final report revealed that there had been six other recorded occasions in the same aircraft type (A330) where pilots had coped successfully with unreliable airspeed readings.
Airline recurrent trainers need to go back to basics with instrument flying, because it is increasingly clear many pilots all over the world are losing this crucial skill.
Loss of reliable airspeed information is unsettling, and it usually causes the autopilot to trip out, so airlines should ensure their pilots are able to cope with this situation.
In stable flight, whether level, climbing or descending, airspeed is a product of engine power and pitch attitude. All pilots with time on a particular type should know approximately what power will produce the performance they want.
So if they become aware that airspeed indications are compromised, it makes sense to adopt straight and level flight (if at a safe altitude) while sorting out a Plan B. That way the attitude is stable, and if the pilot selects the power setting that will produce a safe airspeed, all is well. However unsettling it is to see an airspeed reading that is clearly wrong, and which would be dangerous if true, it is a plain fact that the correct pitch attitude for S & L flight plus the correct power setting will produce the correct airspeed.
In the case of the Iran Aseman ATR72 the cause of the crash isn’t known yet, but there was no emergency call and that range of mountains contains many aircraft wrecks. If it turns out to be a classic case of CFIT (controlled flight into terrain), the issue will be one of three-dimensional navigation on instruments. Yes, such approaches are demanding, but these procedures should be the lifeblood of crews working for Iranian domestic carriers, for whom approaches into airports surrounded by mountains is their daily work.
These airlines – and others – have to ask themselves what is missing in their pilots’ skills, and why these skills are missing at all. Finally, they have to ask what they need to do to replace skills that have lapsed.
If the investigators’ final verdict is that pilot error was a factor in these accidents, the fault lies squarely with the carriers for failing to ensure, in their recurrent training regime, that their pilots have the living skills their passengers have a right to expect.
And again, if that verdict were to be delivered by the investigators, the airlines should worry about whether their existing crews could fail in the same way tomorrow.
If you look at the statistics for fatal airline accidents in 2017, the year looked faultless.
There were no fatal accidents – at least not among the mainline carriers operating passenger jets.
But if you look at the number of near-disasters, and especially if you hear the accounts of what happened on board and imagine the trauma the survivors underwent, you might wonder what made the difference between the mishaps they survived and fatal crashes in recent years that had almost identical precursors.
The answer is luck. Not a scientific answer, but it is the only word in the English language that describes that difference. A study Flight International/FlightGlobal will shortly publish (Flight International issue 23-29 January) contains an analysis of how luck works in today’s air travel.
Giving detail of numerous recent near-disastrous mishaps, the report observes: “Sometimes these mishaps start with a technical problem, but more often they are the result of inadequate crew knowledge, poor procedural discipline or simple human carelessness.”
Many of them ended up as that most common of all airline accidents, runway excursions or overruns on landing, and the result is usually serious and very expensive damage.
Pegasus Airlines at Trabzon, Turkey, 13 January (Twitter World News)
The spectrum of industry discussion about how to deal with this “luck” factor includes – at one end of the scale – automating pilots and their fallibilities out of the picture, and at the other end imbuing today’s crews with a quality referred to as “resilience”. The latter is the ability to face a surprising or unforeseen combination of circumstances with cool logic based on knowledge, situational awareness and skill. That’s what most passengers assume all pilots have.
Airline pilots today are firmly discouraged by their employers from disconnecting the autopilot and autothrottle during revenue flights. There are good reasons for this, the most obvious being that the automation – properly programmed – flies the aircraft more accurately than most pilots can. The argument against it is that if the automation is wrongly programmed, or used unintentionally in the wrong mode, or suffers a rare failure, the pilot reaction to the unintended consequences frequently demonstrates a lack of “resilience”, setting off a chain of events that can lead to an accident.
The question is, if pilots were permitted to fly their aircraft manually more often during revenue passenger flights, would their manual flying and associated cognitive skills be better primed for the unexpected, making a resilient response more likely when things don’t go according to plan? Pilot organisations like IFALPA believe they would.
To many airlines, that idea is heresy. Letting pilots “practice” flying with passengers on board is just not acceptable, they argue. “Practicing” (what pilots call flying) should only take place in a simulator or an empty aeroplane, they maintain.
The main problem with simulators is that, although getting better all the time, they will – psychologically – be no preparation for the real environment. The sense of risk, or fear, and the stress generated by it, can never be replicated in a simulator.
The reason aeroplanes have not been even more automated than they have been so far is that most flights don’t happen exactly as planned, so the pilots have frequently to intervene to make decisions and adjust the trajectory, even if they use the automation to do it.
This is a discussion that will – and should – continue, and the existing polarisation of views also seems likely to persist.
What is really needed is a cost-benefit and risk examination of whether the regular employment of manual and traditional pilot cognitive skills in flight has net advantages or disadvantages for airlines, but such research has never been carried out.
The ideal institution to do it would be the Institut Supérieur de l’Aéronautique et de l’Espace in Toulouse , which has expertise in measuring neuro-ergonomics in working pilots. ISAE has successfully carried out studies of the effect of stress on pilot cognitive and manual skills, and tested ways of re-orienting pilots when they lose situational awareness.
An unpredicted jet engine design flaw means that all commercial airliners in service today – except one – technically fail to meet the regulatory standards for cabin air quality, according to a new study carried out at Cranfield University, UK.
The Boeing 787 is the exception because – uniquely at present – it doesn’t use engine bleed air for cabin pressurisation and air conditioning. In other types, air for the cabin is bled directly from the compressor of the aircraft’s engines, which makes them vulnerable to an overlooked secondary effect of jet engine lubrication system design.
The design flaw relates to so-called labyrinth and mechanical oil seals that act to contain the lubricant supply to the engine-shaft bearings. Effective lubrication depends on a low level of oil flow through them. In terms of engine oil consumption this leakage is negligible, and it was assumed by engineers that high air pressure would prevent oil leakage into the compressor chamber.
Arguably the seals do exactly what they were designed to do, but the assumption about the effect of high air pressure preventing leakage into the compressor turned out to have been over-optimistic. This matters, because aero engine lubricating oil – an entirely synthetic fluid, not a mineral oil – contains organophosphate additives (tricresyl phosphate) that are highly effective anti-wear agents, but are also particularly toxic to humans.
A 2014 study by Robert Flitney, a sealing technology consultant, established that oil from the bearings does indeed leak into the compressor chamber despite the high air pressure in it. As Flitney explains: “Simply put, the labyrinth seal is essentially a controlled leakage device relying on pressurisation to minimise oil leaking along the compressor shaft.” It may indeed minimise it, Flitney found, but it does not prevent it. As a result, the lubricant that escapes from the seals into the hot environment of the engine compressor chamber are continuously – and inevitably – delivered as pyrolised fumes via the engine bleed air system into the cockpit and cabin. Mechanical oil seals similarly leak a small amount. Meanwhile the bleed air flow to the cabin is not filtered, and there are no detection systems anywhere on the aircraft to measure contamination levels or to alert crews to contamination risk – nor is a detection system mandated.
The latest empirical examination of the cabin air issue was carried out at the UK’s premier aeronautical university, Cranfield. The same establishment in 2011 produced a report into cabin air quality commissioned by the UK Civil Aviation Authority on behalf of the Department for Transport (DfT). At the time, controversially, the study confirmed that engine oil fumes were indeed carried into the cabin, but the first Cranfield study proposed the contaminants were not a hazard to human health at the levels measured.
The report admitted, however, that during the period in which the study team was taking cabin air samples for analysis, there was no occurrence of a “fume event” – an incident in which higher concentrations of oil fumes enter the cabin. Sometimes this is because of the failure or partial failure of an engine oil seal, but it can result from a simple variation of engine power, which varies the internal gas pressure and temperature distribution and affects the seal effectiveness. As the DfT says: “The science is difficult because fume events are unpredictable and can last just a couple of minutes.” It also states that its research into cabin air quality “has been completed and the department’s programme in this area has now stopped”.
Fume events are not everyday occurrences, but neither are they very rare. Their exact frequency is undocumented, partly because the industry and government agencies play down their significance, and the reporting rate per occurrence is unknown. The issue that is particularly carefully ignored, however, is the continuous presence of low level cabin air contamination resulting from the fact that engine oil-seal leakage, it has now been established, is effectively a designed-in phenomenon.
This exposes those who fly for a living – and also frequent fliers – to the risk of the cumulative effects of neurotoxins that can build-up in their systems even if they don’t experience a fume event. The DfT itself admits that the chemical constituents of aero-engine oil are potentially neurotoxic, but maintains that the levels of exposure are so low as to be harmless. The DfT has not, however, carried out any research into the cumulative medical effects of low level exposure despite hundreds of pilots and cabin crew having had to retire because of ill-health, some following fume events, but rather more suffering long-term health degradation from continuous exposure. As the DfT admits, however, its studies into this phenomenon have now stopped.
But the latest study related to cabin air quality carried out at Cranfield is an independent one, and it examined the issues relating to engine design. It also highlighted the failure of regulatory organisations like the DfT or EASA to enforce laid-down standards for bleed air system certification. The study, for which Cranfield holds the copyright, concludes: “Low-level oil leakage in normal flight operations is a function of the design of the pressurised oil and bleed-air systems. The use of the bleed-air system to supply the regulatory required air quality standards is not being met or being enforced as required.”
This study was carried out at Cranfield by Dr Susan Michaelis, a former airline pilot who, in 2010, had been awarded a PhD by the University of New South Wales, Australia for her paper entitled “Health and flight safety implications from exposure to contaminated air in aircraft”. In 2016 Cranfield added an MSc to her academic achievements. The result of the MSc research is her new paper “Implementation of the requirements for the provision of clean air in crew and passenger compartments using the aircraft bleed air system “, which also won Dr Michaelis the accolade “best overall student on the [Cranfield] MSc Air Safety and Accident Investigation” course .
Meanwhile the European Aviation Safety Agency has produced an industry-led study that has more or less re-hashed all the old industry arguments, the main tenet again being that although potentially harmful organophosphate-based fumes are present in bleed air, the concentration is so low as to be harmless. EASA doesn’t address the issue of repeated crew exposure to low levels of harmful toxins and occasional “fume events”, and where it has been established that specific crews have suffered medically identified symptoms, including incapacitation in flight. EASA’s report has dismissed them as psychosomatic.
Now the University of Stirling has just had a paper published (June 2017) in the World Health Organisation’s journal Public Health Panorama. It examines “the health of aircrew who are suspected to have been exposed to contaminated air during their careers,” and says the study shows “a clear link between being exposed to air supplies contaminated by engine oil and other aircraft fluids, and a variety of health problems. Adverse effects in flight are shown to degrade flight safety, with the impact on health ranging from short to long-term”.
The report confirms that more than 300 aircrew, whose cases were examined, “had been exposed to a number of substances through aircraft’s contaminated air and reveal a clear pattern of acute and chronic symptoms, ranging from headaches and dizziness to breathing and vision problems”. One of the report’s authors, Professor Vyvyan Howard, professor of pathology and toxicology, Centre for Molecular Biosciences at the University of Ulster, added: “What we are seeing here is aircraft crew being repeatedly exposed to low levels of hazardous contaminants from the engine oils in bleed air, and to a lesser extent this also applies to frequent fliers. We know from a large body of toxicological scientific evidence that such an exposure pattern can cause harm and, in my opinion, explains why aircrew are more susceptible than average to associated illness.”
Recorded fume events causing sensory impairment and incapacitation of pilots and cabin crew are numerous, but listing them all is of limited use because the stories are remarkably similar. In terms of scale, an event over Canada on 24 October last year is notable because it involved an Airbus A380, but similar events have been recorded on all types large and small. In the A380 case British Airways flight 286 en route San Francisco-London was over Saskatchewan when it was forced to divert to Vancouver with a major fume event that incapacitated at least eight crew members, forcing them to go onto oxygen. When it landed all three pilots and 22 cabin crew were taken to hospital, and many of them were unfit for work months later, according to their union, Unite. The condition of the passengers is unknown. There has been no formal inquiry by British authorities into the event, and BA was left alone to deal with it. BA says the aircraft’s flight back to London was uneventful.
Some individual aircraft become notorious for fume events but remain in service with no follow-up by the authorities. An example is N251AY, a US Airways Boeing 767-200. On 16 January 2010 it operated a flight from St Thomas, US Virgin Islands, to Charlotte, North Carolina with 174 passengers and seven crew on board. During the flight the cabin crew noticed an unpleasant smell in the cabin, and the pilots suffered the onset of headaches, sore throat and eye irritation. By the time they were managing the approach to Charlotte they began to feel groggy and had difficulty in concentrating, but they landed the aircraft safely. During the en-route phase the pilots had messaged base to request medical attendance on arrival.
The event has been confirmed by US Airways but is not recorded by the FAA or the National Transportation Safety Board. Crew blood tests on arrival confirmed high levels of carboxyhaemoglobin, all the symptoms persisted for days, and the feeling of fatigue never left the pilots. They had their aircrew medical clearance rescinded and lost their pilot licences.
In March the same year the US Association of Flight Attendants reported that eight pilots and cabin crew members, including all but one of the crew on the St Thomas-Charlotte flight on 16 January 2010, did not return to work, and that there had been at least three known fume events on N251AY in December and January. The only fault the airline said it found was leaky rear door seals which, arguably, could have allowed engine fumes into the cabin on the ground, but the AFA says it doubts that explains what actually happened.
US Airways had carried out a borescope check on N251AY’s engines but initially found no engine fault. Dr Michaelis points out, however, that there did not have to be a fault for oil seal leakage into the compressor to take place. Her Cranfield work explains that oil seal leakage is lowest during stable flight phases like cruise, but in transition phases like start, spool-up, throttle-back, or whenever the power is varied, the pressure and thermal equilibrium is disturbed, and a fume event can occur even when there is no bearing fault. Hence the frequency of “no fault found” reports from the engineers after post-fume-event inspections.
Meanwhile internal reports and messages by official agencies about cabin air contamination also abound, but again they all say much the same thing. Here is one example of a US FAA report in 2009 recorded, along with many others, in one of Dr Michaelis’ research papers. The FAA said: “Lubricants: Many incidents of smoke/fumes in aircraft cabins have been linked to contamination of cabin air with pyrolytic products of jet engine oils, hydraulic fluids, and/or lubricants by leaking into ventilation air. These leaks can be subjected to 500°C or higher temperatures. If the origin of the smoke/fumes is of organic petroleum derivatives, then the smoke/fumes may cause a multitude of symptoms, including central nervous system dysfunction and mucous membrane irritation.”
Ever since the US Watergate political scandal and cover-up, when news media are following such a story they tend to tag it as a cover-up by suffixing the key word with “gate”. In what is perhaps the most notorious aviation industry alleged cover-up – the Westgate affair – the suffix was already in place. Richard Westgate was a British Airways A320 pilot when he died at age 43 in December 2012.
Westgate had been treated by a specialist clinic in Brussels for a painful neurological disorder for more than a year before his death, and extensive neurological damage was confirmed by his post-mortem. But when the coroner, Dr Simon Fox, QC, ruled on the cause of death, he stated it was the result of a self-administered, non-intentional overdose of pentobarbital, a sedative taken to aid sleep. Westgate died alone in a hotel room in Brussels.
Fox explained in his judgement that, although Westgate may have been exposed to organophosphate neurotoxins as a result of his job, and although that may have caused his poor health, it was not the cause of his death. He also ruled that there had been no causative negligence by British Airways, the Civil Aviation Authority or the Health and Safety Executive, basically because there are no prescriptive rules or guidelines relating to cabin air quality. Effectively, there are no applicable laws, so nobody broke the law.
Fox stated: “My provisional view subject to representations is that, whether or not in life in the period of months or years before his death the deceased was suffering from an illness caused by exposure to organophosphates in the course of his employment as a commercial pilot, is not a proper issue to be the subject of the Inquest.” In a statement that the dead pilot’s mother, Judy Westgate, read out after the judgement, she concluded with the words: “One day the truth will out.”
The subject of contaminated cabin air is to be reviewed by scientists, medical experts and engineers at the International Aircraft Cabin Air Conference at Imperial College, London on 19-20 September 2017 https://www.aircraftcabinair.com. Potential solutions to the problem will be aired as well as research and reports.
Meanwhile the industry and its regulators repeat the mantra that contaminants in the bleed air are at a harmless level of concentration. Dr Michaelis, in her studies, cites numerous, detailed, publicly recorded scientific data sources that all indicate there is no such thing as a safe level of exposure to the chemicals in aero-engine oil, especially when they are released in the form of pyrolised fumes.
But the industry can claim what it likes because it does not have to prove its case. In courts, the legal burden of proof rests entirely on those who claim to be victims of cabin air toxins, and it seems not to be sufficient to demonstrate – as in the Westgate case – that leakage of neurotoxic organophosphates into the cabin air is continuous and inevitable, but that the observable neurological harm to crew was not a coincidence nor psychosomatic.