Jeg begynte i samme cockpit som Albright, og har fulgt utviklingen, men ikke så nøye som denne forfatteren har gjort. Hans fire case studies er interessante og relevante, men jeg skulle gjerne lest om den første med den nye fly-by-wire generasjon fly, en A320 som fløy i skogen full av pressefolk; Air France Flight 296 26. juni 1988. (Red.)
Human-Engine interface: Many problems, One Easy Solution
Credit: Dutch Safety Board
My first piece of aircraft automation was a flight director in the Northrop T-38. It was pure magic: Two mechanical needles came into view, one for course and another for glidepath, and you simply flew the airplane so as to center them. Over the next few years the crossbars turned to vee bars, but there was nothing earthshaking until one of my airplanes allowed us to couple those bars to the autopilot. Now, that was neat.
Then came an autothrottle system that was good for an ILS approach and autoland, but not much else. (It could not be trusted for takeoff or climb.)
It was not until I got to the Gulfstream GV that I had an airplane that allowed you to engage the autothrottles for takeoff and then simply forget about them until after landing. And, I must admit, sometimes I forget about them. But these days, I mostly don’t trust them during the climb because with the wrong mode of the autopilot they can result in a stall. Oh yes, I don’t trust them en route because changing environmental conditions can leave us short of thrust. And then there is the descent. And don’t get me started about the approach phase! OK, OK. I guess I just don’t trust them. But I do use them from takeoff to landing; they free up my brain for other things.
Why so paranoid? There have been a lot of accidents over the years in which autothrottles had a role to play leading up to the scene of the accident. Four follow — each with an autothrottle problem. Let’s see if we can come up with a solution.
Case Study: Gulfstream GIV, G-GMAC
Problem: There has been a divergence of opinion in the Gulfstream world on the proper way to engage and disengage the autothrottles. There are two sets of switches, forward and aft of what are called throttles, power levers or thrust levers. The type of switches used has changed but their locations remain the same. The forward switches will only disengage and the aft switches will engage or disengage. You can only engage with the switches aft of the throttle stems, so no debate there. I believe you should only disengage using the forward switches, since there is no chance you will engage the autothrottles with a “double click.” But Gulfstream gives us the option and it seems many pilots use the aft switches for everything.
On Dec. 1, 2004, a crew destroyed a perfectly good airplane while landing at Teterboro Airport (KTEB), New Jersey. The pilot disengaged the autothrottles at 570 ft. AGL. It is unclear as to who or why, but the autothrottles were reengaged at 38 ft. The GIV cannot be landed with the autothrottles engaged and I speculate that the pilot hit the aft engage/disengage switches at the last moment to ensure they were disengaged. Of course, that caused them to reengage.
After landing when the speed decayed below the target approach speed, the autothrottles pushed the thrust levers forward, making it impossible for the pilot to lift the reverse levers out of their stowed detent.
With available runway disappearing, the pilot activated the emergency brake, which does not have anti-skid protection, and the airplane departed the runway. All survived the landing except the airplane.
The NTSB blames the crew’s inadvertent engagement of the autothrottles and failure to recognize that during landing. The Safety Board also notes the lack of autothrottle switch guards and a lack of an audible engagement tone. But all of that misses the point.
Once the airplane had been landed the pilot should have noticed the throttles moving forward and he should have slapped them back. I am speculating that the pilot’s right hand was not on the throttles during the final phase of the approach and landing until he wanted the reversers.
Solution: Keep your hands on the throttles during approach and landing, and mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.
Case Study: Turkish Airlines Flight 1951
Problem: Does this sound topical? A Boeing 737 equipped with two sensors used by the automated flight system was designed to use only one of those sensors at a time, ignoring the opposite sensor. Then one day the sensor being used went bad and the airplane crashed, even though the opposite sensor could have saved the day. It has nothing to do with the 737 MAX of the Lion Air Flight 610 era; this was 10 years ago.
In a nutshell, here is what happened to Turkish Airlines Flight 1951 on Feb. 25, 2009: The captain’s radio altimeter malfunctioned to read -8 ft. in flight. The crew were slam-dunked into Schiphol Airport, a common occurrence. A poor design allowed the autothrottles to use the left radio altimeter while the first officer flew the ILS with the autopilot coupled to the right autopilot. As the aircraft intercepted the ILS from above, the autothrottles had all they needed to go into “retard” mode. Neither pilot seemed to correlate a cascading series of warnings, including one for low airspeed, and the resulting high deck angle, with the radio altimeter failure.
The 737 ran itself out of speed at about 500 ft., at which time it stalled. The airplane impacted short of the runway. Nine of the 135 people on board were killed. The airplane was destroyed.
The Dutch accident investigators placed the blame on Boeing for the design of the radio altimeter/autothrottle interface while giving the crew an additional mention, as if they were bystanders to the crash.
Well, maybe they were. Here’s my take: The radio altimeter system was one of the leading maintenance squawks for the Boeing 737-800 of the time — in fact, it was the top squawk at Turkish Airlines. Boeing knew a faulty radio altimeter could cause an autothrottle “retard” mode while in flight but reasoned that the cockpit had more than enough warning systems to alert the crew.
Actually, the very airplane involved in this crash had the “retard” mode occur in two previous flights in the previous 48 hr. But each crew noticed the “RETARD” annunciation, the decaying airspeed, the low-speed cue and the higher than usual deck angle. Each crew disconnected the autothrottles and flew the jet to a successful landing. This crew did not. Rather, the captain was busy training a new first officer, but there was a third pilot on the flight deck as a safety pilot. Nevertheless, they got rushed with the slam dunk and nobody noticed the visual cues and five audible warnings until the stick shaker alerted them, too late.
Solution: Keep your hands on the throttles during approach and landing, and mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.
Case Study: Asiana Airlines Flight 214
Problem: Airlines in South Korea have a long history of crashing airplanes because their pilots had difficulty when they were deprived of an ILS signal and their crews were unwilling to challenge the most senior pilot on the flight deck. This particular crash fits that mold, but the design of the autothrottle system combined with poor pilot technique was certainly a factor.
On July 6, 2013, Asiana Flight 214, a Boeing 777, was on approach to San Francisco International Airport (KSFO) on a clear day with no real challenges to speak of, except maybe one. The ILS glideslope was out of service. While many U.S. pilots prefer visual approaches, many Korean airline pilots seem to fear them. The crew started the approach too high, made a few automation mistakes that caused them to get even higher, and then as they were plummeting down to briefly pass through the correct glidepath (at a very high descent rate), they ended up with the autothrottles in a mode that would not correct their speed. They got too low and slow to safely recover and impacted short of the runway.
There is much to unpack from this accident and I encourage you to do that. But for our purposes here, let’s look at the Boeing 777 autothrottle system.
The autothrottles have several modes that should be familiar to most autothrottle users:
Thrust reference (THR REF) — Thrust set to the reference thrust limit displayed on EICAS.
Speed (SPD) — Thrust applied to maintain target airspeed set using the mode control panel or flight management computer.
Thrust (THR) — Thrust applied to maintain the climb/descent rate required by AFDS (autopilot flight director system) pitch mode.
Idle (IDLE) — Occurs when A/T (autothrottle) controls the thrust levers to the aft stop.
Hold (HOLD) — Occurs when A/T removes power from the servo motors. In this mode, A/T will not move the thrust levers.
Flight level change (FLCH) — A mode on many autopilots that holds speed by either bringing the throttles to idle or climb thrust while controlling speed with the elevator.
I am familiar with all of these modes except the HOLD mode, but more on that later. Airplane speed can be controlled by the AFDS or the A/T. When the AFDS is controlling speed, this is informally called “speed-on-elevator,” as the speed is controlled by modifying the pitch of the airplane through elevator movement. This is typically during a climb when the thrust is set at an upper limit, or during a descent when the thrust is set to idle. When the A/T is controlling speed, this is informally called “speed-on-throttle,” as the speed is controlled by movement of the thrust levers. The A/T controls speed only when it is in SPD mode. This is typically at times other than a climb or descent, such as in cruise or on an approach.
In FLCH SPD mode, A/T is limited by the thrust limit at the forward range of thrust lever travel and by idle at the aft range of travel. During a FLCH descent, HOLD mode will engage when the thrust levers reach the aft stop or if the pilot manually overrides the A/T. During a FLCH climb, HOLD mode will engage only if the pilot manually overrides the A/T. When the HOLD mode engages, the annunciation for the A/T mode will change from “THR” to “HOLD,” and the annunciation will be surrounded by a green box for 10 sec. The A/T will remain in HOLD mode until one of the following conditions is met:
(1) The airplane reaches the MCP target altitude.
(2) The pilot engages a new AFDS pitch mode or new A/T mode.
(3) The A/T arm switches are turned off.
(4) The thrust is manually commanded to increase past the thrust limit.
(5) The A/P is disconnected, and both F/D switches are turned off.
This seems nonsensical at first. If you are in an idle descent why do you want the autothrottles to essentially stop moving once they hit idle? To rationalize a reason, visualize a typical descent with autothrottles that don’t do this. You start down and the autothrottles go to idle. As you descend the speed target will eventually change from Mach to Indicated or Calibrated and that could cause the throttles to come up momentarily. Environmental conditions can change so the speed is suddenly too low and the autothrottles will move forward only to move back again. This back and forth makes it harder to descend quickly and can be annoying in the cabin as the power comes up and back again. So, I guess, there is a reason for this behavior.
But isn’t it dangerous? Typically, you are descending to a target altitude on the mode control panel (MCP) at which point the HOLD mode is released. But the sequence of events for Asiana Flight 214 left the throttles in HOLD until it was too late. They were too high coming down rapidly. Their MCP target was set to 3,000 ft., which was the missed approach altitude for the ILS. The pilot wanted to increase his descent rate and selected the FLCH mode, wanting the autothrottles to command an idle descent. But the autothrottles increased thrust for a climb, because the MCP target altitude was above them. The pilot manually overrode the autothrottles, pulling them to idle and placing them into the HOLD mode, where they would stay until one of the conditions noted above was met.
But most of those were unlikely to happen: The MCP target altitude was above their actual altitude, they were flying a visual approach and were unlikely to change that, and they normally left the A/T arm switches on. Interestingly, Asiana standard operating procedures called for the PM to turn both F/D switches to off and then his own to on during a visual approach. Had the PM done this, the A/T would have released the HOLD mode, but the PM simply turned the PF’s F/D switch off and left his own on, and the HOLD mode persisted as a result. By the time the PF realized he needed more thrust, it was too late.
Note that in many accidents where automation is a factor, the investigators never fail to point out that the mode in question is clearly shown to the pilot. An important factor in this case was that the pilots failed to realize the autothrottles were in HOLD mode when it was clearly annunciated at the top of their pilot flight displays.
I’m not so sure. There is a lot of information on that display and the “HOLD” is tucked away on top with other things that compete for attention. Of course, the pilot should have spent some time looking at the airspeed indicator and the approaching amber band and barber pole. There is a trend vector forecasting what is to come. But there was an even better predictor of what was to come in this Boeing: the throttles that move even when being manipulated by the autothrottle system.
Solution: Keep your hands on the throttles during approach and landing, and mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.
Case Study: Emirates Flight 521
Problem: This was a surprising accident on many fronts. First, Emirates has a sterling safety record and the carrier’s record was perfect with the Boeing 777. Second, from what I’ve heard about Emirates, they take all of this very seriously. And finally, the incident itself seemed at first to be one of those cases of a perfectly good airplane destroyed for reasons unknown.
On Aug. 3, 2016, this Emirates 777 appeared to be coming off a stable approach into gusty winds and a hot runway with thermals. Everything appeared normal into the flare. While the touchdown was a little late, it wasn’t too bad. The airplane appeared to go around, climb briefly and then fall to the runway. Passengers evacuated (some with their carry-ons in hand) and the airplane was engulfed in flames. The captain initiated the flare 15 ft. earlier than he should have. (As someone I used to fly with on the Boeing 707 often said, “I’ve done worse and bragged about it.”) The combination of shifting winds (headwinds to tailwinds) and hot runway thermals made it difficult to touch down in the touchdown zone, so the captain elected to go around.
The captain wasn’t aware that the aft set of wheels on the trucks of his main landing gear were going in and out of ground mode, which made the airplane think it was on the ground for a second. When the captain pressed the Takeoff/Go-Around (TO/GA) button, the go-around thrust mode of the autothrottles was disabled because they were “on the ground.” The captain did not realize he was at idle thrust as he pitched up for the go-around. The airplane ran out of speed. As the airplane began to sink, the captain realized his power state and manually advanced the power, but it was too late.
It appears the crew did everything right all the way to the flare. Briefs, callouts, crew coordination. Very good.
The airplane survived the initial impact but not the ensuing fire. Incredibly, the only fatality was a firefighter. It was a tremendous loss, especially considering two things. First, had the captain simply flown the airplane onto the runway, none of this would have happened. Second, the go-around was only missing one thing: Somebody should have pushed the throttles forward when the autothrottles didn’t.
Solution: Keep your hands on the throttles during approach and landing, as well as the go-around, and mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.
Fixing What Is Broken
In my current aircraft, the autothrottles come on when you engage the autopilot; the two are linked. While you can use one without the other, that is not its modus operandi. I find it helpful to think of the autothrottles as an extension of the autopilot, which we know bears considerable watching. A common theme to many autothrottle accidents is that pilots simply stopped thinking about the throttles at all.
In the case of the Teterboro Gulfstream GIV, the pilot disengaged the autothrottles, pulled them to idle and assumed they would stay there until it was time to pull on the reverse levers.
In the case of the Turkish Airlines flight, once the airplane was on the approach the pilots busied themselves with helping the autopilot catch up with their “slam dunk” and assumed the autothrottles would take care of airspeed until the “RETARD” message appeared, which ironically is exactly what happened.
In the case of the Asiana Airlines flight, the autothrottles behaved as designed, but not as expected. Here again the pilots were provided the information they needed to survive, but the information wasn’t in a place they could receive it because their eyes were not on their instruments during the visual approach and the pilot’s right hand was not in “receive mode” for the one critical piece of missing information.
Finally, in the case of Emirates Flight 521, the crew did just about everything right but failed to realize the engines were not doing what they expected because their human-to-engine interface was disconnected.
Years ago I had a mechanic complain that one of our pilots was putting too much wear and tear on the throttle quadrant. This was in a Gulfstream GV where the throttle quadrant is not much more than two thrust levers connected to a rotary variable displacement transducer (RVDT) that translated the physical movement of the levers into digital signals for the engine’s full authority digital engine control (FADEC). The throttle quadrant was a $300,000 item and we had already broken two of them. You couldn’t simply replace the RVDT — the entire unit had to be swapped. This caused me to think about my usual hand-on-throttle technique.
I place my hands on the throttles for takeoff; I remove them at V1. I’ll watch them closely during the climb, cruise and descent. But I typically don’t rest my hands on them until the gear is down again on approach. And I keep them there during the approach, landing and rollout. I’ve done a few go-arounds over the years and my hand will stay on the throttles until we are at our missed approach or pattern altitude again.
Is my technique right or wrong? I will leave that to you, but I encourage you to read each of these four case studies and the recommended solution to each.
Ingen kommentarer:
Legg inn en kommentar
Merk: Bare medlemmer av denne bloggen kan legge inn en kommentar.