Human Factors Breakdown: C-17 Crash at Elmendorf
Last week, we looked at a fatal C-17 accident at Elmendorf in 2010. I now want to focus on the analysis of the situation leading up to the stall. It’s clear that the flight crew did not react to the warning signs as they attempted their manoeuvres at low altitude without reaching their target airspeed. What isn’t immediately clear is why no one reacted.
The investigation was quickly able to show that the maintenance on the aircraft was in order and there was no evidence of mechanical, structural or electrical failure that could have caused the loss of control. There was no evidence of medical issues or any signs of incapacitation for any of the crew. Every crew member was experienced and well respected, none of them had life style factors which could have been relevant, and there was no evidence to suggest that any of the crew were fatigued or inadequately rested.
So the first obvious question is why did no one on the flight react to the stall warner when it activated? The commander did not make any attempt to increase airspeed or initiate recovery. The first officer did not call out that he’d retracted the slats. The safety officer did not react or seem to expect anyone else to react. The reason for this was simple and sad: The commander of the aircraft didn’t believe that stall warnings were relevant and had told the crew to ignore them.
This was standard procedure for his flights: the commander routinely gave the instruction to ignore stall warnings during aerial demonstrations. He said in training that stall warnings were an “anomaly,” inaccurate and transitory, and that the stall warnings would stop when the turn was completed and believed that the aircraft would not be adversely affected. He had flown numerous aerial demonstrations in the C-17 with the stall warnings active and without incident.
There’s a phrase we’ve talked about before, normalisation of deviance, where someone takes a short cut or disregards a procedure and nothing goes wrong and so they continue to do so, until no one much notices any more. Over time, safety and security requirements erode as people quickly become accustomed to this behaviour and stop seeing it as deviant, even though the actions can end up far outside of their personal boundaries for safety.
As Mendel said in the comments, the routine had been modified by the commander in order to create a better show. But those modifications were never approved and, more importantly, they would never have been approved if anyone had been paying attention. Each of the commander’s changes pushed the aircraft closer to its operational limits. The changes to the profile slowly but surely eroded the safety buffer built into the routine.
This can be seen a bit more clearly by going over the individual factors as defined by the final report.
The first causal factor was straight forward procedural error, starting with the fact that the commander had replaced the approved aerial demonstration procedure with his own techniques in order to increase the impact. He chose to climb steeper, level out sooner and turn steeper than the manoeuvre called for.
Energy management is the most critical factor in aerobatics and every single change that the commander made affected the amount of energy available. If the aircraft does not maintain sufficient speed and altitude, it cannot sustain controlled flight.
On that final flight, the commander climbed away from the runway at a pitch angle of 40° instead of focusing on minimum climb-out speed. As a result, the C-17 only reached 107 knots in the climb, instead of the target of 133 knots. He then levelled out at 850 feet instead of continuing to the minimum altitude of 1,500 feet. He maintained full right rudder and control stick pressure for the 80/260 reversal turn, increasing the bank angle from 45° to 60°. All of these changes reduced the amount of energy available to the aircraft.
The manoeuvre was meant to demonstrate the aircraft capabilities but the commander instead pushed the C-17 to its maximum performance at the threshold of a stall, the very definition of a low energy state.
The second procedural error is the obvious one: the commander never implemented proper stall recovery procedures.
The operating manual gives the following steps for C-17 stall recovery:
- apply forward stick pressure
- apply maximum available thrust
- return or maintain a level flight attitude.
Large rudder inputs, it says, should be avoided.
Instead the commander continued to execute his 260° turn. He consistently maintained control stick pressure and he did not return to a level flight attitude, first continuing the turn and then attempting to turn in the other direction. Throughout, full rudder was applied, first right rudder and then, in the deep stall, full left rudder.
The commander’s reaction to the stall is actually a very good example of what the investigators defined as the second causal factor: overaggressive.
Overaggressive is a factor when an individual or crew is excessive in the manner in which they conduct a mission.
The pilot of the flight was the commander and responsible for all aspects. He planned, briefed and flew the sortie with the intent of pushing the C-17 to maximum performance. His choice of bank angles, altitudes, timing and rudder usage all contributed to the aircraft entering a deep stall from which he could not recover.
The investigators found that the commander had regularly planned and flown the 80/260 manoeuvre using 60° of bank with full rudder, instead of the 45° bank angle recommended for the manoeuvre, in order to tighten the turn and keep the display as close to the crowd as possible.
On that day, he’d planned an initial climb-out of 1,000 to 1,500 feet with a 35-40° nose high attitude. Normally, that climb-out would be flown based on minimum climb-out speed, with the nose-high attitude of about 25-35°.
The commander had become overaggressive, excessively pushing the parameters of the flight beyond recommendations and accepted limits. In other words, the crash was caused by the commander deliberately planning and executing the flight without following the procedure for the manoeuvre.
The contributing factors are focused on the lack of reaction once things started going wrong, focusing on the human factors affecting the flight crew during the sixty-second flight. It is interesting because it describes a number of different types of human factors to help us to better understand what happened in the cockpit.
Caution/Warning — ignored is when a caution or warning is perceived and understood by the individual but ignored by the individual leading to an unsafe situation.
Challenge and Reply is when communications did not include supportive feedback or acknowledgement to ensure that personnel correctly understood announcements or directives.
When the stall warner sounded, the Pilot Monitoring called out “Temperature, altitude, lookin’ good.” Clearly he was monitoring the systems, however, he did not see the stall warning to be worth commenting on. At the same time, the commander did not adjust his control inputs, for example releasing pressure on the control stick or reducing the bank angle, after the stall warner sounded. Neither the Pilot Monitoring nor the Safety Officer made any comment regarding recovery from the impending stall until after the aircraft was stalling.
These are the actions in the cockpit that contributed to the fatal crash but the investigation also looked into the history of the crew to try to understand why the stall warning was ignored and the personnel did not consider it to be a problem.
Two training issues were brought to light. The commander routinely instructed flight crew that stall warnings could be ignored during demonstrations, effectively that the warnings did not apply to them.
The second issue is that the commander had instructed the Pilot Monitoring to retract flaps and slats automatically, without a challenge or reply. On that day, the Pilot Monitoring retracted the flaps and slats as he’d been trained to do, silently. However, the C-17 was low and slow after the climbout and the flaps and slats retraction affected the angle of attack, bringing the aircraft closer to the stall. We can’t tell if the commander and the safety officer knew that the configuration of the aircraft had changed.
Channelized Attention is when the individual is focusing all conscious attention on a limited number of environmental cues to the exclusion of others of a subjectively equal or higher or more immediate priority, leading to an unsafe situation.
The commander showed two clear instances of channelized attention. The first was that he continued his aggressive turn, with a priority of keeping the aircraft close to the show centre (that is, to where the crowd would best be able to see the C-17) despite the low energy state which triggered the stall warner. The second is his response after the aircraft began to stall: he moved the control stick to the left but continued to hold the stick back and applied full left rudder, which meant that the manoeuvre to the left did not help and he failed to reduce the angle of attack.
Overconfidence doesn’t need defining, other than that misplaced confidence can be in your own skills but also in your colleagues or your aircraft.
The commander showed overconfidence both in his own skills and in the capabilities of the C-17. He taught that stall warnings were an “anomaly,” inaccurate and transitory, and to be expected during aggressive aerial demonstration manoeuvres. He was “not concerned” about stalling during the manoeuvres, because he believed that the stall warnings would stop when the turn was completed. He had flown numerous demonstrations with the stall warnings active and without incident.
Although this isn’t cited in the report, I think it is fair to say that the crew also showed overconfidence in the commander, accepting that he knew better than the text books, with a result of having an overconfidence in the C-17.
Misplaced Motivation is when an individual or unit replaces the primary goal of a mission with a personal goal.
The commander wanted to put on a good airshow, which doesn’t sound misplaced until he started to plan a compressed profile, using unsafe techniques, in order to impress the crowd and improve the airshow. The point of the profile was to demonstrate the performance of the C-17, not to demonstrate the maximum performance. However, the commander’s desire to put on a good show for the spectators led him to push the C-17 harder and harder, until eventually the flight went beyond limits.
Expectancy is when the individual expects to perceive a certain reality and those expectations are strong enough to create a false perception of the expectation.
The commander had consistently planned, practised and flown aerial demonstrations with the stall warning sounding during the 80/260 manoeuvre. He taught demonstration pilots that the stall warning was transient and could be ignored. So when the stall warner activated during the mishap flight, the crew responded as trained, ignoring the audio and tactile signs that the energy state of the aircraft was dangerously low. Everyone clearly believed that there was no actual risk of the aircraft stalling.
Procedural Guidance/Publications is when written directions, checklists other published guidance is inadequate, misleading or inappropriate in a way that creates an unsafe situation.
Air Force Policy Directive (AFPD) 11-2, Aircraft Rules and Procedures, para. 1 states:
“The Air Force establishes rules and procedures that meet global interoperability requirements for the full range of aircraft operations. Adherence to prescribed rules and procedures is mandatory for all personnel involved in aircraft operations.” (Emphasis added.)
Two years before the accident, in the Spring of 2008, the commander underwent “aerial demonstration upgrade training” and was recommended as a safety observer.
There, the instructor taught the crews that after take off, they should start lowering the nose at 1,000 feet while continuing to climb to 1,500 feet above ground level. The instructor also taught crews to make the initial 80° turn at a speed 15 knots above flap retract speed. He included use of rudder in his curriculum but also that there was no requirement to use the rudder in the C-17 for that manoeuvre. He taught that the profile as described in Air Force Instruction 11-246 for Air Force Aircraft Demonstrations should be considered PROCEDURE not GUIDELINES.
The commander of the fatal flight had clearly been trained in all these things but over time had lost sight of the requirements which were not reinforced by the documentation, which could be seen to guidelines which allowed him the opportunity to modify and vary the routines.
The mishap pilot violated regulatory provisions and multiple flight manual procedures, placing the aircraft outside established flight parameters at an attitude and altitude where recovery was not possible.
Furthermore, the mishap co-pilot and mishap safety observer did not realize the developing dangerous situation and failed to make appropriate inputs.
I’m pleased that the investigation didn’t stop there but carried on to look at the environment which enabled the pilot to plan and perform what a deliberately unsafe air show routine.
This had more to do with what we discussed on the first post, in which a highly experience commander carries such authority, that those around him don’t think to question him.
The commander had a stellar reputation, known as an excellent pilot, extremely precise and knowledgeable. He was highly respected by the squadron leadership for his aviation skills and his instructor abilities.
As a result, he was able to work independently with very little oversight. Over time, the US Air Force chain of command allowed him to modify the routine with little or no oversight because they trusted his judgement.
They also allowed him to change the checklist for demonstration flights without going through the process of having those changes approved. In fact, it was shown that in the 3rd Wing, checklists were often modified and put into use without being approved, directly in violation of Air Force regulations. The practice had become so widespread that no one gave it any further thought.
The Operations Group Commander responsible for supervising the aerial demonstration program was very interested in the C-17 programme. He had booked a flight with the commander to evaluate his performance but had to cancel when a last-minute emergency came up. It was never rescheduled. Another Operations Group Commander intended to observe the demonstration flights, but ended up busy with other things when the C-17 flights took place.
No one saw this as a big deal. His superiors simply assumed that the commander was complying with regulation and did not make any extra effort to review his techniques and performances. No one realised that as a result, the commander was operating with no checks and balances at all.
I’m sure the commander never made a decision to fly an unsafe airshow. Over time, though, the demonstration had evolved into a series of barely-safe manoeuvres, eroding the margins allowing for safe flight.
The commander’s overconfidence then led him to continue the turn during a low-altitude stall, with a crew who had been trained by the commander that the stall warning was not meaningful. As instructed, they did nothing to respond to the constant aural warnings, instead confirming that everything was “looking good” as the aircraft flew low and slow into the second turn. Neither the co-pilot nor the safety observer saw any cause for concern until the final seconds of the flight. Their reaction, or rather lack of it, happened because the commander was repeatedly and consistently allowed to fly unsafe aerial routines. It was normal.
The board president found clear and convincing evidence that the cause of the mishap was pilot error. The pilot violated regulatory provisions and multiple flight manual procedures, placing the aircraft outside established flight parameters at an attitude and altitude where recovery was not possible. Furthermore, the copilot and safety observer did not realize the developing dangerous situation and failed to make appropriate inputs. In addition to multiple procedural errors, the board president found sufficient evidence that the crew on the flight deck ignored cautions and warnings and failed to respond to various challenge and reply items. The board also found channelized attention, overconfidence, expectancy, misplaced motivation, procedural guidance, and program oversight substantially contributed to the mishap.
Thanks to Mendel who found a copy of the report on Wikimedia Commons: 2010 Alaska USAF C-17 Crash Report
This is a clear case of normalisation of deviance, when people become so accustomed to cutting corners and pushing limits, they stop even noticing the deviant behaviour. Within the group, each individual’s ability to make decisions about risk becomes compromised as risk-taking behaviour becomes normal. Eventually, the risks taken are well beyond what any individual would have considered reasonable at the start.
To put it simply, it was just a matter of time until something went wrong.