Dimness by daylight

The cockpit modifications required for using night-vision goggles can lead to misreading of important warning lights.

By Brendan Reinhardt

The helicopter pilot settles into cruise on an hospital patient transfer about 20 minutes after take-off. Time to do some admin and cruise checks. Plenty of fuel in the tanks, compass within limits.

Bang!

The aircraft yaws, number one engine N1 is decaying and now there are several other caution lights coming on. What’s going on—engine failure?

Bang! Bang!

The aircraft descends and the attitude pitches up and rolls right. ‘Whoop whoop’ screams the low rotor horn.

It’s a double-engine failure, the pilot suddenly realises. But how? That doesn’t normally happen unless you run out of fuel and there is plenty of fuel—the pilot had just checked.

An isolated incident? No, not in this case. Two accident reports regarding BK117 helicopters in separate countries (New Zealand in 2014 and the United States in 2017) outline almost identical circumstances where a cockpit modification to use night-vision goggles (NVG)—meant to make the aircraft safer to fly at night—introduced a small but critical hole in the Reason accident causation model. A series of events leads to both pilots mismanaging the fuel distribution in the helicopter so that the engine supply tanks are run dry.

The endurance running on the supply tanks is about 20 minutes but most of the aircraft’s fuel is sitting in the main tanks—unusable—because it first has to be sent to the supply tanks via pumps to be available to the engines.

The fuel transfer pumps need to be turned on, so fuel is constantly moved from the main tanks into the engine supply tanks. If you take-off without those pumps on, you have only about 20 minutes of endurance before the supply tanks run dry. That is why there is a caution (FUEL PUMP XFER) on the central annunciator panel.

However, for 20 minutes during the incidents described above, these caution lights were on, indicating the supply tanks were not being topped up. How did the pilots not notice the FUEL PUMP XFER and then the FUEL LOW lights staring them in the face as a double-engine failure loomed?

The last layer of defence of the Reason model failed in these accidents—the night-vision goggles cockpit modification made the caution lights unreadable by day.

The modification is designed to allow helicopters to operate safely at night below lowest safe altitude (LSALT). The goggles gather small amounts of ambient and near infra-red light, magnify it and present an image that allows the pilot to see better in the dark. It doesn’t turn night into day; however, it does allow the pilot to see obstacles around them while below LSALT and on approach to and take-off from unlit remote landing sites.

If there are normal amounts of light in the cockpit, the goggles will get swamped by the relatively brightly lit cockpit and the pilot will not be able to see the outside night image. For this reason, the cockpit lighting is changed. The goggles have a filter to prevent the transmission of green light; therefore, the cockpit can be illuminated by green lights, which will not be inadvertently picked up by the goggles. The pilot looks at the green instruments by glancing under the googles with an unaided eye.

However, only being able to use green cockpit lights removes a lot of the colour coding we pilots like, that differentiates information or draws our attention to critical or emergency situations.

If we put other filters on the goggles, we can use modified colours (and even some whites). However, the colours are washed out and the lighting is dimmer than normal.

Bulbs that generate light using heat often put out infra-red energy that is picked up by the goggles and need to be changed for other sources such as cooler LEDs.

However, this now presents a readability issue for daytime flight. The instruments still need to be readable by day, even in direct sunlight. NVG-compatible lights and displays may not be readable in these conditions. For daytime operations, there may be a dimming relay that increases brightness or a setting that utilises a brighter colour palette. The challenge of daylight readability and night-vision goggles compatibility is not easy.

In both the incidents cited earlier, the NVG-modified cockpit changed the colour and brightness of the FUEL PUMP XFER and the FUEL LOW lights (both cautions). There was a setting for daytime and night-time operations. Pre-modification, the lighting was red for warning and orange for caution; after modification, warning was orange and caution yellow.

Daylight readability can be a subjective test; however, the NZ report indicates the daylight readability testing had not been done satisfactorily. Figures 4 and 5 show the lighting with the dimmer off and on. Note how in the first figure, the FUEL PUMP XFER is visible in the bottom right and not in the dimmed image.

If we analyse these accidents utilising the Reason model (Figure 3), we could possibly allocate the following failed defences to the NZ accident:

1. Organisational influences—the company did not require pilots to refer to written checklists if lacking recency on the aircraft type.
2. Unsafe supervision—there was not a robust system to ensure oversight of pilot’s proficiency and currency.
3. Preconditions for unsafe acts—the NVG cockpit modification had adversely affected the readability of the caution lights during daylight when left in the dimmed setting.
4. Unsafe act—the pilot did not follow the checklist and did not turn the fuel transfer pumps on.

There is specific guidance in certification material about NVG cockpit modification and daylight readability. CASA has Civil Aviation Advisory Publication CAAP 174-01, that outlines in part what is required for the modification. The US Federal Aviation Administration (FAA) provides guidance material in Advisory Circular 29-2C Miscellaneous Guidance 16. Military standards such as MIL-STD-3009 also provide good reference material.

The FAA guidance material calls out the following requirements:

• The basic unmodified crew alerting system and caution warning panel is readable in both daylight (with sunlight on the display) and night lighting conditions.
• Annunciators and other push button switches with illuminated legends are readable during the day in full sunlight and their lighting levels can be balanced with the rest of the cockpit.

Analysis: The sun also rises

It should be noted that subsequent modifications to later helicopter designs in this series included an aural FUEL LOW warning. And supply tanks in more modern helicopters are of slightly different sizes to ensure that one engine fails before the other, giving the pilot some warning to realise the error and turn on the transfer pumps.

When considering an NVG cockpit modification, a full system safety assessment should be done. This may indicate that critical systems and/or warning systems require modification to compensate for the deficiencies in the NVG modification.

For such critical cautions, it may have been worth upgrading the FUEL PUMP XFER and the FUEL LOW captions from cautions to warnings in the NVD modification. This would have allowed them to still be seen even if the dimmer was accidentally left on. Similarly, an aural tone could have been added to the fuel transfer pump switches to indicate if they were off when the aircraft became airborne. In this case inclusion of any one of these changes with the NVG modification may have been enough to break the accident chain and prevent the holes lining up.

NVG cockpit modification is a compromise between allowing the device to function without interference and readability by both day and night. An NVG cockpit modification requires more than just one-for-one replacement of lights as per a specification. There needs to be a more fundamental system safety assessment by someone who understands how that particular aircraft type and model operates and how the aircraft is going to be used. The configuration, role and environment the aircraft operates in needs to be considered. This may mean that more than just lighting is required to be modified to allow a safe NVG flying operation.

Unless it’s on a helicopter that only flies at night, an NVG helicopter modification must consider the title of a Hemingway novel—The Sun Also Rises.