The Risk of Loss of Control In-flight

Figure 1. Fatalities by CICTT Aviation Occurrence Categories

Loss of Control In-flight remains the leading cause of fatalities in commercial aviation. The most recently released statistics from the Commercial Aviation Safety Team (CAST) shows nearly 40% of commercial aviation fatalities worldwide are the result of a LOC-I mishap.1 The CAST data, released by Boeing and depicted at Figure 1, show that the chances of fatality from LOC-I are nearly twice that of Controlled Flight Into Terrain (the second leading cause), almost ten times that of Mid-Air Collision, and well over 100 times more likely than a runway excursion. Nearly 40% of all commercial aviation fatalities during the period 2004-2013 were the result of a LOC-I mishap. The data clearly show that LOC-I is a significant threat that needs to be addressed.

The air transportation industry and the national aviation authorities have begun to make reducing LOC-I mishaps a priority. The National Transportation Safety Board (NTSB) identified reduction of LOC-I mishaps as one of their top ten priorities for 2015.2 Airline manufacturers, the International Commercial Aviation Organization (ICAO), and Federal Aviation Administration (FAA) have all released guidance pertaining to LOC-I prevention and preferred training methods. The Airplane Upset Recovery Training Aid, a joint publication by Boeing, Airbus, and the Flight Safety Foundation, was released in 2008.3 The ICAO Document 10011,Manual on Aeroplane Upset Prevention & Recovery Training, was published in 2013.4 The FAA’s AC 120-111, Upset Prevention and Recovery Training, was published in April of 2015.5 All of this attention is due to a number of high visibility aircraft accidents related to LOC-I. This paper explains how the techniques of Threat and Error Management (TEM) can be leveraged to help mitigate the threat of LOC-I.

What is UPRT?

Upset Prevention and Recovery Training (UPRT) is specialized pilot training focused on mitigating the risks of LOC-I events. UPRT has recently been a topic of high interest within the aviation industry, with a number of documents addressing the subject being released within the last few years. The documents are unanimous on the definition of an aircraft upset:

Figure 2. Training & Operational Envelopes

An airplane in flight unintentionally exceeding the parameters normally experienced in line operations or training:

1. a) pitch attitude greater than 25 degrees, nose up; or
2. b) pitch attitude greater than 10 degrees, nose down; or
3. c) bank angle greater than 45 degrees; or
4. d) within the above parameters, but flying at airspeeds inappropriate for the conditions.3,4,5

The pitch and bank envelope comprising “normal fight parameters” described above entails only about 5% of the entire all-attitude envelope of +/- 90 degrees of pitch and 180 degrees of L/R bank (green zone in Fig. 2). The pitch and bank envelope achieved during currently required pilot certification training, +/- 30 degrees of pitch and 60 degree of L/R bank, expands this envelope to about 11% of the all attitude environment (yellow zone in Fig. 2). Unfortunately, aircraft in upset events do not abide by the restricted envelopes above, but are free to explore the entire all-attitude envelope regardless of pilot expectation or experience.

In accordance with FAA AC 120-111, the goal of UPRT is for a pilot to “demonstrate knowledge and skill in preventing, recognizing, and, if necessary, recovering from an upset” through a “train-to-proficiency” methodology.5 Effective UPRT programs are multi-modal, comprised of academics, on-aircraft, and simulator training mediums. The ICAO Manual on Aeroplane Upset Prevention & Recovery Training provides fairly detailed guidance on the content of each phase of the training. The manual also describes a training path that moves from academics, to on-aircraft training, to non-type specific Flight Simulation Training Device (FSTD) training, to type-specific FSTD training.4 This progression allows the pilot to build knowledge from the fundamental aerodynamics to application of mitigation and recovery strategies in their specific aircraft. On-aircraft training is critical, as simulators are unable to accurately present the sensations necessary to “develop the knowledge, awareness and experience of aeroplane upsets and unusual attitudes, and how to effectively analyze the event and then apply correct recovery techniques.” 4 Relevant human factors effects are both psychological and physiological in nature.

Figure 2. Training & Operational Envelopes

The intent of UPRT is to provide pilots with the knowledge and skills necessary to recover the aircraft from a LOC-I event regardless of how severe the upset becomes. While the pilot should not wait for a predetermined pitch or bank angle to develop before initiating recovery, the pilot should be able to effectively apply the mitigation strategy to any flight condition.6Figure 3 depicts this by showing an increasingly divergent bank upset. At any bank angle, the pilot should apply an appropriate strategy to return the aircraft to the desired attitude.

Ransbury and Carroll outline three categories of UPRT, starting with Awareness Training.7Many pilots have never experienced the G-loadings and pitch- and bank-angles associated with aircraft upsets. Awareness Training presents the core concepts of UPRT as well as exposing the pilot to the sights and sensations of aircraft upsets in a building-block approach that builds confidence in the training while minimizing the likelihood of the pilot in training being overwhelmed. The goal of awareness training is to enhance the ability to recognize the precursors that lead to divergence from the desired aircraft state, which enables avoidance of aircraft, upsets by preempting escalation. The next category of UPRT is Recognition and Avoidance, which Ransbury and Carroll further divide into time-favorable and time-critical.7Time-favorable situations allow the pilots to use Aeronautical Decision Making (ADM) to manage the outcome. These scenarios provide the pilots with the time necessary to plan for mitigation or avoidance of the threat. For example, while still 30 minutes from arrival reports from the destination airport indicate strong windshear associated with thunderstorms. The pilots could hold until the storms pass, or elect to proceed to the divert location. Either are valid strategies that should avoid the potential for a LOC-I event. Time-critical situations require immediate (on the order of mere seconds or less) response to a divergence from the desired aircraft state.7 Recognition and Recovery becomes necessary when the aircraft exceeds the parameters defining an aircraft upset. Immediate application of appropriate recovery techniques is critical to safe recovery of the aircraft.

It is important for UPRT programs to build skills that are, in general, universally transferable. As Ransbury and Carroll have noted:

The general building-block sequence addressing the recovery phase of skills training has been shown to impart long lasting skill sets to pilots while maximizing the understanding of prevention and recovery mitigation within the widest range of fixed wing airplane operations. The end result of a comprehensive upset recovery training program is to arm pilots with enhanced awareness and skills that are generally transferable and effective with due consideration for type-specific variations.7

What is TEM?

Threat and Error Management is a concept developed by researchers at the University of Texas Human Factors Research Project (HFRP) that seeks to “minimize safety risks”, thereby “maximizing safety margins” through a “proactive philosophy”.8 The TEM concept is to have pilots consider not only the external influences that impact safety, but also to consider their own reactions to those influences as well as mistakes they make in the conduct of a flight. The consideration of both of these factors is a distinct advantage of the TEM concept. Those external influences are the “threats”, while mistakes made by the pilots are the “errors”. The TEM concept assumes that pilots are qualified and competent in their positions, and that each error is addressed sequentially as they occur.9

Threats

Figure 4. TEM Assessment Process

A wide array of items falls into the category of “threats. Threats are those events that are beyond the control of the pilots, which increase flight complexity, requiring flightcrew management and attention.9 This is quite a broad category, encompassing many aspects of a flight. Threats are further divided into “expected” and “unexpected”.10 Forecast weather, planned routing, and high-density airport operations are all threats that fall into the expected category. The pilots can plan for these issues and plan defenses to accommodate them. Aircraft malfunctions, changed routings, and unforecast weather issues fall into the unexpected category, and pilots must deal with these issues as the emerge. An additional threat exists in the impact of errors committed by others.8 Of note; to be considered a threat, the issue must complicate the flight. A change in routing from air traffic control that simplifies the flight (such as being cleared direct to the destination) would not meet the criteria of a threat.

Threat management involves how the pilots anticipate, prepare for, and respond to these threats.8 Many of these threat management activities are part of the normal process of operating aircraft. The pilot’s preflight inspection of the aircraft, the use of checklists, and adhering to operational limitations all help prevent aircraft malfunctions. A thorough weather briefing, use of airborne weather radar, and periodic inflight weather updates are all part of managing threats due to weather.8 In most cases, the crew adequately manages the threats throughout the flight. Merritt and Klinect estimate that up to 90% of all threats are properly managed within airline operations, leaving about 10% of threats mismanaged, due to or leading to crew errors.8

Errors

An error is any act committed or omitted by the pilots that results in a deviation from what they intended, reduces the margin of safety, and increases the likelihood of an “adverse operational event”.8 Merritt and Klinect place error into three categories; procedural, communications, and aircraft handling.8 Procedural errors involve pilot divergence from policy, regulations, aircraft flight manual standards or procedures. Examples include accidentally missing a checklist step or purposely omitting said step. Communication errors can be between the pilots or with those outside the cockpit.10 Finally, aircraft handling errors are identified as those involving skill or knowledge in handling the aircraft. Aircraft handling errors result in deviations of aircraft direction, attitude, velocity and configuration.8

How the pilot responds to an error directly impacts the outcome of the event. The process flow for each error is depicted in Figure 4. First, the error must be detected. As Merritt & Klinect emphatically state, “an error that is not detected cannot be managed.”8 If the pilot detects the error, and the error is dealt with (managed) appropriately without additional error and without significant effect, the error is said to result in a “trap”. “Exacerbate” is the result of the pilot’s response (or intentional non-response) to a detected error resulting in the situation worsening. Finally, if the pilot does not react because the error is not noticed or ignored, it is classified as “fail to respond”.10

There are three possible outcomes from the error, regardless of the response of the pilot. If there is no impact on the safe conclusion of the flight, regardless of action or inaction by the pilots, or even if the error went undetected, the outcome of that error is “inconsequential”.9 The pilot, in responding to this error, might commit an “additional error”, and that error must also be detected and managed by the pilot. Third, and most critical to this paper, the pilot’s response may result in an “undesired aircraft state”. A UAS is:

[A] position, condition or attitude of an aircraft that clearly reduces safety margins and is a result of actions by the flight crew. The error results in the aircraft being unnecessarily placed in a condition that increases risk. This includes incorrect vertical or lateral navigation, unstable approaches, low fuel state, lining up for wrong runway and reduced separation.9

The term UAS encompasses a wide range of situations. Simply being at the wrong altitude constitutes a UAS. If deviations in pitch, bank or airspeed become severe enough, the UAS moves into the category of an “upset”, with an accident or incident resulting from an upset event falling into the classification of a LOC-I.

In response to the undesired aircraft state, the pilot may apply appropriate techniques and strategies to “mitigate” the situation. Or, the pilot may make control inputs that create further deviation from the desired aircraft state and “exacerbate” the situation. Or the pilot may “fail to respond”.9 The outcome of an undesirable aircraft state can be “recovery” of the aircraft back to a desired aircraft state, “additional error” which must be further dealt with by the pilot, or an “accident/incident”.9 Pilots can be trained to appropriately manage undesired aircraft states through UPRT.

Integrating TEM and UPRT

Pilots can significantly increase flight safety by integrating UPRT considerations into their TEM process. By including the threats that can result in a LOC-I event during the flight planning phase, they can develop plans that avoid those threats. By keeping LOC-I threats in mind during the conduct of the flight, they will be more likely to recognize the precursors to a LOC-I, and take early action to prevent an LOC-I occurrence. Should a LOC-I event happen, having participated in a quality UPRT program should have imparted the skills necessary to recover the aircraft.

Threats that can be anticipated should be taken into consideration during flight planning. Forecast weather that includes thunderstorms, windshear, or icing all fall into this category. Wake turbulence also has a component that falls within this category. If the flightplan includes operations in areas where heavy aircraft traffic is expected, the pilot should take this into consideration during planning. A possible mitigation strategy in this situation may be to select an alternative destination, such as a nearby reliever airfield, that still meets the objective of the flight. The pilot with an awareness of preceding traffic, the airfield winds, and the dynamics of wake turbulence can plan the approach to minimize the possibility of encountering wake turbulence. While the best mitigation is to avoid the threat completely, oftentimes the flight is of such priority that other forms of mitigation are necessary.

During flight, pilots should continue to be aware of emergent LOC-I threats.6 By staying aware of possible situations conducive to LOC-I, they are more likely to recognize the early stages of a LOC-I event. Early detection greatly enhances the likelihood of preventing an upset. This awareness is especially important during flight with the autopilot engaged. While autoflight is often the time the pilot will assume a lower level of vigilance, in the presence of an LOC-I threat such a relaxed attitude can lead to a sudden upset. The autopilot will attempt to keep the aircraft within the desired state, using more and more of its control authority. If the limits of authority are exceeded, most autopilots will disengage, suddenly allowing the controls to return to neutral in most aircraft. The counter-upset control inputs previously held by the autopilot will be removed and the aircraft may be rapidly placed into an upset condition. A vigilant pilot would notice the increasing displacement of the control from neutral. In such an instance, it may be prudent to assume control from the autopilot to prevent the situation of experiencing a disconnect with no pilot on the controls.

A further byproduct of an active awareness of LOC-I threats is that the pilot is less likely to be startled should an upset occur. A pilot that is unaware may have as much as twice the reaction time as that of a pilot that is aware of the potential need for intervention.11 Minimizing reaction time in a LOC-I recovery event is essential. Joint research by the National Aeronautics and Space Administration (NASA) and Boeing determined that window of opportunity available to resolve an airplane upset is often less than 10 seconds to initiate correct recovery action.12 With this potentially limited recovery window, pilots should constantly remain vigilant awareness and active mitigation of LOC-I threats.

Conclusion

Loss of Control In-flight continues to be the greatest threat of fatality in commercial aviation. The emergence of TEM has provided pilots with a valuable tool in identifying and mitigating threats and minimizing their impact. It is incumbent upon pilots to utilize all the available tools to achieve the desired outcome of a safe flight. The application of the TEM methodology to the LOC-I threat has the potential to greatly decrease the LOC-I mishap rate through better awareness of the threat, enhanced vigilance in its presence, and more rapid response should it strike