Intercession

Our work is flying airplanes. Our job – in the sense that we are paid to accomplish something – is survival. The corollary is that every accident is a story about a relationship gone sour. Pilot and airplane have hit a rough patch.

But there are other players in the drama. Other pilots. Robots. Builders and owners of aircraft. Nation-states and regulatory bodies. These supporting actors often have intercessor roles on the flight deck. Their intentions are good. But as we shall see, the essential relationship between aircraft and Pilot Flying can be eroded to the point of failure by well-intentioned intercession.

Automation

Our friendly robot, known familiarly as ‘Otto’, has more pole time than any of us. We refer to ourselves as ‘PF’, but 95% of the time it is he who is doing the work. Has anyone ever referred to the autopilot as ‘Pilot in Command’? Not to my knowledge. But in the real world Otto is promoted more often than we like to admit. Any time the autopilot stays engaged when the human pilots either do not understand what it is doing, or are too overloaded to notice what it is doing, Otto is effectively in command.

And worse: there are times when Otto announces “You have control”, and the pilots do not notice or respond.

Nor is the classic autopilot alone. With the evolving sophistication of auto-thrust, our familiar Otto became a two-headed hydra whose behavior was increasingly arcane.

How, for example, do we ask the auto-thrust to remain on and in SPD mode when we turn the autopilot off? By selecting A/T and SPD? No. By turning BOTH Flight Directors off. In fact, this piece of hidden knowledge caused the second A320 crash, at Bangalore. Only one of the F/D’s was off, and the A/T mode remained IDLE.

Autopilot Evolution

The DC-9 autopilot had a vertical speed wheel. That was the choice if you didn’t want to fly by hand. The throttles (we were still saying throttles and buckets in those days) were strictly manual. But man and machine managed to operate with a high degree of mutual understanding.

As pilots we had the advantage of learning our trade before the new generation of autopilots arrived. It was not news to us that the DC-9 autopilot was using pitch to maintain a vertical speed. Without thinking about it we could control the airplane with high precision, whether we were using the autopilot or not. And when we dropped a hand down and rolled the V/S wheel into the zero detent, we knew exactly what EPR to set for level flight, be it at Mach 0.78 at altitude, at 250 knots below 10,000 feet, or at 160 knots with slats and flaps 15. We also understood that being at low altitude and on the back side of the power curve with the engines at idle was a no-no. Dead-stick landings were a parlor trick, usually demonstrated only in the simulator.

Today’s pilots go directly to the new-generation auto-flight systems. These usually have at least three vertical modes: pitch controls V/S, pitch controls A/S, and VNAV. There is no standard nomenclature, or even standard function between manufacturers. For example, Boeing calls its pitch controls airspeed mode Flight Level Change. At Airbus it is Open Climb, or Open Descent. As far as I know, there is no course where young pilots learn the basics of autopilot function. There are only the type rating courses, where you learn the type you are being trained on. Even there, Controls and Indicators are all the pilot needs to know.

But questions are left open, and pilots changing types can be led astray. What does the auto-thrust do in a pitch controls A/S mode? Airbus is clearer, with climb thrust in Open Climb, or IDLE in Open Descent. Set an altitude lower than the aircraft altitude and pull, and you get IDLE|OP DES. Set a higher altitude and pull, and you get THR CLB|OP CLB.

On a Boeing, set an altitude higher than the aircraft altitude and press FLCH, and you get THR|FLCH SPD. So far, so good. But if you set a lower altitude and press FLCH, you get IDLE|FLCH SPD, and when the thrust levers reach the aft stop, HOLD|FLCH SPD. What does HOLD mean? It means there is no power to the thrust lever servos. The thrust levers are not going to move. In effect, it says to the human pilot, “You have control.”

On a Boeing, the thrust levers move. That’s great feedback. Except if you touch them the A/T effectively turns off. On an Airbus the thrust levers don’t move, and if the A/T commands idle, the FMA will say IDLE. And in open climb, if you pull the thrust levers back out of the climb detent, the FMA will change from THR CLB|OP CLB to LVR CLB|OP CLB.

Simple, eh?

Background Automation

With the A320, Airbus introduced Alpha Floor. It was active with the A/T in any mode, including IDLE, including OFF. More recently, Boeing introduced ‘auto-thrust wakeup’. But there are situations when the A/T will not wake up. The pilots of Asiana 214 managed to set up such a situation. And neither the Airbus nor the Boeing system anticipate the 5-8 seconds these engines need to spool up from idle to climb thrust. It was this last complication that escaped the notice of Captain Michel Asseline of Air France 296 at Mulhouse-Habsheim. This was the first A320 crash, on June 26, 1988. When the power was advanced from IDLE to TOGA (Takeoff/Go-Around) thrust the aircraft was – according to the DFDR – at 30 feet altitude, 15° nose-up attitude, and 122 knots airspeed.

Alpha Floor and Auto-Thrust Wakeup are examples of what I would call ‘background automation” – in other words, automation that is out of the pilots’ control. A more recent example (not described in most airline operating manuals) is Landing Attitude Modification (LAM). This software was introduced with the B777 to try to prevent landings on the nosewheel. (I know this seems improbable, but an hour spent watching landings at one of our factory schools will change your mind.) On an approach that is too fast, LAM will reduce flaperon droop and, on the B777-300, reflex the ailerons, pushing their neutral position as much as 10° up. This “reduces overall wing lift and causes an increase in angle-of-attack, increasing nose gear ground clearance.”

The Pipeline

In his 1970 book, Handling the Big Jets, D.P. Davies spoke of the line of communication from manufacturers to airlines to their pilots. In his view, that pipeline should be as short as possible and refreshed as often as necessary. Without the essential knowledge about his aircraft and systems, the pilot is unable to do his job.

Davies was a test pilot working for a nation-state regulator (the Air Registration Board). Manufacturers and airlines are businesses, and they face competition. Thus the confusion on what travels the pipeline – is it essential knowledge, or can it have a promotional component? Can it be a sales tool?

Today’s pilots assume that all large aircraft are born with auto-thrust. Where would they learn otherwise? The auto-thrust seems to be engaged all the time – at least, the SOP’s say so, and gradually the pilots start to believe it. (For example, in the Dubai crash the go-around was initiated, the gear was selected up, but the thrust remained at idle.) Nor are the pilots making this up – it is received wisdom from the horse’s mouth. Salesmen from the manufacturer tout “alpha floor” and “auto-thrust wake-up” to the airlines, instructors from the manufacturer train airline instructor pilots and pass on the good news, and the good news leaks (at least by implication) into the airline’s SOP’s.

Where does this leave the pilot? As a trained dog. He or she has been fed with pre-processed ‘knowledge’, and can parrot it back, but is completely lacking in critical intelligence. That quality is the reason a human is aboard in the first place.

Standard Operating Procedures

We were lucky at Air Canada to have wound up with SOP’s on the Airbus aircraft which made sense. (Although it did take seven years: 1988-1995.) We called changes to the FMA so everyone knew what mode we were in. If we disconnected the autopilot to do a visual approach, we called, “Autopilot Off, Flight Directors Off,” and the PNF reached out with both arms to do it. Passing the FAF, the PNF called “Autothrust”, and the PF read the FMA. The only acceptable responses were SPD or OFF. As an airline we had responded to the early A320 crashes, and to the infamous A330 ALT* crash.

Not everyone was so well off. In fact, the airline whose SOP’s responded to crashes seems to have been a rarity. For example, in a United Airlines B777 Flight Manual, Normal Operations, Final Descent from October, 2003, we have “when VNAV is not available, large altitude changes (more than 1000 feet) should normally be accomplished in FLCH. For small altitude changes (less than 1000 feet), V/S may be used so that throttle movement is kept to a minimum. Keep in mind that V/S does not incorporate the speed protection included in other autoflight modes.” (My emphasis.)

This section is copied directly from Boeing documentation. Flying in the face of what we have learned from the A320 crash at Bangalore, it touts Boeing’s pitch controls speed descent mode (FLCH) as the best choice at low altitude, because it has “speed protection.” It ignores the fact that below 3000 AGL, most airlines will have set the missed approach altitude, which is (or soon will be) above the aircraft altitude. Sure – there is speed protection. But the auto-thrust is in IDLE or HOLD and is not going to wake up.

Redacted Evidence

As it happened I was in the Bay Area on July 6, 2013. I eagerly read the coverage each morning in the San Francisco Chronicle and studied the TV news clips. The NTSB Chair at the time was Deborah Hersman. I was amazed and delighted by her open and straightforward sharing of evidence as it emerged. So was the Chronicle. From the edition of Thursday, June 11, 2013, a Joe Garofoli byline has this lead: “There’s a queue of requests to interview National Transportation Board Chairwoman Deborah Hersman, whose daily Sgt. Joe Friday, just-the-facts updates on the investigation into the crash of Asiana Flight 214 have become the unlikeliest must-see of TV viewing in the Bay Area.” Further down in the article is this paragraph: “In releasing a steady flow of information on last week’s crash, Hersman is doing something few bureaucrats do. She says it is her agency’s duty, as the ‘advocate for the travelling public.’ Journalists who have attended the daily briefings express amazement at the unusual amount of detail flowing from the federal bureaucracy.”

I can quote from these articles only because I saved the San Francisco Chronicles from that week. I am glad I did, mostly because of this paragraph from the front-page article on the previous day, Wednesday, July 10, 2013. The headline was “Pilots saw danger, but it was too late.” The paragraph is worth remembering because of where it is on the approach. “The trouble appears to have begun as the aircraft descended to 500 feet on the airport approach. At that point, Lee Jeong-min (the IP, acting as PM) told investigators that he realized the plane was coming in too low and asked Lee Kang-guk (the PF) to pull back, Hersman said.” (My emphasis.)

That communication was marked ‘unintelligible’ in the CVR transcript.

The Pilots

The Pilot Monitoring (PM) had been a B777 captain for five years. He had qualified as Instructor Pilot (IP) on the B777 in June 2013. The accident flight was his first as IP.

The Pilot Flying (PF) was transitioning from A320 captain to B777 captain. He had logged eight flight legs with an Instructor Pilot before the accident flight. He was in the cockpit for the first four hours of that flight, and then took a scheduled five-hour break. He recalled feeling excited about flying into KSFO, but stressed that the glideslopes on 28L and 28R were out of service. He was “concerned about his ability to conduct a stable visual approach without an electronic glideslope.”

His concern is not surprising. The Asiana 777 chief pilot said the airline recommended using “as much automation as possible.” An Asiana contract simulator instructor said that manual flying was a “big scare for everybody.” Pilots avoided flying manually “because of concern that they might do something wrong and the company would blame them.” Standard practice appears to have been leaving the A/P engaged to 1000 AGL or lower.

In his approach briefing, the PF stated he would use the autopilot in LOC mode for lateral guidance, and V/S to maintain the vertical profile. Prior to that briefing, and before the IP returned to the flight deck, the relief captain advised the PF that he had programmed the FMC for the LOC 28L approach, and of the likelihood that “the flight would be held at high altitude and/or high speed by air traffic control for longer than normal during the approach to SFO.”

The Story

Here’s the thing: in the years since it happened, this accident has changed, at least in my head. It is like the recent election down south. At first it is incomprehensible, the impossible become real. Then we delve deeper into what led up to it, and it begins to make some sort of twisted sense.

There are human beings trying to do their jobs. Their employer is trying to operate as a successful business, but knows next to nothing about flying. It accepts unchallenged whole hunks of policy from the manufacturer, itself a business which knows little of flying and less about running an airline. On the other end, the regulatory bodies have swallowed hunks of policy from the manufacturer via lobbyists and the manufacturer has remained solvent via grants and incentives from the nation-state. But this has always been so. Why, then, does something like Asiana 214 happen now?

The last defence has always been people. The captain. A few courageous souls in Flight Operations who can push back against dangerous trends. But people with survival in their DNA were not present on the flight deck on July 6, 2013. Neither had they appeared in the apprenticeship and training pipeline. So when push came to shove at 11:25:08 that morning, the dangerous bits of policy arose unchallenged.

You or I, right about then, would have called, “Autopilot Off, Flight Directors Off” and checked the FMA to make sure it had happened. Someone would have called “Auto-thrust . . . SPD”. But in the culture of the moment flying by hand would have seemed reckless. So the PF stuck to his plan and rolled the V/S wheel to -1500 fpm. Here the airplane was 7.4 miles from the runway, gear down, flap 5, 184 knots, and 3100 MSL. It was about 650 feet above a 3° glideslope.

Then at 11:25:23 the PM calls “(* * *)”, followed by “ok” and “one thousand”. (Asterisk means ‘unintelligible word’). Then NORCAL switches the flight to tower. The PM checks in. Meanwhile the PF has rolled the V/S wheel back to -1000 fpm, effectively ending the correction back toward a 3° glideslope. That was the first step in the unwinding. The next steps followed quickly.

Following SOP’s, the PF sets the G/A altitude of 3000 feet. He calls for and receives Flap 20. Then he calls for Flap 30, but the PM says, “Speed check flaps 30, sir”. (They were four knots fast.) Ten seconds later, the PF selects FLCH. Immediately, the automatics initiate a climb to 3000 feet. Someone – probably not the PF – selects Flap 30. The FMA goes to THR|LOC|FLCH SPD. The engines start spooling up. Frustrated, the PF pulls the thrust levers back to idle.

There is a lot happening here, and no indication that the pilots understand any of it. Three seconds after selecting flap 30, the PM says, “Flaps 30.”

11:26:28.3 CAM-1 flaps thirty.

11:26:29.5 HOT-2 * sir *.

11:26:32.5 CAM-1 flight director.

11:26:34.0 CAM-2 check.

11:26:35.7 CAM-1 speed.

11:26:36.8 CAM-2 target speed one three seven.

{CAM = Cockpit Area Microphone; CAM-1 = voice identified as PM, CAM-2 =PF, CAM-3= Oberver}

At 11:26:37, the engines have just returned to idle. The FMA reads HOLD|LOC|FLCH SPD. In HOLD, there is no power to the A/T servos. With the selected altitude above the airplane, the A/T will not “wake up”. The airspeed is 165 knots, the altitude 1350 feet.The airplane is in landing configuration – gear down, flaps 30. The PAPI shows 4 white lights. They are still about 400 feet high.

This is the last moment the flight meets company requirements for a stabilized approach. All, that is, except one: the engines are at idle. (“Thrust setting appropriate” is the sixth of seven items on the stabilized approach requirements list.)

11:26:40.4 CAM-2 flight director off.

11:26:41.3 CAM-1 okay. (the PM did not turn off his own FD)

11:26:44.0 CAM-1 it’s high (in Korean)

11:26:52.2 CAM-1 one thousand.

11:26:54.2 CAM-2 check.

This is the second time the PM has called, “one thousand.” This time they are at 1000 AGL.

11:26:58.6 CAM-3 sink rate sir.

11:26:59.1 CAM-2 yes sir.

At 11.27.05, the airspeed is 146 knots, the altitude 720 feet. They are 1.7 miles from the runway, and the PAPI is is showing 4 white.

11.27.05.1 CAM-3 sink rate sir.

11.27.06.1 HOT-1 cleared to land? (in Korean)

11.27.07.3 CAM-? sink rate. (in Korean)

11.27.07.5 TWR Asiana two one four heavy San Francisco tower runway two eight left cleared to land.

11.27.10.7 CAM * * * *

This is where the Deborah Hersman’s quote fits in: “At that point, (500AGL) Lee Jeong-min (the IP) told investigators that he realized the plane was coming in too low and asked Lee Kang-guk (the PF) to pull back.” The words have become unintelligible, and which pilot is speaking has become a mystery.

11.27.10.8 RDO-2 cleared to land two eight left Asiana two one four.

11.27.14.3 CAM-1 okay.

11.27.15.5 CAM five hundred. [electronic voice]

11.27.16.6 HOT-2 landing checklist.

11.27.16.8 CAM minimums, minimums. [electronic voice]

11.27.17.5 CAM-1 landing checklist complete cleared to land.

11.27.19.8 HOT-1 on glide path sir.

11.27.21.2 CAM-2 check.

At 11.27.14 and 1.4 miles from the runway, the airplane descended through the glideslope and simultaneously slowed through the approach speed. At 11.27.19.8, as the PM called “On glide path, sir”, the aircraft was 1.1 miles from the runway, at 380 radio altitude and 133 knots (V_ref was 132) and descending at 1200 feet per minute. The approach is seriously de-stabilized by any standard, and the engines are still at idle.

The PM has not called “five hundred”, as Asiana SOP’s prescribe, and received the response “stabilized” or “go-around”. Instead he has said “pull back”, and that is what the PF is now doing. Over the next fifteen seconds the pitch attitude rises from 0° to 7° and the airspeed drops to 120 knots. Three seconds later (11:27:38.2) there is the sound of a pilot seat being adjusted.

We’ll rewind and pick up the narrative at 200 AGL. The quadruple chime is a caution-level aural alert, associated in this case with low airspeed.

A/S Pitch Att.

11.27.32.3 CAM two hundred [electronic voice] 121 5°

11.27.33.6 CAM-1 it’s low. (in Korean) 120 6°

11.27.34.8 CAM-2 yeah. 120 7°

11.27.36.0 HOT-? * 118 7.5°

11:27:38.2 CAM [sound similar to electronic seat adjustment]

11:27:39.3 CAM [sound of quadruple chime] 114 8°

11:27:41.6 CAM one hundred. [electronic voice] 110 9°

At 11:27:43 the thrust levers begin to move up.

11:27:42.8 CAM-1 speed. 108 9.5°

11:27:44.0 CAM-? Speed * *. 107 10°

11:27:45.8 CAM fifty. [electronic voice] 103 12°

The thrust levers are all the way forward and the engines are spooling up. A passenger seated behind the right wing notices a geyser of water where the engine exhaust kicks up the surface of the bay.

11:27:46.4 CAM [sound similar to a stick shaker lasting 2.24 seconds]

11:27:46.6 CAM forty. [electronic voice]

11:27:47.3 CAM thirty. [electronic voice]

11:27:47.8 HOT-1 oh # go around.

11:27:48.6 CAM twenty. [electronic voice]

11:27:49.5 HOT-2 go around.

11:27:49.6 CAM ten. [electronic voice]

11:27:50.3 HOT-? oh.

11:27:50.3 [sound similar to impact]

Simulator Evaluations

• It was determined that the flight could have made a successful go-around as late as 11-12 seconds before impact. The PM began to move the thrust levers up 7 seconds before impact.

• Asiana’s guidelines on a stabilized approach recommend that the rate of descent be not more that 1500 fpm below 2000 AGL and not more that 1000 fpm below 1000 AGL. In ten simulator runs beginning from the accident profile at 2100 feet, six broke one or both of those restrictions to achieve a stabilized approach by 500 AGL. Four failed to achieve a stabilized approach.

• Pilot eye height was calculated and correlated with the PAPI guidance (see Figure 4)

Pilot Interviews

• No crew member recalled seeing the change to HOLD|LOC|FLCH SPD on the FMA.

• The PF stated that the A/T was “always working”, and if the airspeed got too slow it would transition to TOGA thrust.

• The PF said he considered using FLCH to get a higher descent rate, but could not remember if he had done so.

• The PF recalled thinking that “if he allowed the PAPI to go to four red lights he would fail his flight and be embarrassed.”

Conclusions (mine)

Airbus Alpha Floor and Boeing “auto-thrust wakeup” are different animals, but they come wrapped in the same promotion package. In both cases the package promises but cannot deliver. And pilots are deceived by the FMA. What does HOLD mean? Most of the time, the auto-thrust will ‘wake up’ out of HOLD mode. But not all of the time.

Asiana’s SOP’s were detailed and overly prescriptive, and their whole SOP culture had no sense of priorities. Pilots were afraid of the vertical speed restrictions, but ignored the FMA callouts. There was no requirement to turn off both flight directors when flying by hand. When push came to shove, the SOP’s overrode airmanship and even the survival instinct. Automation and the SOP’s were viewed by the company as compensating for the lack of skill of the line pilots. But in the simulator runs from the accident profile, no pilot achieved a stabilized approach within the conditions of the Asiana SOP’s. It was the invisible hand of the market at work. The SOP’s had priced the operation beyond the skill level of the pilots.

When pilots are discouraged from flying the airplane, and never fly without auto-thrust, skills atrophy. (Assuming they were there in the first place.) The PF adjusted his seat 11.8 seconds before impact perhaps because that was a reaction to being overloaded, but more likely because he couldn’t see out the windscreen and didn’t realize he had already pulled the aircraft to 7° nose-up. That only makes sense if the pilot has drunk the Kool-Aid passed down from above – from regulators, marketers, and airlines incapable of writing good Standard Operating Procedures.

The effects of all this intercession on the accident flight are clear. Not only were the pilots incapable of doing their job; they were also prohibited from ever learning it.

Loss

You – most of you – were in the military. You flew the Clunk, the Sabre, the Lawn Dart. You were pilots flying airplanes. Challenging airplanes. Then you were flying for an airline and you took it seriously. And you had the chops to do so. Worldwide, how are today’s pilots going to get that calibre of chops?

So. We are speaking of loss. Loss of seriousness. Loss of experience. Simply loss of what was, in our time. But we can’t stop there. We have to be open-eyed. We have to acknowledge that time is change is loss. We have to ask, is there a pipeline we can use to hand some of it down to those who follow?

Acknowledgements

I am indebted to you, my teachers, and to Mark Goodrich, who continues trying to get me up to speed on the arcana of the B777 in particular, and on the normal operations of the intercessors (robots, manufacturers, airlines, and regulatory bodies) in general. Thank you all.

Chris Brown

January 12, 2017