Airplanes, Accidents, and Risk Management

Failed Risk Management: the Accidents

The real meat of what gets news, ulcers, and emotions when it comes to airplane risk management is accidents. And, I'm a bit of an accident geek, since they say so much about our flying culture when we retrospectively line up the holes in the swiss cheese to see how people die in flying things in the first place.

For example, when it comes to Air France 447 "loss of control," Joe private pilot running out of fuel, or the all-to-frequent "controlled flight into terrain," my life experience, for better or worse, leaves me privy to the magic behind the curtain. In the case of Boeing's latest crisis, an updated version of the "pusher" that occasionally surprises untrained and unaware crew, there's a story to be told.

In a perfect bit of timing, I'm writing this piece as I am getting trained on the third aircraft in my career that has a "pusher." This "pusher" is preceded by a "shaker." The shaker is a warning to flight crews that the airplane thinks that it is getting too slow (and high angle of attack) to fly and it is issuing an initial warning.

If you don't listen to the shaker, you face the pusher. The pusher "pushes" the nose down so that it keeps flying. The airplane gets some speed and flies again. This is fine unless you are near the ground. If the dip happens too close to the ground, you get a Lion Air or Ethiopian situation where the pusher makes the dip happen, and the airplane hits the ground.

In Boeing's case, the Swiss designers who built the Pilatus PC-12 put in two angle of attack (AoA) vanes and a computer with redundant interpretations of said info. If either one disagreed with the other, the system was disabled. But, on the newest 737, it appears that Boeing put in two AoA vanes, but data was only taken from one. Why? I'm still researching that. Many of us accident geeks are, actually.

The trick and danger with such automation are that it might slam you into the ground when you don't want to. That's why training is so important: know the system, recognize limits, learn how to override it, and understand everything you need to know in order to be in charge of it versus it being in charge of you.

Blame

Let's talk a bit about blame. Where do fingers point? It's likely they point to institutions like Boeing, airplane design committees, shareholders, and pilots, of course. Some initial questions may be the following.

• What led Boeing to think that an "enhancement" to legacy "pusher" technology was necessary?
• Was there a rush to roll this system out in the 737 Max?
• Lastly, what happened to appropriate training, inclusion in manuals, and the rest of it?

Improving systems is common sense and is done all the time. In fact, they were ostensibly doing us all a favor by acting on the safety and training ecosystem's increased concern with this flight regime. They decided to help pilots fly better since more and more accidents seemed to be coming from loss of control. ¹

Loss of Control

One thing that is little discussed but much worried about is the concept that pilots are forgetting how to fly. This loss of "ability" is leading to loss of control accidents. These accidents are causing training regimens (in simulators, training programs, etc.) to include more concrete discussions about how to maintain control by what the experts call "flying the airplane," which means nothing more than (1) disconnect the automation and (2) physically/manually fly the plane to ensure control—the most primary element in remaining bird versus brick.

"Loss of control" incidents/accidents continue to surpass "controlled flight into terrain" ² crashes. The Federal Aviation Administration, National Transportation Safety Board (NTSB), and other authorities surmised that the new number one risk to airline safety was from pilots losing control of the aircraft while flying, usually sometime during or after the aerodynamic stall of its primary source of lift and/or control surfaces. ³

These were nearly all a variety of getting the aircraft into a stalled condition. If your small or large airplane doesn't have a way to get the nose down (reduce AoA), you enter the world of "loss of control" (aka "brick" territory). When an aircraft is stalled—no longer producing lift from its primary wing(s)—it falls stone-like until the pointy bits face into the wind again. ⁴ Stall avoidance is accomplished by lowering the nose (and AoA of the wing) before it gets into a stalled condition.

In Boeing's case, it appears they simply took the trend, data, and osmotic pressure from the accident experts and built a system that took away a bit more "choice" for those flying. To make matters worse, it appears that this was done too quickly. Perhaps more documentation and training were needed before shipping the product.

There is much more nuance to how accidents like this can even enter the realm of possibility. In my opinion, the story of the pilots who failed to keep the problematic aircraft airborne, while it repeatedly tried to kill them, is about the following.

• Lack of training
• Lack of experience
• Lack of systems knowledge

How did the accidents happen? From the accident report narrative, the shaker/pusher was active when it shouldn't have been. This is now widely known to be because the initial design relied on only one sensor when it could have used two. In the Boeing 737 Max 8 accidents, the battle between pilot and machine was longer than it should have been, with the pilot losing in the end. From further reading, it also appears that the "brain" that processes all the flight angle, regime, etc., data flowing into the computer that decides whether or not to activate the shaker/pusher was likely flawed, off, or erroneous enough to be triggered when it should not have been.

How could this have been avoided? Well, it appears extracurricular investigations, more study, and preventative planning were needed.

The sad part is that many everyday pilots would never want to set foot in an airplane where there wasn't a clear sense of how to kill unwanted automation and, if that failed, implement measures to disable the entire system by knowing where the circuit breaker was. 

The Pilot Evolution

What makes the news of the 737 pusher-related stuff timely to write about is that it reveals another side to the evolution of the human and machine interface.

To the murky corners of underwriting, be it Lloyd's of London or a closed online forum of reinsurance advisers, one thing is clear to me: no one really sees the bigger event coming over the horizon in that some of us are facing so much automation that we forget how to fly. Here is a vastly oversimplified but helpful duality to explain aviation's global evolution. There are the following two groups of pilots. 

Group one. The old geezers who grew up flying small taildraggers out of "fields" versus airports (and all the mechanical hands-on stuff that came with that). 

Group two. A new generation of airline pilots who have little experience outside of their highly structured and heavily automated world.

I offer this opinion for the risk manager with an important caveat: I'm not saying one is better than the other. There are simply two different pools of talent, shaped differently, that are currently flying aircraft. One group is suspicious of automation but uses it cautiously nonetheless. They are also rapidly going extinct due to the fact that "trade" skills continue to be undervalued, and fewer people are entering the trade of flying than once were.

The other group being sought after are youngsters (precollege), who are often put through what are known as "ab initio" airline programs. Basically, the airline "lends" students money to obtain a commercial pilot license in exchange for their work commitments to the airline. They are put through a highly structured environment and start building experience in the right seat of a large airplane that is equipped with a fancy flight management system, flight director, autopilot, and a pusher.

So, these young cadets have known (and trusted) automation since day one. They have been flying with it, and thus it plays a heavy role from the formative years of their training. They are grouped together with their older counterparts and sometimes not. The pilot shortage only exacerbates this dynamic.

As we dive further into the era of automation, pilots tend to get softer mentally in their flying skills. Our iPads, not to mention the airplane's systems, do "so much" for us. The hiring world is changing as pilots become system specialists rather than the scarf-wearing "seat of the pants" people. Boeing's short-sightedness aside, a related cultural tsunami is rolling in.

Conclusion

The following are a few risk management elements that emerge out of the current Boeing situation.

• It appears the problem was known, yet went on without any action on the manufacturer's part.
• Pilots were talking about it and in some cases building their own homebrew survival skills, game plans, etc.
• The public was in the dark until there was enough carnage for it to pay attention.

Progressive operators know the strength of more than a few key elements: the generalist, the well-rounded, and the curious pilot and systems person are the most valuable. And paying a living wage to the best talent you can find—and keeping them—pays huge safety dividends. If bottom-line-oriented airlines and their investors see the connection, they create a safer culture, while putting bricks down that will transform the future.

Or, as the safety people at the most profitable airlines like to say: "If you think safety is expensive, wait until you have an accident."