As a Captain, you can distill the whole of your many daily tasks down to two simple, overarching duties. The first is to transport your craft and your passengers from point A to point B, on a set schedule and with the utmost reliability and efficiency. The second duty is to shout "stop" and abandon your first duty whenever you determine that it cannot be done or is not being done safely and legally. Technically, every airline employee has these dual responsibilities. At some airlines, the second is emphasized as strongly as the first. At others, management merely pays lip service to the second duty while making very clear through their actions that moving airplanes is their primary concern. This seems to be particularly prevalent at the regional airlines, where performance numbers are one of the primary criteria by which their mainline partners judge their suitability for continued business. Sometimes it can feel very lonely to be the only person holding up the operation when everyone else is saying "go, go, it's allright."
A little over a month ago, I was starting out a three day trip with a Chicago-Midway turn. It had been snowing fiercely in Chicago, and although the weather was forecast to improve, visibility was still near approach minimums. My First Officer, whom I had never flown with before, was fresh off IOE, although he had flown the JungleBus previously at his last airline (from which he had received his second furlough in under a year).
Twenty minutes before our scheduled departure time, two maintenance personnel appeared in the cockpit door and announced that they were going to upload a new FMS database, since the current one was due to expire a few hours after our arrival back to Minneapolis. Passengers were already boarding but we were assured the update wouldn't delay our departure. It's usually a quick, routine matter.
This time that did not prove to be the case. For whatever reason, the FMS froze partway through the upload process and was unresponsive to subsequent attempts. The maintenance guys told us to recycle the ship's power, which we did. That compounded our problems: not only did the FMS continue to refuse the new database, it dropped the current one out of the system! Further attempts at getting the system to respond were futile.
After conferring with maintenance control, the mechanics informed us that their solution was to defer both FMS's for now and worry about solving the problem later. I referred to our Mininum Equipment List (MEL), and sure enough, it permitted the aircraft to be flown with both FMS units deferred. This effectively turns the JungleBus into an old-school DC-9, confined to navigating from VOR to VOR. Now, back in my freight dog days I could do that, single pilot, without an autopilot, in solid IMC and moderate turbulence, while filling out paperwork and listening to the ballgame on the ADF - but these days I'm a little out of practice on that sort of thing! The FO and I reviewed the MEL and a related portion of our Flight Operations Manual; it laid out, in great detail, how to accomplish lateral and vertical navigation without either FMS. I reviewed the routing and approach at MDW; they were uncomplicated and easily accomplished "green needles." I checked the weather in Chicago, which was rapidly improving. Finally I conferred with the FO and determined that we were both comfortable operating the aircraft in this condition. That settled, the mechanics began signing off the logbook, and I turned my attention to my preflight flows.
I quickly realized there were greater problems than a simple lack of FMS navigation capability. I couldn't access any of the MCDU pages other than the Radio and Thrust Setting pages. Some of these, like Navigation, Route, and Flight Plan were to be expected - but some, like ACARS and the Performance page, seemed wholly outside the scope of the MEL. The Performance pages are especially important to the operation of the JungleBus. Without them, we have no way to set our takeoff and landing airspeed bugs. Moreover, there is no other place you can enter the takeoff flap setting for the takeoff configuration warning system. We had no idea whether we'd get a "No Takeoff" warning when we advanced the thrust levers on takeoff, necessitating a mandatory abort. Finally, the inability to enter a zero fuel weight in Performance Initialization disabled our flight director until we selected a vertical mode at 1000 feet AGL.
I told the mechanics about these problems, and stated that in my opinion this was outside of the scope of the FMS deferral. I pointed out that the MEL contained very detailed operational information on how to navigate laterally and vertically without FMS navigation or VNAV, but was utterly silent on how we were supposed to work around the lack of access to the Performance pages. They disagreed, saying that Performance is one of the FMS's functions and therefore the MEL applies. I told them that I would accept that if they could provide supporting documentation, including Operator notes on how to cope without the Performance pages. They began perusing the MEL, randomly pointing to anything containing the word "Performance" no matter how unrelated to the problem (ie, "Required Navigational Performance"). I was unmoved; they were exasperated. "There's no way anyone would build a plane so automated that you can't fly without the automation!" one exclaimed. It was clear that they just wanted us out of their hair. They called maintenance control to report our recalcitrance. Meanwhile, I went back to the cabin to report to the passengers why we still hadn't left - it was now well past departure time - while keeping the specifics fairly vague.
When I returned to the cockpit, the mechanics handed the phone to me. On the line was the maintenance controller, who told me that it was his opinion that our condition was indeed covered by the FMS MEL, but I could talk to the supervisor. When the supervisor picked up, I again recited the litany of problems and reasons it didn't appear that the MEL covered them, and repeated my offer to reconsider if anyone could provide any supporting documentation for their contention that we were good to go. He said he didn't have anything beyond the MEL, but thought that the Director of Maintenance might have better answers. "Sure, transfer me to the DM," I said.
The DM was initially even more strident that we were legal than the others. "The FMS modules in the avionics cabinets handle the performance pages," he said. "The MEL covers the whole FMS." That might be so, I answered, but if that was the intention of those drafting and approving the MEL they certainly didn't make that clear, given the explicit operational guidance on how to operate in lieu of LNAV and VNAV but the absolute dearth of information on how to substitute for speed bugs or flight director and how to ensure the takeoff warning system worked correctly. At this he began to back down: "I don't know anything about VNAVs or bugs or anything," he sputtered, "I just know that it's all in the same module and that module can be MEL'd!"
It was well past time to get the Chief Pilot's Office involved. I called the Chief Pilot and the two assistant CPs; nobody was answering. I left a short message for the Duty Chief Pilot to call me ASAP. Then I called our dispatcher, who was rather curious about why I was refusing an airplane that everybody from the line mechanics to the Director of Maintenance said was legal. I gave him the rundown and told him I certainly wouldn't be leaving until a chief pilot called me. He said he'd try to track one down. I hung up and went back to the cabin to update the passengers. We were over an hour late now. I tried to give them more specific information without letting on that this was essentially an argument between me and the company. I admitted that I didn't have a timeframe for a go/no-go decision at this point. Several passengers requested that they be allowed to deplane. I coordinated it with the harried gate agent; shortly after, half the plane got off, to her exasperation. Finally I settled back into the my seat in the cockpit to await a call. My FO and I talked the situation over again. He agreed with my interpretation, and pointed out that even if they were correct and it was legal, operating with this condition would involve making up several procedures on the fly, and it wasn't our job to make up procedures.
A few minutes later, my phone rang. It was the Duty Chief Pilot. I summarized the problem, our interpretation, and the response from the maintenance department. He was rather taken aback: "We can't be operating without the Performance pages!" he exclaimed. That was a relief, as I was wondering if everyone in the company would push me to go. He said he'd call the Director of Standards, the man who had written the MEL, to make sure that our interpretation was correct. He called back a few minutes later and said the Director of Standards definitely agreed that the Performance pages were not intended to be covered by the MEL, and the aircraft was unairworthy in its present state.
I informed the mechanics that I was refusing the aircraft and asked whether they would attempt to fix it. They told me they had "bigger fish to fry" and stormed off in disgust. Dispatch said they were attempting to find another airplane for us to take. I told the remaining passengers this airplane wouldn't be going to Chicago; they filed off glumly. Shortly thereafter we were assigned a new aircraft so we quickly packed up and hurried off to the new gate. As we deplaned, our gate agent was in an animated argument with her supervisors. Nobody, it seemed, was very happy that I hadn't simply accepted the mechanics' word and launched with a very questionable airplane. C'est la vie.
Afterward, I wondered what I would've done if the Chief Pilot who called me had backed the maintenance department up and said the airplane was airworthy. Ultimately, it shouldn't have made a difference: it's the Captain who determines if his craft is airworthy. Practically, though, it would've added immensely to the pressure to go. Most chief pilots, although they're management, are pilots first and foremost. Most would've been like the one I talked to and recognized that from a pilot's standpoint, the aircraft was probably not airworthy and there certainly wasn't enough guidance to operate it safely. There are a few chief pilots out there, however, who believe their primary mission is to ensure that the peons keep the metal moving. I'm not claiming any of my chief pilots are that way, but they are scattered throughout the industry. They make it harder for a Captain to say no when he needs to say no, but don't in any way relieve him of that responsibility. Ultimately, a Captain may have to pay the price for doing what is right. Having some good contacts among the Feds can help. Being part of a union is better yet.
Friday, February 27, 2009
Wednesday, February 18, 2009
A few words about Colgan 3407
My story related to the JungleBus' FMS will have to wait for the next post. I've been debating whether I should write about Colgan 3407; I generally take the "let's wait for the investigators to do their jobs" approach to airline accidents. Unfortunately the media doesn't share this sentiment in the least, and in their drive to solve the accident before the wreckage is cold they've put out a tremendous amount of disinformation in the last week. Few of the media's sources appear to have any experience flying turboprop airliners, much less the Q400. While my knowledge of the airplane isn't perfect and has faded a bit in the year and a half since I last flew it, I do have a few thousand hours in it.
I'm not going to speculate on what caused the crash. All that I know about the circumstances are what's been reported by the NTSB thus far and repeated in the media. The morning after the crash, enough was already known that there were only a few likely culprits. I myself suspected it was one of two scenarios. The first known facts made one seem most likely, and subsequent information is now shifting the investigation towards the second possibility. The media hasn't reported accurately on either scenario, with a few exceptions. There's a decent chance that more information will come to light that will take the investigation in a completely different direction before it's all over. To say I have any idea what really caused this accident would be a farce. I will, however, give my take on some of the ways the known information has been interpreted and reported to the general public.
"Significant" versus Severe Icing
Because the air traffic controller was prudent enough to collect icing PIREPs from other pilots immediately following the accident and the audio of those interactions was immediately available on LiveATC.net, speculation that this was an icing accident reached a fever pitch before the fire was even out. The investigation now seems to be proceeding in a different direction, but it could came back to icing as a contributing factor.
The media seized upon the NTSB's statement that the crew noted "significant" icing on the descent. They've treated this term as the equivalent of severe icing, even though the NTSB has specifically said they have no reports or evidence of severe icing in the area. There were a number of other airlines that landed just prior to and after the accident aircraft. One that landed a half hour later was another Colgan Q400. There were also several light aircraft in the area at the time. The very worst reports of icing were for what would normally be considered moderate. None of the airliners requested routing or altitude changes to get out of the ice, and nobody even bothered giving a PIREP until the controller started soliciting them after the accident. That's not what a bad ice night in the northeast sounds like. Although icing conditions can vary significantly over small changes of distance and time, it seems rather unlikely that one crew could encounter severe ice when multiple pilots around them were barely noting it.
Ice and the Q400
Horizon has been flying the Q400 in the Pacific Northwest, Montana, and southwestern Canada since 2000. This area gets its share of bad icing conditions every year, and the Q400 has shown itself to be up to the challenge. It does have deice boots, but they generally do an excellent job of keeping the leading edges of the wing and tail clean in moderate icing. The one problem spot is that the deice valves sometimes freeze closed, but this is immediately annunciated in the cockpit with a "Deice Pressure" caution message and nine times out of ten the crew can cycle the system off and on and get the valve to unstick. The NTSB has indicated that the deice system was turned on before the aircraft entered icing conditions (which was Horizon's procedure, too), and there were no obvious, annunciated malfunctions of the system.
It's easy to tell when you're getting a lot of ice on the Q400. The windshield wipers are excellent collectors of it, and there's a little plastic pin on the top of them that accumulates ice before any other part of the airframe. The cockpit even has a built in light to illuminate the pin at night. All of the wings outboard from the engines are visible from the cockpit, as is the unprotected propeller hub. Both are well illuminated by ice inspection lights.
As soon as the ice detection probes detect ice, a message starts flashing on the EICAS and won't stop flashing until the pilots select the ice speeds switch on. This makes the stall protection system speeds 20 knots faster, forcing the pilots to use adjusted ice speeds for landing.
I've had decent ice loads on the Q400 several times, including one thankfully short encounter with icing possibly falling into the "severe" category. The airplane has so much excess power, especially down low, that performance wasn't even an issue. I never felt that controlability was an issue either, although I suppose it's pretty easy to get to the edge of controlability in ice without realizing you're at the edge (more on that later).
Turboprops under Fire
Given that the Q400 is a turboprop with deice boots, there have been (premature) parallels drawn between this accident and others involving turboprops with boots. There has been a fair amount of insinuation that turboprops are inherently dangerous in ice. Today, former NTSB chairman Jim Hall, who now partners in an aviation litigation firm, carried this idea to it's ultimate, idiotic conclusion: all twin turboprops ought to be immediately grounded.
It's true that jets are superior to turboprops in ice. The reason has a lot less to do with equipment than with performance. Yes, hot leading edges are nice and do a better job of keeping the wing perfectly clean in "normal" conditions. In severe ice, though, hot wings are just as susceptible as boots are to runback (ice forming behind the protected area). A jet aircraft's main advantage is that its superior performance and greater altitude capabilities allow it to get out of ice quicker and stay out for longer.
That said, I believe turboprops can be safely operated in icing conditions so long as their pilots monitor the situation carefully, know the limits of their equipment, and always have an out if things get nasty. Overall, turboprop pilots have done a great job of doing just that. Two icing accidents out of 30 years and millions of hours of flying small turboprop airliners does not make them inherently unsafe, as some would have it - especially when you look at what actually happened in those accidents. One involved prolonged flight through supercooled water droplets (SLD), which wasn't widely understood but we now know is the worst kind of severe ice, because it runs behind the protected areas before freezing, with drastic implications for controlability. The other involved getting too slow in an iced up airplane on which the deice system had not been activated. Both of these had little to do with the systems or limitations of a turboprop aircraft, and could've as easily happened in a jet. To use these accidents, plus a currently unsolved accident in which ice may have played a factor, to call for the grounding of all turboprops is the height of insanity.
Tailplane Stall
One subset of the icing scenario which attracted the most attention among pilots but received fairly little coverage from the media was the possibility of a tailplane stall. The reason it caught so many pilots attention was the NTSB's announcement that Colgan 3407 suffered an upset immediately after the pilots selected Flaps 15, and NASA's previous research has shown that flap extension can cause a nearly-stalled tailplane to stall. Subsequent information from the flight data recorder, however, appears to contradict the tailplane stall sceneario.
On all conventional aircraft, the wing is positioned so that the center of lift is behind the center of gravity (which is essentially the pivot point of the aircraft during maneuvering). This causes a nose-down, tail-up pitching moment whenever the wing is producing lift. To compensate, the horizontal stabilizer is designed to generate tail-down force. It does so with an airfoil much like an upside-down wing. Like a wing, the horizontal stabilizer can only generate lift up to a certain angle of attack. Beyond that critical AoA, it stalls, or ceases to generate lift. When that happens, the aircraft rapidly pitches down thanks to its natural pitching moment.
Under normal conditions the tail is pretty hard to stall. At slow speeds where the boundary layer might tend to separate, the aircraft is usually flying at a higher AoA, which is actually a low AoA for the tail. Lowering flaps decreases the aircraft's AoA, making it greater for the horizontal stabilizer, generally at slower speeds where the boundary layer can detatch more easily. High-wing aircraft with conventional tails, like the Twin Otter, also generate quite a bit of downwash on the tail with flap extension, which further increases the A0A. Throw in some ice contamination and you have the potention for real trouble: an unexpected, rapid pitch down at presumably low altitude. It looks a lot like a conventional stall, but the recovery is exactly opposite: pull up, retract flaps, and go easy on the power. Aircraft with unpowered elevators can be very difficult to recover from a tailplane stall, with stick forces of well over 100 pounds required.
The Q400 has a hydraulic-powered elevator, which would make recovery from a tailplane stall much easier, assuming you know it's a tailplane stall and take the appropriate recovery steps. I'd be surprised if this accident had anything to do with a tailplane stall due to more recent information that's come to light: the initial upset was a pitch up, not down, and the autopilot disconnect was precipitated by the stick shaker. A stick shaker indicates critically high aircraft angle of attack, which would be a low AoA for the horizontal stabilizer.
If you're interested in learning more about tailplane stalls in icing - and if you're a pilot who flies in ice, you should be - there's a very interesting NASA video for you to watch here. Of particular note is the inadvertent tailplane stall they experience in a Twin Otter.
On Autopilot Usage
For a few days there was an absolute uproar over the fact that the aircraft was on autopilot just prior to the upset. If anything indicates the media's cluelessness about how we operate airliners, this is it. I'm a big proponent of turning off the automation and hand flying the airplane at times. A dark, snowy night when I'm about to shoot an approach is not one of those times. That's when you use the automation to keep your workload low. Yes, if really iced up, I'll turn off the autopilot early to get a feel for the plane. But there's nothing in the Q400 manual (or Colgan's procedures, apparently) that says you have to hand-fly the airplane except in severe icing. The media acted as though Captain Renslow was being negligent merely by having the autopilot on in fairly normal icing conditions. That's baloney.
Now, automation does pose its own hazards. You need to make sure its doing what you want it to do, and you have to do your own part. The Q400 has a very capable autopilot but it doesn't have autothrottles. You need to pay attention and bring up the power when leveling off from descents or its possible to get into a low-airspeed situation very quicky; those 13 foot props produce a lot of drag at flight idle.
A Big Upset
The most recent information the NTSB has released is that the aircraft was approaching the marker and was at 134 knots at the time gear was selected down and flaps selected to 15. If that number turns out to be correct, that is a very, very low speed in the Q400 without being in the landing configuration. Shortly after the flaps were selected to 15, the stick shaker and then the stick pusher activated, which automatically turns the autopilot off. An upset occured at that time, with pitch angles as high as 31 degrees nose up and 45 degrees nose down, and bank angles as high as 105 degrees.
That's a pretty huge upset, and one difficult to recover from at 1500 feet even if done perfectly with a clean, undamaged airplane. Although it's only been about a day since the media started letting go of their ice obsession and began reporting on the low speed upset, there's already been a fair amount of finger-pointing that the pilot flying let the aircraft speed get so slow, or that he supposedly pulled up and fought the stick pusher. Suffice it to say that we know very little about what was going on other than those basic numbers that the NTSB has released. It'll come out soon enough; this investigation is unusual in that the NTSB has been releasing information more or less as they find it out rather than waiting to put together a final report in a year or two. The point is, though, that until a lot more is known, about all we can say is that the aircraft appeared so suffer from a low-speed upset. We don't know why, we don't know whether icing was a contributing factor, we don't know whether recovery was possible. All those answers will come with time; in the meantime, any certitude on the part of the media, most of their sources, bloggers, or web board participants is mere affectation.
I'm not going to speculate on what caused the crash. All that I know about the circumstances are what's been reported by the NTSB thus far and repeated in the media. The morning after the crash, enough was already known that there were only a few likely culprits. I myself suspected it was one of two scenarios. The first known facts made one seem most likely, and subsequent information is now shifting the investigation towards the second possibility. The media hasn't reported accurately on either scenario, with a few exceptions. There's a decent chance that more information will come to light that will take the investigation in a completely different direction before it's all over. To say I have any idea what really caused this accident would be a farce. I will, however, give my take on some of the ways the known information has been interpreted and reported to the general public.
"Significant" versus Severe Icing
Because the air traffic controller was prudent enough to collect icing PIREPs from other pilots immediately following the accident and the audio of those interactions was immediately available on LiveATC.net, speculation that this was an icing accident reached a fever pitch before the fire was even out. The investigation now seems to be proceeding in a different direction, but it could came back to icing as a contributing factor.
The media seized upon the NTSB's statement that the crew noted "significant" icing on the descent. They've treated this term as the equivalent of severe icing, even though the NTSB has specifically said they have no reports or evidence of severe icing in the area. There were a number of other airlines that landed just prior to and after the accident aircraft. One that landed a half hour later was another Colgan Q400. There were also several light aircraft in the area at the time. The very worst reports of icing were for what would normally be considered moderate. None of the airliners requested routing or altitude changes to get out of the ice, and nobody even bothered giving a PIREP until the controller started soliciting them after the accident. That's not what a bad ice night in the northeast sounds like. Although icing conditions can vary significantly over small changes of distance and time, it seems rather unlikely that one crew could encounter severe ice when multiple pilots around them were barely noting it.
Ice and the Q400
Horizon has been flying the Q400 in the Pacific Northwest, Montana, and southwestern Canada since 2000. This area gets its share of bad icing conditions every year, and the Q400 has shown itself to be up to the challenge. It does have deice boots, but they generally do an excellent job of keeping the leading edges of the wing and tail clean in moderate icing. The one problem spot is that the deice valves sometimes freeze closed, but this is immediately annunciated in the cockpit with a "Deice Pressure" caution message and nine times out of ten the crew can cycle the system off and on and get the valve to unstick. The NTSB has indicated that the deice system was turned on before the aircraft entered icing conditions (which was Horizon's procedure, too), and there were no obvious, annunciated malfunctions of the system.
It's easy to tell when you're getting a lot of ice on the Q400. The windshield wipers are excellent collectors of it, and there's a little plastic pin on the top of them that accumulates ice before any other part of the airframe. The cockpit even has a built in light to illuminate the pin at night. All of the wings outboard from the engines are visible from the cockpit, as is the unprotected propeller hub. Both are well illuminated by ice inspection lights.
As soon as the ice detection probes detect ice, a message starts flashing on the EICAS and won't stop flashing until the pilots select the ice speeds switch on. This makes the stall protection system speeds 20 knots faster, forcing the pilots to use adjusted ice speeds for landing.
I've had decent ice loads on the Q400 several times, including one thankfully short encounter with icing possibly falling into the "severe" category. The airplane has so much excess power, especially down low, that performance wasn't even an issue. I never felt that controlability was an issue either, although I suppose it's pretty easy to get to the edge of controlability in ice without realizing you're at the edge (more on that later).
Turboprops under Fire
Given that the Q400 is a turboprop with deice boots, there have been (premature) parallels drawn between this accident and others involving turboprops with boots. There has been a fair amount of insinuation that turboprops are inherently dangerous in ice. Today, former NTSB chairman Jim Hall, who now partners in an aviation litigation firm, carried this idea to it's ultimate, idiotic conclusion: all twin turboprops ought to be immediately grounded.
It's true that jets are superior to turboprops in ice. The reason has a lot less to do with equipment than with performance. Yes, hot leading edges are nice and do a better job of keeping the wing perfectly clean in "normal" conditions. In severe ice, though, hot wings are just as susceptible as boots are to runback (ice forming behind the protected area). A jet aircraft's main advantage is that its superior performance and greater altitude capabilities allow it to get out of ice quicker and stay out for longer.
That said, I believe turboprops can be safely operated in icing conditions so long as their pilots monitor the situation carefully, know the limits of their equipment, and always have an out if things get nasty. Overall, turboprop pilots have done a great job of doing just that. Two icing accidents out of 30 years and millions of hours of flying small turboprop airliners does not make them inherently unsafe, as some would have it - especially when you look at what actually happened in those accidents. One involved prolonged flight through supercooled water droplets (SLD), which wasn't widely understood but we now know is the worst kind of severe ice, because it runs behind the protected areas before freezing, with drastic implications for controlability. The other involved getting too slow in an iced up airplane on which the deice system had not been activated. Both of these had little to do with the systems or limitations of a turboprop aircraft, and could've as easily happened in a jet. To use these accidents, plus a currently unsolved accident in which ice may have played a factor, to call for the grounding of all turboprops is the height of insanity.
Tailplane Stall
One subset of the icing scenario which attracted the most attention among pilots but received fairly little coverage from the media was the possibility of a tailplane stall. The reason it caught so many pilots attention was the NTSB's announcement that Colgan 3407 suffered an upset immediately after the pilots selected Flaps 15, and NASA's previous research has shown that flap extension can cause a nearly-stalled tailplane to stall. Subsequent information from the flight data recorder, however, appears to contradict the tailplane stall sceneario.
On all conventional aircraft, the wing is positioned so that the center of lift is behind the center of gravity (which is essentially the pivot point of the aircraft during maneuvering). This causes a nose-down, tail-up pitching moment whenever the wing is producing lift. To compensate, the horizontal stabilizer is designed to generate tail-down force. It does so with an airfoil much like an upside-down wing. Like a wing, the horizontal stabilizer can only generate lift up to a certain angle of attack. Beyond that critical AoA, it stalls, or ceases to generate lift. When that happens, the aircraft rapidly pitches down thanks to its natural pitching moment.
Under normal conditions the tail is pretty hard to stall. At slow speeds where the boundary layer might tend to separate, the aircraft is usually flying at a higher AoA, which is actually a low AoA for the tail. Lowering flaps decreases the aircraft's AoA, making it greater for the horizontal stabilizer, generally at slower speeds where the boundary layer can detatch more easily. High-wing aircraft with conventional tails, like the Twin Otter, also generate quite a bit of downwash on the tail with flap extension, which further increases the A0A. Throw in some ice contamination and you have the potention for real trouble: an unexpected, rapid pitch down at presumably low altitude. It looks a lot like a conventional stall, but the recovery is exactly opposite: pull up, retract flaps, and go easy on the power. Aircraft with unpowered elevators can be very difficult to recover from a tailplane stall, with stick forces of well over 100 pounds required.
The Q400 has a hydraulic-powered elevator, which would make recovery from a tailplane stall much easier, assuming you know it's a tailplane stall and take the appropriate recovery steps. I'd be surprised if this accident had anything to do with a tailplane stall due to more recent information that's come to light: the initial upset was a pitch up, not down, and the autopilot disconnect was precipitated by the stick shaker. A stick shaker indicates critically high aircraft angle of attack, which would be a low AoA for the horizontal stabilizer.
If you're interested in learning more about tailplane stalls in icing - and if you're a pilot who flies in ice, you should be - there's a very interesting NASA video for you to watch here. Of particular note is the inadvertent tailplane stall they experience in a Twin Otter.
On Autopilot Usage
For a few days there was an absolute uproar over the fact that the aircraft was on autopilot just prior to the upset. If anything indicates the media's cluelessness about how we operate airliners, this is it. I'm a big proponent of turning off the automation and hand flying the airplane at times. A dark, snowy night when I'm about to shoot an approach is not one of those times. That's when you use the automation to keep your workload low. Yes, if really iced up, I'll turn off the autopilot early to get a feel for the plane. But there's nothing in the Q400 manual (or Colgan's procedures, apparently) that says you have to hand-fly the airplane except in severe icing. The media acted as though Captain Renslow was being negligent merely by having the autopilot on in fairly normal icing conditions. That's baloney.
Now, automation does pose its own hazards. You need to make sure its doing what you want it to do, and you have to do your own part. The Q400 has a very capable autopilot but it doesn't have autothrottles. You need to pay attention and bring up the power when leveling off from descents or its possible to get into a low-airspeed situation very quicky; those 13 foot props produce a lot of drag at flight idle.
A Big Upset
The most recent information the NTSB has released is that the aircraft was approaching the marker and was at 134 knots at the time gear was selected down and flaps selected to 15. If that number turns out to be correct, that is a very, very low speed in the Q400 without being in the landing configuration. Shortly after the flaps were selected to 15, the stick shaker and then the stick pusher activated, which automatically turns the autopilot off. An upset occured at that time, with pitch angles as high as 31 degrees nose up and 45 degrees nose down, and bank angles as high as 105 degrees.
That's a pretty huge upset, and one difficult to recover from at 1500 feet even if done perfectly with a clean, undamaged airplane. Although it's only been about a day since the media started letting go of their ice obsession and began reporting on the low speed upset, there's already been a fair amount of finger-pointing that the pilot flying let the aircraft speed get so slow, or that he supposedly pulled up and fought the stick pusher. Suffice it to say that we know very little about what was going on other than those basic numbers that the NTSB has released. It'll come out soon enough; this investigation is unusual in that the NTSB has been releasing information more or less as they find it out rather than waiting to put together a final report in a year or two. The point is, though, that until a lot more is known, about all we can say is that the aircraft appeared so suffer from a low-speed upset. We don't know why, we don't know whether icing was a contributing factor, we don't know whether recovery was possible. All those answers will come with time; in the meantime, any certitude on the part of the media, most of their sources, bloggers, or web board participants is mere affectation.
Thursday, February 12, 2009
JungleBus Systems Post: Flight Management System
Jeeze. It's been a while since I've posted. If I still have any readers left - sorry! I turn around for one second, life happens, and it's suddenly nearly a month since I've written for the blog. I actually have weekends off this month - probably a one-time fluke, which I'll write about in another post - so I've been spending my days off with Dawn. That's certainly a good thing from my perspective, but it does mean less time for writing.
I have a good story that happened to me about a month ago, but understanding it requires some knowledge about the JungleBus' Flight Management System (FMS). That's as good of an excuse as any to revive the JungleBus Systems series, along with the fact that a reader specifically requested a post on the FMS a few months ago. I'll write about the FMS in this post, and tell you the related story in my next.
One note: the FMS is one system where I think it's prudent to keep some details vague. Information on how various aircraft systems work isn't generally security-sensitive - someone with nefarious intentions probably isn't too interested in the purpose of Electric Hydraulic Pump 3A! - but the FMS is an exception. I have no interest in helping some Mohommed Atta wannabe navigate their way to Washington DC, so I'll confine myself to theoreticals rather than a detailed walk through of the FMS' functions.
The Flight Management System in the JungleBus is manufactured by Honeywell and is an integral part of their Primus Epic integrated aviation system. To light plane pilots, the Primus Epic is most analogous to the Garmin G1000 system. It covers a great many of the features in the JungleBus' cockpit: the flat panel Primary Flight Displays, Multifunction Displays, Engine Indication & Crew Awareness System (EICAS) Display, the trackpad-like cursor control devices, the autothrottle, flight director/autopilot, FMS units, communication radios, ground proximity warning system (EGPWS), and Multifunction Control Display Units (MCDUs). Because all these components are so interrelated, it's hard to delineate exactly where the FMS ends and another component begins.
Many of the Primus Epic's components are visible in the above photograph - but not the FMSes. They reside in the belly of the airplane, in several Modular Avionics Units (MAUs). The identical boxes on the forward portion of the center pedestal are commonly referred to as FMSes, but they're technically MCDUs. The MCDU is the pilots' only interface with the FMS. On some airplanes, that's all that the MCDU does, so the terms MCDU and FMS became roughly interchangeable. The Q400 is that way; you can actually turn the MCDUs/FMSes off in flight if you want to, and all you'll lose is GPS navigation. On the JungleBus, though, the MCDUs also handle a number of non-FMS functions such as communication and navigation radios, ACARS (Aircraft Communication Addressing & Reporting System), and engine thrust setting selection. The FMS itself has a number of non-navigation functions that are separate on less integrated airplanes. I'm guessing that we use the MCDUs more than any other single peice of equipment on the airplane - including the control yokes! There is no way to turn off the MCDU on the JungleBus short of pulling circuit breakers.
The most basic feature of the Flight Management System is navigation. It's easy to think of the FMS as an overbuilt GPS unit, but GPS is actually only one of the signals that the FMS considers in determining aircraft position. The Inertial Reference System (IRS) also provides input. Surprisingly, the system also automatically tunes and triangulates good old fashioned VORs and DMEs to help determine position. From all these inputs, the system not only determines aircraft position but also calculates its own margin of error, a number known as ANP (actual navigation performance). Most of the time, ANP is less than .1 nautical mile. If ANP exceeds certain parameters for varous phases of flight, or if the two FMSes disagree with each other, the pilots get a warning that navigational performance is degraded. If GPS signals are lost for whatever reason, the system can still do a reasonably accurate job of determining aircraft position using only IRS or VOR/DME.
Navigation is accomplished by entering waypoints into the FMS' flight plan. It uses an internal worldwide database of airports, navaids, and airways that's updated every 28 days. It's relatively easy to make a mistake while entering a flight plan, and this has led to more than one accident in the past. For this reason, the FMS will not actually use any changes to the flight plan for navigation until you go through the second step of activating it. It's standard operating procedure for both pilots to thoroughly review the flight plan before any changes are activated. The Primus Epic makes this easier by displaying the proposed route on the Multi-Function Display as a dashed line. The complete cleared route, including destination and alternate airports, is always entered, reviewed, and activated before flight.
Besides entering the flight plan, the pilots will also initialize the performance function of the FMS before flight. This involves entering speed profiles, cruising altitude, average wind & temperature at cruise altitude, zero fuel weight, and reserve & holding fuel. The FMS automatically gets fuel on board numbers, and calculates time and fuel required to each waypoint. This is automatically updated while enroute, since the FMS calculates current winds aloft and incorporates this into its calculations. The FMS' fuel calculations can easily be checked against the printed flight plan prepared by dispatch. The FMS also has a handy "What-If" performance function where you can check the effect that changing altitude or speed will have on time and fuel required to your destination.
Assuming that the performance function has been initialized, the JungleBus' FMS is capable of not only lateral but also vertical navigation. Wheras the Q400's VNAV was only usable for descents, this one can be used for both climbs and descents. This is particularly handly for RNAV departures and arrivals, where there may be multiple crossing altitude and airspeed restrictions in a fairly short period of time. As long as these restrictions are properly loaded into the flight plan, compliance is as easy as setting the flight guidance panel's altitude selector to the final cleared altitude, coupling VNAV as the vertical mode, and setting the speed selector to FMS. Of course this can lead to complacency, and more than one pilot has busted their clearance by entering restrictions into the FMS improperly or asking the airplane to do something it physically cannot do. You really need to keep a close eye on the magic to make sure it's doing what you want it to do.
Like the Q400, the JungleBus' FMS is approach approved, with the VNAV usable for approach. We can fly VOR, GPS, or NDB approaches using the FMS, with a vertical path on nearly every approach. Interestingly enough, we don't even have an ADF receiver in the airplane to receive NDBs, so we can only fly those approaches if they have GPS overlay. Unlike the newest general aviation boxes, we cannot use LPV minimums - we use the LNAV/VNAV minimums. Given how many major airports with ILSes that we fly to, I don't shoot FMS approaches nearly as much as I did at Horizon.
One feature that the JungleBus FMS handles that's critical to my next post is takeoff and landing speed bugs. These are displayed on both pilots' Primary Flight Displays and are called off by the pilot not flying. The First Officer normally enters the takeoff speeds in the FMS during his preflight flow. He uses the same menu to set the takeoff flap setting, which the takeoff configuration warning system uses to verify that the flaps have been properly set when the thrust levers come up for takeoff. During the same flow, the FO uses another menu to set the takeoff thrust setting; this is technically not part of the FMS, but another MCDU function. One could operate the JungleBus without FMS navigation easily enough - there are still airliners like the DC9 that do it every day - but without MCDUs you'd be in a very unusual situation indeed. This is an important distinction for my next post.
Overall, I think the JungleBus' FMS is pretty well-designed. It's fairly easy to use once you get used to it; the software seems to have been designed by pilots rather than engineers. There are a nice few features that the UNS-1E in the Q400 has that this one doesn't, but the Q400's FMS isn't nearly as well integrated with the rest of the airplane. My chief complaint with the Honeywell unit is that it's awfully slow sometimes; we often joke that they used recycled 286 processors. The VNAV is also rather glitchy; you just have to keep a close eye on it and sometimes use other autopilot modes to ensure smooth transitions.
One final comment is that the FMS that's in the JungleBus is a far cry from the FMS that was in the airplane when I went through initial training. It's the same hardware, to be sure, but the software has gone through several major revisions since then. Whole menus have changed in some cases. The funny thing is that the simulator was one revision behind the airplane even when I went through initial training, which made for a few surprises during IOE. The sim's revision still hasn't changed since then, so when I go back for recurrent it feels like I'm being tested on my historical knowledge of JungleBus software loads!
I have a good story that happened to me about a month ago, but understanding it requires some knowledge about the JungleBus' Flight Management System (FMS). That's as good of an excuse as any to revive the JungleBus Systems series, along with the fact that a reader specifically requested a post on the FMS a few months ago. I'll write about the FMS in this post, and tell you the related story in my next.
One note: the FMS is one system where I think it's prudent to keep some details vague. Information on how various aircraft systems work isn't generally security-sensitive - someone with nefarious intentions probably isn't too interested in the purpose of Electric Hydraulic Pump 3A! - but the FMS is an exception. I have no interest in helping some Mohommed Atta wannabe navigate their way to Washington DC, so I'll confine myself to theoreticals rather than a detailed walk through of the FMS' functions.
The Flight Management System in the JungleBus is manufactured by Honeywell and is an integral part of their Primus Epic integrated aviation system. To light plane pilots, the Primus Epic is most analogous to the Garmin G1000 system. It covers a great many of the features in the JungleBus' cockpit: the flat panel Primary Flight Displays, Multifunction Displays, Engine Indication & Crew Awareness System (EICAS) Display, the trackpad-like cursor control devices, the autothrottle, flight director/autopilot, FMS units, communication radios, ground proximity warning system (EGPWS), and Multifunction Control Display Units (MCDUs). Because all these components are so interrelated, it's hard to delineate exactly where the FMS ends and another component begins.
Many of the Primus Epic's components are visible in the above photograph - but not the FMSes. They reside in the belly of the airplane, in several Modular Avionics Units (MAUs). The identical boxes on the forward portion of the center pedestal are commonly referred to as FMSes, but they're technically MCDUs. The MCDU is the pilots' only interface with the FMS. On some airplanes, that's all that the MCDU does, so the terms MCDU and FMS became roughly interchangeable. The Q400 is that way; you can actually turn the MCDUs/FMSes off in flight if you want to, and all you'll lose is GPS navigation. On the JungleBus, though, the MCDUs also handle a number of non-FMS functions such as communication and navigation radios, ACARS (Aircraft Communication Addressing & Reporting System), and engine thrust setting selection. The FMS itself has a number of non-navigation functions that are separate on less integrated airplanes. I'm guessing that we use the MCDUs more than any other single peice of equipment on the airplane - including the control yokes! There is no way to turn off the MCDU on the JungleBus short of pulling circuit breakers.
The most basic feature of the Flight Management System is navigation. It's easy to think of the FMS as an overbuilt GPS unit, but GPS is actually only one of the signals that the FMS considers in determining aircraft position. The Inertial Reference System (IRS) also provides input. Surprisingly, the system also automatically tunes and triangulates good old fashioned VORs and DMEs to help determine position. From all these inputs, the system not only determines aircraft position but also calculates its own margin of error, a number known as ANP (actual navigation performance). Most of the time, ANP is less than .1 nautical mile. If ANP exceeds certain parameters for varous phases of flight, or if the two FMSes disagree with each other, the pilots get a warning that navigational performance is degraded. If GPS signals are lost for whatever reason, the system can still do a reasonably accurate job of determining aircraft position using only IRS or VOR/DME.
Navigation is accomplished by entering waypoints into the FMS' flight plan. It uses an internal worldwide database of airports, navaids, and airways that's updated every 28 days. It's relatively easy to make a mistake while entering a flight plan, and this has led to more than one accident in the past. For this reason, the FMS will not actually use any changes to the flight plan for navigation until you go through the second step of activating it. It's standard operating procedure for both pilots to thoroughly review the flight plan before any changes are activated. The Primus Epic makes this easier by displaying the proposed route on the Multi-Function Display as a dashed line. The complete cleared route, including destination and alternate airports, is always entered, reviewed, and activated before flight.
Besides entering the flight plan, the pilots will also initialize the performance function of the FMS before flight. This involves entering speed profiles, cruising altitude, average wind & temperature at cruise altitude, zero fuel weight, and reserve & holding fuel. The FMS automatically gets fuel on board numbers, and calculates time and fuel required to each waypoint. This is automatically updated while enroute, since the FMS calculates current winds aloft and incorporates this into its calculations. The FMS' fuel calculations can easily be checked against the printed flight plan prepared by dispatch. The FMS also has a handy "What-If" performance function where you can check the effect that changing altitude or speed will have on time and fuel required to your destination.
Assuming that the performance function has been initialized, the JungleBus' FMS is capable of not only lateral but also vertical navigation. Wheras the Q400's VNAV was only usable for descents, this one can be used for both climbs and descents. This is particularly handly for RNAV departures and arrivals, where there may be multiple crossing altitude and airspeed restrictions in a fairly short period of time. As long as these restrictions are properly loaded into the flight plan, compliance is as easy as setting the flight guidance panel's altitude selector to the final cleared altitude, coupling VNAV as the vertical mode, and setting the speed selector to FMS. Of course this can lead to complacency, and more than one pilot has busted their clearance by entering restrictions into the FMS improperly or asking the airplane to do something it physically cannot do. You really need to keep a close eye on the magic to make sure it's doing what you want it to do.
Like the Q400, the JungleBus' FMS is approach approved, with the VNAV usable for approach. We can fly VOR, GPS, or NDB approaches using the FMS, with a vertical path on nearly every approach. Interestingly enough, we don't even have an ADF receiver in the airplane to receive NDBs, so we can only fly those approaches if they have GPS overlay. Unlike the newest general aviation boxes, we cannot use LPV minimums - we use the LNAV/VNAV minimums. Given how many major airports with ILSes that we fly to, I don't shoot FMS approaches nearly as much as I did at Horizon.
One feature that the JungleBus FMS handles that's critical to my next post is takeoff and landing speed bugs. These are displayed on both pilots' Primary Flight Displays and are called off by the pilot not flying. The First Officer normally enters the takeoff speeds in the FMS during his preflight flow. He uses the same menu to set the takeoff flap setting, which the takeoff configuration warning system uses to verify that the flaps have been properly set when the thrust levers come up for takeoff. During the same flow, the FO uses another menu to set the takeoff thrust setting; this is technically not part of the FMS, but another MCDU function. One could operate the JungleBus without FMS navigation easily enough - there are still airliners like the DC9 that do it every day - but without MCDUs you'd be in a very unusual situation indeed. This is an important distinction for my next post.
Overall, I think the JungleBus' FMS is pretty well-designed. It's fairly easy to use once you get used to it; the software seems to have been designed by pilots rather than engineers. There are a nice few features that the UNS-1E in the Q400 has that this one doesn't, but the Q400's FMS isn't nearly as well integrated with the rest of the airplane. My chief complaint with the Honeywell unit is that it's awfully slow sometimes; we often joke that they used recycled 286 processors. The VNAV is also rather glitchy; you just have to keep a close eye on it and sometimes use other autopilot modes to ensure smooth transitions.
One final comment is that the FMS that's in the JungleBus is a far cry from the FMS that was in the airplane when I went through initial training. It's the same hardware, to be sure, but the software has gone through several major revisions since then. Whole menus have changed in some cases. The funny thing is that the simulator was one revision behind the airplane even when I went through initial training, which made for a few surprises during IOE. The sim's revision still hasn't changed since then, so when I go back for recurrent it feels like I'm being tested on my historical knowledge of JungleBus software loads!
Subscribe to:
Posts (Atom)
