Well, not quite. But something promising has emerged on the pilot training market just as the world’s airlines are beginning to slip the surly bonds of earth once more.
The newly created Airline Pilot Club (APC) offers free registration, and a whole range of advice, guidance, professional aptitude assessment, airline pilot standard e-learning course and tech webinars, for all of which there is no charge.
To access this, all that aspiring pilots have to do is join the club.
APC is a kind of marketplace which brings together selected Approved Training Organisations (ATO), airlines and other operators, and aspiring pilots. As at all marketplaces, they are there to eye each-other up.
The downside? There isn’t an obvious one.
But free flying training? Now you’re getting greedy!
No, it doesn’t offer that, but by the time aspiring APC pilots reach the airborne stage of their preparation they will know their own potential, and be as well prepared as they can be to enter an approved training course from which they will almost certainly graduate.
APC doesn’t provide the flying training, but it vets its short-listed ATOs according to a set of strict criteria.
As for financing, next year the Club expects to launch its pilot training funding system. This is designed to enable students who pass their professional aptitude assessment to get financing without having to rely on the bank of mum and dad, which will democratize access to flight training, thus benefiting the entire industry.
The guy who came up with the APC idea is well-known in European pilot training and recruitment circles: Captain Andy O’Shea. He was head of training at Ryanair for 18 years and chairman of the European Union Aviation Safety Agency (EASA) Aircrew Training Policy Group (ATPG). You can learn more about him and the training innovations he pioneered at the ATPG here.
It was O’Shea who shocked the airline and training establishment by revealing a few years ago that more than 50% of fully licensed pilots applying for Ryanair jobs consistently failed flying tests in a simulator session for which they had been given plenty of time to prepare. Other airlines then admitted their experience had been similar.
The author and O’Shea in his days as Ryanair Head of Training
Not many people know this, but there are about 7,000 fully licensed pilots in Europe who have never been able to get a job. Not because they were casualties of the recent pandemic – this phenomenon pre-dates that. They were simply trained to license minima, and passed. It was like someone passing their driving test and looking for a job in Formula One.
So when O’Shea, having introduced several highly innovative recurrent training systems at Ryanair, finally left the carrier, he wanted to set up a system that introduced aptitude-tested, motivated, technically prepared wannabe pilots to ATOs that would then put them through a training programme that prepares them to do more than scrape through their license.
This is the course that would see them pass the acceptance check-ride at his old airline.
There’s more, but you’ll find it at the link I provided earlier, and at APC.
Environmental awareness could be embedded in future airline pilot training if a new study by a European training think-tank is accepted at the European Union Aviation Safety Agency (EASA).
EASA’s Aircrew Training Policy Group (ATPG) has produced an advisory paper that takes – as its starting point – the fact that there is no mention anywhere in training syllabi of preparing pilots to operate in an environmentally friendly manner. Entitled “Environmental Awareness Training for Pilots”, the paper points out how incongruous this looks when trade bodies like the International Air Transport Association have, for several years, publicly acknowledged that the industry must strive toward environmental sustainability in the face of accelerating public concern about global warming, atmospheric pollution, noise, and species extinction.
The chief authors of the report – Marina Efthymiou, Assistant Professor in aviation management at Dublin City University, and ATPG chairman Captain Andy O’Shea – point out that, although pilots may be instructed in fuel-saving techniques on command courses, that is not the same as “embedding ecologically friendly flight operations in young pilots’ DNA from their early training.” If EASA were to accept the paper’s argument and develop appropriate changes, they argue that standardising this approach to pilot training – and air traffic management/ATCO training also – would have the potential to influence a way of thinking, and thus to benefit operational behaviour. Efthymiou points out that fuel management training at airline level is not standardised, neither are its results measured. “The purpose here,” she explains, “is sustainability, not saving fuel costs.”
The advisory paper points out: “Traditionally the management of these three decision-based functions (fuel, time, noise) has mostly been considered as solely within the remit of the pilot-in-command.” Now, says the study, the proposed incorporation of environmental awareness into all pilot training is intended to “encourage good behaviour through early, attitude-forming education thereby contributing to the improved environmental aware performance of all pilots.”
O’Shea believes that adopting this proposal need only entail a “re-balancing” of existing training programmes, not radical change, embedding objectives in already-adopted safety instruction concepts like threat and error management (TEM). He suggests that “by recording objective observable behaviour (OB), and TEM outcome data on how recurrent pilots manage environmental scenarios, powerful insights can be generated to help drive a feedback loop into initial type rating training.”
In the end, airlines would benefit financially from the care taken by pilots imbued with a culture of care for their aircraft and the environment, the study argues. Meanwhile, at a time when airlines are spending some of their public relations budget on campaigns to persuade travellers of how ecologically aware they are, and while movements like “Flygskam” (Flight Shaming) are competing for passengers’ attention, being able to claim – truthfully – that “your pilots” are trained to care about their skies might also prove a marketing advantage.
The European Union Aviation Safety Agency (EASA) has published a Proposed Airworthiness Directive (PAD) , signalling its intention to approve the Boeing 737 MAX’s return to Europe’s skies “within a matter of weeks” – probably about mid-January.
But Europe is specifying a few requirements that the US Federal Aviation Administration (FAA) has not demanded.
It was on 20 November that the FAA approved the aircraft’s return to America’s skies, but US carriers have many preparations to complete before resuming commercial services with the Max. American Airlines reckons it will be ready by the end of December.
EASA, however, wants to see the application of some operational measures that the FAA does not require. It insists, nevertheless, that the Max airframes in America and in Europe will be the same. The agency explains: “The [PAD] requires the same changes to the aircraft as the FAA, meaning that there will be no software or technical differences between the aircraft operated by the United States operators and by the EASA member states operators.”
The EASA PAD is a consultation document, and all responses have to be received by 22 December. EASA executive director Patrick Ky is at pains to point out that the agency, while cooperating with the FAA on correcting the anomalies in the Max’s manoeuvring characteristics augmentation system (MCAS) (see immediately preceding blog entry), insisted on looking independently at the whole issue.
Ky explained: “EASA’s review of the 737 MAX began with the MCAS but went far beyond. We took a decision early on to review the entire flight control system and gradually broadened our assessment to include all aspects of design which could influence how the flight controls operated. This led, for example, to a deeper study of the wiring installation, which resulted in a change that is now also mandated in the [PAD].” That, basically, is a requirement to bring the venerable 737’s design up to date, and is a signal that the days of “grandfather rights” – a dispensation to build the 737 Max as earlier versions of the 737 were constructed rather than as new aircraft have to be designed – are numbered.
The Max airframe design came through all the handling tests satisfactorily, as Ky explained: “We also pushed the aircraft to its limits during flight tests, assessed the behaviour of the aircraft in failure scenarios, and could confirm that the aircraft is stable and has no tendency to pitch-up even without the MCAS.”
Two principle differences between the FAA and EASA requirements are explained as follows: “EASA explicitly allows flight crews to intervene to stop a stick-shaker from continuing to vibrate once it has been erroneously activated by the system, to prevent this distracting the crew. EASA also, for the time being, mandates that the aircraft’s autopilot should not be used for certain types of high-precision landings [and approaches such as RNP-AR]. The latter is expected to be a short-term restriction.”
The crew intervention mentioned would allow the pilots to pull the stick-shaker circuit breaker. The stick-shaker – a system designed to alert pilots to an approaching stall – was one of the distractions that faced the Lion Air and Ethiopian Airlines crews before they lost control of their aircraft, despite the fact that the shaker was triggered by a false warning.
The FAA doesn’t see the need for this intervention, because the modifications have ensured that a single sensor failure will not trigger the stick-shaker any more.
Boeing and EASA say they have agreed to continue tests to see if they can further strengthen the aircraft’s systems’ resilience to angle of attack (AoA) sensor failures – the causal trigger for the two fatal Max accidents, and Boeing has also made this promise: “Boeing will also conduct a complementary Human Factor assessment of its crew alerting systems within the next 12 months, with the aim of potentially upgrading these to a more modern design approach.”
After nearly two years of grounding, Boeing’s 737 Max series has been cleared by the US Federal Aviation Administration to carry fare-paying passengers once again.
This is the first step in a redemption process for one of the world’s truly great engineering companies. Like a boxer who dropped his guard for just a second, Boeing has taken a punch that has knocked it to the canvas, and the referee had started counting.
Now, air traveller reaction is nervously awaited. Will the public believe claims by the FAA and Boeing that, together, they have confined to history the flaws that caused the 737 Max fatal crashes in 2018 and 2019?
The FAA – blamed along with the manufacturer for the lapses in design oversight that led to the two accidents – has declared the aircraft safe to operate in America. One by one, other national aviation authorities (NAA) are expected to follow suit.
Oversight of the type’s rehabilitation continues to be the FAA’s responsibility, but decisions on the systems and software changes applied to the Max have been made by multinational teams. Bodies formed to decide what changes were needed – and then to see them implemented – included the Joint Authorities Technical Review (JATR) representing nine nations plus the European Union Aviation Safety Agency (EASA) – and the Joint Operations Evaluation Board.
The relationship between the FAA and Boeing was much criticised in the accident investigations and the JATR review process . For that reason, the reaction of EASA to the Max’s clearance to fly is seen as critical.
Not only is EASA the agency that oversees safety in the region containing the largest group of aerospace industries outside America, but its contribution to the JATR recommendations made clear EASA was not happy with the FAA’s former piecemeal approach to certifying critical changes applied to the 737 Max.
Its opprobrium was directed particularly at the FAA’s approval of the flawed Manoeuvring Characteristics Augmentation System (MCAS), unique to the Max, and not used in earlier marques of 737. It recommended “a comprehensive integrated system-level analysis” of the MCAS, and of its integration into the total system-of-systems that constitutes a modern aircraft (for more detail, see “The Failures and the Fixes”section following this article).
So it was with heartfelt relief that Boeing heard EASA’s executive director, Patrick Ky, report on Max progress to the European Parliament Transport Committee on 29 October. Ky told them: “We are fully confident that, given all the work that has been performed, and the assessments which have been done, the aircraft can be returned safely to service.” Ky’s statement suggests EASA will re-certificate the 737 Max in Europe soon after the FAA’s announcement.
Meanwhile, out in the real world, Covid-19’s near-immobilisation of commercial air transport worldwide has rendered the Max’s long grounding almost invisible to the media and the public. Because of the far lower level of air travel activity, the airlines have been able to live without the 387 Maxes already delivered to them, and also without the additional 450 that have rolled off Boeing’s Renton, Washington production line since then. The latter are all in storage, awaiting any updates not already incorporated, and ultimate delivery.
Although clearance to fly has now been delivered, even in the USA the airlines will not instantly be re-launching their already-owned 737 Max fleets. The status of all the proposed software and hardware modifications to the type will not have been confirmed until the moment the FAA signs it all off.
American Airlines has said it hopes to start getting its Max fleet airborne before the end of December.
REUTERS/Nick Oxford/File Photo
Once the FAA has done that, getting the Max fleet ready for the sky will be an aircraft-by-aircraft, crew-by-crew process. In many airframes, a knowledge of what changes were coming has enabled a great deal of the work to be done. But also, because of the hardware and software changes to the Max, the crews have to be trained to use the new systems.
Incidentally, while the Max series was grounded, the FAA decided to order some additional modifications – completely unrelated to the crashes – to bring the type fully in line with modern safety regulations. For example, one of these involves the re-routeing and separation of wiring looms that the 737 had previously been allowed to sidestep under “grandfather” rules.
The number of lessons for manufacturers and regulators to learn from this aerospace drama is legion.
The failures and the fixes
The failures
Just a reminder: the 737 Max series fleet was grounded in March last year as a result of findings from the investigations into to the Lion Air and Ethiopian Airlines fatal crashes, respectively in October 2018 and March 2019.
The primary causal factor of the Lion Air Max crash was erroneous triggering of its manoeuvring characteristics augmentation system (MCAS) by a faulty angle of attack (AoA) sensor, according to the Indonesian final accident report. It is at the MCAS that Boeing’s corrective efforts have mostly been directed.
In both the accidents, the aircraft’s AoA sensor that feeds data to the MCAS wrongly indicated a very high AoA soon after take-off. The system reacted by providing nose-down stabilizer rotation that took the pilots by surprise. They did not understand the reason it kicked in, and their efforts to reverse the strong nose-down pitch did not succeed. Both these events occurred soon after take-off, and because the MCAS kept repeating the nose-down stabilizer in response to the continued erroneous high AoA sensor signal, the loss of height quickly resulted in impact with the surface.
During the examination of all the issues arising from the accidents, the JOEB was aware there were solutions to the situation in which the crews found themselves. But the fact that two crews in different regions of the world were so confused by what the MCAS was doing that they lost control had totally eclipsed pilot failings as the main issue.
MCAS was designed to trigger only in a specific flight configuration that causes the Max’s centre of lift to move slightly further forward, delivering a slight nose-up moment that can be countered by flight controls. This configuration is a combination of relatively low airspeed, flaps up, with the aircraft being flown manually. In the case of the Lion Air and Ethiopian flights, the pilots decided to continue to fly the aircraft manually during the early climb, rather than engaging the autopilot, so this precise flight configuration was encountered as soon as the flaps were fully retracted.
With flaps up, and still at a fairly low airspeed, the aircraft would be at a high angle of attack, and not far above the stall. FAA regulations require that, in the proximity to the stall, one of the “feel” cues to the pilots is that there should be a linear increase in the required control column force versus elevator displacement response, but the Max’s aerodynamics in this configuration had negated this effect, and MCAS was designed to restore that pilot cue automatically.
The JATR decided that MCAS’ fatal design weakness, above all, was that it was triggered by a single AoA sensor with no backup in case the unit had a fault or suffered damage. It seems Boeing and the FAA had overlooked that possibility, and had not explored the potential effects of erroneous inputs. Their excuse at the time was that the system was not seen as a critical one, rather as a refinement.
The fixes
The 737 Max had always been fitted with two AoA vanes, but originally only one was wired up to MCAS, and there was no flight deck indication of a disparity between the two sensors if a difference developed, which could have warned the pilots of a potential vane fault.
The hardware fix agreed by the JATR was that both AoA sensors would now feed into the MCAS, there would be an automatic comparison between them, and if there was more than a small disparity the MCAS would be locked out completely, because the aircraft can be flown without it.
The software fix also ensures that – now – the MCAS only operates once per high AoA event, so the repeated nose-down pitch demand by the stabilizers that led to the two accidents would not occur. In addition, the two flight control computers (FCC) now continuously cross-monitor each other.
After the hardware and software changes, the final improvements – overseen by the multinational JOEB – are to pilot training and cockpit drills for the Max series.
Now, even if the pilots are coming to the Max from the very similar 737NG series, pilots must undergo a one-off training session in a Max full flight simulator. This involves recovery from a full stall, dealing with a runaway stabilizer, practice manual trimming at high speeds (and therefore high trim loads), and crew cooperation on all these exercises.
Non-normal checklists have now been compeletely revised, and contain updated procedures that concentrate particularly on the operation of the horizontal stabilisers and trim controls, both in normal operation and in the case of all potential faults. The drills deal with runaway stabilizer, speed-trim failure, stabilizer out of trim, stabilizer trim inoperative, airspeed unreliable, altitude disagree, and AoA disagree.
Computer based training (CBT), containing video of crew exercises using the real controls, teaches drills for the following: airspeed unreliable, runaway stabilizer, the speed trim system, trim controls, and differences between the autopilot flight director system (AFDS) in the NG series and the Max series.
Testing the changes
Boeing and the FAA say they have put in 391,000 engineering and test hours developing the solutions, which have then been tried for 1,847 hours in simulators and for 3,000 airborne hours in the real aircraft.
Boeing, the FAA, and national aviation authorities (NAAs) from several other countries, met in Dallas on 23 May to consider the future of the 737 Max series of aircraft.
It is impossible to overstate how important this meeting is. The way civil aircraft manufacturing does business, not just in America, but all over the world, is under scrutiny.
Detail gradually emerging from Boeing and the FAA following the two 737 Max fatal crashes has upset such basic assumptions about the way modern aviation works that industry veterans – whose initial reaction was that this was just a case of finding a fix and getting the Max airborne again – are , only now, fully realising it’s not.
Like the Looney Tunes cartoon characters who ran over a cliff they didn’t know was there, we didn’t begin to fall until we looked down.
Let’s examine the proposal that all airliners nowadays are massively computerized, so adding some digital controls to the good old 737 to make it a Max is just bringing the 737 marque up to date.
After all, digital controls work on other types like Airbuses and Boeing’s own 777 and 787, and they are safe, so why not on the 737?
Back to basics.
All modern commercial airliners are supposed to be designed, in the first place, so they fly easily and intuitively, and have a natural aerodynamic stability within their flight envelope. That should hold true with or without computer control.
Designing an aircraft to be fly-by-wire, rather than conventionally controlled, can provide additional safeguards, but the airframe itself should still fly naturally.
Applying a digital solution to an airframe-related flight characteristic that is undesirable is a different matter entirely; but that is what Boeing chose to do when it installed the Manoeuvring Characteristics Augmentation System (MCAS) in the new Max.
The fact – revealed by the fatal accidents – that the MCAS could be triggered when it was not needed, and what consequences might follow its triggering, appears not to have been examined in any depth by Boeing or the FAA.
The fundamental questions for the FAA – and the foreign NAAs- are these: is the Max, as a simple airframe without digital corrections, sufficiently stable within its flight envelope to satisfy the regulators it is worthy of certification?
If not, is a digital fix sufficient to cover the undesirable flight characteristics lurking in a corner of its flight envelope? How reliable does the fix have to be to win approval?…and how can its reliability be proven?
For three decades the aviation world has agreed to operate a regime whereby the NAAs in countries where aircraft are manufactured all use the same standards when they certificate a new aircraft. So when the FAA certificated the 737 Max, the rest of the world accepted the FAA’s judgement and did not insist – as in the bad old days of the 1970s and before – on re-certificating it country by country.
At the end of the Dallas meeting Boeing had this to say: “We appreciate the FAA’s leadership…in bringing global regulators together to share information and discuss the safe return to service of the 737 MAX….Once we have addressed the information requests from the FAA, we will be ready to schedule a certification test flight and submit final certification documentation.”
Industry speculation as to when the FAA will be ready to approve return to service varies massively, from a week to many months. These seers also seem to be preparing themselves for disagreement between the FAA and foreign NAAs.
This is the point at which you dare not look down.
Yesterday the US Federal Aviation Administration joined most of the rest of the aviation world in grounding the Boeing 737 Max series of aircraft, the very latest version of the established 737 series. What took it so long?
Having entered service in May 2017, by early March this year the Max had suffered two fatal crashes within five months. This is extraordinary for a new commercial airliner today.
Evidence from the preliminary report on the earlier of the two accidents suggests a technical failure precipitated it. The first event, in October 2018, involved a nearly-new 737 Max 8 belonging to Indonesian carrier Lion Air. It crashed into the sea near Jakarta within about 10min of take-off. The second accident, on 10 March this year, involved an Ethiopian Airlines aircraft of the same type, and it plunged into the ground within six minutes of take-off from Addis Ababa. Pilots of both aircraft radioed that they were having trouble controlling the aircraft’s height, and this was evident on flight tracking systems.
The FAA issued its grounding order on 13 March. This was three days after the Ethiopian crash, two days after China, Ethiopia and Singapore had banned Max operations, and a day later than the influential European Aviation Safety Agency – and many other states – had done the same.
Does this demonstrate that there are different safety standards – or safety philosophies – in different countries? Or does it suggest that the relationship – in this case – between the safety regulator and the manufacturer is too close?
On 12 March, resisting calls to ground the aircraft, the FAA said: “Thus far, our review shows no systemic performance issues and provides no basis to order grounding the aircraft.”
The next day it stated: “The FAA is ordering the temporary grounding of Boeing 737 MAX aircraft operated by U.S. airlines or in U.S. territory. The agency made this decision as a result of the data gathering process and new evidence collected at the site [of the Ethiopian crash] and analyzed today. This evidence, together with newly refined satellite data available to FAA this morning, led to this decision.”
The safety principle behind aircraft design, for more than half a century, has been that all systems should “fail safe”. This means that any one critical system or piece of equipment, if it fails, will not directly cause an accident. This is achieved either by multiplexing critical systems so there is backup if one of them fails, or by ensuring that the failure does not render the aircraft unflyable.
The preliminary report from the Indonesian accident investigator NTSC suggests that a factor in the sequence of events leading to it was a faulty angle of attack (AoA) sensor. This device, says the report, sent false signals to a new stall protection system unique to the Max series of 737s, known as the manoeuvring control augmentation system (MCAS). According to the report, these signals wrongly indicated a very high AoA, and the MCAS triggered the horizontal stabiliser to trim the aircraft nose-down. Finally, the crew seems not to have known how to counteract this nose-down control demand.
The implication of the NTSC report – not the final verdict – is that the MCAS was not designed according to fail safe principles: a single unit failed, causing a software-controlled automatic system to motor the powerful horizontal stabiliser to pitch the aircraft nose-down, and it kept on doing this until the crew could not overcome the pitch-down force with elevator.
At that point disaster could still have been prevented if the crew had been familiar with the MCAS, or with the drill for a runaway stabiliser trim. But the MCAS would not have been expected to trigger at climb speeds during departure. The result was that in this case the crew failed to act as the final backup safety system.
In the months immediately following the Indonesian crash some pilot associations in the USA whose members operate the Max publicly claimed that there was a widespread ignorance among Max-qualified pilots of the very existence of the MCAS, and also many assumed that a runaway trim could be dealt with in exactly the same way as it was for all the earlier 737 marques. Actually the drill is quite different for the Max, as Boeing and the US Federal Aviation Administration (FAA) have pointed out. There is more detail on the MCAS in the preceding item in this blog – “This shouldn’t happen these days”.
Somehow, therefore, many 737 Max pilots in Boeing’s home territory had found themselves un-briefed on a system that was unique to the Max. They claimed lack of detail in the flight crew operations manual (FCOM), which described the system’s function but did not give it a name. US pilots who converted to the Max were all 737 type-rated and had flown the NG marque, but their conversion course to the Max consisted of computer-based learning, with no simulator time.
This ignorance among US pilots was soon corrected because the issue got plenty of intra-industry publicity, so if a US carrier pilot suffered an MCAS malfunction the crews would have known to apply the runaway trim checklist, and select the STAB TRIM switches to CUT OUT. Was this confidence about US crew knowledge the reason the FAA was able to maintain its sang-froid over grounding for longer than the rest?
On the other hand it is not a good principle to use a pilot as the back-up for a system that is not fail-safe.
In the 1990s there were several serious fatal accidents to 737s caused by what became known as “rudder hard-over”. This was a sudden, uncommanded move of the rudder to one extreme or the other, rendering the aircraft out of control, and unrecoverable if it happened at low altitude. The problem was ultimately solved by redesigning the rudder power control unit, for which there was no backup, thus no fail-safe.
If a Boeing product has a fault the responsibility is Boeing’s, but it is equally the FAA’s. The FAA is the safety overseer, and should satisfy itself that all critical systems are fail-safe and that the manufacturer has proven this through testing.
If America has an image it is that of the can-do, the entrepreneurial risk-taker. Why would Boeing or the FAA be different? One of the FAA’s stated values is this: “Innovation is our signature. We foster creativity and vision to provide solutions beyond today’s boundaries.”
The world has benefited from the USA’s risk-taking culture which has driven some aviation advances faster than they would have occurred in other more risk-averse cultures like that of Western Europe. An example of this is the massive extension of ETOPs (extended range twin engine operation) with the arrival on the market of the Boeing 777, which ultimately drove the four-engined Airbus A340 out of the market and influenced the early close-down of the A380 line. Boeing and the FAA took the risk together, and together they got away with it.
Is the 737 Max going to prove to be the one Boeing didn’t get away with? Time will tell.
But is certain Boeing will find a fix that will get the Max back in the sky. And although this episode, if it runs the course it seems likely to follow, will damage Boeing, the damage will be far from terminal. The company has an unbreakable brand name by virtue of being so good for so long, but trust will have suffered.
In the world at large, the art and science of safety oversight is changing dramatically. Technology is advancing so fast that the traditional system of close oversight by the regulator cannot work without stifling innovation, so “Performance-Based Regulation” (PBR) is the new watchword. Basically this means that the regulator prescribes what performance and reliability objectives a system or piece of equipment should meet, and the manufacturer has to prove to the regulator that it meets them. This is fine, providing that the regulator insists on the testing and the proof, and has the expertise and resources to carry out the oversight.
Although lack of oversight resources in the FAA seems unlikely, it would be a global disaster if it occurred. The same would be true of other national aviation agencies (NAA) in countries where aviation manufacturing takes place.
That risk of under-resourcing NAAs is a serious worry for the future, because all the signs are that most countries consider it a very low political priority, especially at a time of budget austerity.
A radical change in pilot training philosophy is being implemented in Europe over the next four years, overseen by the European Aviation Safety Agency (EASA).
A few airlines and approved training organisations (ATO) are ahead of the curve, but most are struggling to keep up.
The present systems for airline pilot training and recruitment have been under scrutiny for many years, and for good reason: they were designed for an earlier era.
Despite the scrutiny, however, nothing much has changed. But it is about to.
When airline accidents happen these days it is the result – more often than not – of a mistake or misjudgement by a person. Often by the pilot. But airline pilots are the product of the system that trained them and the airline that conducted an assessment before hiring them.
The fact that a new pilot has passed the existing exams and flying tests to win a commercial pilot licence (CPL) means he or she can be legally hired by an airline, but it does not mean he or she is a good pilot. It just demonstrates that a minimum legal standard was achieve on the days the tests were taken.
EASA puts figures on the relationship between pilots and accidents: “An analysis of fatal aircraft accidents worldwide for the period 2010–2011 shows that in more than 50% of these accidents the actions of the flight crew were the primary causal factor. This analysis shows that flight crew handling skills were a factor in 14% of the accidents, whereas flight crew non-technical skills were a factor in more than twice as many (32%).” Non-technical skills, basically, are knowledge, understanding and problem-solving.
Since 2011 the fatal accident rate has slightly decreased, but human factors causality in the accidents that occurred is as strong as it was in the earlier EASA study results.
During training for the commercial pilot licence and instrument rating (CPL/IR), some pilots pass the theory exam with the minimum score in the multiple-choice exam questions, and marginally pass the flying test – perhaps on the third attempt – but at a time of pilot shortages the temptation to hire anyone with a licence will inevitably increase.
Everyone in the industry knows this, but solving the problem will entail a cash investment in additional training. Few people – whether self-financing cadets or sponsoring airlines – are prepared to pay. It is easy to argue that accident rates are low, the attrition rates are therefore acceptable, and accidents happen to other people, so there is a temptation to do nothing.
In Europe the option to do nothing is evaporating. In January this year EASA triggered its plan for phasing in a total change in pilot training philosophy over four years, and by 31 January 2022 “at the latest” all airline training departments and ATOs in EASA countries must have implemented the changes. By that date, successful pilots will be graduating with their theoretical knowledge tested against a completely updated question bank.
The training philosophy changes entail moving away from “silo learning and testing” toward competency-based training, and from rote learning toward scenario-based teaching that confers understanding, not just factual knowledge. A new EASA concentration on “Knowledge, Skills and Attitudes” (KSA) embodies this philosophy change, the reference to “Attitude” indicating the need to select students for their approach to the learning process, which may speak volumes about their personal suitability for the job.
EASA observes: “Current teaching and learning tools are not sufficiently developed to encourage future pilots to use analytic and synthetic thinking or to challenge student pilots to enhance their decision-making skills, their problem-solving ability, and their level of understanding of assimilated knowledge.”
These are massive attitudinal changes. The preparation for them has been set up at ICAO level, but the practical changes EASA is overseeing have been driven, above all, by changes that have their origin in Ryanair’s training department. That airline’s head of training, Capt Andy O’Shea, also chairs EASA’s Aircrew Training Policy Group (ATPG), which has been working with the agency, the airlines and the training industry for several years now, and it has driven the changes now in the pipeline.
Now the largest European carrier by most measures, and still growing rapidly, Ryanair has a voracious appetite for new pilots, and became aware some years ago that there were problems obtaining the high quality crew they insisted upon. O’Shea revealed publicly that more than 50% of pilots who applied for Ryanair jobs were simply not good enough, whether ab-initio trained or even with airline experience. EasyJet has since confirmed it has had a similar recruiting experience.
A few years ago, despite this failure rate, Ryanair could still find enough good pilots among the applicants to meet its needs, but this is no longer true. It couldn’t wait for EASA and the industry to come up with solutions, so it set up its own in-house enhanced training schemes at entry for newly licensed pilots, simply because the raw CPL/IR product was not good enough, and even many of those who had added a standard multi-crew cooperation and jet orientation course (MCC/JOC) to their CPL/IR were not proving ready for a Ryanair Boeing 737 type rating course.
The result of Ryanair’s experience has been the evolution of a course – approved at EASA via the ATPG – called the Airline Pilot Standard MCC. O’Shea describes it as an enhanced MCC/JOC which takes in the KSA philosophy, and consolidates knowledge, skills and understanding through scenario-based learning. It adds about 20h to the training pilots get but, says O’Shea, a successful APS graduate is more or less guaranteed to pass the 737 type rating, and become a quality line pilot.
In the last few days Ryanair has gone further, and set up a mentored cadetship programme, working with Cork, Ireland-based Atlantic Fight Training Academy, which will produce 450 Ryanair-ready copilots over the next five years.
AFTA training fleet on its pan at Cork International Airport
O’Shea says Ryanair will be announcing more such alliances with European ATOs soon, driven by the need for large numbers of new flight-deck-ready pilots.
Meanwhile back on the line, Ryanair the employer is having to change too. It is evolving from the rabidly anti-union carrier it has traditionally been, into a company that recognises retention is as important as recruitment. Pilot and cabin crew union recognition is gradually being set up. This is not taking place without some hitches, but it looks as if they will get there in the end.
An unpredicted jet engine design flaw means that all commercial airliners in service today – except one – technically fail to meet the regulatory standards for cabin air quality, according to a new study carried out at Cranfield University, UK.
The Boeing 787 is the exception because – uniquely at present – it doesn’t use engine bleed air for cabin pressurisation and air conditioning. In other types, air for the cabin is bled directly from the compressor of the aircraft’s engines, which makes them vulnerable to an overlooked secondary effect of jet engine lubrication system design.
The design flaw relates to so-called labyrinth and mechanical oil seals that act to contain the lubricant supply to the engine-shaft bearings. Effective lubrication depends on a low level of oil flow through them. In terms of engine oil consumption this leakage is negligible, and it was assumed by engineers that high air pressure would prevent oil leakage into the compressor chamber.
Arguably the seals do exactly what they were designed to do, but the assumption about the effect of high air pressure preventing leakage into the compressor turned out to have been over-optimistic. This matters, because aero engine lubricating oil – an entirely synthetic fluid, not a mineral oil – contains organophosphate additives (tricresyl phosphate) that are highly effective anti-wear agents, but are also particularly toxic to humans.
A 2014 study by Robert Flitney, a sealing technology consultant, established that oil from the bearings does indeed leak into the compressor chamber despite the high air pressure in it. As Flitney explains: “Simply put, the labyrinth seal is essentially a controlled leakage device relying on pressurisation to minimise oil leaking along the compressor shaft.” It may indeed minimise it, Flitney found, but it does not prevent it. As a result, the lubricant that escapes from the seals into the hot environment of the engine compressor chamber are continuously – and inevitably – delivered as pyrolised fumes via the engine bleed air system into the cockpit and cabin. Mechanical oil seals similarly leak a small amount. Meanwhile the bleed air flow to the cabin is not filtered, and there are no detection systems anywhere on the aircraft to measure contamination levels or to alert crews to contamination risk – nor is a detection system mandated.
This is a schematic diagram, used to train engineers, of a gas turbine engine labyrinth oil seal.
The latest empirical examination of the cabin air issue was carried out at the UK’s premier aeronautical university, Cranfield. The same establishment in 2011 produced a report into cabin air quality commissioned by the UK Civil Aviation Authority on behalf of the Department for Transport (DfT). At the time, controversially, the study confirmed that engine oil fumes were indeed carried into the cabin, but the first Cranfield study proposed the contaminants were not a hazard to human health at the levels measured.
The report admitted, however, that during the period in which the study team was taking cabin air samples for analysis, there was no occurrence of a “fume event” – an incident in which higher concentrations of oil fumes enter the cabin. Sometimes this is because of the failure or partial failure of an engine oil seal, but it can result from a simple variation of engine power, which varies the internal gas pressure and temperature distribution and affects the seal effectiveness. As the DfT says: “The science is difficult because fume events are unpredictable and can last just a couple of minutes.” It also states that its research into cabin air quality “has been completed and the department’s programme in this area has now stopped”.
Fume events are not everyday occurrences, but neither are they very rare. Their exact frequency is undocumented, partly because the industry and government agencies play down their significance, and the reporting rate per occurrence is unknown. The issue that is particularly carefully ignored, however, is the continuous presence of low level cabin air contamination resulting from the fact that engine oil-seal leakage, it has now been established, is effectively a designed-in phenomenon.
This exposes those who fly for a living – and also frequent fliers – to the risk of the cumulative effects of neurotoxins that can build-up in their systems even if they don’t experience a fume event. The DfT itself admits that the chemical constituents of aero-engine oil are potentially neurotoxic, but maintains that the levels of exposure are so low as to be harmless. The DfT has not, however, carried out any research into the cumulative medical effects of low level exposure despite hundreds of pilots and cabin crew having had to retire because of ill-health, some following fume events, but rather more suffering long-term health degradation from continuous exposure. As the DfT admits, however, its studies into this phenomenon have now stopped.
But the latest study related to cabin air quality carried out at Cranfield is an independent one, and it examined the issues relating to engine design. It also highlighted the failure of regulatory organisations like the DfT or EASA to enforce laid-down standards for bleed air system certification. The study, for which Cranfield holds the copyright, concludes: “Low-level oil leakage in normal flight operations is a function of the design of the pressurised oil and bleed-air systems. The use of the bleed-air system to supply the regulatory required air quality standards is not being met or being enforced as required.”
This study was carried out at Cranfield by Dr Susan Michaelis, a former airline pilot who, in 2010, had been awarded a PhD by the University of New South Wales, Australia for her paper entitled “Health and flight safety implications from exposure to contaminated air in aircraft”. In 2016 Cranfield added an MSc to her academic achievements. The result of the MSc research is her new paper “Implementation of the requirements for the provision of clean air in crew and passenger compartments using the aircraft bleed air system “, which also won Dr Michaelis the accolade “best overall student on the [Cranfield] MSc Air Safety and Accident Investigation” course .
Meanwhile the European Aviation Safety Agency has produced an industry-led study that has more or less re-hashed all the old industry arguments, the main tenet again being that although potentially harmful organophosphate-based fumes are present in bleed air, the concentration is so low as to be harmless. EASA doesn’t address the issue of repeated crew exposure to low levels of harmful toxins and occasional “fume events”, and where it has been established that specific crews have suffered medically identified symptoms, including incapacitation in flight. EASA’s report has dismissed them as psychosomatic.
Now the University of Stirling has just had a paper published (June 2017) in the World Health Organisation’s journal Public Health Panorama. It examines “the health of aircrew who are suspected to have been exposed to contaminated air during their careers,” and says the study shows “a clear link between being exposed to air supplies contaminated by engine oil and other aircraft fluids, and a variety of health problems. Adverse effects in flight are shown to degrade flight safety, with the impact on health ranging from short to long-term”.
The report confirms that more than 300 aircrew, whose cases were examined, “had been exposed to a number of substances through aircraft’s contaminated air and reveal a clear pattern of acute and chronic symptoms, ranging from headaches and dizziness to breathing and vision problems”. One of the report’s authors, Professor Vyvyan Howard, professor of pathology and toxicology, Centre for Molecular Biosciences at the University of Ulster, added: “What we are seeing here is aircraft crew being repeatedly exposed to low levels of hazardous contaminants from the engine oils in bleed air, and to a lesser extent this also applies to frequent fliers. We know from a large body of toxicological scientific evidence that such an exposure pattern can cause harm and, in my opinion, explains why aircrew are more susceptible than average to associated illness.”
Recorded fume events causing sensory impairment and incapacitation of pilots and cabin crew are numerous, but listing them all is of limited use because the stories are remarkably similar. In terms of scale, an event over Canada on 24 October last year is notable because it involved an Airbus A380, but similar events have been recorded on all types large and small. In the A380 case British Airways flight 286 en route San Francisco-London was over Saskatchewan when it was forced to divert to Vancouver with a major fume event that incapacitated at least eight crew members, forcing them to go onto oxygen. When it landed all three pilots and 22 cabin crew were taken to hospital, and many of them were unfit for work months later, according to their union, Unite. The condition of the passengers is unknown. There has been no formal inquiry by British authorities into the event, and BA was left alone to deal with it. BA says the aircraft’s flight back to London was uneventful.
Some individual aircraft become notorious for fume events but remain in service with no follow-up by the authorities. An example is N251AY, a US Airways Boeing 767-200. On 16 January 2010 it operated a flight from St Thomas, US Virgin Islands, to Charlotte, North Carolina with 174 passengers and seven crew on board. During the flight the cabin crew noticed an unpleasant smell in the cabin, and the pilots suffered the onset of headaches, sore throat and eye irritation. By the time they were managing the approach to Charlotte they began to feel groggy and had difficulty in concentrating, but they landed the aircraft safely. During the en-route phase the pilots had messaged base to request medical attendance on arrival.
The event has been confirmed by US Airways but is not recorded by the FAA or the National Transportation Safety Board. Crew blood tests on arrival confirmed high levels of carboxyhaemoglobin, all the symptoms persisted for days, and the feeling of fatigue never left the pilots. They had their aircrew medical clearance rescinded and lost their pilot licences.
In March the same year the US Association of Flight Attendants reported that eight pilots and cabin crew members, including all but one of the crew on the St Thomas-Charlotte flight on 16 January 2010, did not return to work, and that there had been at least three known fume events on N251AY in December and January. The only fault the airline said it found was leaky rear door seals which, arguably, could have allowed engine fumes into the cabin on the ground, but the AFA says it doubts that explains what actually happened.
US Airways had carried out a borescope check on N251AY’s engines but initially found no engine fault. Dr Michaelis points out, however, that there did not have to be a fault for oil seal leakage into the compressor to take place. Her Cranfield work explains that oil seal leakage is lowest during stable flight phases like cruise, but in transition phases like start, spool-up, throttle-back, or whenever the power is varied, the pressure and thermal equilibrium is disturbed, and a fume event can occur even when there is no bearing fault. Hence the frequency of “no fault found” reports from the engineers after post-fume-event inspections.
Meanwhile internal reports and messages by official agencies about cabin air contamination also abound, but again they all say much the same thing. Here is one example of a US FAA report in 2009 recorded, along with many others, in one of Dr Michaelis’ research papers. The FAA said: “Lubricants: Many incidents of smoke/fumes in aircraft cabins have been linked to contamination of cabin air with pyrolytic products of jet engine oils, hydraulic fluids, and/or lubricants by leaking into ventilation air. These leaks can be subjected to 500°C or higher temperatures. If the origin of the smoke/fumes is of organic petroleum derivatives, then the smoke/fumes may cause a multitude of symptoms, including central nervous system dysfunction and mucous membrane irritation.”
Ever since the US Watergate political scandal and cover-up, when news media are following such a story they tend to tag it as a cover-up by suffixing the key word with “gate”. In what is perhaps the most notorious aviation industry alleged cover-up – the Westgate affair – the suffix was already in place. Richard Westgate was a British Airways A320 pilot when he died at age 43 in December 2012.
Westgate had been treated by a specialist clinic in Brussels for a painful neurological disorder for more than a year before his death, and extensive neurological damage was confirmed by his post-mortem. But when the coroner, Dr Simon Fox, QC, ruled on the cause of death, he stated it was the result of a self-administered, non-intentional overdose of pentobarbital, a sedative taken to aid sleep. Westgate died alone in a hotel room in Brussels.
Fox explained in his judgement that, although Westgate may have been exposed to organophosphate neurotoxins as a result of his job, and although that may have caused his poor health, it was not the cause of his death. He also ruled that there had been no causative negligence by British Airways, the Civil Aviation Authority or the Health and Safety Executive, basically because there are no prescriptive rules or guidelines relating to cabin air quality. Effectively, there are no applicable laws, so nobody broke the law.
Fox stated: “My provisional view subject to representations is that, whether or not in life in the period of months or years before his death the deceased was suffering from an illness caused by exposure to organophosphates in the course of his employment as a commercial pilot, is not a proper issue to be the subject of the Inquest.” In a statement that the dead pilot’s mother, Judy Westgate, read out after the judgement, she concluded with the words: “One day the truth will out.”
The subject of contaminated cabin air is to be reviewed by scientists, medical experts and engineers at the International Aircraft Cabin Air Conference at Imperial College, London on 19-20 September 2017 https://www.aircraftcabinair.com. Potential solutions to the problem will be aired as well as research and reports.
Meanwhile the industry and its regulators repeat the mantra that contaminants in the bleed air are at a harmless level of concentration. Dr Michaelis, in her studies, cites numerous, detailed, publicly recorded scientific data sources that all indicate there is no such thing as a safe level of exposure to the chemicals in aero-engine oil, especially when they are released in the form of pyrolised fumes.
But the industry can claim what it likes because it does not have to prove its case. In courts, the legal burden of proof rests entirely on those who claim to be victims of cabin air toxins, and it seems not to be sufficient to demonstrate – as in the Westgate case – that leakage of neurotoxic organophosphates into the cabin air is continuous and inevitable, but that the observable neurological harm to crew was not a coincidence nor psychosomatic.
Ryanair has found, consistently over the years, that half the licensed pilots who apply for first officer jobs fail its entry tests.
That’s not because the tests are particularly demanding, or because Ryanair springs unexpected things on them in the simulator. Wannabes all get a month’s warning of everything they’re going to face, and all the data they need to prepare for it.
Ryanair’s head of training Andy O’Shea told me his airline had recently considered backing future pilots via the MPL route, because that’s designed to deliver airline-ready pilots complete with a type rating.
But they’ve abandoned that idea because they think the MPL – as it’s organised right now – is too inflexible to cope with the vagaries of market demand. It locks the airline and the student into an 18 month relationship that may not survive market changes.
On the other hand the CPL/IR route prepares pilots to fly a light piston twin all on their own. It’s really only preparation for a good general aviation job, which is fine if that’s what you want to do.
Even if the twin is EFIS-equipped, it’s a million miles away from preparing a pilot for the right hand seat in a Boeing 737. And bolt-on multi-crew and jet-orientation courses are clearly not delivering, or Ryanair wouldn’t have that high failure rate.
O’Shea is looking for a way of plugging the skills and knowledge gap effectively between the CPL/IR and the right hand seat of a jet. If that can be done well – and he has been working on it with EASA and a working party called the Airline Training Policy Group – the students and the airlines would be able to enjoy the flexibility of the CPL/IR route, but it would produce the flight-deck-ready pilots that the MPL is designed to create.
He summarises what’s missing in those who fail their tests. They lack – to a greater or lesser degree – knowledge and understanding, flight path management skills, crew resource management ability, and what he calls “maturity and attitude”.
Basically, what O’Shea and the ATPG propose is a CPL/IR course extended to embed quality MCC and JOC components, including sessions closer to airline line oriented flight training than is done currently, plus some more advanced knowledge training. The result would be a course known as the Airline Pilot Certificate Course.
One of the possibilities is that the APCC would be available to students as one of the choices, as well as the MPL and CPL/IR as they exist today. That would not demand any more flight crew licensing regulatory work, but EASA could – and seems likely to – endorse the APCC as a valid qualification.
The question is, if the APCC is successful in attracting students and airlines, what would the future of the MPL be?
The CPL/IR could continue to be a stepping stone, via GA, into the airline world, and the MPL incorporating a JOC might be an alternative equivalent to the APCC.
This is still a work in progress, but something along these lines looks likely to win approval in Europe.
Learmount.com 