Crash investigations again highlight prominence of human error and mode confusion
Ever since computers and airplanes came together, modal confusion and pilot perplexity have gone hand in hand. Now and again they hook up with grave consequences and there’s an unintended outcome. Herewith we provide two such examples. The first, the June 2003 controlled flight into terrain (CFIT) fatal crash of a Canadair RJ near Brest, France, is fairly simple. The crew missed a step, stumbled, and the pilot died (see ASW, Jan. 10, for a roundup of CFIT incidents).
The second is less simple. The three-man crew of the Flash Airlines 737-300 completely lost the bubble — and everybody died. The illogicality of what happened there has left everybody in disbelief.
The final report on the first accident, from the French Accident Investigation Bureau (BEA), was released on Jan. 7. It is available (only in French) at http://www.bea-fr.org/docspa/2003/f-js030622/htm/f-js030622.html, but it contains some sobering color imagery. It cries out for an English translation because there are many lessons to be learned, and they cannot be done justice via a rudimentary Internet translation service. Thus, it has to be concluded that the BEA is being very parochial in not providing one.
The conclusions we draw from the second accident are based upon a little insight and the initial factual report by the Egyptian Ministry of Civil Aviation at http://www.civilaviation.gov.eg/conf/files/flash.pdf.
In the first accident, the French BEA found that the crew failed to select the approach (APPR) mode prior to the approach and that they were first focused on vertical, and thereafter only on horizontal, navigation, failing to note their dangerous descent in time to avoid landing a kilometer short — despite their state-of-the-art Head-up Display (HUD). Looking at the diagrams in the report, you wonder whether pilots are capable of assimilating that level of clutter of abstruse symbology. Ponder whether the absence of a critical symbol or mode annunciator is sufficiently attention-getting.
In the second accident, a Boeing 737-300 operated by Flash Airlines of Egypt (SU-ZCF) departed from runway 22R at Sharm el Sheikh (HESH) at night on Jan. 3, 2004. The visibility was 10k+, 17 deg C, light winds and SU-ZCF was bound for Cairo and then Paris, but it disappeared off radar at 4:44 a.m. Cairo time, three minutes after takeoff. Wreckage was soon spotted in very deep water in the Red Sea, seven miles south of its departure point. The 135 passengers and 13 crew of Flight FSH604 died in a crash that was close enough and violent enough to shake the windows of the coastal resort.
The aircraft took off and climbed normally and began a left hand turn as scheduled. But at 2,000 feet the turn slowly inverted to the right and the aircraft progressively rolled until it was banked 90 degrees at about 5,600 feet. It then rapidly lost height and dived into the sea. No mayday call was made.
Terrorist activity was quickly ruled out. Looking back at 737 “accidents” over the past 30 years, it was noted that this one ranked as the 2nd worst. In terms of French nationals killed, it was the worst air disaster for France since the 1960s. Most of the passengers were French tourists.
In the days and weeks that followed, the company, founded six years previously by a consortium of Egyptian and Italian businessmen, was held in the spotlight and found wanting. The Egyptian air company Air Flash had not been allowed to land on or fly over Swiss territory since October 2002. The Swiss took this precautionary measure after spot tests made by the Swiss Federal Aviation office (BAZL) at Zurich-Kloten airport had failed Air Flash on its safety standards “due to important technical faults.” The Swiss Federal Aviation office had then put a report in the European Civil Aviation database — where it was ignored. The faults allegedly included:
- Several instruments in the flight deck were unserviceable;
- Flight crew (cockpit) oxygen masks were missing;
- Emergency oxygen bottles were missing;
- Emergency exit lights were unserviceable;
- Quite a few life jackets were missing; and
- Passenger seatbelts were partly unserviceable or unusable.
While not constituting potential accident causes, such breaches are indicative of an airline’s safety culture as well as its supervisory and regulatory environment. The Swiss Federal Office for Civil Aviation (FOCA) said it had inspected one of the company’s aircraft in April 2002 and found that navigation documents were missing, fuel reserves were not calculated to international standards and the signposting of emergency exits was partly “in unusable condition.”
“In addition, obvious maintenance deficiencies were found in the areas of the landing gear, the engines and the aircraft steering,” it said in a statement. FOCA said the inspection of a second Flash Airlines aircraft in October 2002 had revealed “essentially the same defects”. After the airline failed to provide sufficient proof that it had remedied the defects, it was barred from landing in Switzerland a few days later, the office said. One Norwegian passenger filed a complaint with the Norwegian CAA that this company had seats without seat belts. This led Norwegian Tour Operators not to contract with Flash anymore. One of Flash’s two 737s had an emergency landing at Geneva Airport in early 2003 (despite it being banned from Swiss airspace), following an earlier one caused by engine failure in Athens (at the end of 2002). Flash Air returned its remaining aircraft to its lessor on March 6, 2004, and ceased trading as Flash. It’s believed that this Phoenix has resurfaced on the same routes in the guise of Cairo Aviation. It’s called sticker-change.
Swiss airworthiness inspectors work in conjunction with the Joint Aviation Authorities‘ (JAA) Safety Assessment of Foreign Aircraft (SAFA) and both France and Italy were apparently notified about the FOCA reservations regarding Flash. France initially denied this, and the Italians questioned that they’d been told. It then came to light that Flash had passed subsequent French tests in the fall of 2003. Flash airlines also had its operating license revoked in Poland in 2002 but, following some maintenance, it was reinstated in 2003. The ill-fated aircraft had had seven different registrations since delivery by Boeing [BA] in 1993. Eventually the European Aviation Authorities got its act together and evolved a harmonized information-sharing protocol for highlighting marginal operators. All of these disclosures were beginning to focus the inquiry upon possible technical failure related to poor maintenance.
An Italian news agency reported the aircraft had operated four sectors on Friday Jan. 2 from Sharm to Turin and Sharm to Venice. On arrival back at Sharm it only spent a short time on the ground before departing for Cairo and Charles de Gaulle (CDG). Six of those killed were a slip crew. Obviously maximum airframe utilization was the name of the Flash game.
The takeoff was from RWY 22R. The last mode C transponder height reading seems to have been 4800 feet. No distress call was made. Sharm radar recorded that the climb to 4800 feet occurred without problem, followed by an abrupt, near 180 degree turn and a dive descent from nearly 5400 feet, with the end of the recording (and presumably the crash) 17 seconds later (that’s a mean vertical speed of 17,000 ft/min and an impact velocity of about double that; about 336 knots straight down).
Spatial Disorientation Suspected
The aircraft should have been flying faster than crossover speed in the takeoff regime so the ailerons would have been easily able to overpower a fully hard-over rudder. With the climb over a black sea, and instant transition into a terminal velocity dive, it was beginning to look like spatial disorientation (SD) and recalled the fate of the GulfAir A320 at Bahrain. But that A320 had been turning, accelerating and leveling at a much lower level over the inky blackness of the Gulf. What could have induced loss- of-control in this 737’s wings-level climb on a smooth night? Could crew fatigue have been a factor? An Italian newspaper reported this “heavy” (augmented) crew had flown (Egypt)/HESH/Turin/HESH/Venice/HESH before this final leg to Cairo. The max duty-time for a “heavy” crew, for a day departure would be around 16 hours; a single crew 13 hours. By Jan. 8, 2004, the attached 37.5khz acoustic pinger had localized the flight data recorder (FDR) at 1030m and the cockpit voice recorder (CVR) 1500m away at 400m. They were later recovered by the deep submergence vehicle Scorpio 2000. Suicidal actions by the pilot were ruled out and the process of scenario elimination tracked inexorably towards what would still be a dumb-founding revelation.
SU-ZCF had accumulated 25,603 hours and 17,976 cycles, a history that was representative of its species. The 430-page factual report on the accident provides a second-by-second account of the facts recorded by the two recorders. It transcribed the technical data of the flight and the conversations of crew members between takeoff at 0242 GMT and its crash off the coast three minutes later. Once airborne, and into its cleared climbing left turn for overhead passage and intercept of the 306 VOR radial outbound, the copilot had shouted “Bank angle” three times during the aircraft’s steady roll into an unscheduled right turn — but without any response from the captain. Momentary incapacitation? Possibly, but the CVR’s very last lines describe how the captain said “Come out!” as his plane was diving and he was attempting recovery from a highly over-banked roll angle, one second before the ground proximity warning that was the last information recorded by the flight data recorder.
It was beginning to sound like that perennial piloting problem of, once without a visual horizon, “which way is up?” Pulling while rolling always establishes an aircraft in a plummeting high-g graveyard spiral. Unusual attitude recovery techniques emphasize the prerequisite of first leveling the wings before pitching — either back to the horizon or, if without a reliable attitude instrument reference, until the altimeter slows and then “pegging it” with ever smaller inputs until it stops.
Pilots who don’t regularly practice that rigmarole, or who get suddenly “caught out,” are likely to “screw the pooch” (as the test-pilot book “The Right Stuff” describes a pilot’s failure to recognize or react correctly to dynamic cues). Dynamic is the operative word. Airline pilots typically are not “into” dynamics– unless they have a military background. They are into stability and anything other than dynamics. Dynamic flying is what causes passengers to complain and fill sick bags. But, perversely, the necessary dynamics of an unusual attitude recovery is likely to rapidly over-extend even a mature airline pilot well beyond his experience and currency. You can talk about upset and loss of control all day. However, it is the mind-numbing physiological effects of the event itself that always come up against that unforgiving fourth dimension of time available and the sucking fifth dimension of gravity. Of course, lingering in the back of a pilot’s mind is always the possibility of exceeding the ultimate design load and pulling the wings or tail off.
What is the likelihood of a successful recovery from a full-blown unusual attitude on a moonless night in a high inertia heavy aircraft, without a visual horizon or untoppled attitude indicator, or while suffering “the leans”? It is less than 10 percent. Yet it is always a single pilot task — but it’s one for either pilot. Avoidance must be the name of this game, and that’s the crew task and it requires good crew resource management (CRM) (mutual cooperation, coordination and collaboration, with no authority gradient entering into the formula).
Senior Egyptian investigator Shaker Kelada said that it was too early to determine what had caused the crash. “In the next stage, we will cross-examine the data we have collected and we will then observe whether the crash was the result of a faulty automatic pilot or a human error by the pilot.” He stressed that the factual report was only the sum of a fact-finding effort, including the black box readings and the results of back-driven engineering simulator testing at Boeing’s headquarters in Seattle, Wash. In the coming months, the report will be analyzed by the Egyptian, French and U.S. parties involved and a final report determining the cause of the crash is expected to be issued this coming June.
“We have established how, now we have to determine why,” Kelada said in a press conference.
“The plane took a shallow right turn which turned into a steep right turn,” Kelada said. “Recovery was attempted, but there was not enough recovery before it dived into the sea.” Enough information is available to interpret a likely sequence of events. This is best assimilated by taking onboard the comments annotated in the Factual Report’s timeline below. But first, a few pre-rambles…
Spatial Disorientation Explained
Type 2 SD is related to vertigo, disorientation and illusions. Type 1 (pilot unaware and distracted) allows an unusual attitude to develop into loss of control (LOC) because of inattention and/or an attitude change-rate below the perceptive threshold (e.g., a very slow roll-rate). It took 40 seconds for this Type 1 situation to develop in Flash Airlines Flight FSH604 to the point of dawning realization, with a further 24 seconds until impact. Positive and assertive unusual attitude recovery action was taken only eight seconds before impact.
The first officer (F/O) shows no indication of understanding his vital intervention role, despite having a good appreciation of the developing situation (although not fully understanding its cause and effect). This lethal hesitancy is assessed as being equal parts cross-cockpit rank-related authority gradient and the product of a cultural block. He didn’t have the boasted 5000 hours. He had less than 800. He lacked the moral fortitude to intervene. CRM tutors must start teaching F/O’s to identify the ramifications of not acting responsibly and assertively, once put squarely “on the spot.”
Instrument Twinning Could Have Helped
The 737-300 standby attitude indicator for both pilots is in the middle of a wide panel, quite remote (outta sight, outta mind) from the pilot and copilot’s flight instrument panels…virtually useless. Disparity in response, roll-rate and comparative bank-angle is just not going to be noticed because of this wide separation.
The concept of twinning places the Standby Attitude Indicator and the main EADI (electronic attitude display indicators) in very close conjunction so that any disparities become glaringly and instantly obvious (see ASW, April 5, 2004, “Getting your Attitude Together”; and Apr 13, 2003, Oct. 19, 2003, Aug. 4, 2003). This also recognizes that a pilot under duress tends to narrow and focus his scan (aka “tunnel vision”). In addition, this captain had a lot of experience on the Mig21, where the Soviet-based artificial horizon (AH) presentation is just the opposite (upside-down) and in a different color code to Western-made instruments. It is well known that in such stressful situations one tends to fall back on previous experience. This also happened to a Moldavian crew, flying a CrossAir Saab 340 that crashed upon departure from Zurich.
Russian AH displays are based on the “outside-in” principle as opposed to the Western “inside-out.” That means that the horizon line moves with the aircraft and the wings-model is gyro stabilized. The wings give the bank angle on the outside lower portion of the instrument. The pilot sees the aircraft’s actual position with respect to the horizon as if he were observing from outside and behind the aircraft.
To summarize the CrossAir Saab 340 crash on Jan. 10, 2000:
The Saab pilot was probably concentrating on his flying with respect to the flight director but not “seeing-through” it and monitoring the raw data behind.
When at some point he perceived a navigational discrepancy, his attention was further taken from the AH. When challenged by the pilot not flying (PNF) about his direction of turn and returning his gaze to the AH, he was presented with information that he could no longer correlate to his mental model of a left turn (as cleared). The AH picture (0�ANU and 40�+ right bank) was probably closer to the “inverted” Russian AH picture of a left turn with the horizon line stepping in for the Russian bank line. Hence, his reaction to “lift” the left wing, but in actuality he dropped the right one into a tightening turn. From this attitude to impact took 12 seconds.
These two crashes look very similar: Manual flying; distraction; perception reversal; loss of attitude control; lack of assertive action by PNF. There are also issues regarding the “Russian” attitude (for lack of a better term) toward automation in general. This was borne out by the Uberlingen mid-air collision over Germany (see ASW, May 31, 2004). The “Russian” pilot followed human commands as opposed to those of a machine (among the other factors, of course).
The training issue is also center stage here: CRM and all the other aspects, but also the tendency to train with “clean system failures” — engine out, auto-throttle off, etc. Either it works or it doesn’t and you have to fly manually. Unfortunately, in the real world, electronic glitches and partial failure or erratic behavior of systems are never clear-cut. NASA’s (and others’) studies pertaining to automation highlight this. Time is lost identifying the discrepancy first and more time is lost finding how to deal with the loss of performance. A series of accidents come to mind in this department: the Nov 14, 1990, Alitalia in Zurich (FD bars not retracted), KAL747F in Stansted, 757 Charter in Punta Plata, etc. For pilots assimilating the newer technologies and not just adapting from the old, it is a question of both attitude and aptitude.
Autopilot Engagement
The 737 autopilot will not engage if there is any pressure being applied to the control column at the time. If you try to engage it in a turn it takes a bit of practice to “unload,” or centralize the column, then engage the A/P. Older 737-300s had very positive “paddle” switches that had a magnetic lock when engaged. If they didn’t engage, they very positively sprang back to the OFF position, so you knew immediately if it hadn’t gone in. Later ones had a press-button of the same type as the other mode control panel’s (MCP) switches. With this giant leap backward, in order to verify the A/P has engaged, you MUST check the Mode Annunciator Panel. It wouldn’t be hard for a (tired?) crew to push the button while some control input pressure was in, believe the A/P was engaged, and miss the lack ofthe little green “CMD” annunciator on the upper EADI display.
The Egyptian Ministry of Civil Aviation report on Flash Airlines Flight 604, on pp. 22-26, informs that: “If certain required conditions are met, the selected autopilot will synchronize the roll channel autopilot servo to the current position of the ailerons” (emphasis added). At 02:43:58 after takeoff, the captain calls for autopilot but then says, “Not yet” — most likely because he was still in (or rolling out of) a turn. Unfortunately, the F/O, possibly distracted by simultaneous transmissions from an inbound aircraft, goes ahead and engages it. It kicks back due to non-synchronization and the disconnect warbler sounds. It too may have been drowned out by a transmission, but someone (either pilot) reflexively cancels that cavalry charge warbler, and the situation becomes such that it had effectively never sounded at all.
The pilot and F/O both assume that the autopilot is engaged, but nobody is actually flying the aircraft. It’s an infectious mindset. The captain is selecting turn directions via Control Wheel Steering (CWS) inputs to his yoke and quickly becomes confused when it fails to do what CWS-R does (limit bank-angles to 30 degrees and roll out on selected headings). An indication that the number 1 slat stayed in “ext” (extended position) during flap retraction (as confirmed by the flight-data recorder) may have compounded the problems of engaging the autopilot and may explain the persistent right banking tendency of the airplane.
But it does not explain why the crew did not take over manual control when the autopilot disconnected, yet instead tried over and over again to find a solution by attempting to reengage the autopilot while outside of engagement parameters — to no avail. Note how this situation develops over a period of 50 seconds in the timeline below. Try to understand the confusion of limited appreciation, consideration, cross-cockpit effective communication and a manifest inability to cope with the suddenly evident non-normal event. Ponder the crutch that the autopilot has become for those whose scan and ability to function under a high workload is otherwise deficient.