Ok guys, to be fair: Asiana admits that the crew failed to do their job. But they said that Boeing helped in that fail. I copy-pasted fragments that show the last part only, but told you to go to AvHerald to get the full story.
Here is a fragment of the "full picture": This is a sort of accident investigation report made by Asiana themselves:
I fully agree with the bolded parts. I don't have enough info to judge the last sentence about ATC (but of course that the pilot can always, and MUST if needed, say "unable"). The rest is, in my not-so-humble opinion, BIG TIME ROTTEN DIARRHEA BULLSHIT.
Now, let me explain why in more detail. Most of the explanation below has nothing to do with the Asiana accident, except that you need to understand the big picture to properly manage each mode, including the one used by the Asiana crew. You cannot properly understand just a part of it and expect to use it correctly. In the same way that you cannot just learn the use of the yoke and then say "ok now, let's move to the throttle class".
Let me warn you that this will be a very "Gabriellian" thread.
There are two basic categories of AP modes for the pitch channel:
1- Pitch controls altitude.
2- Pitch controls speed.
The first mode has a good control of the vertical path. The second, used together with other tools and methods, help optimize the operations.
So, if you want to hold the altitude, climb or descend at a specific climb rate, of follow the glide slope of an ILS or other approach with vertical guidance, which mode will you use? Pitch controls altitude.
If you want to climb to cruise at the optimum cruise power and speed, or make a descent with he engines idled, or get the max climb performance with full thrust and best-climb speed, which mode will you use? Pitch controls speed.
There are several modes within the "pitch controls altitude" group.
- Altitude hold: The AP will command pitch to hold the selected altitude and correct any deviations from it. If you are flying in another mode (including manually) and then select "altitude hod" then the selected altitude is automatically set to your current altitude.
- Vertical speed: The AP will command pitch to keep the selected vertical speed and correct any deviations from it. In this mode you will also set a target altitude, which will hopefully be consistent with your selected vertical speed (like a lower altitude of you selected a negative vertical speed). When approaching the target altitude, the AP will revert to "Altitude hold" by itself.
- Glide slope: The AP will command pitch to track the glide slope and correct any deviations from it.
Note that, traditionally, the AP will try hard to follow your command. Too hard.
It will, for example:
- Attempt to fly through the ground if you are descending in vertical speed and the selected target altitude is below the elevation of the terrain.
- Overspeed the plane of you select a sink rate that is too high for the currently applied thrust.
- Stall the plane in an attempt to keep the selected vertical profile when the thrust applied is not enough to sustain it. Examples are Turkish at Amsterdam where they were in "glide slope" mode with the engines at idle and the plane increasingly pulled up to try to keep the glide slope with a deteriorating airspeed, until it stalled, and the Pinnacle crash ("let's four oh' one it, dude, and gimme a diet pepsi") where even max thrust was not enough to keep a healthy airspeed a that altitude, but the AP insisted with his "altitude hold" command and stalled the plane at 41000ft.
Pilots need to understand that the AP is not there to do their jobs. The pilots are still responsible to ensure the flight path. The AP is there to follow the pilot's commands so he is relieved from some workload and has more time to concentrate on ensuring that the plane is doing what he wants. The difference between an AP and a co-pilot is that the copilot will hopefully not fly through the terrain or stall the plane if the captain tells him to do so, and will instead hopefully question the captains orders or advise "sum tin wong". A copilot is a crewmember with whom CRM is possible and expected. The AP is a stupid machine that won't question the pilot's stupidity and will gladly destroy himself in a fiery crash to honor the commands given to it.
The "pitch controls speed" family of modes is in fact just one mode: Speed hold: The AP will adjust the pitch to keep the selected airspeed (or Mach number).
For example, say that you are flying in the "altitude hold" mode and have a thrust that keeps a constant airspeed. Now you select "Speed" mode. What will the plane do? Nothing. With the current altitude and thrust the AP was actively holding the altitude constant but the speed was also stable, so now actively holding the airspeed means that the altitude will be stable.
Now, if from this stable state you:
- reduce the thrust, the AP will pitch down to hold the airspeed.
- increase the thrust, the AP will pitch up to hold the airspeed.
- increase the selected speed, the AP will pitch down to increase the airspeed.
- reduce the selected speed, the AP will pitch up to reduce the airspeed.
In this mode you also enter a target altitude, hopefully different from your current altitude and hopefully consistent to the maneuver you are about to perform (a lower altitude if you are about to descend). When the altitude approaches the selected target, the mode again automatically reverts to "altitude hold".
This is the mode the Boeing calls FLCH for "Flight Level Change", because you use it (among other things) at cruise to change your cruising flight level without changing your speed.
In a time where the FMS managed the horizontal aspect of the flight navigation) but not the vertical path (no V-NAV), it was much more used for other things too. I will go back to that later.
Did you see all the times that I've said "AP" above. Well, delete them. I did it for simplicity, but in fact it's the "FD", "flight director". The "flight director" shows in the attitude indicator the control inputs that the pilot needs to do (pull up, push down) to achieve the desired performance (i.e. the values that you entered and the mode you selected). "The pilot needs to do" here means the human pilot or the auto pilot. The human pilot will typically try to follow the flight director's commands because he knows that this assured the desired performance. But he can also choose not to follow it for whatever reason (for example, realizing that the result is not what he expected). The AP will simply obey the flight director's commands.
Now, all that is the Auto Pilot (AP). What about the Auto Throttle (AT, also Auto Thrust)?
I didn't mention it because of one good reason: all of the above applies with and without AT. In fact, there are many planes with APs that have all the above modes and are not even fitted with an AT.
Now, the AT also have different modes which I will also divide in two categories: "throttle controls speed" and "throttle controls thrust".
The "throttle controls speed" category is the most obvious one and has only one mode that does what it's name says: Speed hold. It adjusts the throttle to hold the selected airspeed (or Mach number). It's the equivalent to the "cruise control" in cars.
In the "throttle controls thrust" category we have different modes:
- Hold a given engine parameter: For example, hold a given N1 (which is a fancy name for RPM).
- Hold a performance thrust: For example, hold take-off thrust or climb thrust or maximum continuous thrust. This is quite similar to the previous one, except that the engine parameter is automatically computed. For example, the N1 for the take-off thrust depends on ambient temperature. So the pilot can look up the correct value for today's conditions and select "hold this N1" or, more simply, select "hold take-off thrust". In some planes, in facts both modes are the same one. The AT will hold a N1 that is shown in a window. Now, that N1 can be manually entered by the pilot or the pilot my chose "show the take-off N1". The AT doesn't care and will just hold whatever N1 is shown.
- Do nothing (I will cal this mode "clamp"): Now, this is tricky. What is the difference between this and "AT off"? The only difference is that the AT will remain engaged, but doing nothing whatsoever, until some specific criteria is met. Then it will "wake up", "kick in" and start doing things. More on this later.
Now, what happens if you select the "speed" mode both in the AP and AT? That shouldn't be done. Only one of them should be trying to hold the speed, or they would be fighting between them.
But there are good news: The engineers are not that stupid, so while the AP and AT are two different systems, there is communication between them, and selecting the "speed hold" in one of them will revert the other one to some other mode (if it was in "speed hold" too). There is more communication and coordination between them.
Let me give you an example of a very simplified full flight in an MD-80 (which is the system I know best). The names will be different in other planes but the concepts will be basically the same.
So the flight, of which I will concentrate only in the vertical profile, is this:
Take off, climb at V2+10, level off at 1500ft, accelerate to 250 while cleaning up, climb to 10000ft at 250, climb to 20000 at 270, cruise at 290, descend to 10000ft at 270, descend to 2500 ft at 250, slow down to Vapp while configuring for landing, follow the glide slope and land.
Here we go:
I'm lined up. The AP and AT are off.
I select "TO/GA" in the Thrust Rate Computer. The correct N1 for take-off thrust appears in a window. In the AT I select the "Hold N1" function, but the AT remains off.
In the AP (in fact, in the flight director) I select 1500ft. The AP also remains off.
I advance the throttles levels to achieve a N1 value that is close to the N1 shown in the window, then I engage the AT which will follow the "N1 hold" mode already set, and adjust the throttle levers to keep that N1 value shown in the window: Take off thrust.
Vee one, rotate, positive climb, gear up. While the plane accelerates, I slowly increase the pitch do diminish the acceleration until I stabilize the plane at V2+10 with about 15 to 20° nose-up attitude (depending on the weight and ambient conditions).
Now I engage the AP in "speed hold" mode. So by now, the AT will hold take-off thrust and the AP will adjust the pitch to hold V2+10.
But remember that I had already selected a target altitude of 1500ft.
When we approach 1500ft, the AP will automatically revert to "altitude hold" and the AT will automatically revert to "speed hold".
So I now select 250 in the AT and the AT increases the thrust to increase the speed while the AP adjust the pitch to keep 1500ft.
As the plane accelerates I start retracting the flaps and slats. The AP makes many pitch corrections to keep 1500ft with all these configuration changes and increasing speed.
The plane will approach 250kts and the AT will reduce the thrust to hold it. Eventually, the plane will stabilize with the AT holding 250 and the AP holding 1500.
Then, I change the AP mode to speed hold at 250, the AT automatically reverts to "clamp" (stops playing with the thrust levers).
Now I select at target altitude of 20000ft and... ta-da!!!! Nothing happens. The plane remains at 250 and 1500.
Ok, now I select "climb thrust" in the thrust rate computer, the correct value of N1 for climb is shown in the N1 window, and now yes... nothing happens.
Now I change the AT mode from "clamp" to "N1 hold". Finally, the AT starts playing with the throttles, increases thrust to hold the selected N1 (which, remember, was the N1 calculated by the thrust rate computer) and the speed will tend to increase, but the AP will prevent that by pitching up.
The plane will achieve a stable climb at climb thrust and 250 kts. And at what vertical speed? Whatever makes the plane hold 250kts. The AP is not caring of vertical speed but speed itself.
When we cross through 10000ft I slowly start to increase the selected speed in the AP to 270. The AT will lower the nose a bit to let the speed increase to 270 and then will pitch up a bit again to hold 270 for the remaining of the climb. Why did I say "slowly increase the selected speed"? Remember I commanded to the AP "you will adjust the pitch to hold the speed I tell you". If we are at 250 and suddenly I tell the AP "now adjust the pitch to hold 270", the "lower the nose a bit" may become more than "a bit". The AP might lower it enough that the plane might actually descend as it builds speed. Nothing serious anyway. As the speed approaches 270 the AP will raise the nose again to stabilize in a 270 kts climb. The "slowly" part was for the sake of smoothness only.
When the altitude approaches 20000ft, the AP will revert to "altitude hold" and the AT will revert to "speed hold".
Now I set 290 in the AT and the plane stabilizes at cruise with the AP holding 20000 and the AT holding 290.
After a while at cruise, it's time to descend.
I change the AP mode to "speed", the AT reverts to "clamp", select a target altitude of 10000 and nothing happens.
So I manually retard the throttles all the way to idle and the AP commands nose down to keep the speed.
I slowly reduce the selected speed in the AP to 270 (again, "slowly" to prevent that the AP actually climbs to reduce the speed quickly), and the plane finally stabilizes in a descent at idle and 270. At what vertical speed? Again, whatever it happens to be the only vertical speed that makes this happen.
Note that now I selected 10000ft as target altitude, but I had not selected the intermediate 100000ft as a target altitude during the climb. The reason is that, during the climb, I have no problem to cross 10000ft at 250 and then accelerate to 270 while climbing. But now want to make sure I won't descend below 10000ft with a speed above 250 because I'd be violating the "250 max below 10000ft" speed limit.
When the plane approaches 10000ft, the AP reverts to "altitude hold" and the AT reverts to "speed hold", but I override it by pulling and keeping the throttle levers to idle. So the plane levels off at 10000ft and, with the throttles levers kept at idle by my hands against the wishes of the AT, the loses speed.
When the speed reaches 250 (because, unlike Asiana pilots, I AM monitoring the speed) I select "speed hold" in the AP and the AT reverts to "clamp".
Now the AP will lower the nose to keep the speed at 250kts. And I don't need to fight against the AT anymore to keep the levers at idle.
The plane will stabilize in a descent at idle and 250kts.
Now I set a target altitude of 2500ft.
When the plane approaches this altitude, the AP will revert to "altitude hold" and the AT will revert to "speed hold", and the plane will stabilize with the AP holding 2500 and the AT holding 250.
Ladies and gentlemen, we will be landing in a few minutes. Fasten your seatbelts, close your trays, and put your seat-backs in the vertical position.
Now I select Vapp (say 140kts) in the AT.
The AT reduces thrust to slow us down, and as we do I start extending the salts and flaps in steps and also lower the landing gear.
When we are close to 140kts, the AT adds thrust and the plane stabilizes at 140kts and 2500ft.
I see that the glide slope needle of the ILS comes alive. I select the glide slope mode in the AP but nothing happens yet. The glide slope is just armed, but since we are not tracking the glide slope yet the active mode remains "altitude hold".
As the glide slope needle approaches the center, the AP mode reverts to "glide slope" and the AP starts to adjust the pitch to keep that needle centered. The AT remains in "speed hold", so it will retard the throttles a bit since less thrust is needed to keep 140kts while descending in the glide slope than what it was needed to hold the altitude.
Perfect, we are stabilized in the glide slope. Now I will select a target altitude of 4000ft. No, I'm not crazy and the AP will ignore it, at least by now. It's the altitude we have to climb in the event of a go-around.
We complete the landing checklist and get the tower clearance to land.
You might not note it, but I am closely monitoring the ILS and the speed and I am ready to immediately disconnect the AP and AT and take manual control if these parameters don't stay where they should. I even have my hand on the thrust levers to have a tactile cue of what the AT is doing and to be able to quickly firewall the throttles if needed.
We are in visual conditions, so our stabilized approach gate is 500ft, and we are approaching this altitude right now.
Let's see:
Aligned with the runway? Check.
Speed stable at Vapp (which is not the same than "crossing through Vapp")? Check.
Stabilized in the glide slope (which is not the same than "crossing the glide slope)? Check.
Thrust stabilized in an "approach" value, and specifically NOT in a very low value (like idle) from where we know that it would take too long to spool up? Check.
Airplane configured for landing? Check.
Landing checklist completed? Check.
Are we cleared to land? Check.
Ok, we go.
I am about to disconnect the AP to manually complete the landing (I plan to leave the AT on so I only need to monitor the speed but don't need to control it, and I will override it by pulling to idle during the flare), but then the tower calls: "There's a cow in the runway, go around".
No problem. I click the "go around" buttons. The AT and AP enters "go around" mode which basically is AT goes to "Take-off thrust hold" mode and the AP goes to "go-around speed hold" mode. I follow with my hand how the AT firewalls the throttles and I monitor the AP pulling up to keep Go-Around speed. Flaps 15. Take-off thrust check. Positive climb, gear up.
Now, remember that target 4000ft that we entered a few minutes ago? There we go. When we approach 4000ft the AP will revert to altitude hold and the AT will revert to speed hold. And we are ready for a second try. Don't worry, I'll not go through it.
There were some simplifications there, but I hope that now we all have a good understanding of the concepts and philosophy behind the design of these AT and AP systems. The big picture.
Now let's move to Asiana.
The pilot is in a long final and finds himself higher and faster than he would have liked to. What are his options?
- Go around.
- Requesting a descending 360 turn.
- Try to correct the situation while continuing the approach.
The pilot opted for the last one. I am ok with that, but don't blame the ATC for this because you had the other 2 options. A pilot is never compelled to follow ATC instructions that he feels are not safe, including if that feeling is due to own limitations rather than technical ones.
So how would a pilot try to correct the situation? Let's see: it's a visual, long straight-in approach in a perfect day with excellent visibility and nearly no winds? I'd likely turn everything off and, manually fly the beast and, if I don't like how it's going, I'll go around.
A second option would be to disconnect just the AP but leave the AT set in "speed hold" and selecting lower speeds (all the way down to Vapp) as we "dirty" the plane by extending slats, flaps and landing gear. But I have to be careful because if I pitch down too much to try to descend to the "good" descend profile, the AT might be unable to keep the selected speed even with the throttles at idle and I might bust some flaps speed.
A third option would be to use the "speed hold" mode (FLCH) in the AP (the AT reverts to "clamp") and pull the throttles back to idle. This is what the Asiana pilot did and, unlike many, I actually like it. A lot! You can just select Vapp in the AP and, as the speed goes down, you start dropping slats, flaps, gear, speedbrakes, the anchor, all what you have. You don't need to care about the speed because the AP will first keep the nose up to slow down to Vapp, and then lower the nose as much as needed to keep Vapp (well, you DO need to care about it and monitor it, but as long as it's doing what you expect you don't need to "manipulate" it). If THAT doesn't correct the situation, then NOTHING will and it's time to go around. And if it works, when you are in the path you wanted you select "speed hold" in the AT and "vertical speed hold" in the AP and make small adjustments in the selected vertical speed to keep the desired descent slope until you finally disconnect the AP and manually land the plane (you can leave the AT on in "speed hold" mode if you want).
But... the Asiana pilot did one more thing: He disconnected the AP.
Now, I know that I have just presented two first courses of action that included disconnecting the AP. But in this third option, doing it is really way too stupid. Think of it:
You tell the system: Autothrottle, forget about the speed. Autopilot, you have the speed. And next you disconnect the autopilot? So who is in charge of the speed now? YOU. Okay, we are now in the first scenario, the pilot is in full manual flight. I am okay with that. That was my first option after all. But if you are going to take full manual control of the plane, why select FLCH in the AP (only do next disconnect the AP) which causes the AT to go in "clamp" mode and leave the AT engaged in a mode that basically means "do nothing"?
AND YOU STILL EXPECT THAT THE AT WILL KEEP A SPEED?????
Again: By selecting the FLCH ("speed hold" mode) in the AP, you have just told the AT "forget about the speed" and told to the AP "you have the speed". And then, killed the AP.
Do you realize the magnitude of the stupidity of this?
If you want to take full manual control, better disconnect everything, right?
But no, this pilot's intention was not to take full manual control. Apparently, his intention was to override the AP to pitch down more steeply and he expected that the AT will take care of the speed (yes, he have just told the AT exactly the opposite, but it seems that he didn't understand what he was commanding by selecting FLCH).
So, why did the pilot thought that the AT would take care of the speed?
Nothing in all this explanation so far said anything about the AT taking care of the speed when not in "speed hold" mode, and in many planes this is the end of the history. However, the 777 adds an additional safety layer: If the speed goes too low, the AT will add thrust to keep the speed and prevent a stall.
This additional safety layer is not required by regulations and that many planes don't have it.
So the pilot was using a last-resource back-up safety feature to operatively control the speed. But there is one thing that he didn't take into account: this feature is inhibited when these two conditions are met at the same time: the throttle levers are at idle AND the plane is below 100 ft above the ground. Why? Because when the pilots flare the plane for landing, they are below 100ft, they pull the throttles to idle, and they do it precisely because they WANT the speed to go down and become what would be "too low" for normal flight.
Look at the videos and animations of the Asiana crash. It would have been a perfect and smooth landing, except that the runway was 2000ft farther. How on Earth could have the AT known that the pilot was not in fact flaring to touch down on a runway that began 2000ft earlier than the actual runway?
The crash was so close to the actual runway, that even the EGPWS (enhanced ground proximity warning system), which is specifically designed for this, couldn't detect that it was landing short of the runway and hence triggered no warning.
So Boeing adds a last-resource back-up safety layer that works exactly as designed but not as the pilot (and Asiana) expected, and now Boeing is sued for such system. If I was Boeing I'd say "You know what? I should have not added it. All operators must disable this function and it will not be included in airplanes coming out of the factory".
It happens all the time: The manufacturers add additional safety features that are not required and then they get in trouble when the operators abuse them. And then the people (and the operators) ask "but why don't add this feature to the feature to prevent this, and then this other feature in case we abuse from the new additional feature in some other way, and then..." And the answer is "because each additional feature that I add is abused by you and then you blame me for it". The manufacturers could add much more safety features but they don't because of this reason.
Let me make an analogy: I manufacture inflatable life vests. These life vest have two independent chambers with two independent gas bottles to inflate them. One chamber is enough to keep you afloat. But the vest is designed with this redundancy in case one chamber leaks or one bottle fails.
Now you have one of these life vests in your boat. You already inflated one of the chambers once some time ago, so you know that this bottle is empty. But never minds, there is another one, right?
You are not rated to operate this boat, but still recklessly operate it in a dangerous reef zone, the hull is breached, you put this life vest and jump. You pull the chord to inflate the other chamber, but it fails. You die and your mother sues me. Know what? Fuck your mom.
And fuck Asiana. That the pilot made this human-factor mistake is serious enough. That Asiana uses this as a defense is criminal.
Ok, another point that Asiana makes is not only that the system failed to give them the expected speed protection, but that the plane didn't want them of the deteriorating airspeed with enough time to correct the situation. Let's revise this:
So, the pilot selected FLTCH, disconnected the AP and retarded the throttle. I don't have this clear, but I will assume that he didn't disconnect the flight director.
If so, the flight director would have shown command bars on the attitude indicator that, if followed, will have made the plane slow down and then keep Vapp. If the AP had been on, it would have followed these command bars.
As soon as the speed goes below Vapp, the command bars will show the need to lower the nose to keep the airspeed. Something that the pilot didn't follow. Cue one.
The plane was last trimmed at 1500ft. From this point down, all and any reduction in airspeed must have been accomplished by the pilot pulling up with increasing yoke travel and increasing force. For any low-time student pilot, the fact that more pull is needed is and must be a clear and unmistakable cue that the speed is going down. Cue two.
In line with the previously explained increasing pull-up, the airplane was flying with increasing levels of nose-up attitude since, as the speed goes down, the angle of attack must increase to keep the lift. In the last stages of the approach but when there was still time to save the day, the nose-up attitude was way above the normal approach attitude (7° vs the normal 2°), and thios attitude is clearly displayed in 3 attitude indicators (two of them directly in front of the pilots in the PRIMARY FLIGHT display that have the words PRIMARY and FLIGHT in its name for a reason). But, more surprisingly, was also "displayed" in the windshield. Remember this was a visual approach, so the pilot had to be looking outside at least from time to time to see if he was high or low, for example. The CVR even recorded the sound of an electric seat motor, which is strongly suspected was one of the pilots raising the seat to be able to see the approach zone through the windshield with this so nose-up attitude. As said, that you need a too nose-up attitude is a strong cue that you are too slow. Cue 3.
Several seconds before the crash, when there was still time to correct, they received a 4-chimes warning and an EICAS alert message that said "AIRSPEED LOW". Did they increased the thrust at this point? Nah! The AT will provide!!! Cue 4.
After all this, the fact the pilot had airspeed indication seems too basic. But there was not one but three airspeed indicators, all correctly showing that the plane was slowing down too much, two of them included a Vapp bug, which is an icon that shows where the airspeed should be so you don't have to say "let's see, the airspeed is 120, it should be 140, oh fuck, I'm 20 kts slow". You just see that the current speed is below the icon and you know you are slow. It's like putting a sticker at the target speed in your car's speedometer. You don't need to "read" the speed. Just tell if the needle is above or below the sticker. Easy, uh? Not only that, but these 2 airspeed indicators that featured the speed bug were, again, directly in front of the pilots in the PRIMARY FLIGHT display that have the words PRIMARY and FLIGHT in its name for a reason. And do you know for how long they showed the speed below the bug until they finally increased thrust? 26 seconds!!!! Who on Earth was the pilot flying the plane during this time? And who was the pilot monitoring? Because holding the speed and monitoring the speed is well within their job requirements, do you know? Cue 5.
So say again, Asiana?
I don't even blame the pilots any longer. This is my final report:
"The probable cause of this accident was fucking Asiana"
[/rant]
Here is a fragment of the "full picture": This is a sort of accident investigation report made by Asiana themselves:
The probable cause of this accident was the flight crew’s failure to monitor and maintain a minimum safe airspeed during a final approach, resulting in a deviation below the intended glide path and an impact with terrain. Contributing to this failure were (1) inconsistencies in the aircraft’s automation logic, which led the crew to believe that the autothrottle was maintaining the airspeed set by the crew; and (2) autothrottle logic that unexpectedly disabled the aircraft’s minimum airspeed protection.
Significant contributing factors to the accident were (1) inadequate warning systems to alert the flight crew that the autothrottle had (i) stopped maintaining the set airspeed and (ii) stopped providing stall protection support; (2) a low speed alerting system that did not provide adequate time for recovery in an approach-to-landing configuration; (3) the flight crew’s failure to execute a timely go-around when the conditions required it by the company’s procedures and, instead, to continue an unstabilized approach; and (4) air traffic control instructions and procedures that led to an excessive pilot workload during a high-energy final approach.
Significant contributing factors to the accident were (1) inadequate warning systems to alert the flight crew that the autothrottle had (i) stopped maintaining the set airspeed and (ii) stopped providing stall protection support; (2) a low speed alerting system that did not provide adequate time for recovery in an approach-to-landing configuration; (3) the flight crew’s failure to execute a timely go-around when the conditions required it by the company’s procedures and, instead, to continue an unstabilized approach; and (4) air traffic control instructions and procedures that led to an excessive pilot workload during a high-energy final approach.
Now, let me explain why in more detail. Most of the explanation below has nothing to do with the Asiana accident, except that you need to understand the big picture to properly manage each mode, including the one used by the Asiana crew. You cannot properly understand just a part of it and expect to use it correctly. In the same way that you cannot just learn the use of the yoke and then say "ok now, let's move to the throttle class".
Let me warn you that this will be a very "Gabriellian" thread.
There are two basic categories of AP modes for the pitch channel:
1- Pitch controls altitude.
2- Pitch controls speed.
The first mode has a good control of the vertical path. The second, used together with other tools and methods, help optimize the operations.
So, if you want to hold the altitude, climb or descend at a specific climb rate, of follow the glide slope of an ILS or other approach with vertical guidance, which mode will you use? Pitch controls altitude.
If you want to climb to cruise at the optimum cruise power and speed, or make a descent with he engines idled, or get the max climb performance with full thrust and best-climb speed, which mode will you use? Pitch controls speed.
There are several modes within the "pitch controls altitude" group.
- Altitude hold: The AP will command pitch to hold the selected altitude and correct any deviations from it. If you are flying in another mode (including manually) and then select "altitude hod" then the selected altitude is automatically set to your current altitude.
- Vertical speed: The AP will command pitch to keep the selected vertical speed and correct any deviations from it. In this mode you will also set a target altitude, which will hopefully be consistent with your selected vertical speed (like a lower altitude of you selected a negative vertical speed). When approaching the target altitude, the AP will revert to "Altitude hold" by itself.
- Glide slope: The AP will command pitch to track the glide slope and correct any deviations from it.
Note that, traditionally, the AP will try hard to follow your command. Too hard.
It will, for example:
- Attempt to fly through the ground if you are descending in vertical speed and the selected target altitude is below the elevation of the terrain.
- Overspeed the plane of you select a sink rate that is too high for the currently applied thrust.
- Stall the plane in an attempt to keep the selected vertical profile when the thrust applied is not enough to sustain it. Examples are Turkish at Amsterdam where they were in "glide slope" mode with the engines at idle and the plane increasingly pulled up to try to keep the glide slope with a deteriorating airspeed, until it stalled, and the Pinnacle crash ("let's four oh' one it, dude, and gimme a diet pepsi") where even max thrust was not enough to keep a healthy airspeed a that altitude, but the AP insisted with his "altitude hold" command and stalled the plane at 41000ft.
Pilots need to understand that the AP is not there to do their jobs. The pilots are still responsible to ensure the flight path. The AP is there to follow the pilot's commands so he is relieved from some workload and has more time to concentrate on ensuring that the plane is doing what he wants. The difference between an AP and a co-pilot is that the copilot will hopefully not fly through the terrain or stall the plane if the captain tells him to do so, and will instead hopefully question the captains orders or advise "sum tin wong". A copilot is a crewmember with whom CRM is possible and expected. The AP is a stupid machine that won't question the pilot's stupidity and will gladly destroy himself in a fiery crash to honor the commands given to it.
The "pitch controls speed" family of modes is in fact just one mode: Speed hold: The AP will adjust the pitch to keep the selected airspeed (or Mach number).
For example, say that you are flying in the "altitude hold" mode and have a thrust that keeps a constant airspeed. Now you select "Speed" mode. What will the plane do? Nothing. With the current altitude and thrust the AP was actively holding the altitude constant but the speed was also stable, so now actively holding the airspeed means that the altitude will be stable.
Now, if from this stable state you:
- reduce the thrust, the AP will pitch down to hold the airspeed.
- increase the thrust, the AP will pitch up to hold the airspeed.
- increase the selected speed, the AP will pitch down to increase the airspeed.
- reduce the selected speed, the AP will pitch up to reduce the airspeed.
In this mode you also enter a target altitude, hopefully different from your current altitude and hopefully consistent to the maneuver you are about to perform (a lower altitude if you are about to descend). When the altitude approaches the selected target, the mode again automatically reverts to "altitude hold".
This is the mode the Boeing calls FLCH for "Flight Level Change", because you use it (among other things) at cruise to change your cruising flight level without changing your speed.
In a time where the FMS managed the horizontal aspect of the flight navigation) but not the vertical path (no V-NAV), it was much more used for other things too. I will go back to that later.
Did you see all the times that I've said "AP" above. Well, delete them. I did it for simplicity, but in fact it's the "FD", "flight director". The "flight director" shows in the attitude indicator the control inputs that the pilot needs to do (pull up, push down) to achieve the desired performance (i.e. the values that you entered and the mode you selected). "The pilot needs to do" here means the human pilot or the auto pilot. The human pilot will typically try to follow the flight director's commands because he knows that this assured the desired performance. But he can also choose not to follow it for whatever reason (for example, realizing that the result is not what he expected). The AP will simply obey the flight director's commands.
Now, all that is the Auto Pilot (AP). What about the Auto Throttle (AT, also Auto Thrust)?
I didn't mention it because of one good reason: all of the above applies with and without AT. In fact, there are many planes with APs that have all the above modes and are not even fitted with an AT.
Now, the AT also have different modes which I will also divide in two categories: "throttle controls speed" and "throttle controls thrust".
The "throttle controls speed" category is the most obvious one and has only one mode that does what it's name says: Speed hold. It adjusts the throttle to hold the selected airspeed (or Mach number). It's the equivalent to the "cruise control" in cars.
In the "throttle controls thrust" category we have different modes:
- Hold a given engine parameter: For example, hold a given N1 (which is a fancy name for RPM).
- Hold a performance thrust: For example, hold take-off thrust or climb thrust or maximum continuous thrust. This is quite similar to the previous one, except that the engine parameter is automatically computed. For example, the N1 for the take-off thrust depends on ambient temperature. So the pilot can look up the correct value for today's conditions and select "hold this N1" or, more simply, select "hold take-off thrust". In some planes, in facts both modes are the same one. The AT will hold a N1 that is shown in a window. Now, that N1 can be manually entered by the pilot or the pilot my chose "show the take-off N1". The AT doesn't care and will just hold whatever N1 is shown.
- Do nothing (I will cal this mode "clamp"): Now, this is tricky. What is the difference between this and "AT off"? The only difference is that the AT will remain engaged, but doing nothing whatsoever, until some specific criteria is met. Then it will "wake up", "kick in" and start doing things. More on this later.
Now, what happens if you select the "speed" mode both in the AP and AT? That shouldn't be done. Only one of them should be trying to hold the speed, or they would be fighting between them.
But there are good news: The engineers are not that stupid, so while the AP and AT are two different systems, there is communication between them, and selecting the "speed hold" in one of them will revert the other one to some other mode (if it was in "speed hold" too). There is more communication and coordination between them.
Let me give you an example of a very simplified full flight in an MD-80 (which is the system I know best). The names will be different in other planes but the concepts will be basically the same.
So the flight, of which I will concentrate only in the vertical profile, is this:
Take off, climb at V2+10, level off at 1500ft, accelerate to 250 while cleaning up, climb to 10000ft at 250, climb to 20000 at 270, cruise at 290, descend to 10000ft at 270, descend to 2500 ft at 250, slow down to Vapp while configuring for landing, follow the glide slope and land.
Here we go:
I'm lined up. The AP and AT are off.
I select "TO/GA" in the Thrust Rate Computer. The correct N1 for take-off thrust appears in a window. In the AT I select the "Hold N1" function, but the AT remains off.
In the AP (in fact, in the flight director) I select 1500ft. The AP also remains off.
I advance the throttles levels to achieve a N1 value that is close to the N1 shown in the window, then I engage the AT which will follow the "N1 hold" mode already set, and adjust the throttle levers to keep that N1 value shown in the window: Take off thrust.
Vee one, rotate, positive climb, gear up. While the plane accelerates, I slowly increase the pitch do diminish the acceleration until I stabilize the plane at V2+10 with about 15 to 20° nose-up attitude (depending on the weight and ambient conditions).
Now I engage the AP in "speed hold" mode. So by now, the AT will hold take-off thrust and the AP will adjust the pitch to hold V2+10.
But remember that I had already selected a target altitude of 1500ft.
When we approach 1500ft, the AP will automatically revert to "altitude hold" and the AT will automatically revert to "speed hold".
So I now select 250 in the AT and the AT increases the thrust to increase the speed while the AP adjust the pitch to keep 1500ft.
As the plane accelerates I start retracting the flaps and slats. The AP makes many pitch corrections to keep 1500ft with all these configuration changes and increasing speed.
The plane will approach 250kts and the AT will reduce the thrust to hold it. Eventually, the plane will stabilize with the AT holding 250 and the AP holding 1500.
Then, I change the AP mode to speed hold at 250, the AT automatically reverts to "clamp" (stops playing with the thrust levers).
Now I select at target altitude of 20000ft and... ta-da!!!! Nothing happens. The plane remains at 250 and 1500.
Ok, now I select "climb thrust" in the thrust rate computer, the correct value of N1 for climb is shown in the N1 window, and now yes... nothing happens.
Now I change the AT mode from "clamp" to "N1 hold". Finally, the AT starts playing with the throttles, increases thrust to hold the selected N1 (which, remember, was the N1 calculated by the thrust rate computer) and the speed will tend to increase, but the AP will prevent that by pitching up.
The plane will achieve a stable climb at climb thrust and 250 kts. And at what vertical speed? Whatever makes the plane hold 250kts. The AP is not caring of vertical speed but speed itself.
When we cross through 10000ft I slowly start to increase the selected speed in the AP to 270. The AT will lower the nose a bit to let the speed increase to 270 and then will pitch up a bit again to hold 270 for the remaining of the climb. Why did I say "slowly increase the selected speed"? Remember I commanded to the AP "you will adjust the pitch to hold the speed I tell you". If we are at 250 and suddenly I tell the AP "now adjust the pitch to hold 270", the "lower the nose a bit" may become more than "a bit". The AP might lower it enough that the plane might actually descend as it builds speed. Nothing serious anyway. As the speed approaches 270 the AP will raise the nose again to stabilize in a 270 kts climb. The "slowly" part was for the sake of smoothness only.
When the altitude approaches 20000ft, the AP will revert to "altitude hold" and the AT will revert to "speed hold".
Now I set 290 in the AT and the plane stabilizes at cruise with the AP holding 20000 and the AT holding 290.
After a while at cruise, it's time to descend.
I change the AP mode to "speed", the AT reverts to "clamp", select a target altitude of 10000 and nothing happens.
So I manually retard the throttles all the way to idle and the AP commands nose down to keep the speed.
I slowly reduce the selected speed in the AP to 270 (again, "slowly" to prevent that the AP actually climbs to reduce the speed quickly), and the plane finally stabilizes in a descent at idle and 270. At what vertical speed? Again, whatever it happens to be the only vertical speed that makes this happen.
Note that now I selected 10000ft as target altitude, but I had not selected the intermediate 100000ft as a target altitude during the climb. The reason is that, during the climb, I have no problem to cross 10000ft at 250 and then accelerate to 270 while climbing. But now want to make sure I won't descend below 10000ft with a speed above 250 because I'd be violating the "250 max below 10000ft" speed limit.
When the plane approaches 10000ft, the AP reverts to "altitude hold" and the AT reverts to "speed hold", but I override it by pulling and keeping the throttle levers to idle. So the plane levels off at 10000ft and, with the throttles levers kept at idle by my hands against the wishes of the AT, the loses speed.
When the speed reaches 250 (because, unlike Asiana pilots, I AM monitoring the speed) I select "speed hold" in the AP and the AT reverts to "clamp".
Now the AP will lower the nose to keep the speed at 250kts. And I don't need to fight against the AT anymore to keep the levers at idle.
The plane will stabilize in a descent at idle and 250kts.
Now I set a target altitude of 2500ft.
When the plane approaches this altitude, the AP will revert to "altitude hold" and the AT will revert to "speed hold", and the plane will stabilize with the AP holding 2500 and the AT holding 250.
Ladies and gentlemen, we will be landing in a few minutes. Fasten your seatbelts, close your trays, and put your seat-backs in the vertical position.
Now I select Vapp (say 140kts) in the AT.
The AT reduces thrust to slow us down, and as we do I start extending the salts and flaps in steps and also lower the landing gear.
When we are close to 140kts, the AT adds thrust and the plane stabilizes at 140kts and 2500ft.
I see that the glide slope needle of the ILS comes alive. I select the glide slope mode in the AP but nothing happens yet. The glide slope is just armed, but since we are not tracking the glide slope yet the active mode remains "altitude hold".
As the glide slope needle approaches the center, the AP mode reverts to "glide slope" and the AP starts to adjust the pitch to keep that needle centered. The AT remains in "speed hold", so it will retard the throttles a bit since less thrust is needed to keep 140kts while descending in the glide slope than what it was needed to hold the altitude.
Perfect, we are stabilized in the glide slope. Now I will select a target altitude of 4000ft. No, I'm not crazy and the AP will ignore it, at least by now. It's the altitude we have to climb in the event of a go-around.
We complete the landing checklist and get the tower clearance to land.
You might not note it, but I am closely monitoring the ILS and the speed and I am ready to immediately disconnect the AP and AT and take manual control if these parameters don't stay where they should. I even have my hand on the thrust levers to have a tactile cue of what the AT is doing and to be able to quickly firewall the throttles if needed.
We are in visual conditions, so our stabilized approach gate is 500ft, and we are approaching this altitude right now.
Let's see:
Aligned with the runway? Check.
Speed stable at Vapp (which is not the same than "crossing through Vapp")? Check.
Stabilized in the glide slope (which is not the same than "crossing the glide slope)? Check.
Thrust stabilized in an "approach" value, and specifically NOT in a very low value (like idle) from where we know that it would take too long to spool up? Check.
Airplane configured for landing? Check.
Landing checklist completed? Check.
Are we cleared to land? Check.
Ok, we go.
I am about to disconnect the AP to manually complete the landing (I plan to leave the AT on so I only need to monitor the speed but don't need to control it, and I will override it by pulling to idle during the flare), but then the tower calls: "There's a cow in the runway, go around".
No problem. I click the "go around" buttons. The AT and AP enters "go around" mode which basically is AT goes to "Take-off thrust hold" mode and the AP goes to "go-around speed hold" mode. I follow with my hand how the AT firewalls the throttles and I monitor the AP pulling up to keep Go-Around speed. Flaps 15. Take-off thrust check. Positive climb, gear up.
Now, remember that target 4000ft that we entered a few minutes ago? There we go. When we approach 4000ft the AP will revert to altitude hold and the AT will revert to speed hold. And we are ready for a second try. Don't worry, I'll not go through it.
There were some simplifications there, but I hope that now we all have a good understanding of the concepts and philosophy behind the design of these AT and AP systems. The big picture.
Now let's move to Asiana.
The pilot is in a long final and finds himself higher and faster than he would have liked to. What are his options?
- Go around.
- Requesting a descending 360 turn.
- Try to correct the situation while continuing the approach.
The pilot opted for the last one. I am ok with that, but don't blame the ATC for this because you had the other 2 options. A pilot is never compelled to follow ATC instructions that he feels are not safe, including if that feeling is due to own limitations rather than technical ones.
So how would a pilot try to correct the situation? Let's see: it's a visual, long straight-in approach in a perfect day with excellent visibility and nearly no winds? I'd likely turn everything off and, manually fly the beast and, if I don't like how it's going, I'll go around.
A second option would be to disconnect just the AP but leave the AT set in "speed hold" and selecting lower speeds (all the way down to Vapp) as we "dirty" the plane by extending slats, flaps and landing gear. But I have to be careful because if I pitch down too much to try to descend to the "good" descend profile, the AT might be unable to keep the selected speed even with the throttles at idle and I might bust some flaps speed.
A third option would be to use the "speed hold" mode (FLCH) in the AP (the AT reverts to "clamp") and pull the throttles back to idle. This is what the Asiana pilot did and, unlike many, I actually like it. A lot! You can just select Vapp in the AP and, as the speed goes down, you start dropping slats, flaps, gear, speedbrakes, the anchor, all what you have. You don't need to care about the speed because the AP will first keep the nose up to slow down to Vapp, and then lower the nose as much as needed to keep Vapp (well, you DO need to care about it and monitor it, but as long as it's doing what you expect you don't need to "manipulate" it). If THAT doesn't correct the situation, then NOTHING will and it's time to go around. And if it works, when you are in the path you wanted you select "speed hold" in the AT and "vertical speed hold" in the AP and make small adjustments in the selected vertical speed to keep the desired descent slope until you finally disconnect the AP and manually land the plane (you can leave the AT on in "speed hold" mode if you want).
But... the Asiana pilot did one more thing: He disconnected the AP.
Now, I know that I have just presented two first courses of action that included disconnecting the AP. But in this third option, doing it is really way too stupid. Think of it:
You tell the system: Autothrottle, forget about the speed. Autopilot, you have the speed. And next you disconnect the autopilot? So who is in charge of the speed now? YOU. Okay, we are now in the first scenario, the pilot is in full manual flight. I am okay with that. That was my first option after all. But if you are going to take full manual control of the plane, why select FLCH in the AP (only do next disconnect the AP) which causes the AT to go in "clamp" mode and leave the AT engaged in a mode that basically means "do nothing"?
AND YOU STILL EXPECT THAT THE AT WILL KEEP A SPEED?????
Again: By selecting the FLCH ("speed hold" mode) in the AP, you have just told the AT "forget about the speed" and told to the AP "you have the speed". And then, killed the AP.
Do you realize the magnitude of the stupidity of this?
If you want to take full manual control, better disconnect everything, right?
But no, this pilot's intention was not to take full manual control. Apparently, his intention was to override the AP to pitch down more steeply and he expected that the AT will take care of the speed (yes, he have just told the AT exactly the opposite, but it seems that he didn't understand what he was commanding by selecting FLCH).
So, why did the pilot thought that the AT would take care of the speed?
Nothing in all this explanation so far said anything about the AT taking care of the speed when not in "speed hold" mode, and in many planes this is the end of the history. However, the 777 adds an additional safety layer: If the speed goes too low, the AT will add thrust to keep the speed and prevent a stall.
This additional safety layer is not required by regulations and that many planes don't have it.
So the pilot was using a last-resource back-up safety feature to operatively control the speed. But there is one thing that he didn't take into account: this feature is inhibited when these two conditions are met at the same time: the throttle levers are at idle AND the plane is below 100 ft above the ground. Why? Because when the pilots flare the plane for landing, they are below 100ft, they pull the throttles to idle, and they do it precisely because they WANT the speed to go down and become what would be "too low" for normal flight.
Look at the videos and animations of the Asiana crash. It would have been a perfect and smooth landing, except that the runway was 2000ft farther. How on Earth could have the AT known that the pilot was not in fact flaring to touch down on a runway that began 2000ft earlier than the actual runway?
The crash was so close to the actual runway, that even the EGPWS (enhanced ground proximity warning system), which is specifically designed for this, couldn't detect that it was landing short of the runway and hence triggered no warning.
So Boeing adds a last-resource back-up safety layer that works exactly as designed but not as the pilot (and Asiana) expected, and now Boeing is sued for such system. If I was Boeing I'd say "You know what? I should have not added it. All operators must disable this function and it will not be included in airplanes coming out of the factory".
It happens all the time: The manufacturers add additional safety features that are not required and then they get in trouble when the operators abuse them. And then the people (and the operators) ask "but why don't add this feature to the feature to prevent this, and then this other feature in case we abuse from the new additional feature in some other way, and then..." And the answer is "because each additional feature that I add is abused by you and then you blame me for it". The manufacturers could add much more safety features but they don't because of this reason.
Let me make an analogy: I manufacture inflatable life vests. These life vest have two independent chambers with two independent gas bottles to inflate them. One chamber is enough to keep you afloat. But the vest is designed with this redundancy in case one chamber leaks or one bottle fails.
Now you have one of these life vests in your boat. You already inflated one of the chambers once some time ago, so you know that this bottle is empty. But never minds, there is another one, right?
You are not rated to operate this boat, but still recklessly operate it in a dangerous reef zone, the hull is breached, you put this life vest and jump. You pull the chord to inflate the other chamber, but it fails. You die and your mother sues me. Know what? Fuck your mom.
And fuck Asiana. That the pilot made this human-factor mistake is serious enough. That Asiana uses this as a defense is criminal.
Ok, another point that Asiana makes is not only that the system failed to give them the expected speed protection, but that the plane didn't want them of the deteriorating airspeed with enough time to correct the situation. Let's revise this:
So, the pilot selected FLTCH, disconnected the AP and retarded the throttle. I don't have this clear, but I will assume that he didn't disconnect the flight director.
If so, the flight director would have shown command bars on the attitude indicator that, if followed, will have made the plane slow down and then keep Vapp. If the AP had been on, it would have followed these command bars.
As soon as the speed goes below Vapp, the command bars will show the need to lower the nose to keep the airspeed. Something that the pilot didn't follow. Cue one.
The plane was last trimmed at 1500ft. From this point down, all and any reduction in airspeed must have been accomplished by the pilot pulling up with increasing yoke travel and increasing force. For any low-time student pilot, the fact that more pull is needed is and must be a clear and unmistakable cue that the speed is going down. Cue two.
In line with the previously explained increasing pull-up, the airplane was flying with increasing levels of nose-up attitude since, as the speed goes down, the angle of attack must increase to keep the lift. In the last stages of the approach but when there was still time to save the day, the nose-up attitude was way above the normal approach attitude (7° vs the normal 2°), and thios attitude is clearly displayed in 3 attitude indicators (two of them directly in front of the pilots in the PRIMARY FLIGHT display that have the words PRIMARY and FLIGHT in its name for a reason). But, more surprisingly, was also "displayed" in the windshield. Remember this was a visual approach, so the pilot had to be looking outside at least from time to time to see if he was high or low, for example. The CVR even recorded the sound of an electric seat motor, which is strongly suspected was one of the pilots raising the seat to be able to see the approach zone through the windshield with this so nose-up attitude. As said, that you need a too nose-up attitude is a strong cue that you are too slow. Cue 3.
Several seconds before the crash, when there was still time to correct, they received a 4-chimes warning and an EICAS alert message that said "AIRSPEED LOW". Did they increased the thrust at this point? Nah! The AT will provide!!! Cue 4.
After all this, the fact the pilot had airspeed indication seems too basic. But there was not one but three airspeed indicators, all correctly showing that the plane was slowing down too much, two of them included a Vapp bug, which is an icon that shows where the airspeed should be so you don't have to say "let's see, the airspeed is 120, it should be 140, oh fuck, I'm 20 kts slow". You just see that the current speed is below the icon and you know you are slow. It's like putting a sticker at the target speed in your car's speedometer. You don't need to "read" the speed. Just tell if the needle is above or below the sticker. Easy, uh? Not only that, but these 2 airspeed indicators that featured the speed bug were, again, directly in front of the pilots in the PRIMARY FLIGHT display that have the words PRIMARY and FLIGHT in its name for a reason. And do you know for how long they showed the speed below the bug until they finally increased thrust? 26 seconds!!!! Who on Earth was the pilot flying the plane during this time? And who was the pilot monitoring? Because holding the speed and monitoring the speed is well within their job requirements, do you know? Cue 5.
So say again, Asiana?
"Contributing to this failure were (1) inconsistencies in the aircraft’s automation logic, which led the crew to believe that the autothrottle was maintaining the airspeed set by the crew; and (2) autothrottle logic that unexpectedly disabled the aircraft’s minimum airspeed protection.
Significant contributing factors to the accident were (1) inadequate warning systems to alert the flight crew that the autothrottle had (i) stopped maintaining the set airspeed and (ii) stopped providing stall protection support; (2) a low speed alerting system that did not provide adequate time for recovery in an approach-to-landing configuration;
Significant contributing factors to the accident were (1) inadequate warning systems to alert the flight crew that the autothrottle had (i) stopped maintaining the set airspeed and (ii) stopped providing stall protection support; (2) a low speed alerting system that did not provide adequate time for recovery in an approach-to-landing configuration;
"The probable cause of this accident was fucking Asiana"
[/rant]
Comment