Monitoring the standby ADI at critical phases of flight

[Centaurus]

Flight International 3-9 January 2017 described conflicting indications on the captain's and co-pilot's artificial horizon which led to spatial disorientation and fatal crash of a Bombardier CRJ 300 freighter on 8 January 2016.
A defect in the captain's primary attitude indicator caused it to show a rapidly increasing nose up attitude while the aircraft was in level flight at night at 33,000 feet.

Swedish investigators said the apparent increasing pitch on the captains ADI probably led to an "instinctive reaction' to counter the unusual attitude.
Although the aircraft exceeded 500 knots on the descent the CRJ did not break up in the air. Recorder information showed a shift in the elevator towards a nose-down position and the autopilot disengaged automatically. The recorder also revealed the horizontal stabiliser was moved manually using the left hand control column for 19 seconds in the nose-down direction.

The CRJ would have been fitted with a standby ADI as an "umpire" between the two primary ADI's. At the risk of being wise after the event one could argue that a quick comparison between the standby ADI and the two primary ADI's may have prevented the accident; yet the article fails to make this point. I wonder if the investigators had thought about this?

In simulator training it is rare that scenarios are introduced where more or less instant use of the standby ADI is required. While flight on standby flight instruments in the simulator may be tested during an IPC it is usually after the introduction of failures to all generators and where quite complex non-normal checklist actions are called for.

The standby ADI is rarely monitored as a cross check in normal flight on instrument approaches and this can lead to pilot complacency. From personal experience during black night departures from Pacific atolls in Boeing 737's, where one was on instruments from initial rotation, this writer developed the habit of closely monitoring the operation of both the primary ADI and the standby ADI, until safely established in the climb away.

In fact, monitoring the operation of the standby ADI should be part of normal instrument scan. However, with accent placed in many airlines on following primary ADI flight director indications once rotation is commenced and thus instrument scan is reduced to basically the FD needles to the detriment of other flight instruments, it is no wonder that general monitoring of the standby ADI is considered by some as unnecessary. Good airmanship would suggest otherwise.

[dixi188]

Does the CRJ-300 not have a comparator system to give a warning of ADI miss match of displays?
Warning comes on, check standby, cover bad ADI with piece of paper.
All the aircraft I've come across since the BAC 1-11 era have had one.

[alf5071h]

"... monitoring of the standby ADI is considered by some as unnecessary. Good airmanship would suggest otherwise."
Whichever view is favoured, it is chosen with hindsight.

Where would a requirement to monitor the standby instruments come from?
Certification mandates that a difference between the main instruments must be identified by a comparator - the monitoring function. Also that the combined failure of the attitude display and comparator must be extremely remote; thus the crew could have confidence in an alert and be trained to respond when given. However due to a system discrepancy, design or failure, the alerting function in this accident was removed shortly after the IRS failure.
This aspect and related issues were discussed at http://www.pprune.org/rumours-news/572882-crj-down-sweden-13.html#post9606976 and onwards to the end of the thread.

Taking 'a crew should monitor' view, then the crew would be required to deduce a failure where the automatic function could not - compare that with AF447 ADC malfunction.

A danger of hindsight is that specific issues in rare, highly salient accidents, are chosen for urgent safety action, but may not actually achieve the expected improvement.
The CRJ accident report recommended more training, new calls; the effectiveness of which was discussed in the link above with reference to the startle effect - automatic reaction, limited ability for 'rational' thought, and possible repeating surprise. Also consider any effect of recent LoC training - immediate nose down change in response to any pitch up.

Similarly, in choosing the need to monitor the standby ADI; why not the standby ASI, Altimeter, etc. The hazard in this is increased workload, perhaps beyond what has been assumed by certification and operational training requirements, thus exposing the crew for new opportunities for error.

This is indicative of a highly reliable industry, where a rare highly visible accident demands the need for urgent safety reaction, but where the intervention may do more harm than resolve very difficult combinations of contributing factors; particularly where alternative action is available.

Systems reliability could be improved, or at least achieve that required by certification; again compare with AF447 - fix the pitots tubes, and in this accident - fix the monitoring system, also in the 737 at AMS - retrofit the latest standard of Rad Alt (self monitoring).
Also see the recent incident involving an unmonitored enhanced vision display and rad alt in a PC21 (Investigation: AO-2016-064 - Synthetic vision display error involving Pilatus PC-12, VH-OWA, Meekatharra Airport, Western Australia, 18 June 2016 (http://www.atsb.gov.au/publications/investigation_reports/2016/aair/ao-2016-064/)).

The industry should not choose the easy option of human intervention, more training, procedures, or call outs as a solution for complex problems, particularly where the human can be the weakest link - especially in monitoring.

Why not improve the equipment - cost? Not necessarily so, modifying a few aircraft in comparison to training all pilots, and with less assurance that the crew will monitor vs the ability to react to an alert.
Willingness to improve safety?
Perhaps this dilemma is the new challenge for a highly reliable industry; but first do no harm.

[Centaurus]

Whichever view is favoured, it is chosen with hindsight.


Well argued points of discussion alf5071h
The lift off and initial climb in IMC and/or night requires a high level concentration on the ADI. Most pilots will never have experienced a sudden failure of the ADI in their flying career especially at night and the momentary total disbelief that this is for real. While safety features such as comparators warn of a problem, it takes time to sort out which instrument is faulty and at low altitude there is no room for a delayed or faulty diagnosis.

Pertinent call-out's are fine but not all PM's are quick to first detect and call a problem; especially if their attention is momentarily elsewhere such as monitoring gear or flap retraction during IMC.

Glancing at the primary and standby ADI's together during those critical moments of initial rotation and climb out is nothing more than a simple precaution that both should read the same rather than rely on a comparator system or a sharp PM.

[plhought]

What's a CRJ300?

[galaxy flyer]

Maybe lucky for me, but my USAF instructors always taught to "check the standby" before reacting. I've done several recoveries and approaches using the standby in the sim.

[Amadis of Gaul]

Actually, we had a similar scenario in the SIM long before this accident. Crosschecked with the standby and landed no sweat.

[flyhardmo]

Alf
I think the point Centaurus is making is not the requirement (in the regulatory sense) to monitor the stby instruments but good airmanship to use what's available on the flight deck and confirm that what you are seeing is correct. In the bad old days when you trusted nothing, it made good sense to cross check information to spot errors and avoid undesirable situations. Have we as pilots been lured to the other end of the spectrum where we put absolute trust in a fault detection system and discount our old cross checking habits? Who is fault detecting the fault detector?

[alf5071h]

'Airmanship' depends on definition; individual interpretations, goals, standards, etc. This involves judgement, yet judgement is embedded in airmanship, like expertise; what is expertise ... what is knowledge, good awareness, ... ad nauseam.

If we are to use whatever is available then this too depends on judgement - in context. The danger is that without central explanation individual choice will result in differing standards of effectiveness and the risk of creating further (unseen) problems. Explanation does not imply regulation, but at least an acknowledging the assumptions in the fundamental 'rules' of our industry; see comments on abnormal drills below.
Humans are very very poor monitors, that's why we choose to protect systems and automate cross monitoring as far as possible - a judgement in certification.

We assume that the crews will be able to apply good sense, but if rare and surprising situations result in startle, then the crew may not react as anticipated. Reduced cognitive resource limit the ability to choose to look at the standby instrument or make calls; unforeseen (subconscious) actions can dominate.

Our assumptions are flawed:- 'Startle' http://www.icao.int/Meetings/LOCI/Presentations/Managing%20Startle%20Individual%20Crew%20and%20Organizationa l%20Strategies.pdf
'... an appraisal that a situation is threatening and is beyond the immediate control of the individual'
'... significant impairment in information processing for up to 30 seconds.
... tasks such as attention, perception, situational awareness, problem solving and decision making can be markedly impacted. Communication is often disorganised and incoherent for some time'.

Training to minimise the effects of startle is difficult, but with thought it should be possible to influence subconscious reactions, e.g. revise abnormal drills for a comparator alert to first use the standby instruments opposed to diagnose the abnormality: first fly the aircraft ... then manage the situation.
As much as the human may have 'failed' (been limited) then so too did the technical system. The technology did not meet the assumptions in the specification, yet there is no specification for the human; so why should we conclude 'human failure' - improvement required.
In reality both the human and technology were limited (the detector of faults and the fault detector), except that technology could be improved at least to the specified standard; not so the human.

[megan]

Does the CRJ-300 not have a comparator system to give a warning of ADI miss match of displays?dixi, yes it does, but note its limitation in the aircraft, and the difference from the simulator. From the accident report.

The declutter function means that only roll and pitch angle is displayed on the attitude indicator part of the PFD units during unusual attitudes. This meant that the comparator monitor indication disappeared from the PFD 1 and PFD 2 at an early stage of the sequence.

The purpose of clearing the PFD units from unnecessary information, and thereby providing the pilots with a better display of the situation during unusual attitudes, is easy to understand. It is however more difficult to understand why indications related to instrument errors are removed.

It is possible that such an indication could have helped the pilots to identify the erroneous PFD display. Furthermore, there is a delay of more than 1 second between the caution message and the associated single chime. In case of multiple cautions and warnings, the audio alerts may be desynchronized with the visual messages, causing confusion in the flight crew’s troubleshooting.

Furthermore, as the system does not know which PFD displays the correct parameters when EFIS COMP MON triggers, no declutter function should be automatically performed in this case to avoid the removal of information useful to troubleshoot the situation.

SHK considers that the decluttering of the caution indications on the PFD displays during unusual attitudes is a weakness in the system design.

The simulator flight performed by SHK proved that the comparator caution was not removed from the PFD during unusual attitudes in the simulator.

Training experience with comparator cautions displayed during unusual attitudes might contribute to trust in a decluttered faulty attitude indicator.

System discrepancies between a simulator and the aeroplane mean that the quality of flight education and training is downgraded. This is particularly true during unusual attitudes and other malfunctions that are not normally trained in the aeroplane.

[AerocatS2A]

Surely a normal instrument scan would have picked up that something was wrong (nose up with speed increasing, altitude unwinding, VSI indicating a descent... hmmmm...). Then once you've been clued in to a problem you can check other instruments. (I wonder what the FO's ADI looks like? Hmmm... shows nose down. What does the standby look like? Hmmm... it shows nose down as well.)

That process shouldn't take very long at all, and probably should've happened within seconds of the initial climb showing on the faulty ADI. In short, I don't think routine monitoring of the standby is necessary. What is necessary is having a good overall picture of what the aircraft is doing, in other words, one mustn't allow one's self to be a numpty in charge of a high performance jet.

[PEI_3721]

Aero, you appear to overlook the effects of startle; crew impairment for up to 30 sec, unconscious fight-or-flee reaction, and confusion.
In addition to the link given in #10, see the Australian research into startle at http://www98.griffith.edu.au/dspace/bitstream/handle/10072/54072/82496_1.pdf?sequence=1
Also consider that having acted to 'restore' controlled flight, any reversal of the decision requires much greater evidence and time for deliberation; i.e. is more difficult to change you mind after acting because you have to understand why your action is not working in addition to understanding the 'situation' which required it.

The FO could have been just as startled. The startled Captain acts according to his ADI; the FO is startled by the Capts action in comparison with his ADI, perhaps questioning the accuracy of his (the FO) display. Such confusion takes time to resolve; add to that an unexpected overspeed alert, an apparent need to roll, and confusion reigns.

Startle, together with illusion and disorientation, are significant threats to human performance. Both crew members can be affected simultaneously; thus a core safety concept of cross monitoring is invalid.

Pilots are not 'numptys', but the effects of startle can give the appearance of such behaviour; it just human.

P.S. Another version of the research. https://flightsafety.org/asw-article/pathological-reactions/
Note the lead authors aviation credentials.

[Centaurus]

Aero, you appear to overlook the effects of startle;

IMHO "Startle factor" is just another buzzword to excuse any cock-up by the pilot where quick thinking was required.

We all get startled occasionally; but hopefully for not long enough to make gross errors such as this event. In our profession there are very good pilots as well as those of far lesser skills; particularly when it comes to instrument flying. It is when the chips are down that those of us saddled with far less instrument flying skills, are more likely to react hastily and occasionally fatally.

[misd-agin]

Read the United Airlines 757 incident descending into Birmingham, UK.
Reacted instead of 'wind your watch' and taking a moment to scan all the instruments.

Push over in the Swedish crash lasted for 19 seconds. When have you ever pushed forward for 19 seconds?

[RAT 5]

Startle factor: It is not meant to be taken lightly, but I was always taught that when there is time & height to spare "sit on your hands" for a few seconds. I'm not talking of 'unusual recovery techniques, but more the WTF is my PFD telling me? type moments. If it suddenly shows a huge pitch up, or down, or roll left/right your backside should be tuned in. If that hasn't reacted then perhaps the PFD speaks with forked tongue. Then you can analyse all the instruments to work it out and act accordingly. Easy to say, I know, but rushed/panicked reactions are often not the correct response. I'm thinking back to aerobatics when you feel you are inside a washing machine: let it all go and let the a/c start to sort it out. Hence having lots of space below you if practicing. Rushing into rapid reactions at CRZ FL might not be the best solution. SBY's are there to help when they are needed, but are not primary.

[alf5071h]

Advice like 'sit on your hands' etc, generally requires a conscious choice, its another context sensitive judgement, which startle may degrade.
It might be possible to train pilots for some subconscious inactivity, but this could conflict with situations which require quick action.

Systems safety partly considers this with different levels of alerting, red, amber, etc, and to a lesser extent in abnormal drills. However, both of these depend on interpretation of what is required and when to react, it depends on training, and how a pilot perceives a situation - the real context, not that imagined by regulation or trainers.

The reliability of the wider technical 'system' (man machine environment) has also improved, so too the ability of components to self-check, thus reducing the generation of misleading information (weaknesses in this accident, PC12, AMS 737, MAD MD80 takeoff config).
There has been some improvement in human interfaces by providing advanced warning of hazards or system degradation - strategic awareness vs tactical decisions; GPWS - EGPWS, wind shear alerting - predictive systems, hard failure vs alternate or reversionary control modes, stall warning vs push.

However, there are fewer advances in comparator systems which remain at the triplex, dual-dual standard, (a factor in this accident and AF447). This is not a technical problem, but more the choice in certification specification; it's where the regulators draw the line of safety, 10^-x.
Conversely the operational regulation continues to promote pilot responsibility for safety, 'pilots are not expected to fail'; this is neither reality or achievable. This belief promotes the old view of human error, blame the human, more training possible; or even an attitude of resignation - 'what more can we do, we are safe enough'.
The industry is unable to provide an acceptable boundary for pilots' contributions to safety; instead it is sidelined to another judgement of 'good enough', but this is difficult to judge particularly if the boundary of human performance is unknown, or worse still believing that humans should not fail.

There are few opportunities for improving a highly reliable industry; existing methods are limited by cost or judgement of the required level of safety.
Cost-reliability might favour more automation, but this could reduce the valuable human ability to adapt.
Advancing technology could improve monitors and cross comparison - focusing automation on those aspects of human weakness, but this implies revised certification or checking that the assumed levels of reliability are being achieved (this accident).
Resistance to startle implies improved knowledge and experience - don't rush; and a better understanding of risk and risk assessment - assumptions in certification - reducing perceived fear.

All of the above require some change in the way in which we think about safety, particularly how investigators and regulators view human performance.
Many of the views above suggest otherwise, with the risk of little or no safety improvement.

[Intrance]

Just as some more info, the pitch comparison fail in that CRJ crash should have also showed an "EFIS COMP MON" caution message on the (EI)CAS, making it even more tragic that the flight ended up the way it did. Whether is was filtered from the PFD in declutter mode or not, they would still have a nice yellow message displayed. If I recall correctly, this is never mentioned in the report.

If anything, that crash should teach us all to take the extra second and gather information from ALL resources for a moment... That means not only standby ADI but do a quick crosscheck between both PFDs and check the damn (EI)CAS.

Yes yes, surprise and startle is a factor and this is all hindsight. Not here to appoint blame, just pointing out there is something to learn and to mash into your mind... Take the extra second.

[Onceapilot]

I am sorry for the crew. However, this type of important instrumentation failure should be safely handled by any IFR qualified crew in similar circumstances. IMO, something was lacking in this crew's training and qualification that led to a shortfall in competence. Sad.

[megan]

The industry is unable to provide an acceptable boundary for pilots' contributions to safety; instead it is sidelined to another judgement of 'good enough', but this is difficult to judge particularly if the boundary of human performance is unknown, or worse still believing that humans should not fail.When measured against the aviation 10^-9 criteria I wonder where pilots fit. Sort of a MTBF if you will. Personally I reckon they do a pretty good job.

[PEI_3721]

An interesting discussion. Perhaps problems of human behaviour need a compromise solution.
Both forms of safety intervention are required; pilot training as far as is reasonable for cost and effectiveness, and a review of the equipment and operating conditions. A broad front of small changes to improve safety.

M, "Humans do a pretty good job", yes but the whatever enables the good performance can also result in 'pretty good mistakes'.
Humans are variable; we need to reduce variability, or shift it to the good side of the line.
We need to be adaptable, but not too adaptable.
Encountering such dilemmas suggest the need to reduce emphasis on training the human and consider more how technology and operating conditions influence behaviour.
Is there a solution, is there any way to improve without blame and train; can we afford to make small changes and see what happens. Or do we continue with hindsight to target the (wrong) issues, reactive safety not proactive.

[megan]

"Humans do a pretty good job", yes but the whatever enables the good performance can also result in 'pretty good mistakes'Too true. In the course of observing 60 flights 899 deviations were observed, 194 in checklist use, 391 in monitoring, and 314 in primary procedures. Helios would fit right in there as a pretty good mistake as you put it.

https://human-factors.arc.nasa.gov/publications/NASA-TM-2010-216396.pdf

[TOGA Tap]

There are other failures resulting in loss of attitude information such as failure of the pilot flying primary display unit and maybe some vierd electrical failures.

If that happens on take-off near V1 speed on a limited runway it might be wise to continue takeoff. Most probably that situation will not be covered by your departure briefing as reason tor the mandatory reject like engine failure, fire etc.
Aircraft is perfectly flyable and it can safely lift off.
Then the only available source if attitude information for the pilot flying would be the ADI. Just rotate into PREVIOSLY KNOWN SAFE attitude, monitor airspeed and when you feel safe and nicely climbing away transfer controls to the other pilot.

This is not just airmanship - this is a training issue.

In my humble oppinion it should be the SOP to mention this safe pitch attitude in takeoff and in go-around briefings.

This would greatly reduce the startling effect in the minds of both pilots so hopefully one of them will start monitoring the pitch angle early in the event.
alf5071h made some exellent points in his post on negative effects of startle. We are just humans.

Aplogize for the long post.

[RAT 5]

In my humble oppinion it should be the SOP to mention this safe pitch attitude in takeoff and in go-around briefings.

Over the years I witnessed takeoff briefings getting longer and longer and more blah blah; yet there is no delay code for them???!? In the Ops Part A there is a statement that "briefing should be brief as memory & concentration have their limits. Briefings should be able to be recalled easily." Then they expand the takeoff briefing to include even more SOP items. What is the point of having rigid SOP's if they need to be repeated every takeoff. Flaps, SID's & emergency routings differ, yes: but RTO's, fires, depressurisation procedures etc. are all SOP's. If you don't know those and need reminding everyday then you shouldn't be there.

[PEI_3721]

M, thanks, an interesting report by NASA.

I will trade you this one.
http://homes.lmc.gatech.edu/~fischer/SortingTM.IH-014_Orasanu.pdf
The relevance to this thread is that pilots view situations according to experience and the role they have in the flight deck (discussion p31).
Captains focus on the the severity of the problem - flight task. Monitoring pilots prioritise judging if and when a response - call out, is required.

If this is a general conclusion then the argument for cross monitoring and FO intervention is weak because there is little shared awareness of a developing problem.
Thus in the CRJ accident, the Capt continues with the task of flying - but based on an erroneous attitude display; the monitoring pilot calls 'pitch attitude' but may not understand the nature of the problem. The result is that neither pilot has an overall grasp of the situation, and with a reluctance to change the original understanding and action, become committed, each in their respective task.

[Judd]

Over the years I witnessed takeoff briefings getting longer and longer and more blah blah;


While not specific to a take off briefing the following article in www.skybrary.aero (http://www.skybrary.aero) concerned a Boeing 737 in fog flying an ILS to Cat 1 DH where, among other SOP calls, the automated call-out of "1000 feet" was supposed to be acknowledged by the PF as "stable" or "Not stable - going around." Another automated call-out of "Minimums" occurred at DH where the PF was supposed to say "Continuing" if visual at that point or "going around" if not visual.

In the event, the PF descended to 100 ft above the runway where he became visual and disconnected the autopilot before landing.

The investigation not only criticised the PF (a 23,000 hour captain) for failure to make the required company call-out procedures during the ILS but also criticised the co-pilot for not taking action when the captain omitted to make the company SOP calls. The aircraft was stable on the approach. It did not state specifically what physical action the co-pilot was supposed to take.

The investigation heard the captain was known for his silent cockpit attitude and replying by grunts instead of articulating SOP call-outs.

The company was criticised for not taking preventive measures to call in the captain on numerous previous occasions when his failure to stick to SOP call-outs was well known among fellow pilots.

How things have changed over the years where once a silent cockpit was considered not only safe but desirable with the only call-outs being for an emergency. Monitoring took place but not necessarily articulated.

Perhaps because of a well founded fear of litigation, but disguised as essential flight safety measures (everything is recorded via the CVR), manufacturers and companies for years have steadily increased SOP call-outs to the degree where on an instrument approach and even visual approaches, it is common to have almost continuous verbalising of instrument and mode information from start of the approach to touch down.

If the tendency of some passengers to back seat driving is annoying to most car drivers, then the increasing plethora of crew SOP calls required by a company can be equally distracting to the pilot concentrating on flying; even if most of the time the automatics are engaged. Some pilots may welcome SOP calls coming thick and fast as it gives them a sense of comfort that all is well. But have we gone too far and are these calls becoming distracting and thus counter-productive?

[RAT 5]

Interesting questions, Judd. Back in the day, even in a company wth quite rigid, but not intrusive SOP's, I flew with various old dogs whose takeoff brief was the flap, the thrust, SID, the emergency routing and "the rest will be SOP's". The same with an ILS or visual approach. The approach brief was "SOP's + salient items for that particular day."
Too much Blah Blah, that is just repeating of SOP's causes boredom and switching off. It's like the wife telling me how to fill the dishwasher. The second thing with too many callouts is that under stress the first thing that shuts down is your ears; thus yapping too much has the opposite effect of 'trying to be helpful'. You gave up listening long ago.