Tuesday, August 02, 2011

Beware of Broken Glass

Loyal reader majroj forwarded me this link to an NTSB study on glass cockpits in general aviation. The term "glass cockpit" refers to integrated computerized information screens that augment and take the place of traditional instrumentation and paper documentation both. Instead of the pilot having to look at a paper chart then at separate instruments showing things like altitude, heading, airspeed time, and angular displacement from a selected line, they look at a high resolution screen that combines all that information and computes time en route and descent profile. Twelve years ago these were new shiny toys that some airlines had, and I remember a "hilarious" joke a friend and I had about installing such screens in a tiny two-place airplane. Now they are commonplace. After the initial learning curve, having that much information available seems to represent an enormous decrease in workload and increase in situational awareness. But the NTSB (the agency that investigates air crashes in the United States) didn't find the evidence supported that supposition.

The study compared aircraft of similar age and performance capability, but unfortunately did not control for the fact that people who invest in glass instrumentation use their aircraft differently. The aircraft with conventional instruments were involved in more accidents overall, but fewer fatal accidents, a predictable outcome when it is revealed that the conventional instruments are in airplanes used for flight training, which involves frequent, short, local flights used for flight training, while the glass cockpits were in aircraft flown less frequently but in long distance IFR flights in less ideal weather. Training accidents tend to be runway excursions and botched landings: embarrassing, expensive, but less likely to be fatal, while an accident on an IFR cross country is more likely to involve CFIT or loss of control in icing and thus kill someone.

The study report acknowledges the problem with the comparison, but doesn't appear to have made an attempt to control for it, which is unfortunate. I'd be interested to see a head-to-head comparison of similar flying with and without the modern tools. The integrated screens are fantastic, but the two big dangers I identify are catastrophic failure and tunnel vision, when the pilot gets so caught up in the avionics that they miss the big picture. Ask me if I haven't done that, in the last couple of weeks, and you'll just get an embarrassed mumble from me. People can literally fly into the side of a mountain or mumble mumble bust their assigned altitude while trying to make the little pink line point in the correct direction. When you learn to use conventional instruments, you learn how failures manifest and how to identify them by cross-checking with other instruments. You learn to disregard bogus information from failed instruments, perhaps using exactly the same technique as your flight instructor used to simulate failure in training: putting a post-it note over it. Once the misleading information is removed from your scan, it's gone and you can make decisions using only the believed trustworthy information remaining.

When the information from all the different sensors is processed and presented together, you don't have as smooth a way of removing the faulty information. The computer tries to make sense of conflicting data and while there are circuits and algorithms designed to remove unreliable data from the equation, the loss of control in Air France 447 is probably related to integrated displays reaching incorrect or ambiguous conclusions about the state of the aircraft.

My hypothesis is that if a study were done comparing the safety of similar flights by pilots of similar experience before and after glass cockpits in small GA aircraft they would find an initial increase in safety, followed by a return to pre-glass accident rates, or even worse accident rates. That is, initially they would increase safety, but then people would start taking greater risks. It appears that psychologically people have a certain level of risk tolerance, so if you make something safer, they'll find a way to make it more dangerous again.

The issue the NTSB identified is training. Just because a GPS display requires less interpretation than a VOR, doesn't mean that it needs less training and practice to be proficient and safe in its operation. Probably the opposite. It needs more initial training and more review to get and stay proficient with just one part of that formula, a complex GPS system. I started a while ago documenting my progress towards proficiency with the G530, but I never finished, and am especially guilty for not raving at more length and detail about Max Trescott's GPS and WAAS Instrument Flying Handbook, a book which I highly recommend to anyone using or teaching on the G430/530/1000. I'm never going to finish learning how to use this instrument, but I will post some more about it and the book.

I picked up my unrepairable camera and went to a store look for a replacement. I took out the broken camera and practiced holding and shooting with one hand, to remind myself how small it was and easy to use. I pressed the on button, and pointed it at things. See, easy to balance, and my thumb doesn't change settings while I'm holding it. And I can see my feet in the formerly broken screen.

"Can I help you?" asks the camera counter guy.

"I, uh, came to buy a replacement for this broken camera, but ..."

"Now it works?"


He looks at it, takes a picture of my happy-my-camera-works smile and agrees that it works.

I guess while putting it back together after determining that they couldn't fix it, they accidentally fixed it. I know it probably won't last long, so I look at the cameras for sale, but none is as tiny. The company doesn't make that kind any more. Anyone have a Canon Power Shot SD10 they are not in love with? Or one that works really well, and which they would like extra batteries and a battery charger for?


Sue said...

My camera is a Canon Powershot SD850. I've had it for a little over three years now, and I really like it. Now I'm wondering about its life-span.

sean said...

Hi 'trix.
A quick comparison between the Powershot SD10 and the new Canon IXUS 115.
They are almost the same size (3mm x 7mm x 0.9mm larger) and the button style and placement appears to be almost identical.

Could this be the new version of your old camera?

Anoynmous said...

I think the Elph 100 HS is the current equivalent. If I didn't already have a good enough still camera/HD camcorder, I'd be tempted to buy one.

Sarah said...

I have scoffed at glass cockpits ( and those "Cirrus head-down videogame pilots" for a while,, but they're coming, even for trainers.

It's true that the early installs were used in higher-end IFR aircraft.. but these days everything new or old has glass. ( Just got back from Oshkosh Sunday. ) For instance: a Waco biplane, with a full Garmin G600 setup!

I did play with a G1000 in a simulator, and I can see both the learning curve and fantastic amount of information presented. I would think a new pilot would be better off with a simpler presentation at first - what a distraction learning to fly with a G1000 would be. They don't make post-its big enough to cover that, do they?

leisuresuitwally said...

In the aftermath of of AF447, EASA is ordering operators to upgrade their flight control software to disengage autopilot in the event of unreliable airspeed.
My first impression is "This makes sense. Why hasn't it always been like that?". In fact it has always been like that. With unreliable data in a fly-by-wire system, autopilot reverts to alternate mode (flight control laws with mathematical models they don't teach us in university), or direct mode.
After a little more research, it turns out that the EASA directive is to inhibit autopilot engagement with unreliable airspeed. This makes sense. Why hasn't it always been like that?

I don't have any training in glass cockpits (Aviatrix: I'll be more than happy to put away my polarized lenses when the time comes!), let alone aircraft with more than one pitot tube. But if you're flying through a towering cumulus, aren't both your pitot tubes are subject to same the icing conditions? Essentially making it very likely to have two identical erronous airspeeds?

This is not the first time flight envelope protection is the cause or contributor to an accident. See Air France Flight 296. It's also an excellent example of  "if you make something safer, they'll find a way to make it more dangerous again". I'm not trying to revive the dead horse in the Boeing vs. Airbus flight control authority debate, but this doesn't bode well for the latter. What's the point of going through thousands of hours of training to become a glorified bus driver? (mind the pun)

All pilots know (at least I hope they do!) that if your pitot tubes are blocked, your airspeed indicator turns into an altimiter. My solution: Have the flight control computers monitor trends, possibly even using GPS ground speed and wind as an inputs, to disconnect autopilot and display a Caution message in the event of potential unreliable data. The pilot flying would then establish cruise power and attitude before using procedures to troubleshoot. Sure, you might bust some assigned altitudes now and then, but you'll greatly diminsh your chances of entering a deep stall.

I should re-iterate that I'm not an expert. This probably isn't the right forum to discuss groundbreaking flight envelope protection systems (or crazy ideas from nutjob blog readers), but I'd like to see everyone's input.

...Sorry for the ridiculously long comment.

DataPilot said...

This reminds me of an incident from my Complex Aircraft endorsement training. It happened waaaay back in the days before glass cockpits were invented.

As I was setting up for an approach in an unfamiliar plane with retractable gear, my instructor (a middle-aged man) asked me (a teen-aged girl), "What kind of contraception do you use?" I initially assumed I'd misunderstood his question, but eventually realized that I hadn't. I was infuriated by the inappropriateness, and I don't remember if or how I answered him. Eventually, I turned the plane onto final, throttled down -- and the gear horn came on. Doh! I'd forgotten to lower the gear.

Once on the ground, my instructor apologized to me for his embarrassing question. He explained that it was an exercise intended to demonstrate how incredibly dangerous little distractions can become. It was a lesson I never forgot.

I would love to read about research being done on the psychological impact of glass cockpits on pilots. While training and more accurate software clearly need improvement, there's still the matter of the pilot's attention. Pilots need to focus their attention on flying the airplane, first and foremost. When instrumentation distracts the pilot from that task, it becomes a hazard rather than an aid.

gmc said...

If you check this Wikipedia Entry on Pitot Static systems... you'll see that disasters have occured due to failures of these systems prior to the current "glass cockpit" and automation etc.. Certainly to Boeings as well as Airbusi. Just to put previous comments in perspective.

Remember - just because you "know" in your head that blocked pitot tubes will cause asi to "work like an altimeter" doesn't protect you. The accident sequence does not start out with a big annunciator coming on that says: "Danger Will Robinson!! Blocked Pitot tube!"

Rather, it starts with: "Hmm - airspeed is five knots fast .. better pitch up a little to control it...." - and this is just one thought-train in the middle of dozens of others related to bad weather, turbulence, and who knows what, and soon jarred by LOUD alarming warnings of STALL!! simultaneously with OVERSPEED chimes, and airframe vibrations, and aerodynamic upset into extreme attitudes in the ultra-thin air at 35,000+ feet .... and >>> what the hell is happening!!?"

TgardnerH said...

At first, my completely inexpert instinct agreed that disengaging the autopilot in the face of bad airspeed data is a good idea, but then I read more in-depth about the AF447 accident. From what it looks like to me, it seems like the pilots, for whatever reason, pitched up until the wings stalled, and then never recovered. It seems to me that an autopilot rule of "if the airspeed dies, fly 'pitch and power' until otherwise told" might be safer than "if airspeed dies, give control to the pilot."

Captain Dave said...

Commenting on leisuresuit wally's comment... I fly through icing conditions on a regular basis, especially in the winter; I have about 11,400 domestic hours in the Airbus Industries line of narrow bodies and have not yet had any problems with the software, flight control laws, or pitot tube failures. None of my pilot friends have experienced any of those problems either. I have read reports about such things, but it is not common. Yes, you can find numerous official reports of such, but considering the staggering number of flights Airbus a/c fly, it is miniscule.

As far as AF296 goes... That was pilot error, period. That French captain did not totally understand the flight envelope he was operating in and, secondly, must have misjudged the spool up time required for a hi-bypass engine to come out of idle.

leisuresuitwally said...

Very good and valid points! Thanks for your comments gmc, Tgard, and Capt'n Dave (ps. Great blog).
I hope that when I find myself in that situation, glass cockpit or not, I react properly.

gmc said...

Excuse another long post ... but:

A couple of other thoughts that came to mind regarding this incident and as highlighted by Capt. Dave's comments regarding the rarity of such occurences. The rarity is what makes them so dangerous. Airline pilots are generally not trained for high altitude, manually flown, upsets and recovery from extreme attitudes. In fact one of the greatest weaknesses in modern training is that economic$ dictate that new pilots are kicked out onto the line with barely adequate knowledge of the automation, and little actual feel for the manual flying characteristics and all the implications of disengaging the autoflight system under various circumstances. So, when it happens unexpectedly, there can be several seconds of surprise/shock/and disorientation until the pilot's mind gets into "the loop" of instrument flying. Add severe weather, turbulence, inexperience (the two pilots at the controls were the least experienced I notice), and a dark night over the ocean (2am?) and the overwhelming distractions of several warnings all coming on in short order, -- the chances of the pilot instantly resorting to attitude and thrust setting are diminished greatly.

The question I don't see answered in the online Youtube videos of the accident or written reports (that I've found, at least), is what happened to Alpha Floor Protection? IF the pilot pulled the nose up, I wonder if it could have been a survival reaction because he'd seen Alpha Floor Protection demonstrated this way in a flight simulator? That is - when Angle of Attack reaches a critical point, the flight envelope protection system is designed to refuse any further nose-up inputs, keep the wings level at Max Alpha and command full thrust from the engines. Where was all that?

The other question I don't find addressed - IF the pitot tubes iced over suddenly due to super-cooled water (easy to imagine, associated with T-storms), what was the wing-ice situation? Did anyone think to turn on wing/engine anti-icing? Other issues also need to be looked at - for example, using weather radar at high altitude is a fine and mysterious art. Due to the frozen nature of the precip, often a very severe storm will only return faint yellow echoes - which can cause an inexperienced pilot to under-estimate the dangers. (... so many questions, not very many answers)

Don't judge these pilots too harshly without a full understanding of the complexity and disorientation of the emergency they faced. Even the "simple" task of smoothly and precisely hand-flying a jetliner at 30,000+ altitudes is demanding.

I think the Key thing to remember regarding press releases etc. is that "Both Air France and Airbus are being investigated for alleged manslaughter in connection with the crash." IF they can pass it off as pilot error they save themselves a lot of money.

It's the oldest story in aviation accident investigating.

Captain Dave said...

Commenting on gmc's comment... I'm not trying to be the smartest guy in the room here, because I am not.. But let me further your understanding of alpha floor. Alpha floor only works in normal flight control laws and "maybe, if you are lucky" in one scenario of alternate law which we won't get into, but the AF447 pilots were way out of normal flight law, so no alpha protection.

Also, AF296 was below alpha floor, i.e., you don't want it during landing operations or you would never get it on the ground unless you physically disenaged it during every landing, so because of this it is inhibited close to the ground.

The AF296 captain was very close to the ground. Remember, he was demonstrating the slow flight characteristics of the 320 in normal flight law. His nose was way up with gear and flaps extended. When he saw the trees coming, the airflow into the front compressors was not optimum for quick response. During a run-of-the-mill go around, it takes about 3 seconds for the engines to come out of idle and another 3-4 seconds to get meaningful thrust. In his situation, I think it took 8seconds for the engines to respond.

Back during the Iron Age, when we used to have real groundschool with real instructors, instead of the New Age of Digital Learning, we studied AF296 every year. It was a real eye opener.

gmc said...

Thanks Capt. Dave... I did a memory dump of Airbus manuals a few years back, so your response helped clarify. I do recall in my initial Airbus training, when the 320 had been around about a year... that the instructor started Day One with "forget everything you know about flying other aircraft..." My internal BS red light went on. I soon realized that apart from a significantly more complex autoflight system, the airbus is just an aircraft constrained by the same laws of aerodynamics and physics as anything else I'd flown.

Dave W said...

I'd just like to say thank you to the contributors for a well reasoned and civilised discussion - it is so much nicer than some aviation sites where it can become a peeing contest about proving what idiots all the rest are!

I for one am a simmer that enjoys the automated system side of the big aircraft so the glass cockpit has been a boon for me (the wife calls me a geek and leaves me to it) as I can enjoy little of what tactile inputs true flight has to offer but the miriad of systems do give me added levels of immersion - I am still learning the basics of the FMC and I appreciate my basic sim will only scratch the surface.

Apologies to Aviatrix et al if my comments are slightly off topic, see what a great job your blog does of bringing people together for great discussion (and a great read)

On topic, I own an Olympus mju 770sw which is waterproof and shockproof and is now very battered having been around the world with me several times - its showing signs of age but has never let me down!

All the best, and keep blogging (and that includes you Capt. Dave!)

Dave from the UK