Wednesday, December 24, 2008

Failure of Imagination

Pilots are trained to trust their instruments, follow accepted procedures, and maintain situational awareness, but these elements don't guarantee safe results. One model of risk analysis and management puts forth the "swiss cheese" model, originally proposed by British psychologist James Reason in the 1990s.

The idea behind the "swiss cheese" model is that safety barriers we use are not perfect. Holes exist in the equipment, procedures and techniques that we use. Rather than having a static position, it's useful to imagine the holes in each safety barrier as constantly shifting. Should a sequence of holes in each of our safety barriers align, our risk has just increased and here's the important part, we may not even be aware of it. When we pilots rely on multiple systems and procedures to mediate risk, we are assuming that multiple barriers will reduce the likelihood that risk will permeate all of the barriers and cause an accident.

With all this in mind, here is the third and final part of the video series on how disaster was adverted by an alert Air New Zealand flight crew.

For GA pilots in single-pilot operations, our first safety defense is a preflight briefing that includes weather information and NOTAMs (Notices to Airmen). The holes in this first barrier are many and may include a lack of surface weather observations at our intended destination or the simple fact that forecasts are imperfect. Another big hole is reading and digesting NOTAMs, which can be a complicated and error-prone process. Deciphering the abbreviations used in NOTAMs is a skill that can require time and practice. Yet if you skip the preflight briefing altogether or just "get the weather," you have effectively taken this barrier out of the picture and significantly increased the risks associated with your flight.

The second safety barrier is the go/no-go decision. Remember that light GA aircraft are much more vulnerable to hazardous weather due to their inherently low performance, slow speed, and lack of weather detection capability. If the preflight briefing suggests significantly nasty weather, stay on the ground. If you gloss over the go/no-go decision and commit yourself to flight, your life could become very complicated, very quickly. If you are loath to stay on the ground for fear that it will make you less of an aviator, get some serious couch time with a mental health professional.

The third safety barrier for GA pilots is a careful preflight inspection of the aircraft. The older the aircraft, the more holes you're likely to find in this safety barrier. I wouldn't be the first person to point out that there is a strong tension between keeping aviation affordable and maintaining safety. Maintenance is expensive and it's no secret that some owners skimp on maintenance. If you have doubts about the aircraft or a piece of installed equipment, especially if that equipment is critical to your flight, the choice is simple - Find a mechanic, find another plane, or stay on the ground.

The last safety barrier is the GA pilot himself or herself and all the intangible elements that each of us embodies. Are you current and proficient? When did you last fly the aircraft type you are about to fly? Are you familiar with the route and destination? Have you been there before? Did you get enough sleep last night? If the flight conditions will be challenging, are you up to the task? Are you prepared for moderate turbulence, heavy rain, a possible icing encounter, or a strong crosswind? Is another pilot going to be flying with you and can they take on some of the load? How about your passengers? If they get scared or airsick, can you handle the distraction? Do you have a plan B and a plan C?

Lack of familiarity with an aircraft's electronic navigation system can contribute to tragic results, as evidenced by the mid-air collision of a Boeing 737 and a Embraer Legacy jet over the Amazon in 2006. If you haven't already done so, I recommend reading William Langewiesche's Vanity Fair article which vividly describes the breech of several safety barriers - appropriate altitude for direction of flight, ATC conflict resolution, Traffic Collision Avoidance System, and crew situational awareness.

An increasingly popular way to handle the risk of complex avionics systems is standardized, recurrent training. This approach emphasizes eliminating errors, procedural violations and variations, or dangerous behavior on the part of pilots. Professor Reason refers to this as the person approach and the main goal is to eliminate variations in human behavior. At its best, standardized training creates another barrier of safety. At it's worst, this sort of training can emphasize heavy-handed, orthodox principals - "Never use the Direct-to button!" or "Always set the heading bug with your right hand!" are just two examples. I respect and appreciate standardized training, but standardized procedures can't cover every eventuality. That's where imagination comes in.

Imagination allows pilots to conceive of where they are in space, what they need to do next, and how certain choices or changes might affect the flight. At its worst, imagination can lead pilots to make incorrect assumptions to incorrectly explain something that doesn't seem quite right, as seen in the video above.

Flying in moderate or greater turbulence can be distracting, especially during an approach to landing. Assuming a pilot understands the effects and dangers of windshear, I encourage them to imagine how they'd fly the plane in smooth air and then do their best to make what is happening in real-time match up with their idealized flight. This use of imagination gives the pilot a specific outcome to strive for, rather than being at the mercy of the elements. Imagination can backfire, too. A few years back, I flew with a very intelligent pilot whose quick thinking and imagination sometimes led him to jump to incorrect conclusions and talk himself into all sorts of situations.

The G1000 provides an excellent example of a system intended to improve pilot safety through increased situational awareness and navigational accuracy. Used properly, the G1000 can provide exactly what it advertises. Yet the G1000 is it not particularly easy to use. It requires thorough initial training to gain proficiency and more than just occasional use to maintain that proficiency. In my experience, GA pilots who fly infrequently or on an irregular schedule are more apt to become confused or task saturated when using the G1000.

Hard to use systems, with numerous options, and several ways to accomplish the same function may seem flexible, but just as often the multitude of options simply increases a pilot's workload, effectively increases the number of holes in what is supposed to be a safety barrier. At critical phases of flight, poorly designed systems can lead to task saturation as the lone pilot tries to figure out "Why is it doing that?" or "How do I get it to do what I want?" Standardized training alone will not solve this problem.

This brings us back to imagination. A good pilot can imagine all sorts of possible problems that could scrub a flight or make a flight more difficult to complete. Imagination helps us consider a situation where we're behind the plane or where the GPS doesn't function properly. Imagination helps us realize that we might not be proficient, that we need some recurrent training. I'm all for optimism, but a pilot who always assumes everything will be just fine suffers from the worst possible lack of imaginiation - the kind of imagination that can keep all those holes in all those barriers from aligning.

Friday, December 19, 2008

Levels of Paranoia

All instrument approaches provide pilots with course guidance either to a runway or to a point near an airport or runway, but the ILS gives pilots left/right course guidance and descent guidance (glideslope). An instrument in front of the pilot or flight crew basically has two needles (the actual format varies), one vertical needle and one horizontal. The pilot or flight crew adjusts their heading to keep the vertical needle centered and the descent rate to keep the horizontal needle centered. Keep both needles centered, and the ILS takes you right to a runway.

Specialized versions of the ILS can be conducted by authorized flight crews in conditions of virtually no runway visibility, though a 200 foot ceiling and a half a mile of visibility are standard minima for us mere mortals. There used to be a few LDA (Localizer Direction Aid) approaches that provided a glideslope, but the only one I know of that still exists is the LDA RWY 6 approach into Roanoke, Virginia and it doesn't exactly take you right to the runway.

A lot RNAV approaches, many of them less than a few years old, provide vertical guidance in appropriately-equipped aircraft. RNP approaches exist for specially trained air crews that also get down pretty low. But when you need to get to the runway in really crummy weather, the good old ILS is still the gold standard for most pilots. But things can go wrong on an ILS and pilots need to be paying attention and prepared. I recommend you watch this two-part video. Together they are about 20 minutes long, quite thorough, and valuable, I think. If you're short on time, the second video makes the point on its own.

A question I frequently hear as an instrument instructor is "When can a pilot intercept the glideslope on an ILS approach?" My answer is always "When at all possible, from below, at glideslope intercept altitude." This is a good, though not completely infallible way to verify that things are as they should be on the approach. On FAA instrument approach charts, the point of glideslope intercept is depicted on the profile view as a lightning bolt style arrow. For many ILS approaches, the profile view looks something like this.

The glideslope intercept altitude for this particular approach is 1500 feet and the lightning bolt shows that glideslope intercept is slightly before the Maltese cross that represents the Final Approach Fix (FAF) and the altitude over the FAF (a VOR in this case) should be 1493 feet. Technically, the FAF on an ILS approach is where glideslope intercept occurs but I've always thought that to be just a bit of academic trivia. The Maltese cross is the FAF for the purposes of timing the segment between the FAF and the missed approach point. If you were flying just the localizer portion of the approach with the glideslope inoperative for some reason, the FAF is the Maltese cross. On some approaches the Maltese cross and the lightning bolt are the same point, but just as often they are not.

Some ILS approaches, like the ILS RWY 22L at Sacramento Mather, have step down fixes before the final approach fix and this is where pilots ask "If I can receive the glideslope before descending to the glideslope intercept altitude, can't I just start following the glideslope at that point?" Before trusting your life to an ILS glideslope, there are limitations to keep in mind. The gray feather shown on the profile view depicts where glideslope should be reliable. You may be able to receive the glideslope much further out, but I'd treat those indications with skepticism.

There is no preflight test for the aircraft's glideslope receiver that a pilot can perform. Several miles before the FAF, you should verify that the localizer display is not flagged. A few miles before the FAF, verify that the GS is not flagged, too. As you saw in the videos, this is not always a guarantee that all is well.

The videos point out that reception of a valid Morse code ID for the localizer does not mean that the glideslope portion is operational and functioning properly. ATC should know if the glideslope is inoperative and if so, your approach clearance should sound like:
Barnburner 123 is three miles from FIDO, fly heading 330, maintain 3000 until established, cleared Mooselips ILS 30 approach, glideslope inoperative.
Pay special attention to NOTAMs during your preflight briefing that mention any component of an approach (including DME) being unmonitored. "Unmonitored" means that for some reason, ATC will probably not be able to determine the health of that component in real time and warn you if it's misbehaving.

A recognized problem with intercepting the glideslope from above is the presence of false glideslopes. These false slopes are quite steep and should be easy to recognize as erroneous, but a coupled approaches in that situation could provide a pretty wild ride until you figured it out.

Though rare, false glideslopes below the normal slope can be caused by a coating of snow of the just the right thickness and moisture content on the ground off which part of the glideslope signal is reflected. There was an excellent article about this in IFR Magazine a few years back (a brief disclosure - I'm a semi-regular contributor to IFR Magazine). And you can read this accident report concerning a Piper Cheyenne that hit a power pole and crashed short of the runway with (according to the pilot) the glideslope and localizer needles centered.

On a check ride, the ATP and Instrument Rating Practical Test Standards contain the same criteria for the examiner's evaluating a precision approach:

"Establishes a predetermined rate of descent at the point where the electronic glide slope begins ..."

The "Instrument Flying Handbook" says:

"Pilots should pay particular attention to the following approach chart information: name and number of the approach, localizer frequency, inbound course, glide slope intercept altitude, DA/DM, ..."

While my reading of this wording does not necessarily preclude intercepting the glideslope from above during a descent, I like to see pilots in light aircraft reach the glideslope intercept altitude a mile or so before the designated glideslope intercept. Several important tasks need to be accomplished just before the FAF and getting to the intercept altitude promptly gives you plenty of time to have the aircraft configured and stabilized.

Pilots who want to ride the glideslope down from an altitude above the GS intercept altitude usually do so, in my experience, because they are behind the aircraft. There, I said it! They are late appropriately configuring the aircraft or are behind ATC's game plan. When you are pressed for time in a single-pilot environment, you are less likely to be able to detect if something is wrong and staying ahead of the aircraft is critical.

Flying the ILS RWY 22L into Mather, here's how things would look beginning the descent to the step-down fix YOSHE. Note that we've set the #1 bearing pointer to display the GPS course, which will come in handy later. We've also engaged the autopilot to fly the GPS vertical track, which the G1000 provides until we get close to the FAF. More on that later, too.

Setting the #1 bearing pointer to the GPS lets you verify the localizer course is accurate and the bearing pointer's distance to the current waypoint (approach fix) can help you detect abnormalities in an otherwise normal looking glideslope.

As we begin the descent from YOSHE to GADBE, we'll need a fairly high rate of descent to arrive at glideslope intercept altitude a mile or so from the FAF (which also happens to be the point where glideslope intercept should occur). This is a good time to synchronize your heading bug with your current course and put the autopilot into heading mode. Many autopilots will disengage NAV or APR (approach) mode if the navigation source it is tracking is changed. With the G1000, you'll need to switch (or the G1000 will switch automatically) from the GPS to the localizer, so you can nip this in the bud by engaging heading mode. You can then program the autopilot to begin a rate descent.

Since your goal is to get below the glideslope, but not below the intercept altitude, the rate of descent will need to be higher than normal. The descent rate to stay on a 3 degree glideslope can be approximated by multiplying your groundspeed in knots by 5. So at 110 knots a descent rate of 550 feet per minute would keep us on the slope. To get to the intercept altitude and intercept the glideslope from below requires a higher rate of descent (try ground speed times 9 or 10) and this will result in a temporary indication of being below glideslope.

Leveling off at the glideslope intercept altitude requires the restoration of POWER and/or re-trimming the aircraft, something many pilots seem to forget. As the glideslope comes in from above, extending the landing gear should provide a stabilized descent with minimal power adjustment or trim input.

Here's what it would look like at glideslope intercept altitude, one half dot below the glideslope, at the point where gear extension and the Before Landing checklist would be performed. At this point we should again verify there are no flags, the glideslope altitude matches the altitude depicted on the approach chart, and that the GPS bearing pointer and the localizer course are coincident. Any of these being parameters being out of whack should result in a missed approach. If everything looks good, you can engage the autopilot in approach mode to capture the glideslope.

I recently worked with Hamish in an FAA-approved G1000 simulator and we decided to try the Roanoke LDA RWY 6 approach. In the process, we discovered something interesting: The G1000's GPS depiction of the approach course didn't match what the simulator had for the localizer. The #1 bearing pointer was set to the GPS, it gave a very clear indication that didn't agree with the localizer course, and Hamish caught it immediately at the FAF. Turns out this was a simulator bug, but it illustrates the value of using the GPS as a back-up to the localizer.

Descending on a standard 3 degree glideslope, check your position relative to the GPS missed approach point. At a mile or so to the runway threshold, you should be about 500' above the touchdown zone elevation for an ILS with standard 200' minima. Not all ILS are created equal and some have higher visibility and decision height requirements, so read the fine print carefully. Some approaches have interesting notes, like these below. HUD stands for Heads-Up Display and FD for Flight Director, by the way.

I'm often asked why an approach like the Monterey ILS RWY 10R would say that coupled approaches are not authorized. The answer is that the when the FAA flight check crews test flew the approach, they found variations that they thought some autopilots might not handle very well.

The keys to a safe ILS are to stay ahead the airplane (and the autopilot), intercept the glideslope at the appropriate altitude (preferably from below), cross check the localizer course against your GPS (even a hand-held GPS is better than nothing), perform a sanity check on your altitude at the FAF and a mile or so before touchdown, and carefully read the fine print on the approach chart.

Monday, December 15, 2008

Turbulence Ahead

You don't have to look far these days to find people whose primary and exclusive motivation in life is self-interest. In the US, we are constantly bombarded by reports of greedy individuals who seem to require millions and millions of dollars every year to support their lifestyles. And once they acquire significant wealth, it's still not enough.

I'm all for encouraging people to be self-reliant, but instilling future generations with a desire to take care of themselves and their families need not preclude an appreciation and respect of shared needs and interests. There's nothing like an economic downturn to help people realize how interconnected we all are: If large numbers of us fail to prosper, everyone suffers. We may try to hide, figuratively by ignoring what is happening, or literally by living behind walls and gates, but we're better off facing facts.

It doesn't take an economic downturn to help one realize that general aviation is a ridiculously impractical activity. We spend a lot of money to create aircraft that will safely get us airborne. Then we spend a lot of money acquiring those aircraft or gaining access to them. Some of us spend even more money, along with a lot of time and effort, to learn how to fly those aircraft. The aircraft themselves consume a lot of our time and energy. They make a lot of noise, sometimes for the purpose of travel but often times for the sole purpose of just getting us up in the air.

For all its warts, general aviation is one of the few remaining activities in contemporary society where people come together out of shared interest. Trying to fly on our own is just not economically feasible for most of us. We join flying clubs or rent aircraft as way to disperse the cost and in the process, we get the opportunity to fly and to mingle with other pilots. Aviation draws people together who often have very little in common. We may have different views on life and were it not for our love of flying, we otherwise would not have come in contact. And yet that is precisely what a community is: A group of people with diverse views who cast their lot together to make a better life, not just for themselves, but for everyone in the group.

The effects of the economic downturn have not been lost on general aviation. The effects have been probably greater on general aviation than other sectors precisely because the activity is so implausible to begin with. Fewer people are flying fewer hours. Many pilots I know are trying to walk a fine line between saving money and maintaining currency and proficiency. The good news is that the price of avgas has dropped dramatically and that helps a little.

My own situation was made worse by the recent loss of my medical certificate, which has significantly reduced my teaching schedule by limiting the kinds of instruction I can provide. On a positive note, I received official notification from the FAA medical certification folks that I may reapply after a one year waiting period. And for those who have been wondering, I feel fine and all signs point to my problem as being a one-time freak event. My thanks to the folks at Virtual Flight Surgeons, Inc. for their assistance in facilitating the entire process. Two months down, ten months left to go.

As a professional flight instructor, my future has always been a bit uncertain. I'm already being challenged by this double-whammy of temporarily losing my medical right when an economic recession has unfolded. Some of my friends just assumed that I'd throw in the towel and look for a non-aviation job. I've been providing a lot of simulator training and am fortunate to have a few commercial pilot candidates and some flight instructor candidates, too. So my plan for the future is to stay the course.

Tough times can bring out the best in us, or the worst. A lot depends on how we approach the challenge. Flying in turbulence or bad weather can stress even the most accomplished pilots and in that stress, we learn about ourselves. We might not like everything we discover, but stress often reveals the kind of cloth from which we are cut. If we acknowledge and recognize our shortcomings, there is much we can learn. We might even discover that we're more resilient that we first thought, that we can live without a new car every few years, or many of the other trappings our consumer society tells us we absolutely must have.

I know that many people have lost their jobs or are worried about losing their jobs. I have friends who are working reduced hours and taking pay cuts. While things will undoubtedly be tough, life will go on. I'm optimistic that we will come out the other side of this economic storm. In the mean time, we have the opportunity to learn once again that in a country that idolizes the individual, we are more together than the sum of our parts.

Tuesday, December 09, 2008

The Changing Aviation Landscape

Don Brown has an interesting post on the hassles that aerial survey flights can create for ATC. He also touches on the hassles of direct, off-airway routings. I thought about posting a comment, but didn't think I could get my points across in 300 words or less, so ...

Don's first observation is how much of a pain aerial survey flights can be for controllers. I've flown a number of survey flights and let me tell you, they are a pain for the pilots and camera operators, too. I'm sure working these flights as a controller is tedious, but imagine the concentration required to maintain altitude +/-20 feet and course within 10 meters for hours at a time. Add to that the problems created by turbulence, an occasion cloud shadow, the odd traffic alert, camera malfunctions, and a mapping site located smack-dab in the middle of an arrival path for two major Bay Area airports. It's clear that no one is having fun.

Aerial survey flights are a lot of work for everyone involved, starting with the GIS person who lays out the job. During my survey flying, I've been fortunate to have received excellent and understanding service from the controllers in Northern California as well as from airline crews that had to alter their course or altitude while we bored holes in the sky, back and forth.

I had one mission that involved a bunch of east-west lines right over the top of Travis AFB and the Travis Alert Area. The controller did a pretty good job, but he kept asking what we were doing and which direction we were going. I explained at least three times that we would be flying east-west lines, gradually working our way from south to north, but he couldn't visualize it. I tried explaining it different ways while simultaneously flying my photo lines. It was distracting, but I finally managed to word it in a way that he understood. Or maybe he just gave up trying to understand?

I'd say any sort of training that helps controllers appreciate aerial survey missions is probably a good thing. One silver lining during that Travis flight was that someone reported hearing an emergency locator transmitter (ELT) signal and I began monitoring the guard frequency on our second radio. As we went back and forth, I was able to give the controller a pretty good idea of where the signal was strongest.

On the subject of direct, off-airway routings, there are several problems the FAA needs to address. It's obvious that the aviation navigational landscape is changing and the ATC system is not providing pilots and controllers with enough tools to keep up with the changes. Here are just a few examples:

Any pilot who uses a GPS receiver knows that the FAA's way of identifying airports on charts with three-character identifiers is ambiguous, especially when there is an airport and a VOR station with the same name. This could be solved if the FAA would just use four-character ICAO airport identifiers on the charts they publish. That way, pilots and controllers would have a better idea of when they were referring to, say, the Santa Rosa Airport (KSTS) versus the Santa Rosa VOR (STS).

The FAA has started to create routes specifically designed for RNAV-equipped aircraft. T-routes, Q-routes, and GPS MEAs on established airways are all steps in the right direction. But T-routes and Q-routes mimic the old Victor airway paradigm and don't really address random, off-airway routings.

The section 5-1-8(c) of the AIM has specific suggestions for pilots who wish to file direct routes between VORs and off-airway routings. It briefly explains how you can file VOR to VOR or use off-airway routings. One requirement is that an off-airway route must contain at least one waypoint within each Air Route Traffic Control Center (ARTCC) through which the flight will travel, but I imagine from a controller's perspective this can be like finding a needle in a haystack.

The AIM explains that you can use latitude and longitude coordinates to specify off-airway waypoints, but lat/long is a pain for pilots and controllers alike. Just yesterday I had an instrument pilot show me his DUATS-generated IFR navigation log, which contained a couple of automatically generated lat/long waypoints. When he asked me how he would go about entering them into his Garmin 530W, I cringed. I thought about delving into how you first need to create a user waypoint and then enter the latitude and longitude, a digit at a time, but there is need to know and nice to know. User waypoints defined with lat/long is not a need to know item, in my opinion.

Pilots need to do some careful pre-flight planning to be sure their direct route stays at least 3 miles from restricted and prohibited airspace as well as military operation areas (MOAs). APOAs new Internet Flight Planer is definitely a step in the right direction. Using it, pilot's should be able to layout direct, off-airway routings that meet all the requirement specified in the AIM. But what about controllers? What tools do they have?

A big problem with off-airway routes is that these routes are often hard for controllers and pilots to understand and visualize. As Don correctly points out, who the hell knows where lat/long fix 3217/8326 is actually located? Without some known context, a landmark, an airport, or a VOR, it's just a string of numbers. It seems to me that controllers would benefit from a tool or feature that would allow them to quickly resolve an unfamiliar airport identifier, fix, or lat/long waypoint to a position on their radar screen. I remember sitting next to an ZOA controller during a facility tour several years ago and seeing how he could select an aircraft target on his screen, press a button, and see that aircraft's projected track. Wouldn't it be cool if a controller could select a target, press a button, and see the aircraft's current IFR routing appear on their screen? Maybe this feature already exists, but based on what I hear controllers say, I doubt it.

The more things change, the more they stay the same. I wrote a while back about how ATC's automation often can't accommodate flight plans with RNAV, off-airway routings. It seems that most controllers don't even know which targets on their screen are RNAV capable. Pilots often have no choice but to accept a clearance and, once airborne, begin asking the controller for a shortcut, reminding or informing the controller that they are RNAV-capable.

Pilots and controllers live in intersecting, yet different worlds. Most pilots don't fully appreciate the constraints under which controllers operate, the rules and procedures they need to follow, and the complexities of managing a bunch of aircraft traveling different directions at different speeds. Controllers often have a hard time understanding the operational constraints that pilots face, too. And the primary way these two worlds communicate with each other is through a half-duplex radio system. Given all this, it's amazing that things work as well as they do.

Wouldn't it be nice if someone came up with a way to reconcile some of the differences between these two worlds? I'm not touting NexGen, I'm interested in hearing what my readers have to say. What features or tools do you think are needed for the new aviation navigational world we seem to be entering? What do you think would help GA pilots?