Trust, Verify, Adjust, Escape

The fact I write about this regularly testifies to my unease. The last attempt was with Automation Resource Management. I still think that effort was a good one, but perhaps misses the point. I think we are all well advised to understand exactly what it is we are trusting, work hard to verify these systems are doing what they should be doing, and adjust when needed. And when we find ourselves in over our heads, we should be ready to flee the situation by putting the airplane on a trajectory to get out of danger. Remember you must always fly in the middle of the air and avoid the edges. Without this, nothing.

1 — Trust

2 — Verify

3 — Adjust

4 — Escape

5 — Sine Qua Non

The good, the bad, and the ugly of automation

Current levels of aircraft automation are very good, no doubt about it. Autopilots, autothrottles, and all the enhancements that go with them take care of the mundane chores and free up the humans to think ahead of the aircraft. Until they don't.

"What's it doing now?"

"Why is it doing that?"

When I first started flying with an autopilot, I treated it with suspicion. This was in the KC-135A Stratotanker and it was designed to hold altitude to provide a stable platform as receiver aircraft joined up in very close trail formation. The most advanced thing it could do was hold altitude while maintaining a heading. If you had everything just right, it could maintain a course but it was easily distracted. A few years later I was flying a Boeing 747 with an autopilot that could land us off a Category III ILS. Pretty neat. While that 747 had autothrottles, they were not to be trusted. My last several aircraft had autothrottles that engage on takeoff and remain that way until landing. You can almost forget about airspeed because it seems to take care of itself. Or does it? Consider the case of Asiana Flight 214.

Case Study: Asiana 214

The crew of Asiana 214 were on final approach to San Francisco International Airport (KSFO), about ten miles out. The autopilot was handling the lateral navigation automatically and the autothrottles were handling the airspeed. Because the ILS was out of service, the crew had to use less than fully automatic modes for vertical navigation. They were doing well, except they were about 600 feet higher than an optimal descent path. For many of us, this is no big deal: ten miles is more than enough distance to correct.

The crew used a combination of vertical navigation modes to return the aircraft to a proper glide path. Flight Level Change (FLCH) mode will bring the throttles to idle if the aircraft is above the selected altitude or to a CLIMB or other appropriate setting if the aircraft is below the target. Vertical Speed (V/S) mode will shoot for a vertical speed given in feet per minute. FLCH is often used when the crew wants the best possible descent while maintaining speed, but this can be complicated if the target speed is changed during the descent or if there isn't enough drag to hold that speed at idle. V/S mode ensures the descent, but can result in a loss or gain of speed. In their Boeing 777, the autothrottles complicated matters with a HOLD mode which activates when the autothrottles reach the aft stop in a descent or if the pilot overrides them. The autothrottles will remain in HOLD mode until the airplane reaches the target altitude, the pilot engages a new pitch mode or new autothrottle mode, the autothrottle arm switches are turned off, the thrust is manually commanded to increase past the thrust limit, or if the autopilot is disconnected and both flight director switches are turned off.

The crew didn't notice that their airspeed had decayed well below their target approach speed with the throttles at idle and the aircraft well below glide path when still a mile from the runway. By the time they noticed, the aircraft didn't have enough altitude to recover.

In a post-crash interview, the PF stated that the 777 A/T system would always maintain the selected airspeed as long as the autothrottles were on. He said that if a pilot overrode the thrust levers manually, the autothrottles would resume controlling airspeed when the pilot released the thrust levers. An Asiana 777 examiner was asked what mode the autothrottles would be in if the pilot manually pulled the thrust levers back, he said that the autothrottles would remain in SPD mode, and the thrust levers would advance after the pilot released them. All of these statements are incorrect.

Many accidents where automation is involved reveal similar misunderstandings of what the automation is doing and why. It is clear that we are teaching pilots enough to operate the automation to pass a check ride, but not enough to fully understand how that automation makes decisions when things are less than perfectly normal.

Just because it is a routine simulator maneuver, doesn't mean it is routine

Some maneuvers are rare in the airplane but of such a critical nature, that we practice them relentlessly in the simulator. The go around, for example, is practiced almost as often as the landing. The TO/GA, power up, pitch up, gear up, climb procedure is almost an automatic reflex. In an aircraft with autothrottles, however, pressing the Takeoff / Go Around button takes care of power up step and we tend to assume it has happened. But what if something in the go around changed to impact the autothrottle logic? Consider the case of Emirates Flight 521.

Case Study: Emirates 521

The crew of Emirates 521 were very professional and had done everything just right almost to the very end. Briefs, callouts, crew coordination. Very good. The captain initiated the flare 15 feet earlier than he should have. (As someone I used to fly the Boeing 707 with used to say, "I've done worse and bragged about it.") The combination of shifting winds (headwinds to tailwinds) and hot runway thermals made it difficult to touch down in the touchdown zone, so the captain elected to go around. The captain wasn't aware that the aft set of wheels on the trucks of his main landing gear were going in and out of ground mode, which made the airplane think it was on the ground for a second. When the captain pressed the Takeoff / Go-Around (TO/GA) button, the go-around thrust mode of the auto throttles were disabled because they were "on the ground." The captain did not realize he was at idle thrust as he pitched up for the go around. The airplane ran out of speed. As the airplane began to sink, the captain realized his power state and manually advanced the power, but it was too late.

We often think that those things we do repeatedly in the simulator instill on us the mental and muscle memory to do it just right when it counts. But the conditions in the real world are never as standardized as they are in the box. If you didn't have the autopilot, your first instinct after pitching up in a go around would be to verify you are climbing. If you didn't have the autothrottles, your first instinct after pushing the throttles forward would be to check that the engines have indeed increased thrust. Your first instincts before you got the automation were correct. Those same instincts will serve you well even in an automated cockpit.

You (the pilot) are in control (mostly)

I know an Air Force T-37 instructor pilot who failed a student pilot during a formation check ride and then married her. No, that isn't important here, just amusing. What is important is that she was flying fingertip formation with another T-37 when that airplane appeared to be pulling away. He said, "it looks like they are moving away, doesn't it?" She said, "yes, why are they doing that?"

I can use the same logic in many of these automation accidents. It looks like the autopilot is _____. Yes, why is it doing that? But it is more complicated than that. Just as the other airplane was appeared out of position to our hapless student pilot, our perspective of a problem can be masked when the automation appears to be flying without complaint. In both cases, it is up to us to see the world from another view, and make the appropriate adjustment. Consider the case of Indian Airlines Flight 605.

Case Study: Indian Airlines 605

The crew of Indian Airlines 605 was flying a visual approach into Bangalore, India, with the Airbus A320's automation doing a fine job until they disconnected the autopilot, about seven miles out. The automation placed the engines in "Idle - Open Descent" mode for the descent to a selected altitude. Before they got to that altitude, the selected altitude was changed a few times, the autopilot vertical mode was changed a few times, and the pilot monitoring may have inadvertently dialed in a 700 foot target altitude when meaning to dial in a 700 fpm descent. They also turned one flight director off, but not both, which on this Airbus keeps the autothrust guidance active. The scenario resulted in the aircraft being about 20 knots too slow just 175 feet above the ground with the engines at idle. But the biggest issue was that neither pilot noticed the decaying airspeed until it was too late.

They could have survived had they made one of several adjustments along the way. The PF asked for the go around altitude to be set twice, but both times the PM was busy on the radio and failed to do so. Had the PF followed up, the engines would not have remained at idle. If the pilot verified that both flight directors were off after he turned his off, the engines would not have remained at idle. And finally, had either pilot pushed the throttles to the TOGA position as soon as they recognized the low airspeed condition, the engines would have had enough time to spool up and safely execute the go around.

When in doubt, fly in the center of the air

If you are ever startled into realizing you don't know what is going on, your best course of action might be to climb away from the ground so you can regroup. In many accidents, the pilots realized there was a problem and by the time they acted, it was too late. Consider the case of Turkish Flight 1951.

Case Study: Turkish 1951

The crew of Turkish 1951 Boeing 737 got a "slam dunk" arrival into Amsterdam-Schipol, Netherlands, which had them intercept the ILS glidepath from above. While not optimal, this isn't usually a problem. But they also had a radio altimeter problem which caused their throttles to go into the "Retard" mode with the aircraft still 2,000 feet in the air. The crew did not notice the idle thrust setting after they had intercepted the glidepath and did not notice the abnormally high and increasing pitch attitude during the descent on glide path. They could have continued the approach by turning off the autothrottles as soon as the airspeed fell below their approach speed. But beyond that point, executing a go around may have been the best alternative.

Always remember that you should fly in the center of the air and avoid the edges. The edges are defined as the ground, the water, extra terrestrial space, and all objects contained within. Knowing a target power and pitch setting that keeps your airplane climbing is vital. Not every aircraft has the same pitch setting on ILS final. But an increasing pitch above the horizon with the thrust at idle is never a recipe for a stable final approach.

What now?

So, we in aviation are immersed in automation and there is no going back. What now? And what does that have to do with the Latin phrase, "sine qua non?" That phrase translates to "without this, nothing." It is used to denote an essential condition. In aviation, the sine qua nons are airspeed and position. You must keep the airplane at a speed that permits flight and keeps you from hitting anything.

An instrument scan

If things are normal, we must keep up our instrument scans to constantly monitor airspeed, altitude, and heading. If they are not right, we must investigate. If that investigation turns up empty, we are no longer in a normal situation.

The control-performance technique

So how do you know things are normal? One of the first basic ideas taught when I was an Air Force pilot is called the Control-Performance Technique. This was taught before instrument flight. The idea is that in a very basic airplane, you have two control instruments that reflect your control inputs. The attitude indicator reacts to your stick and rudder; the RPM indicators reflect your throttles. These are your intentions. The performance indicators show the results. The altimeter, airspeed indicator, vertical speed indicator, heading indicator, and so on all show what is happening as a result of your controls. Even when the automation is handling the stick, rudder, and throttle, it is up to you to keep an eye on everything.

Known pitch and power settings

For most of the Gulfstreams in my logbook, I have remembered that pushing the thrust levers full forward and pitching up to 15 degrees will get me climbing and accelerating in the airport environment. At high altitudes, 3 degrees nose high with climb thrust works well. In the last two Gulfstreams I've flown, simply keeping the flight path vector above the zero pitch line and the speed trend line positive does the trick. No matter your aircraft type, you should know what pitch and what thrust setting gets you out of trouble when low to the ground or at higher altitudes.

When things are not normal

If things are not normal, it may be in our best interest to start throwing out some or all of the automation. Airspeed not right? Decouple the autothrottles from the rest of the airplane or turn them off completely. You become the autothrottles. Altitude wrong? Turn off vertical navigation and control the pitch and power to make it right. If you are really at a loss, it might be time to assign one pilot to manually put the airplane where it needs to be while the other sorts things out. Always remember that you should fly in the center of the air and avoid the edges. The edges are defined as the ground, the water, extra terrestrial space, and all objects contained within. Knowing a target power and pitch setting that keeps your airplane climbing is vital.