Six Years Since the Bicentennial

Six years ago from today marks 200 years since the birth of Abraham Lincoln, the bicentennial this post refers to. Suppressed anger is seeping to the surface from one of this blog’s founders, who is highly irritable with the nonsense that accompanies the hagiography of the U.S.A.’s 16^th president. But before the historian delves deep into the mists of the nineteenth century, I have been permitted (the historian’s Lincoln piece isn’t ready) to address the insanity that has prevailed in the 21^st since 12 February 2009.

Stalled to Death

I’ve already torn through the aircraft accident report of a crash that occurred on Lincoln’s bicentennial; which sent me spinning through the roof along with the other 2009 accident that somehow managed to rewrite stall recovery procedures for turbine-powered aircraft. However, in the last two months two more passenger airliners have fallen from the sky, indicating that the lessons from Colgan 3407 and Air France 447 have fallen on deaf ears.

Asian airlines have had a bad five weeks—Indonesia AirAsia QZ8501 and TransAsia GE235 both stalled and crashed. Sometimes mistaken for the Malaysian airline that is at the center of the AirAsia Group’s ten affiliates, the Indonesian airline’s A320 stalled at cruise on 28 December 2014. The Taiwanese ATR-72 on 04 February 2015 was reported to have experienced a #2 engine flameout before the crew secured #1 shortly after rotation last week, leading to the turboprop stalling and entering what appears to be an incipient spin. Just like CO3407 and AF447, inevitably the culpability for the loss of life will be placed directly on the shoulders of both pilots in the French jet and the French turboprop. Naturally, the blame is misplaced.

Am I pointing a finger the French government, specifically the Bureau d’Enquêtes et d’Analyses (BEA), whose report on AF447 I eviscerated previously? No, not yet. The accident reports aren’t out yet, but the real issues are already apparent.

Inappropriate Procedures Will Kill You

Let’s start with GE235, the most recent crash of the four. Neither the captain nor first officer identified failure if the correct engine, leading to the ATR-72 losing thrust in both engines. The wisdom of teaching pilots NOT to secure engines (aviator-speak for stopping engine rotation and shutting off fuel flow) at low altitude and airspeed is apparent from the horror in Taiwan. For this reason, regulatory agencies such as the Federal Aviation Administration (FAA) have for years required aircraft manufacturers and air carriers to write procedures that emphasize reaching a safe altitude and airspeed (usually referred to as published acceleration altitude) prior to attempting any emergency procedures, especially procedures that will secure an engine.

Someone with multi-engine flight training (but not knowledge of turbo-propeller design characteristics) might complain not securing GE235’s failed PW127M would leave a great deal of unnecessary drag for the turboprop to overcome; a complaint that is overridden with the fact that the Pratt and Whitney Canada engines had Auto Feather Units (AFU) installed:

The right engine entered a state called “auto-feather”, in which it reduced thrust to the propeller, Thomas Wang, managing director of the council, told a news briefing.

The flight crew then reduced power to the left engine, turned it off and attempted to restart it, but it did not gain enough thrust.

Many turboprops (direct drive turboprops, such as those on the C-130, are excluded) have auto-feathering engines, where the propeller automatically stops windmilling when the propeller governor drives the blades to an angle that greatly decreases airflow (parasitic) drag across the propeller blades in the event that the gas-generator turbine section ceases producing thrust. AFUs are further designed to deactivate the opposite-side AFU after one engine auto-feathers, to prevent the loss of both engines without pilot input {oddly enough, the same design is not commonly present in turbofan engines, as US 1549 (the A320 Hudson River crash on 15 January 2009) can attest}.

Were TransAsia pilots improperly trained? Perhaps it was just bad luck—TransAsia has had four fatal crashes in its 64-year history, and all four involved ATR-72s. Yet, I seriously doubt Taiwan’s Civil Aeronautics Administration (CAA) had ensured TransAsia abided with sensible, conventional aeronautical wisdom:

Taiwanese airline TransAsia has grounded 10 pilots for failing an oral flight test, as divers continue searching for the final victim of the crash of Flight GE235 which killed at least 42 people earlier this month.

The failed pilots will undergo retraining before being allowed to fly again, the airline said, adding that each had an average of 6,900 flying hours, not a insignificant number for a commercial pilot.

The 39 pilots who passed the oral test will have to sit a simulator test — if they don’t pass, they too will be grounded, TransAsia said.

Nineteen other pilots have yet to take any of the tests, but they won’t be assigned any duties until they do so.

The testing was recommended by Taiwan’s Civil Aeronautics Administration for pilots at the controls of ATR turboprop aircraft, the type involved in the February 4 crash.

Imagine that. TransAsia has also been accused of overriding maintenance write-ups:

The captain of doomed TransAsia Flight GE235 complained of “engine abnormalities” and requested an urgent inspection of the plane shortly before its final take-off but was rebuffed, it has been claimed.

Liao Jiangzhong, the plane’s former air force pilot, is among 32 people so far confirmed to have died when the aircraft crashed into a river shortly after taking off from Taipei’s Songshan airport on Wednesday morning.

An unnamed “whistleblower” told Taiwan’s Liberty Times newspaper that Mr Liao requested a thorough inspection of the plane after noticing “engine abnormalities” during its previous flight. The pilot registered the problem on a flight log, the newspaper added.

However, the source claimed that TransAsia staff had only inspected the plane’s communications equipment rather than performing a full inspection, for fear of incurring penalties for relying the flight from Taipei to the island of Kinmen.

The airline, naturally, denies this:

Wu Huh-sheng, a company manager, rejected the allegation, telling the newspaper TransAsia had received no reports of “faulty engines”.

Engines usually exhibit problems prior to total failure, so color me skeptical. Moreover, the failure of 10 TransAsia ATR pilots on an engine failure written exam speaks to deficiencies in either the airline’s operations manuals or training procedures, as Avions de Transport Regional clearly stipulates checklist procedures must only be undertaken after reaching the published acceleration altitude (here on page 540). But the other major aircraft manufacturer headquartered in Blagnac, France is not off the hook.

Designed to Stall

The last minute in the cockpit of QZ8501 must have been horrifying:

At 6:17:54, the plane stalled from 37,000 feet to 36,000 feet in six seconds, and to 29,000 feet in 31-seconds. At 6:18:44 am, the plane vanishes from ATC radar.

My initial reaction to the A320’s final seconds was this was AF447 all over again:

Indonesian Transport Minister Ignasius Jonan said the Airbus A320-200 was ascending at a rate of 6,000 feet (1,800 metres) a minute before stalling, as it flew in stormy weather last month from Indonesia’s Surabaya to Singapore.

I wasn’t the only person to see the similarities:

While they stressed the difficulty of drawing conclusions without seeing the full black box data, analysts said the accident had strong echoes of the crash of Air France flight 447 into the Atlantic in 2009, with the loss of 228 lives.

“The similarities are pretty striking,” Daniel Tsang, founder of Hong Kong-based consultancy Aspire Aviation, told AFP. In that case, the Airbus A330 en route from Rio to Paris vanished at night during a storm. The aircraft’s speed sensors were found to have malfunctioned, and the plane climbed too steeply, causing it to stall.

As with the AirAsia disaster, the accident happened in what is known as the “intertropical convergence zone”, an area around the equator where the north and south trade winds meet, and thunderstorms are common.

But one can already see where accident investigators will place the responsibility for the loss 162 lives:

The investigation into AF447 found that both technical and human error were to blame. After the speed sensors froze up and failed, the pilots failed to react properly, according to the French aviation authority who said they lacked proper training.

Jonan on Tuesday likened the doomed plane’s ascent to a fighter jet, although experts noted that warplanes can climb considerably faster – 10,000 feet per minute when at altitude.

However, Tom Ballantyne, Sydney-based chief correspondent for Orient Aviation magazine, said the rate of climb of the AirAsia jet was “just phenomenal”, adding: “I’m not sure I’ve heard of anything that dramatic before.”

So much for the accuracy of the “experts.” The BEA reported AF447 climbed at in excess of 7,000 feet per minute, and the F-15E’s flight envelope reaches to a service ceiling above 59,000 feet and has an acknowledged climb rate that can exceed 50,000 feet/min.

Far more annoying than how fact-challenged professionals are in general is their total cluelessness that there is a severe design flaw embedded in Airbus’ flight control laws that might have caused the AF447 and QZ8501 crashes outright. Modern air transports such as the A320 are designed to pitch up automatically should any overspeed be detected:

Over Speed or High Speed Protection is activated when airspeed exceeds V_MO + 6 knots or M_MO + M.01.

The M_MO overspeed protection limits are especially odd, as jet transports typically transition to Mach well above 25,000 feet, where AOA margins prior to stalling are much smaller than at lower altitudes. The overspeed mode will kill you if airspeed indications are erroneously high:

When it is active:

• The autopilot disconnects

• High speed aural warning is heard

• Automatic pitch trimming stops

• Bank angle limit is reduced from 67° to 45°

• Side stick nose-down authority is reduced and a positive pitch-up command is introduced

• Positive spiral static stability is introduced to 0° bank angle (instead of 33° bank angle in normal law), so that when the side stick is released it always returns to 0° bank angle instead of 33° bank angle

• Regardless if the stick is released, the airplane continues to pitch-up until the airspeed slows to VMO/MMO at which point the high speed protection is deactivated and normal control laws are restored

Emphasis mine. I added “Regardless” and eliminated the phrase “High speed protection can be overridden,” because Airbus itself contradicts such an assertion:

The A320’s angle-of-attack and over-speed protection cannot be overridden by the pilot, and neither can its load factor limits of +2.5g and -1.0g.

6,000 or 7,000 ft/min climbs above 30,000 feet are incredible…especially on fly-by-wire aircraft. Control inputs are modulated, with a special emphasis on not exceeding performance and structural limits. Such climb rates are exceedingly high—the flight control computers should not have permitted such pilot inputs to reach the elevators in the first place. But there is one exception to those rules—overspeed.

The danger lies in mach tuck—the tendency for subsonic aircraft to pitch down as the center of lift moves forward in as airflow becomes transonic. Another part of the issue is that transonic airflow often causes ailerons, elevators, rudders and to a lesser extent secondary flight controls to flutter, causing pitch, roll and yaw upsets. Should the nose pitch excessively down, airspeed rises even more, exacerbating the situation until the aircraft passes structural limits and can suffer severe damage—up to and including in-flight breakup. However, none of these problems will arise unless the airspeed is actually excessive.

AF447 was acknowledged to have erroneous airspeed data displayed, and QZ8501 was transiting an area of severe weather that could have created the same icing conditions that set the A330’s data displays haywire. Should the airspeed data read far higher than V_MO or (especially) M_MO erroneously, an Airbus A320 product or newer (the A300 and A310 are not fly-by-wire) will pitch for the heavens regardless of pilot input. Climbs of 6,000 ft/min or greater would be expected under the circumstances.

The A320 and A330 FDRs (Flight Data Recorders) also only record the readings from the captain’s-side ADS probes, which would mask the problem should the autopilot be slaved to the first officer’s side {which occurs when the first officer is PF (pilot flying)}. The first officer was PF on AF447; anyone hazard a guess which pilot was PF on QZ8501?

The French first officer of an AirAsia passenger jet that crashed into the sea last month was at the controls just before the accident, Indonesia’s lead investigator said on Thursday.

Heavens to Betsy—both PFs on AF447 and QZ8501 were the same nationality! I’d also wager the BEA will try to throw Rémi Emmanuel Plesel under the (Air)bus as they did with Pierre-Cédric Bonin in the 2009 disaster.

Culpability

I am fairly certain both the 2009 and 2014 overwater crashes involved airliners than indicated overspeed erroneously; the AF447 BEA report is filled with confused French accident investigators wondering why Bonin was obsessed with believing the A330 was flying faster than V_MO/M_MO. There is little questioning why the other two pilots seem to agree with him. Could the FO’s side been displaying speed in excess of V_MO/M_MO (which would not have appeared on the FDRs, as said data is not recorded on the A320/330 families)?  If the overspeed protection had tripped initially (triggering the 7,000 ft/min climb), could any of the pilots be faulted for thinking the airliner was traveling too fast when in fact the speed was too slow? How could the a crew differentiate, especially if they were getting indications of alternating overspeed/stall or worse…simultaneously?

1.18.6 Previous Accidents and Recommendations

Accidents with a relation to airspeed problems

Accident on 1^st December 1974 to the Boeing 727 operated by Northwest Airlines

The aeroplane was scheduled to undertake flight 6231 between New York JFK, NY (United States) and Buffalo, NY. About 10 minutes after take-off, the crew noticed that the speed and the rate of climb were very high, respectively 405 kt and 6,500 ft/min. A little later the overspeed warning triggered, quickly followed by the stall warning (stickshaker). The crew attributed the stickshaker to the appearance of «  Mach buffet » and tried to reduce the indicated speed. The aeroplane levelled off towards 24,800 ft and then stalled. It went into an uncontrolled spiral spin during which the stabilizer separated from the aeroplane. It struck the ground about 1 minute 20 after beginning its descent.

…

Accident on 6 February 1996 to the Boeing 757 operated by Birgenair

The aeroplane was scheduled to undertake flight 301 from Puerto Plata (Dominican Republic) to Frankfurt. During the takeoff run the Captain noticed that his speed display was not working. The copilot’s was working so he decided to continue the takeoff. During climb towards 4,700 ft the Captain’s speed display indicated 350 kt, which led the autopilot to increase the pitch attitude and the autothrottle to reduce thrust. The crew received «  Mach airspeed  » and «  rudder ratio  » warnings. The different speed displays and the simultaneous triggering of the overspeed and stall warnings (stickshaker) led to confusion in the cockpit. Noticing finally that the aeroplane was losing speed and altitude, the crew disconnected the autopilot and applied maximum thrust. A short time later, a GPWS warning sounded and the aircraft struck the sea a few seconds later.

…

Accident on 2 October 1996 to Boeing 757 operated by Aeroperu

The aeroplane was scheduled to undertake flight 603 from Lima (Peru) to Santiago (Chile). Immediately after takeoff the crew noticed that the altitude and speed displays were changing in an abnormal manner. They received a windshear warning, despite very calm weather and declared an emergency with the intention of returning to land at Lima. The aeroplane climbed up to a maximum of 13,000 ft and then began to descend. During the descent, the speed displayed to the Captain was so high that it triggered the overspeed warning even though the stall warning (stickshaker) was also active. The total confusion that ensued in the cockpit led the pilots to depend on the altitude indications given by the controller without realising that it was information supplied by the aeroplane itself in response to a radar signal which was thus false. After about 30 minutes of flight the aeroplane finally struck the sea off the coast of Lima.

These past accidents related to unreliable airspeed (I included all three that the BEA mention in their report–the above list is complete with no omissions) have several common elements. First, both stall and overspeed triggered in every case. Stall recovery requires dropping the nose and adding power. Overspeed avoidance pitches the nose up and reduces power. Well, which is it?

We know now, after hundreds have died, that the aircraft in question were stalling; but in the moment how were the (now dead) pilots supposed to ascertain which indication was unreliable? On three separate occasions (at least) the crews could not answer that question, and everyone onboard died as a result. It was a conundrum that probably could only be solved safe on the ground; not in the air with multiple, contradictory alarms blaring.

More importantly, unreliable data is…unsurprisingly, unreliable. The Aeroperu crew asking ATC for independent altitude data resulted in the erroneous onboard values being parroted back to them. Should they have disabled their transponder and forced the controller to rely on primary radar, a solution the “experts” want to take away from pilots?

Could the same be true for QZ8501?

I’m also fairly certain that a design flaw as glaring as overspeed protection that induces a stalled air transport would not be mentioned in a crash report. AC-120-109 was released one month after the AF447 crash report, which above all emphasizes recovery from autopilot induced/high altitude stalls. The stall recovery rewrite, while it was rolled out with no fanfare at all, has become so important (the old “maintain altitude” and “minimize altitude loss” maxims are now completely verboten) that the advisory circular has migrated to and taken over the stall recovery sections of the ATP/turbine type rating practical test standards. But the reasons why this major rewrite was undertaken are nowhere to be found in official literature…

Neither the advisory circular nor the PTS mentions how to override an erroneous overspeed trigger, though there is the fact that a pilot cannot override overspeed protection on most fly-by-wire aircraft (Embraer’s EMB-170/190 has a similar overspeed protection system). The only hope is the crew recognizes the dangerous situation and slaves the autopilot to the side that indicates the slower airspeed, and this without any formal training to the matter.

Understanding the Dangers…

If this is beginning to sound conspiratorial, trust me, I don’t want to go there. The problem is that regardless of what actually caused AF447 and QZ8501 to climb excessively, the overspeed flaw is already present in many modern airliners. If an aircraft equipped with overspeed protection systems detects an extended excursion from V_MO/M_MO, that aircraft will pitch up until the speed falls back below limits…even if the aircraft stalls in the process.

Moreover, AF447 must have in 2009 appeared to be a one-in-a-trillion freak accident. What was the likelihood that a widebody airliner would disappear at sea or stall because of an excessive climb in the flight levels in the next 5, 10, 15, 50, 100 years?

The answer was 100%. A 777 disappeared in March 2014, an A320 (albeit the 320 is a narrowbody) stalled and crashed in December 2014. If the BEA knowingly hid Airbus’s glaring design flaw, what kind of litigation would it open the French government up to? Not to mention Airbus and ATR, which are both headquartered in the same French city…

Postscript

Why? Why were overspeed protection systems built with such a glaring flaw? More on that later.