Safety The Human-Engine Interface Many problems, one easy solution

BY JAMES ALBRIGHT [email protected]

y first piece of aircraft auto- you to engage the autothrottles for autothrottles had a role to play leading SAICLE/GETTY IMAGES mation was a flight director in takeoff and then simply forget about up to the scene of the accident. Four fol- the Northrop T-38. It was pure them until after landing. And, I must low — each with an autothrottle prob- magic: Two mechanical needles admit, sometimes I forget about them. lem. Let’s see if we can come up with a Mcame into view, one for course and an- But these days, I mostly don’t trust solution. other for glidepath, and you simply flew them during the climb because with the airplane so as to center them. Over the wrong mode of the autopilot they Case Study: Gulfstream the next few years the crossbars turned can result in a stall. Oh yes, I don’t trust GIV, G-GMAC to vee bars, but there was nothing them en route because changing envi- earthshaking until one of my airplanes ronmental conditions can leave us short Problem: There has been a divergence of allowed us to couple those bars to the of thrust. And then there is the descent. opinion in the Gulfstream world on the autopilot. Now, that was neat. And don’t get me started about the ap- proper way to engage and disengage Then came an autothrottle system proach phase! OK, OK. I guess I just the autothrottles. There are two sets of that was good for an ILS approach and don’t trust them. But I do use them from switches, forward and aft of what are autoland, but not much else. (It could not takeoff to landing; they free up my brain called throttles, power levers or thrust be trusted for takeoff or climb.) for other things. levers. The type of switches used has It wasn’t until I got to the Gulfstream Why so paranoid? There have been a changed but their locations remain the GV that I had an airplane that allowed lot of accidents over the years in which same. The forward switches will only disengage and the aft switches will en- gage or disengage. You can only engage with the switches aft of the throttle stems, so no debate there. I believe you U.S. AIR FORCE should only disengage using the forward switches, since there is no chance you will engage the autothrottles with a “double click.” But Gulfstream gives us the option and it seems many pilots use the aft switches for everything. On Dec. 1, 2004, a crew destroyed a perfectly good airplane while land- ing at Teterboro Airport (KTEB), New Jersey. The pilot disengaged the auto- throttles at 570 ft. AGL. It is unclear as to who or why, but the autothrottles were re-engaged at 38 ft. The GIV can- not be landed with the autothrottles en- gaged and I speculate that the pilot hit Northrop T-38 attitude director indicator, circa 1979 the aft engage/disengage switches at

56 Business & Commercial Aviation | August 2020 AviationWeek.com/BCA Case Study: Turkish Well, maybe they were. Here’s my Airlines Flight 1951 take: The radio altimeter system was one of the leading maintenance squawks KEVIN KNECHT Problem: Does this sound topi- for the Boeing 737-800 of the time — in cal? A Boeing 737 equipped fact, it was the top squawk at Turkish with two sensors used by the Airlines. Boeing knew a faulty radio al- automated flight system was timeter could cause an autothrottle “re- designed to use only one of tard” mode while in flight but reasoned those sensors at a time, ignor- that the cockpit had more than enough ing the opposite sensor. Then warning systems to alert the crew. one day the sensor being used Actually, the very airplane involved in went bad and the airplane this crash had the “retard” mode occur crashed, even though the op- in two previous flights in the previous posite sensor could have saved 48 hr. But each crew noticed the “RE- the day. It has nothing to do TARD” annunciation, the decaying air- Gulfstream GIV autothrottle switches with the 737 MAX of the Lion speed, the low-speed cue and the higher the last moment to ensure they were Air Flight 610 era; this was 10 years ago. than usual deck angle. Each crew dis- disengaged. Of course, that caused them In a nutshell, here is what happened connected the autothrottles and flew the to re-engage. to Turkish Airlines Flight 1951 on Feb. jet to a successful landing. This crew After landing when the speed de- 25, 2009: The captain’s radio altimeter did not. Rather, the captain was busy cayed below the target approach speed, malfunctioned to read -8 ft. in flight. training a new first officer, but there the autothrottles pushed the thrust le- DUTCH SAFETY BOARD vers forward, making it impossible for the pilot to lift the reverse levers out of their stowed detent. With available runway disappearing, the pilot activated the emergency brake, which does not have anti-skid protec- tion, and the airplane departed the run- way. All survived the landing except the airplane. The NTSB blames the crew’s inad- vertent engagement of the autothrot- tles and failure to recognize that during landing. The Safety Board also notes the lack of autothrottle switch guards and a lack of an audible engagement tone. But Turkish Airlines Flight 1951 flight mode all of that misses the point. annunciations during approach Once the airplane had been landed the pilot should have noticed the throt- tles moving forward and he should have The crew were slam-dunked into Schi- was a third pilot on the flight deck as slapped them back. I am speculating phol Airport, a common occurrence. A a safety pilot. Nevertheless, they got that the pilot’s right hand was not on the poor design allowed the autothrottles rushed with the slam dunk and nobody throttles during the final phase of the to use the left radio altimeter while the noticed the visual cues and five audible approach and landing until he wanted first officer flew the ILS with the autopi- warnings until the stick shaker alerted the reversers. lot coupled to the right autopilot. As the them, too late. Solution: Keep your hands on the aircraft intercepted the ILS from above, Solution: Keep your hands on the the autothrottles had all they needed throttles during approach and landing, NTSB to go into “retard” mode. Neither pilot DUTCH SAFETY BOARD seemed to correlate a cascading series of warnings, including one for low air- speed, and the resulting high deck angle, with the radio altimeter failure. The 737 ran itself out of speed at about 500 ft., at which time it stalled. The airplane impacted short of the run- way. Nine of the 135 people on board were killed. The airplane was destroyed. Gulfstream GIV G-GMAC The Dutch accident investigators Turkish Airlines Flight 1951 wreckage throttles during approach and landing, placed the blame on Boeing for the de- and mentally connect what they are do- sign of the radio altimeter/autothrottle and mentally connect what they are do- ing against what you want them to do. If interface while giving the crew an addi- ing against what you want them to do. If there is a disagreement, put the throt- tional mention, as if they were bystand- there is a disagreement, put the throt- tles where you want them. ers to the crash. tles where you want them.

AviationWeek.com/BCA Business & Commercial Aviation | August 2020 57 Safety

Case Study: Asiana mode control panel or flight manage- will be surrounded by a green box for Airlines Flight 214 ment computer. 10 sec. The A/T will remain in HOLD υ࠙Thrust (THR) — Thrust applied to mode until one of the following condi- Problem: Airlines in South Korea have maintain the climb/descent rate re- tions is met: a long history of crashing airplanes be- quired by AFDS (autopilot flight direc- (1) The airplane reaches the MCP tar- cause their pilots had difficulty when tor system) pitch mode. get altitude. they were deprived of an ILS signal and υ࠙Idle (IDLE) — Occurs when A/T (au- (2) The pilot engages a new AFDS their crews were unwilling to challenge tothrottle) controls the thrust levers to pitch mode or new A/T mode. the most senior pilot on the flight deck. the aft stop. (3) The A/T arm switches are turned This particular crash fits that mold, but υ࠙Hold (HOLD) — Occurs when A/T re- off. the design of the autothrottle system moves power from the servo motors. In (4) The thrust is manually com- combined with poor pilot technique was this mode, A/T will not move the thrust manded to increase past the thrust certainly a factor. levers. limit. On July 6, 2013, Asiana Flight 214, υ࠙Flight level change (FLCH) — A mode (5) The A/P is disconnected, and both a Boeing 777, was on approach to on many autopilots that holds speed by F/D switches are turned off. San Francisco International Airport either bringing the throttles to idle or This seems nonsensical at first. If (KSFO) on a clear day with no real chal- climb thrust while controlling speed you are in an idle descent why do you lenges to speak of, except maybe one. with the elevator. want the autothrottles to essentially The ILS glideslope was out of service. I am familiar with all of these modes stop moving once they hit idle? To ra- While many U.S. pilots prefer visual ap- except the HOLD mode, but more on tionalize a reason, visualize a typical proaches, many Korean airline pilots that later. Airplane speed can be con- descent with autothrottles that don’t seem to fear them. The crew started the trolled by the AFDS or the A/T. When do this. You start down and the auto- approach too high, made a few automa- the AFDS is controlling speed, this is throttles go to idle. As you descend the tion mistakes that caused them to get informally called “speed-on-elevator,” speed target will eventually change even higher, and then as they were plum- as the speed is controlled by modifying from Mach to Indicated or Calibrated meting down to briefly pass through the the pitch of the airplane through eleva- and that could cause the throttles to correct glidepath (at a very high descent tor movement. This is typically dur- come up momentarily. Environmental rate), they ended up with the autothrot- ing a climb when the thrust is set at an conditions can change so the speed is tles in a mode that would not correct upper limit, or during a descent when suddenly too low and the autothrot- their speed. They got too low and slow the thrust is set to idle. When the A/T tles will move forward only to move to safely recover and impacted short of is controlling speed, this is informally back again. This back and forth makes the runway. called “speed-on-throttle,” as the speed it harder to descend quickly and can There is much to unpack from this is controlled by movement of the thrust be annoying in the cabin as the power accident and I encourage you to do that. levers. The A/T controls speed only comes up and back again. So, I guess, But for our purposes here, let’s look at when it is in SPD mode. This is typically there is a reason for this behavior. the Boeing 777 autothrottle system. at times other than a climb or descent, But isn’t it dangerous? Typically, The autothrottles have several modes such as in cruise or on an approach. you are descending to a target alti- that should be familiar to most auto- In FLCH SPD mode, A/T is limited tude on the mode control panel (MCP) throttle users: by the thrust limit at the forward range at which point the HOLD mode is re- υ࠙Thrust reference (THR REF) — of thrust lever travel and by idle at the leased. But the sequence of events for Thrust set to the reference thrust limit aft range of travel. During a FLCH de- Asiana Flight 214 left the throttles in displayed on EICAS. scent, HOLD mode will engage when HOLD until it was too late. They were υ࠙Speed (SPD) — Thrust applied to the thrust levers reach the aft stop too high coming down rapidly. Their maintain target airspeed set using the or if the pilot manually overrides the MCP target was set to 3,000 ft., which was the missed approach altitude for Boeing 777 the ILS. The pilot wanted to increase NTSB mode his descent rate and selected the annunciator FLCH mode, wanting the autothrot- tles to command an idle descent. But A/T. During a the autothrottles increased thrust for FLCH climb, a climb, because the MCP target alti- HOLD mode will tude was above them. The pilot manu- engage only if ally overrode the autothrottles, pulling the pilot manu- them to idle and placing them into the ally overrides HOLD mode, where they would stay the A/T. When until one of the conditions noted above the HOLD mode was met. engages, the an- But most of those were unlikely to nunciation for happen: The MCP target altitude was the A/T mode above their actual altitude, they were will change flying a visual approach and were un- from “THR” to likely to change that, and they normally “HOLD,” and left the A/T arm switches on. Inter- the annunciation estingly, Asiana standard operating

58 Business & Commercial Aviation | August 2020 AviationWeek.com/BCA procedures called for the PM to turn I’m not so sure. There is a lot of infor- Case Study: Emirates both F/D switches to off and then his mation on that display and the “HOLD” own to on during a visual approach. Had is tucked away on top with other things Flight 521 the PM done this, the A/T would have that compete for attention. Of course, Problem: This was a surprising accident released the HOLD mode, but the PM the pilot should have spent some time on many fronts. First, Emirates has a simply turned the PF’s F/D switch off looking at the airspeed indicator and sterling safety record and the carrier’s and left his own on, and the HOLD mode the approaching amber band and bar- record was perfect with the Boeing 777. persisted as a result. By the time the PF ber pole. There is a trend vector fore- Second, from what I’ve heard about realized he needed more thrust, it was casting what is to come. But there was UNITED ARAB EMIRATES REPORT too late. an even better predictor of what was to Note that in many accidents where come in this Boeing: the throttles that automation is a factor, the investigators move even when being manipulated by never fail to point out that the mode in the autothrottle system. question is clearly shown to the pilot. Solution: Keep your hands on the An important factor in this case was throttles during approach and landing, that the pilots failed to realize the au- and mentally connect what they are do- tothrottles were in HOLD mode when ing against what you want them to do. If it was clearly annunciated at the top of there is a disagreement, put the throt- Boeing 777 main landing gear tilt position their pilot flight displays. tles where you want them. Emirates, they take all of this very se-

NTSB riously. And finally, the incident itself seemed at first to be one of those cases of a perfectly good airplane destroyed for reasons unknown. On Aug. 3, 2016, this Emirates Boeing 777 appeared to be coming off a stable approach into gusty winds and a hot runway with thermals. Everything ap- peared normal into the flare. While the touchdown was a little late, it wasn’t too bad. The airplane appeared to go around, climb briefly and then fall to the runway. Passengers evacuated (some with their carry-ons in hand) and the airplane was engulfed in flames. The captain initiated the flare 15 ft. earlier than he should have. (As someone I used to fly with on the Boeing 707 often said, Boeing 777 indicated speed display “I’ve done worse and bragged about it.”) The combination of shifting winds (headwinds to tailwinds) and hot run- NTSB way thermals made it difficult to touch down in the touchdown zone, so the cap- tain elected to go around. The captain wasn’t aware that the aft set of wheels on the trucks of his main landing gear were going in and out of ground mode, which made the airplane think it was on the ground for a second. When the captain pressed the Take- off/Go-Around (TO/GA) button, the go- around thrust mode of the autothrottles was disabled because they were “on the ground.” The captain did not realize he was at idle thrust as he pitched up for the go-around. The airplane ran out of speed. As the airplane began to sink, the captain realized his power state and manually advanced the power, but it was too late. It appears to me that the crew did Asiana Flight 214 wreckage everything right all the way to the flare. Briefs, callouts, crew coordination. Very good.

AviationWeek.com/BCA Business & Commercial Aviation | August 2020 59 Safety

The airplane survived the initial im- one without the other, that is not its mo- Finally, in the case of Emirates Flight pact but not the ensuing fire. Incredibly, dus operandi. I find it helpful to think 521, the crew did just about everything the only fatality was a firefighter. It was of the autothrottles as an extension of right but failed to realize the engines a tremendous loss, especially consider- the autopilot, which we know bears con- were not doing what they expected be- ing two things. First, had the captain siderable watching. A common theme cause their human-to-engine interface simply flown the airplane onto the run- to many autothrottle accidents is that was disconnected. way, none of this would have happened. pilots simply stopped thinking about the Years ago I had a mechanic complain throttles at all. that one of our pilots was putting too In the case of the much wear and tear on the throttle

REUTERS Teterboro Gulfstream quadrant. This was in a Gulfstream GV GIV, the pilot disen- where the throttle quadrant is not much gaged the autothrottles, more than two thrust levers connected pulled them to idle and to a rotary variable displacement trans- assumed they would ducer (RVDT) that translated the physi- stay there until it was cal movement of the levers into digital time to pull on the re- signals for the engine’s full authority verse levers. digital engine control (FADEC). The In the case of the throttle quadrant was a $300,000 item Turkish Airlines flight, and we had already broken two of them. Emirates Flight 521 wreckage once the airplane was on You couldn’t simply replace the RVDT the approach the pilots — the entire unit had to be swapped. Second, the go-around was only miss- busied themselves with helping the auto- This caused me to think about my usual ing one thing: Somebody should have pilot catch up with their “slam dunk” and hand-on-throttle technique. pushed the throttles forward when the assumed the autothrottles would take I place my hands on the throttles for autothrottles didn’t. care of airspeed until the “RETARD” takeoff; I remove them at V1. I’ll watch Solution: Keep your hands on the message appeared, which ironically is them closely during the climb, cruise throttles during approach and landing, exactly what happened. and descent. But I typically don’t rest as well as the go-around, and mentally In the case of the Asiana Airlines my hands on them until the gear is down connect what they are doing against flight, the autothrottles behaved as de- again on approach. And I keep them what you want them to do. If there is a signed, but not as expected. Here again there during the approach, landing and disagreement, put the throttles where the pilots were provided the information rollout. I’ve done a few go-arounds over you want them. they needed to survive, but the informa- the years and my hand will stay on the tion wasn’t in a place they could receive throttles until we are at our missed ap- Fixing What Is Broken it because their eyes were not on their proach or pattern altitude again. instruments during the visual approach Is my technique right or wrong? I will In my current aircraft, the autothrottles and the pilot’s right hand was not in “re- leave that to you, but I encourage you to come on when you engage the autopilot; ceive mode” for the one critical piece of read each of these four case studies and the two are linked. While you can use missing information. the recommended solution to each. BCA JAMES ALBRIGHT

Gulfstream G500 pilot Jon Cain with his hands on the stick and throttles.

60 Business & Commercial Aviation | August 2020 AviationWeek.com/BCA