With low clouds and a fine mist hanging in the morning air, the pilots of Turkish Airlines Flight 1951 anticipated a routine approach to Amsterdam’s busy Schiphol Airport on Feb. 25, 2009. But instead of touching down gently on the runway, the white and red Boeing 737 dropped out of the sky and slammed into a muddy field just short of the airport, smashing into three pieces. Nine people died, including all three pilots. Another 84 were injured.
Investigators attributed the crash to a faulty radio altimeter, aggravated by pilot errors and oversights. Radio altimeters use radio waves to measure a plane’s altitude—a key piece of equipment, which is why a 737 is equipped with two of them. But what nobody in the cockpit of Flight 1951 realized was that the malfunctioning altimeter happened to control the 737’s auto-thrust systems. So while the co-pilot was busy monitoring the autopilot (which used data from a different altimeter), and Capt. Hasan Tahsin Arisan was watching the co-pilot as part of a training exercise, and a third “safety” officer was supposed to be watching everyone to make sure nothing got missed, the auto-thrust erroneously engaged its “retard” mode, thinking it was just above the runway. The throttles were cut and the plane’s nose pitched up, causing the plane to drift into an aerodynamic stall. The flight crew tried to recover by returning the throttles to full power, but their initial efforts were thwarted by the confused auto-thrust system, which they forgot to disengage. There was no time for a second try.
Statistically speaking, modern avionics have made flying safer than ever. But the crash of Flight 1951 is just one of several recent, high-profile reminders that minor problems can quickly snowball into horrific disasters when pilots don’t understand the increasingly complex systems in the cockpit, or don’t use them properly. The point was hammered home later that year when Air France Flight 447 stalled at nearly 38,000 feet and ended up crashing into the Atlantic, killing all 228 on board. Investigators recently released transcripts from the Airbus A330’s cockpit voice recorder. It reveals a flight crew gripped by confusion as they tried to diagnose and respond to what should have been a manageable mid-air emergency, but instead resulted in a terrifying 3½-minute plunge in total darkness. “I don’t have control of the airplane anymore,” the co-pilot at the controls said at one point. “Now I don’t have control of the airplane at all.”
Despite being responsible for the lion’s share of passenger deaths over the past decade, it’s only recently that the industry has begun to treat so-called “loss-of-control” accidents as a serious issue. Sunjoo Advani, an expert in ﬂight simulation and the president of a Netherlands-based simulation and engineering consulting firm, says he received puzzled looks when, back in 2007, he suggested that Britain’s Royal Aeronautical Society (RAeS), an influential safety group, hold a conference on the issue. Not anymore. Advani has spent the past two years coordinating the International Committee for Aviation Training in Extended Envelopes, or ICATEE, a panel of experts asked by the RAeS to look into stalls and other loss-of-control accidents and find ways to prevent them. “Many of these accidents are recoverable,” he says. “They simply shouldn’t have happened. In many incidents, the airplane has gone into a stall and every automated safety procedure kicked in, but the pilots failed to recognize the situation and failed to recover.”
Why is it happening? Some argue that the sheer complexity of modern flight systems, though designed to improve safety and reliability, can overwhelm even the most experienced pilots when something actually goes wrong. Others say an increasing reliance on automated flight may be dulling pilots’ sense of flying a plane, leaving them ill-equipped to take over in an emergency. Still others question whether pilot-training programs have lagged behind the industry’s rapid technological advances.
It’s a vexing problem for airlines, and a worrisome one for their customers. Unlike mechanical failures that can be traced to flawed design or poor maintenance, there is no easy fix when experienced and highly trained pilots make seemingly inexplicable decisions that end with a US$250-million airplane literally falling out of the sky. “The best you can do is teach pilots to understand automation and not to fight it,” Advani says, noting that the focus in recent years has, perhaps myopically, been on simplifying and speeding up training regimes, secure in the knowledge that planes have never been smarter or safer. “We’ve worked ourselves into a little bit of a corner here. Now we have to work ourselves back out.”
In the past five years alone, there have been more than 50 stalls and other loss-of-control accidents involving commercial airlines, nearly all of them fatal, according to the International Air Transport Association. Unlike a car or truck, a plane stalls when its wings stop producing lift—effectively transforming it from an elegant flying machine into a giant brick. That happens when the angle of attack (the angle of the wing relative to the direction the plane is flying) becomes too extreme. In most cases, stalls occur because a pilot is flying too slowly to maintain altitude, although they can theoretically occur at any speed. To recover, pilots are taught to apply thrust and to lower the nose of the aircraft. A 2010 study by Boeing found that 20 different loss-of-control accidents were responsible for nearly 1,850 deaths between 2000 and 2009, nearly double the number of fatalities of the next biggest category, “controlled flight into terrain,” which is basically the flying of a plane into the side of a mountain. That makes loss of control, including stalls, both the single most common cause of fatal airline crashes, and by far the most deadly.
But stalls needn’t be fatal events. Pilots are taught how to recover from them in basic flight school, and many modern planes are equipped with systems designed to prevent them from occurring in the first place. In modern Airbus-built planes, for example, an electronic ﬂy-by-wire control system means a pilot who hauls back on the side-stick controller, a joystick-like device that has replaced a traditional control yoke in Airbus cockpits, will not be permitted by the computer to put the plane and its passengers in a dangerous situation.
And yet loss-of-control crashes continue to bedevil the industry. And several recent accident investigations reveal a disturbing trend: highly trained pilots who, when faced with a stall, not only fail to correctly diagnose the problem, but take actions that make their predicaments far worse.
That’s what happened on Feb. 12, 2009, aboard Colgan Air Flight 3407. Tired and distracted, Capt. Marvin Renslow and first officer Rebecca Shaw failed to notice that the airspeed of their Bombardier-built Q400 turboprop had slowed significantly as they approached Buffalo’s airport. Suddenly, the Q400’s “stick-shaker” warning system went off, alerting the pilots of an impending stall. But instead of increasing the throttle power and pointing the nose downward, Renslow pulled back on the yoke, turning a near-stall into the real thing. He similarly out-muscled the plane’s “stick-pusher” feature, which is designed to force the plane’s nose downward in a last-ditch effort to recover. The plane spiralled out of control. Investigators cited training deficiencies at the airline and crew fatigue as contributing causes to the crash, which killed 49 people on board and one person on the ground.
Similarly, the investigation of Air France Flight 447 has veered away from the failure of the plane’s airspeed sensors, or pitot tubes, to focus on pilot error, although a final report on the crash is still forthcoming. The recovery of the plane’s black-box recorders from the ocean floor in May revealed that the Airbus A330’s problems began when it lost airspeed readings after flying into thunderstorms during a June 1, 2009, overnight flight to Paris from Rio de Janeiro. But it was the pilots’ response to the wonky airspeed readings that sealed the fate of the 216 passengers in the plane’s cabin. Once the autopilot clicked off, the flight-data recorder showed that the co-pilot (the plane’s captain, Marc Dubois, was taking a scheduled rest break during the first few minutes of the crisis, but returned to the cockpit before the plane went down) set the throttle to takeoff thrust and sent the plane up to nearly 38,000 feet, where it stalled. The interim report released last month said none of the pilots made any reference to the repeated stall warnings, one of which was “triggered continuously for 54 seconds.” Instead, the flight crew seemed utterly perplexed at their predicament. The co-pilot sitting in the captain’s chair at one point says, “Climb, climb, climb, climb,” to which the other co-pilot responds: “But I’ve been at maxi nose-up for a while.” Then the captain (who is now in the cockpit, but not at the controls) says, “No, no, no, don’t climb.” Nevertheless, as the A330 continued its long, gut-churning fall into the Atlantic, the co-pilot at the controls continued to make inputs that were “mainly nose-up,” according to investigators—precisely the opposite of what needed to be done to counteract the stall, which was to lower the nose and restore lift to the wings.
As the operation of commercial jetliners becomes increasingly automated—most are equipped with systems that are perfectly capable of flying and landing the plane on their own, although pilots have the authority to hand-fly the plane when they deem it necessary—some experts are concerned it’s only becoming more difficult for pilots to jump in and take over during a mid-air emergency, when their skills and experience are needed most. “The problem you get into with automated systems is that very often people get left out of the loop,” says Mica Endsley, the president of Atlanta-based SA Technologies and an expert in the field of situational awareness who has worked closely with the U.S. National Transportation Safety Board investigating air crashes. She compares the phenomenon to a person who catches a ride to a dinner party in an unfamiliar neighbourhood, but is later asked to drive home and has difficulty remembering the route. “We’ve found that, even when people are monitoring things very carefully, you just don’t have a good understanding of what’s happening. When you realize there’s a problem, you don’t necessarily know how you got into that state and what to do to correct it.”
There’s also the risk of information overload, as the pilots of a Qantas Airways-owned Airbus A380 “superjumbo” discovered last November. Shortly after takeoff from Singapore, one of the hulking A380’s four engines exploded and sent pieces of the engine cowling raining down on an Indonesian island. The blast also damaged several of the A380’s key systems, causing the unsuspecting flight crew to be bombarded with no less than 54 different warnings and error messages—so many that co-pilot Matt Hicks later said that, at one point, he held his thumb over a button that muted the cascade of audible alarms, which threatened to distract Capt. Richard De Crespigny and the rest of the feverishly working flight crew. Luckily for passengers, Qantas Flight 32 had an extra two pilots in the cockpit as part of a training exercise, all of whom pitched in to complete the nearly 60 checklists required to troubleshoot the various systems. The wounded plane limped back to Singapore Changi Airport, where it made an emergency landing.
It’s not as though manufacturers aren’t aware of the issue. But the reflex is to fix the problem by throwing more technology and automated systems at it. Cockpit component company Rockwell Collins, for example, made waves at this year’s Paris air show when it talked about developing a “panic button” for commercial airplanes that would give confused and stricken pilots the option of flipping a switch and letting the computer fly the plane to safety. Not surprisingly, the concept drew ridicule from aviators, who are quick to point out that computers are hardly infallible, as anyone who has ever struggled with a crashed Web browser knows. “People say it’s impossible to stall an Airbus, right? It has stall-protection systems and it won’t allow you to exceed the maximum angle of attack where a stall would occur,” argues Paul Strachan, an Air Canada pilot who is the head of the company’s pilots’ union. “But that’s not true. If there’s ice on the wing, that whole detection system isn’t accurate to begin with. I would be pretty hesitant to get on a plane with no pilot.”
Endsley takes a more nuanced position. She argues the problem isn’t necessarily with automation, but stresses the need for better-designed systems that allow pilots to see what the computers are doing at any given moment. “Instead of throwing 8,000 pieces of data at pilots, you need to integrate that information in meaningful ways so they can tell what’s going on,” she says. In the case of Flight 447, Air France’s pilots’ union has pointed a finger at Airbus by suggesting that the stall warning system on the A330 likely contributed to the doomed ﬂight crew’s confusion by sounding only intermittently even though the plane remained in a stall the whole time.
But overhauling flight management systems is easier said than done. All-new planes are rare in the industry, and even when they do get made, as with Boeing’s new 787 and Airbus’s A380, there is significant pressure on manufacturers to make sure new models will integrate with airlines’ existing ﬂeets, and the pilot-training programs created for them. Robert Dewar, the general manager of Bombardier’s new CSeries regional jet program, says the Montreal-based aerospace giant wrestled with the question when it was considering the cockpit design for its new 110- to 130-seat plane. Influenced by the company’s experience in building business jets with the latest bells and whistles, Dewar says Bombardier ultimately decided to work with Rockwell Collins to develop a new approach to flight management for the CSeries. “Pilot-in-the-loop and pilot awareness is a thing we can work on to improve safety,” he says. “We took advantage of new technology to make information available to the pilot in a user-friendly manner. And we put it in using a phase-by-phase approach, which hasn’t been done before.” In other words, while most flight management systems organize information based on overall importance to the aircraft, the CSeries will instead have tabbed screens that display everything a pilot needs to monitor a particular stage of a flight—taxiing, takeoff, cruise and so on. There will be no need for digging through sub-menus to find buried, but potentially important, data. In the Air France crash, for example, investigators noted that the plane’s critical angle of attack “was not directly displayed to the pilots” and recommended changes. “There are no multi-screens,” Dewar says of the CSeries. “You’re monitoring one screen. You don’t have to look anywhere else.”
It’s doubtful that technology alone will prove to be a panacea when it comes to airline safety. That’s why Advani and the rest of the ICATEE panel—which includes representatives from Boeing, NASA, Transport Canada, Montreal-based flight simulator maker CAE and the 53,000-member Air Line Pilots Association—are recommending changes to pilot training regimes, with a particular focus on recovering from aerodynamic stalls. Similarly, France’s safety body is also recommending that pilots be required to regularly practise manual airplane handling and “approach to and recovery from stall, including at high altitude” and noted that Air France Flight 447’s co-pilots had received “no high-altitude training for unreliable IAS (indicated air speed) procedure and manual aircraft handling.”
At present, most pilots only learn how to deal with stalls in an actual airplane at the very beginning of their careers, according to Advani. The drill is usually done in a small aircraft like a Cessna and, even then, generally focuses on avoiding a stall, or recovering from its early stages, by powering up the engines and attempting to minimize a loss of altitude, which may explain the actions of Air France’s flight crew. “You learn it during the initial pilot’s licence,” Advani says. “Then you go on to becoming a commercial pilot, getting your multi-engine and instrument ratings. You’re concentrating on moving up and managing bigger airplanes with multi-crew type operations. So as your career progresses, you don’t go back to the basic stuff—the aerodynamic flying of the plane.”
In Canada, training for a private pilot’s licence includes “stall and spiral-dive recoveries, and recovery from an irregular condition of flight solely by reference to a full panel of available instruments,” according to Transport Canada spokesperson Maryse Durette. Before getting a commercial licence, pilots are required to demonstrate “competency” in these skills, with Durette noting that Canada is one of the few jurisdictions that still requires spin-recovery techniques (think of a plane diving in a corkscrew pattern).
Later in a pilot’s career, any further stall or flight-upset recovery training is done in a flight simulator, a full-scale mock-up of an airplane cockpit encased in a fibreglass pod that sits atop spindly hydraulic legs. Inside, pilots look out windows just as they would in a real plane, but instead see a computer-generated image of their surroundings. Simulators can replicate very closely the feel and handling of a particular aircraft under most conditions, allowing instructors to put pilots through various drills like crosswind landings, instrument failures and other potential emergencies.
But Advani, who is an expert in the field of flight simulation, says simulators aren’t very good at mimicking full-blown aerodynamic stalls, which are chaotic and unpredictable events, making them difficult to model. Nor do simulators create the fear and panic that comes from knowing your actions may lead to the death of hundreds of people. As a result, he says, there needs to be more classroom focus on the basics of aerodynamic flight in addition to simulator training, which varies from airline to airline. “We don’t need to train the pilot on exactly how it feels in the simulator,” he says, adding that there needs to be more emphasis on not just avoiding stalls, but recovering from them once they occur. “You need to teach them to get the heck out of that stall. And lowering the nose is the number one rule. Don’t worry about that wing drop, don’t fight that. Just make sure you lower the nose and get the heck out of that dangerous situation.”
In light of accidents like Air France 447, Boeing and Airbus recently overhauled their stall-recovery training in simulators, with the support of airlines and regulators. They now emphasize the importance of reducing the upward angle of the nose, which has the tendency to pitch up when power is added to aircraft with engines located under the wings.
ICATEE, which has yet to issue an official report on its findings, is also recommending regulators go a step farther and require pilots spend time earlier in their careers in aerobatic airplanes, where they can practise honing their skills closer to the edge of the flight envelope—skills that commercial pilots now glean only if they’ve served in the military. “We used to regularly recover from total upsets,” says Air Canada’s Strachan, an ex-military pilot. That included situations where his plane stalled out while nearly vertical or inverted, all while wearing a hood that blocked his view of the horizon. “You couldn’t look outside and had to recover off your instruments. That’s an element of training that isn’t there as much as it should be today.”
Charting an entirely new direction for pilot training isn’t going to be easy. Thanks to a global pilot shortage stemming from the rapid growth of airlines in Asia and the Middle East, the industry has been more focused on finding ways to get pilots into commercial airline cockpits with less real-world training, not more. The International Civil Aviation Organization (ICAO), an agency of the United Nations, predicts airlines will add 25,000 new airplanes to their fleets over the next two decades. And all those new planes will need pilots—about 350,000 of them by 2026. That’s among the reasons that, five years ago, ICAO approved the creation of a “multi-crew pilot licence” for commercial airlines. It allows would-be pilots to step into the co-pilot seat of a commercial airliner with as little as 240 hours of flying time, much of which can be done in a simulator. (In contrast, Strachan says most Air Canada pilots typically have nearly a decade of flying experience before they are hired.) The theory is that the job of a modern commercial airline pilot bears little resemblance to what it was 15 or 20 years ago, and that logging thousands of hours as a bush pilot or crop-duster is no longer as critical.
Strachan concedes that today’s commercial pilots need a variety of skill sets. And as head of Air Canada’s pilots’ union, he knows the cost realities of the business as well as anyone. But he remains convinced that there is no substitute for actual experience in an airplane. “It almost never happens in real life like it happens in a simulator,” he says. “It’s almost never textbook in my experience. You practise it one way and when something finally does happen, it’s always way more nebulous and insidious.” He recalls a takeoff early in his career from the Thule airstrip in northwestern Greenland, where he suddenly caught himself in katabatic winds that had tumbled off the side of a glacier. The plane was forced violently downward toward the waves and Strachan barely managed to power his way out of a near disaster.
“There’s something that you just can’t simulate,” he says, adding that his heart still jumps just thinking about it. “It’s gained through experience. Everybody on the crew learned something that day. It becomes part of your hard drive. So the next time you’re faced with that situation, and you’re in a place where there’s wind coming off a cliff and you’re taking off, you think, ‘Hmm, I’ve seen something like this before. Let’s be careful.’ ”