Based on preliminary reports, the Asiana 214 crash may end up being partially attributed to confusion regarding to what extent the autopilot was managing the airplane and what the human crew still had responsibility for (notably in the management of the thrust levers).
As flight instructors one thing that we stress, starting with the very first lesson, is a positive exchange of flight controls. This is particularly important in helicopters due to their lack of stability. There shouldn’t be any confusion about who is responsible for the aircraft attitude.
Here’s how it works with humans:
- instructor or pilot1: you have the controls
- student or pilot2: I have the controls (puts hands on yoke, stick, or cyclic)
- instructor or pilot1: you have the controls (after seeing student’s hands on controls, removes his or her hands)
When sharing responsibility, here’s an example exchange:
- instructor or pilot1: you have the pedals and collective
- student or pilot2: I have the pedals and collective
- instructor or pilot1: you have the pedals and collective; I have the cyclic
When an autopilot trips off due to a failure of some kind or simply due to disconnection via a switch there is typically a fairly loud alarm that the pilot(s) would have a hard time missing. But when changing modes there is nothing like the positive control exchange described above. The autopilot may switch from flying a heading, for example, to tracking a course over the ground and the only indication is some text changing at the top of the “primary flight display” (PFD). A pilot whose attention is focused on some other task may very likely miss the change.
The popular conception of the autopilot is that it does everything or it does nothing. Push the autopilot button and the airplane will land itself at the destination. Disconnect the autopilot and you’re hand-flying like a 1920s barnstormer. In fact the autopilot has a dozen or more modes, even on a simple four-seat airplane. The autopilot could be set, for example, in any of the following ways:
- hold altitude, letting speed and heading vary (the autopilot will adjust pitch (airspeed) to hold altitude, regardless of throttle setting, and the result may be slowing down all the way to an aerodynamic stall)
- descend at 500 feet-per-minute, letting speed be determined by the pilot’s throttle setting, until the airplane hits the ground (or the autopilot is given new instructions)
- climb at 200 knots until the airplane reaches 31,000′ (climb rate will be determined by the throttle/thrust setting)
- track a multi-leg course over the ground that has been programmed into the GPS, getting the aircraft almost all the way to the destination
- track a radial off a VOR (radio beacon on the ground) until the pilot changes the VOR frequency in the navigation radio
- keep the wings level and don’t worry if the heading drifts
- keep the pitch constant and don’t worry if the altitude drifts
- track the localizer (left-right) beam of the ILS but hold present altitude; do not descend to follow the glide slope
- track both localizer and glide slope of an ILS down to the ground (or until disconnection), letting the airspeed be determined by the pilot adjusting the throttle
- track both localizer and glide slope of an ILS but adjust the thrust levers (“autothrottle”) to hold a set-by-the-pilot airspeed
Managing the autopilot is actually more complex than hand-flying the airplane (there are only three mid-air controls (elevator, aileron, and throttle) and each control can be moved in just two directions, giving a total of six possible choices for control inputs at any time).
The little lights and indications that distinguish one autopilot mode from another are subtle. Of course, as pilots it is our job to pay attention to subtle lights and indications, but in practice humans have demonstrated inconsistency at this task. Is it prudent to assume that somehow human pilots are going to get better at something that they’ve never done well in the past?
Considered as a human applicant for an FAA certificate, the autopilot would fail every checkride due to a failure to participate in a positive exchange of flight controls. Here’s the relevant passage from the FAA Practical Test Standards for a Private certificate (the very first step on the path to the left seat of a B777):
During flight training, there must always be a clear understanding between students and flight instructors of who has control of the aircraft. Prior to flight, a briefing should be conducted that includes the procedure for the exchange of flight controls. A positive three-step process in the exchange of flight controls between pilots is a proven procedure and one that is strongly recommended.
When the instructor wishes the student to take control of the aircraft, he or she will say, “You have the flight controls.” The student acknowledges immediately by saying, “I have the flight controls.” The flight instructor again says, “You have the flight controls.” When control is returned to the instructor, follow the same procedure. A visual check is recommended to verify that the exchange has occurred. There should never be any doubt as to who is flying the aircraft.
[A similar passage is contained within the Airline Transport Pilot PTS, but it says “between the pilots” instead of “between students and flight instructors”.]
Potentially a significant improvement in safety could be obtained for $100,000 in engineering cost (and another $100 million in FAA regulatory paperwork, if going to be installed in a transport jet!). The autopilot would feed voice announcements into the pilots’ audio panel and these announcements would occur after every change of mode and also upon big changes in aircraft speed, attitude, heading, or vertical speed. Here are some examples:
- Upon leveling off at a preset altitude: “I have leveled off at sixteen thousand feet. I am tracking a GPS course. You have the throttle.”
- Upon switching legs: “I have switched legs to fly to the Carmel VOR. I have the throttles and am holding present altitude and airspeed.”
- Upon intercepting a glide slope: “We have intercepted the glide slope. I am descending to follow it and track the localizer as well. You have the throttles and airspeed.”
- After a big thrust lever chop: “We are in flight level change mode, planning to level off at FL240 [about 24,000′ above sea level]. I am holding 300 knots. Vertical speed has increased to 4000 feet per minute. You have the throttles.”
Thoughts from fellow pilots and human factors folks?
[Separately, it is worth noting that the autopilot is over 100 years old. See Wikipedia for Lawrence Sperry’s early success with this technology.]
Aural, and especially voice, warnings are rightly saved for the biggies like TCAS (avoiding midair collision) and GPWS (avoiding terrain). There’s already some corruption of this with runway awareness systems and pitch monitoring in the flare to prevent tailstrike having voice warnings in a minority of aircraft.
Ultimately, the more audio clutter, the less the pilot will pay attention, especially under high workload when hearing is the first sense to degrade. Hence, the ‘woop woop’ before the ‘pull up’. I can envisage a terrible arms race of increasingly intrusive attention grabbing warnings that detract from the safe operation of the aircraft if this is not responsibly policed.
As for this usage case, terrible idea. Some of those announcements would take 15+ seconds, maybe longer given most pilots aren’t native English speakers. I can assimilate autopilot mode and instrument data in a glance. I would quickly tune out from the announcement or find a way to mute them.
Awareness of automation comes down to sensible standard procedures and intra-crew communication (known as Crew Resource Management). As a relevant example, if the autopilot is capturing an altitude with manual thrust, the operating pilot should verbalise that as a reminder that power change will be required. The non-op can speak up at this stage if the op pilot forgets, and this allows plenty of time to resolve any confusion before not making that power change might become a problem.
Good human communication and sensibly prescribed standard procedure are the solution here, not more electronic assistance.
Here’s a link to a YouTube video of a lecture given by Warren VanderBurgh at the American Airlines Training Academy way back in 1997 where VanderBurgh describes the pitfalls of relying too much on the planes advanced automation systems which could result in more workload (not less) resulting in the crew becoming task saturated and losing situational awareness.
No idea if this is something that occurred on Asiana Flight 214, but VanderBurgh does an excellent job in explaining why in a number situations, including on final approaches, that dropping down levels of automation, including all the way down to hand flying the jet, is often the most prudent course of action: https://www.youtube.com/watch?v=h3kREPMzMLk
One of the problems of (frequent) voice coming from the autopilot is that it might become difficult to communicate with ATC. It seems that everytime I acknowledge to ATC that I will contact departure (after takeoff), there is a loud altitude alert that I am 1,000 feet of my intended altitude.
Will, Jan: Agreed that audio clutter is a bad thing. But with only slightly more programming effort (okay, maybe more than $100k!), the autopilot could try to adapt itself to the prevailing conditions in the cockpit and save its non-urgent announcements for a time when less was going on. That’s what a good human co-pilot would do.
The announcements could also be limited to situations in which the human pilots hadn’t done their share, e.g., aircraft levels out but there hasn’t been any thrust lever adjustment, and/or when something is a little unusual (driving down the localizer and getting near the final approach fix but glide slope tracking is not armed).
Will: I don’t think “better CRM” is the answer to cutting our existing accident rate. In my training at Comair they gave us the example of the American Airlines jet that crashed in Colombia due to an improperly tuned ADF. They asked us what could have prevented the accident and I said “A GPS and a $50 copy of Microsoft Flight Simulator to show them that they were flying into the mountainside.” It turned out the right answer was “better CRM” but in fact the evidence showed that the pilots, both of whom I think were USAF veterans as well as long-time AA pilots, were working together reasonably cooperatively. I pointed out that if these guys couldn’t do it then there was little hope for us newbies who’d recently transitioned out of four-seat airplanes. Planning simply to do a better job than an experienced mainline American Airlines crew was not a realistic plan. (Needless to say, this was deemed to be officially the wrong answer!)
Rather than audio cue’s, what about visual? Portions of the throttles and yoke could be made with translucent acrylic sections(lite pipes) with internal LED’s. They would glow green when under autopilot control. Under pilot control, they would glow amber or not at all and default to their natural, milky white, color. These would not get lost or ignored as the fine print indications on various gauges and MFD’s might.
The final straw in Asiana 214 seems to be the trainee was coming from Airbus and would not be alerted when the throttle lever did not move when he was assuming autothrottle engaged. The 777 and other Boeings have servo-driven throttle levers that follow autothrottle commands. Apparently Airbus throttle levers don’t move under autothrottle.
Hi Phil,
I agree CRM does not equal Human Factors, but good CRM reduces HF fails. In the example of wrong NDB tuned, most of the time a disciplined cross check by the other guy would have picked this up. There will inevitably be times when the cross check does fail too and, for me, it is at this point, where humans have clearly failed, that electronics should come in and save the day. You suggested GPS, we indeed now have GPS-assisted EGPWS which would catch this error.
The proposed autopilot announcements just seem too pre-emptive. They assume the double failures of both appreciating autopilot selections from their associated visual annunciations, and also a CRM-driven cross check.
I think you agree that the announcements shouldn’t jump in before it’s clear the humans “haven’t done their share” but I think it’s pretty much impossible for the computer to work out when that is. The situations you give as examples are actually conceivable- you might want to level out of a descent with power off to slow down and configure after descent with a higher, draggier, airspeed. You might intercept the localiser but not arm glide path if you’re flying a localiser-only approach for currency/training.
If we allow pre-emptive intervention, I fear we increase reliance on automation and electronic warning systems that can fail airborne or we wish to dispatch with broken. When that day comes, we are less prepared.
Truly abnormal situations are alerted by existing systems like the stick shaker and overspeed aural warning.
But, for Asiana 214, the stick shaker came too late, and the EICAS ‘Airspeed Low’ annunciation was ignored. So maybe there is scope for a system that analyses airspeed trend and gives warning with adequate recovery time, much like EGPWS improves on GPWS by warning with sufficient time to effect recovery.
Besides the above, another reason to not have audible announcements is that they do not do an adequate job of describing a semi-autonomous state. I don’t see how a single annoucement could convey the complexity of a specifc FLC mode impacting the autothrottles.
One of the lessons of Asiana 214 is that even with two airspeed indicators clearly in front of three pilots, humans can get distracted. Perhaps Airbus has the right approach of having better autonomous envelope protection so that distractions would not be a safety factor in the first place. Whether we like it or not, it is inevitable that there is spiral of better automation leading to loss of basic airmanship leading to even more automation.
How about software that is tracking where the aircraft is on final approach, speed (or even better, AoA), and the rates of change of all these vs. a range of acceptable values. Basically what a good pilot should be doing… If any parameters are out of an acceptable range it says, “Unstabilized approach, GO AROUND.” No argument. 🙂
It shouldn’t even care what mode the autopilot is in, it’s just playing the part of an infallible copilot…
Will, Craig: I think Will’s point about EGPWS is a good reminder that the plane already has about 80 percent of what it needs to implement Craig’s idea. The terrain warning system knows where all of the world’s runways are and uses that database to suppress warnings about being too low. So a slight refinement of that system would yield the system that Craig proposes, e.g., noticing that that plane is not on anything resembling a 3-degree glide slope toward any runway in the database.
I’d just like to thank all of you from someone with no domain knowledge these discussions and anecdotal stories are fascinating.