HOW PAST LOSS OF CONTROL ACCIDENTS MAY INFORM SAFETY CASES FOR ADVANCED CONTROL SYSTEMS ON COMMERCIAL AIRCRAFT C.M. Holloway*, C.W. Johnson † *NASA Langley Research Center, Hampton, Virginia, USA; [email protected] † Dept. of Computing Science, University of Glasgow, Glasgow, Scotland; [email protected] Keywords: accident, loss-of-control, flight controls, adaptive. common concerns, based on a review of five commercial aviation accidents in the United States that involved loss of Abstract control of the aircraft. This paper describes five loss of control accidents involving The remainder of this paper follows a simple structure. In commercial aircraft, and derives from those accidents three section 2, we describe the five accidents. In section 3, we principles to consider when developing a potential safety case posit that these five accidents suggest three principles that for an advanced flight control system for commercial aircraft. should be considered in developing a safety case for any One, among the foundational evidence needed to support a advanced flight control system. We give brief concluding safety case is the availability to the control system of accurate remarks and suggestions for future work in section 4. and timely information about the status and health of relevant systems and components. Two, an essential argument to be 2 The Accidents sustained in the safety case is that pilots are provided with adequate information about the control system to enable them In this section, we describe each of the following accidents: to understand the capabilities that it provides. Three, another (1) The in-flight loss of hydraulics and subsequent crash on essential argument is that the advanced control system will landing of United Flight 232 on July 19, 1989; (2) The not perform less safely than a good pilot. uncontrolled descent and collision with terrain of USAir Flight 427 on September 8, 1994; (3) The loss of control and 1 Introduction impact with the Pacific Ocean of Alaska Airlines Flight 261 on January 31, 2000; (4) The in-flight separation of the Research is currently being planned and conducted to develop vertical stabilizer of American Airlines Flight 587 in advanced flight control techniques and systems for November 12, 2001; and (5) The loss of pitch control during commercial aircraft. A primary goal of some of this research takeoff of Air Midwest Flight 5481 on January 8, 2003. We is to improve aviation safety by providing means for ensuring chose these five accidents because they are among the worst safe flight and landing in the presence of adverse conditions loss of control accidents during the last two decades. such as environmentally induced upsets and actuator or sensor failures [7]. The information for each description below is taken from the referenced report from the US National Transportation Safety Before any of the techniques or systems envisioned by Board (NTSB), which for the purposes of this paper we researchers will be permitted on commercial aircraft, consider to be fully authoritative and accurate. The convincing arguments for the safety of these techniques and descriptions below are necessarily short, with many details systems will have to be developed and sustained. A safety left out. Interested readers are encouraged to read the full case approach to creating these arguments for advanced flight accident reports, for reasons we have explained elsewhere [5]. control systems---that is, an approach in which the safety goals, arguments, and evidence are presented explicitly and 2.1 United Flight 232 (1989) carefully linked together---is the subject of current research. A primary goal of this research is to develop techniques to United Airlines flight 232 was a scheduled passenger flight document and explain thoroughly why a particular design and from Denver, Colorado, to Philadelphia, Pennsylvania, with a implementation is considered to be acceptably safe to use stop at Chicago, Illinois. The aircraft employed for the flight within a specified operating environment. was a McDonnell Douglas DC-10-10. On July 19, 1989, Flight 232 left Denver’s Stapleton International Airport a few Many details of a specific safety case will depend on the minutes after 2 p.m. with 285 passengers and 11 crew particular advanced flight control techniques or systems used; members on board [8]. however, every safety case will likely have to address some common concerns. In this paper, we posit three such possible The first hour of the flight was uneventful, but about 67 The NTSB determined “that the probable cause of this minutes after takeoff, as the plane was flying at about 37,000 accident was the inadequate consideration given to human feet with autopilot and autothrottles engaged, a loud bang was factors limitations in the inspection and quality control heard coming from the rear of aircraft; the noise was followed procedures used by United Airlines’ engine overhaul facility by a vibrating and shuddering of the plane. Instruments which resulted in the failure to detect a fatigue crack showed that the tail-mounted engine (denoted as engine #2) originating from a previously undetected metallurgical defect had failed, and that the normal hydraulic system pressure and located in a critical area of the stage 1 fan disk that was quantity was zero. The airplane did not respond to flight manufactured by General Electric Aircraft Engines. The control inputs by either the first officer or the captain. subsequent catastrophic disintegration of the disk resulted in Attempts by the flight crew to restore hydraulic pressure by the liberation of debris in a pattern of distribution and with using an auxiliary hydraulic pump were unsuccessful. energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the About 6 minutes after the initial bang, the flight crew radioed DC-l0's flight controls.” the nearest Air Route Traffic Control Center, asking for emergency assistance and vectors to the nearest airport. After A specific finding from the investigation relevant to the some discussion, the controller suggested going to Sioux purposes of this paper is finding 6: “The airplane was Gateway Airport, Sioux City, Iowa, which was in the general marginally flyable using asymmetrical thrust from engines direction in which the flight was headed. The flight crew No. 1 and 3 after the loss of all conventional flight control accepted this suggestion. systems; however, a safe landing was virtually impossible.” This finding was supported by a series of flight simulator When the flight attendants began preparing the cabin for an studies, in which a DC-10 simulator was programmed to emergency landing, a United Airlines DC-10 training check behave as the accident airplane behaved. DC-10 rated pilots airman identified himself and volunteered his help. On being flew the simulator. These pilots were unable to control the told about the volunteer, the captain invited the check airman pitch oscillations with any precision; nor were they able to to the cockpit, and asked him to return to the passenger cabin directly control the airspeed. As a result landing safely was to look at the wings. This inspection revealed that the “a highly random event.” The accident report includes praise control surfaces were not moving, the inboard ailerons were for the flight crew: “The Safety Board believes that under the slightly up, and the spoilers were locked down. circumstances the UAL flight crew performance was highly commendable and greatly exceeded reasonable expectations.” When the check airman returned to the cockpit with his report, the captain gave him the job of controlling the throttles 2.2 USAir Flight 427 (1994) while the captain and first officer attempted to manipulate the 1 flight controls. The check airman tried to control the USAir flight 427 was a scheduled passenger flight from airplane’s pitch and roll by varying the engine power on the Chicago, Illinois, to Pittsburgh, Pennsylvania, operated using two underwing engines. He continually had to counter the a Boeing 737-300 airplane. Aboard the aircraft when it tendency of the airplane to turn right. departed Chicago about 6:10 p.m. on September 8, 1994, were 2 pilots, 3 flight attendants, and 127 passengers. The The flight crew made visual contact with the airport about 9 expected enroute flight time to Pittsburgh was 55 minutes [9]. miles out. Air traffic control had intended for the flight to attempt to land on the longest of the airport’s runways The flight was uneventful until after it initiated the descent (runway 31); however, because the airplane was generally and approach to the Pittsburgh airport. At about 7:03 p.m., headed on the approach to runway 22, and because the crew while flying at about 190 knots at 6000 feet, the airplane’s left had great difficulty in making any left hand turns, the captain bank steepened from less than 8° to more than 20°. The left elected to continue to attempt to land on runway 22. Without roll rate was arrested briefly, moving to about 15°. Sounds on hydraulic pressure, the flaps and slats remained retracted, and the Cockpit Voice Recorder (CVR) suggested that the flight the airspeed remained high. crew were struggling to control the aircraft. Oscillations in pitch and roll remained smooth until just After only about a second, the left roll rate increased again, before touchdown. At about 100 feet above the runway, the and the aircraft’s heading moved rapidly leftward also. As right wing dropped rapidly and the nose of the airplane the left bank angle increased to about 43°, the airplane began pitched downward. The airplane touched down on the to descend below its assigned 6000 feet altitude and the runway threshold slightly to the left of the centerline. The airspeed dropped below 190 knots.