What’s wrong with flight simulators

17 February 2012 Steven Cherry: Hi, this is Steven Cherry for IEEE Spectrum’s “Techwise Conversations.” The Air France 447 accident was pretty traumatic for the aviation industry. Everyone from systems engineers to test pilots have tried to determine how much of the 2009 crash,…

17 February 2012

Steven Cherry: Hi, this is Steven Cherry for IEEE Spectrum’s “Techwise Conversations.”

The Air France 447 accident was pretty traumatic for the aviation industry. Everyone from systems engineers to test pilots have tried to determine how much of the 2009 crash, which killed 228 people, was due to human error and how much to mechanical or electrical malfunction.

Increasingly, the focus has been on a “breakdown in situational awareness,” suggesting that actions by the flight crew and the pilot—as well as problems with aircraft design—may have contributed to the accident.

Veteran test pilots are spearheading the effort to reduce pilot error during any number of loss-of-control incidents, especially at high altitudes.

Pete Reynolds is one of them. He was chief of engineering flight-testing for Learjet, which since 1990 is part of Bombardier. After he retired from the Bombardier Flight Test Center, he formed PTR Aero, a flight-test consulting company. He ranks among aviation’s top test pilots, with more than 10 000 hours of flying time in jet aircraft. And he is the only professional general aviation pilot to be a finalist in NASA’s space shuttle astronaut selection. He joins us by phone from Goddard, Kansas.

Pete, welcome to the podcast.

Pete Reynolds: Good to be with you.

Steven Cherry: Pete, am I right that the Air France 447 accident has been something of a wake-up call for the industry?

Pete Reynolds: Yes, it has been. There are a number of issues that were brought up by that accident that are of a concern for both aircraft design and operations in training.

Steven Cherry: I want to get to the training questions in a minute, but new technologies seem to play a big role here. Part of the problem seems to be that we’re sort of betwixt and between. We’re not letting the plane entirely fly itself, but when it’s mostly flying itself, then there’s a problem when it stops. The pilots really aren’t in a good position to figure things out. What…what’s the pilot view of this?

Pete Reynolds: Well, normally that is not a problem. Normally there’s a malfunction indication to the crew, and the crew takes over and responds. The problem in this case was that the system was not designed to handle loss of all altitude and airspeed sources at one time. That information is fed into a whole number of systems on the airplane, including the autopilot, and so the crew was faced with loss of the autopilot but also the whole series of malfunction indications, not only from airspeed and altitude but from a lot of systems that use that information. So it was a very confusing situation, and the aircraft really was not designed to handle that loss of all three or all four sources of data at one time. There’s a—normally a reversion scheme where if you lose one it reverts to the next system, but the simultaneous loss of all four was considered extremely improbable and not covered in the malfunction design.

Steven Cherry: There are some other technological issues that I think some pilots have taken issues with, especially for Airbus planes, which have an interface that’s significantly different from older airplanes. So for example, there’s a lack of tactile feedback in some of the systems that pilots are used to.

Pete Reynolds: And I agree with that. The pilot community in general, I think, doesn’t feel that there is enough information to keep the flight crew in the loop with the Airbus design. You mentioned that compared to older designs, but that’s not really the case. That is an Airbus design philosophy, and there are a lot of newer aircraft, including fly-by-wire airplanes, that do a much better job of keeping the pilots’ situational awareness and keeping the pilots in the loop. The Boeing designs do that to a great extent as well as a number of other manufacturers.

Steven Cherry: I wonder if this is in some part a bit of a generational thing, so you know, in the case of the tactile feedback, for example, older pilots are used to getting it, but you know, maybe a…

Pete Reynolds: No, it’s not. That is what pilots are trained to do from the very beginning. And there are a whole series of requirements built into the regulations as to how the airplane responds, what the control feel is for certain conditions. Being off-speed, for example. You’re supposed to have a force in the stick that tells you you’re…you’ve deviated from the speed that you’re trimmed to. The Airbus was certified to special conditions, and they don’t meet those requirements. So flying an Airbus airplane means relearning a number of different techniques that people have learned to fly with from the very beginning. And there are a number of pilots, myself included, that think that that is a difficult situation to adapt to, and in an emergency situation, people normally revert to their basic training and what they’re used to.

Steven Cherry: Fair enough. I…I’ve never flown a plane, but I know from certain…you know, power steering, when it first came out didn’t provide the kind of resistance from the wheel that you’re used to. And it can make a huge difference.

Pete Reynolds: Yeah, that’s a good analogy. And that’s really where a lot of this is come from, smaller airplanes and controls are strictly mechanical, like cars used to be before power steering, and then as the aircraft became faster and larger and the control forces became too much to handle, just with the muscle power, power-assisted and then fully powered flight-control systems were added, and then the feedback to the pilot was provided artificially, but it was intended to duplicate the kind of feel that pilots were used to from mechanical flight control systems. And there are requirements that the artificial-feel systems perform in a certain way, so that pilots will intuitively know the situation.

Steven Cherry: I’d like to get the pilot take on one other question that’s come up in this podcast series before. And that is the question of planes flying themselves. And some people have, you know, done a sort of risk analysis of the whole situation and said, ”Well, they’re…planes are either good enough now, or soon they will be good enough that maybe we should just let them always fly themselves, and every so often there’ll be an accident, but on average, the planes will be even safer than what we have now.” What’s your thinking?

Pete Reynolds: Well, I don’t agree with that at all. I’ve been involved in developing software for advanced systems for quite a while, and the software is only as good as the engineers designing it and the situations it’s designed for. And I can tell you that there are a number of situations that come up, sets of circumstances that are not covered in the design or in the software, and pilots intervene all the time to correct for errors that you have. I mean, you’re used to that in the computer, you’re working with it, the software will, say, get to a certain dead end and it just won’t work anymore, and you either restart the system or reboot the computer. I don’t think you’d want to be sitting in an airliner when the computer gets into one of those positions. I think we’re a long way from where automation can safely complete an entire mission reliably. They’re quite good at a number of things, including autopilots have improved dramatically for both en route and approach, but there are circumstances that develop almost on every flight where the plan is changed, the weather intervenes, there’s a malfunction, air-traffic control requires rerouting that software currently just cannot handle.

Steven Cherry: Fair enough. That kind of brings us to the training question. You know, for pilots. I’d like to read something from an Aviation Week article last year. It quoted C.B. Sullenberger, who was the pilot who landed his…a plane which happened to be an Airbus, by the way, on the Hudson River about three years ago, and Sullenberger said, “To my knowledge, air transport pilots practice approaches to stalls, never actually stalling the aircraft. These maneuvers are done at low altitude where they’re taught to power out of the maneuver with minimum altitude loss.” He also said, “They never get the chance to practice recovery from a high-altitude upset. At altitude, you cannot power out of a stall without losing altitude.” I’m wondering if Sullenberger captures some of your concerns about pilot training right now.

Pete Reynolds: Yes, he does; I agree with everything he said. Recently, there has been a very significant effort to improve training for upset recovery—both stalls and other types of upsets, including high-altitude upset. And in fact, in the FAA reauthorization bill, Congress required that stall and upset training be improved. One thing that has already occurred, I think, I believe in the last year the FAA has changed their requirements for stall training to require full stalls and to deemphasize minimum altitude loss, which in some cases can actually cause the pilot to put in an input that will cause the airplane to stall again after it’s been recovered. Also, his comments about not having enough power to recover from a stall at high altitude is exactly correct, as the aircraft goes up in altitude, the amount of thrust the engines produce goes down. Also, the drag goes down, so it’s most efficient to cruise at high altitudes, but the response to a power input to recover from a stall at high altitude is much less than at low altitude where approaches to stalls are normally practiced.

Steven Cherry: Very good, and you’re working on some of these pilot-training issues with trying to design new aircraft for them—is that right?

Pete Reynolds: Well, I’m involved in a project where we are trying to design some modifications to an existing aircraft so that in-flight training for some of these upset maneuvers can be done safely. Simulators are a great training device, but in the upset recovery area they’re limited by a couple of factors. First, they’re programmed based on aerodynamic data gathered from flight tests, and the flight-test data just doesn’t go into the portion of the envelope that the aircraft encounters sometimes during an upset. And the other one is, the motion cues, or the acceleration cues that the pilot feels sometimes—it’s called the seat of the pants—are very powerful in terms of the pilot’s recognition of the situation that he’s in and initiating the proper recovery procedures. And because they’re ground-based and the motion systems are quite limited in terms of being able to reproduce the kind of acceleration or feel cues that you get in an upset condition—for that reason, we feel that in-flight training is really the best approach to that. I would mention my…I was an Air Force pilot; that’s how I began my professional flying career. And part of that time I was an instructor. And we would take pilots who had a total of about 60 hours, which is just a little bit more than you need to get your private pilot’s license in a 237 jet, and we would allow them to go to the area and perform acrobatic maneuvers solo, but only after they had demonstrated that they could recover from a very high-pitch attitude or an inverted attitude and pull some stalls and spins. And even those very inexperienced pilots who had adequate upset-recovery training did that safely on a day-to-day basis for many years. That type of training is not required for…in the civilian world, and we think that that would be a significant improvement in overall safety, and I think that’s where both the FAA efforts and international efforts through ICAO [the International Civil Aviation Organization] are focusing on in terms of improving upset pilot training.

Steven Cherry: Very good. I’m wondering if some changes to the simulator training are in the works. It seems to me that if we have this kind of new class of accidents where basically, you know, pilots are stuck with a dramatic lack of information in the middle of a crisis, so for example, you know, in the Air France case it was three different indicators of speed went—you know, weren’t available—could that sort of thing be trained better for in simulators?

Pete Reynolds: Well, the issue is that there is a number training and a number of scenarios that are required, and the, as I mentioned, the simultaneous loss of all airspeed and altitude information has previously been considered so remote that it’s not worth training for. But I do think that there is going to be an increased emphasis both in the design certification and training on what the crew response should be when they’re getting multiple conflicting failure messages. And again, I want to emphasize that the crew of the Air France flight had an extremely difficult situation. As I mentioned, it was at night, in turbulence, and all of a sudden they lost all vital information that they’re used to and have had in all their flying career. As well as the failure-warning system issuing multiple failure warnings that were contradictory. And for each failure warning there’s a checklist that needs to be run, and if you get four, five, or six—or in that case there were more than that—failure warnings coming up, the crew had to be very confused as to what was happening and what should be the priority, what was the root cause of their problem. So I think that there may be an emphasis on trying to prioritize and identify the root cause, but the main thing is, in a situation like that, the crew’s first priority should be to fly the airplane. And ignore the other messages, because unless you keep control of the aircraft, it doesn’t really matter what the systems are doing.

Steven Cherry: Pete, I think a lot of people don’t realize how involved the airplane manufacturers are when it comes to, you know, accident analysis, pilot training, protocols, checklists, and so on, but I guess if you‘re ever going to design the next generation of aircraft and make them safer than ever, you really have to be in the thick of those things. So thank you for doing what you do.

Pete Reynolds: Well, it’s something that I’m quite interested in. I’m an engineer by training and a pilot by desire, and I’ve been fortunate enough to spend a career that involves both of them.

Steven Cherry: Well, thanks again for speaking with us today.

Pete Reynolds: Okay. It was my pleasure.

Steven Cherry: We‘ve been speaking with test pilot Pete Reynolds about how new aircraft technologies are placing new demands on pilots and their training. For IEEE Spectrum’s “Techwise Conversations,” I‘m Steven Cherry.

Announcer: “Techwise Conversations” is sponsored by National Instruments.