High altitude upsets and recoveries are covered in pilot training today, but these type accidents continue to occur, perhaps, for a different reason - Stalls. Yes, we have begun stalling transport category airplanes. And, we have a new culprit - sophisticated (or less-than-sophisticated IMHO) autoflight systems and Flight Management Computers that control all aspects of the airplane’s operation. They give the pilot whatever he asks for, and, sometimes things he didn’t ask for. These days they control all the flight controls - even the speed brakes / spoilers - and the engines also. Even the brakes. One of the things they do is move the horizontal stab.
Commercial jet flying has been going on for over 50 years and I've been around for most of it - nevertheless, - let me say right here from the get-go -- I’ve decided I don’t like that scheme. At least I don’t like the Command Authority the autopilot has over the stab position. It should be much more limited. (This is not intended to be a discussion of “cockpit automation”, although that is certainly involved. That White Paper is still in my future.) (See Note 1 below.)
Having said that, I’d like to point out to those who have started shaking their heads, that an uncomfortable number of recent accidents have been associated with stabs at or near limits that have been driven there by the autoflight systems. I think that’s just plain wrong. A stab trimmed to it’s limit is in a place it shouldn’t be, for anything that wants to be described as “normal” flight. The resultant configuration is a badly mistrimmed airplane that is ripe for an untoward event. Almost always, in this situation, the autopilot will wind up getting disengaged - either by its own actions or the pilot’s. When that happens, the pilot is confronted with a confusing scenario requiring quick thinking - and actions - and an airplane that is going to do some bad things to him in a hurry. Too many times, the final outcome is fatal.
One more thing - a severely mis-trimmed stab - usually in the nose-up direction, can result in an abrupt and severe pitch-up on disconnect. With the majority of transport airplanes now having wing-mounted engines, the natural reaction of the pilot, indeed the approved procedures - confronted with rapidly decaying airspeed and a high body attitude and AOA is to rapidly apply power. In airplanes so configured, this can produce a very large nose up pitching moment of its own, exacerbating an already bad situation.
I THINK AUTOPILOTS SHOULD HAVE LIMITED STAB TRIM AUTHORITY.
They should be able to trim within a “normal” flight envelope band - beyond that, the pilot needs to be brought into the loop so as to recognize a developing situation, and not presented with a fait accompli. My definition of “normal” is very much truncated from what is “available.” A stab that is at its trim limits should be there ONLY due to pilot command (VERY unlikely!) Although the trim position is annunciated with assorted dials and warning lites, etc - often the pilot is unaware of the severe mis-trim, and in most cases, fails to rectify it when the autopilot suddenly says “Your airplane!”
Boeing Ops Bulletins advise against using “too much trim.” They advise this of the pilot community - but fail to address the built in systems that show no such restraint.
With all the smart electronics and software engineers and aero people that are out there these days, logic should be available to tell the autosystems to not try and make the airplane do what the pilot may (seem to) want, because it would place the airplane in an abnormal aerodynamic situation. Yes! I know, that sounds a bit like the Airbus "Protect the airplane from the Pilot Philosophy" - but that's NOT what I'm suggesting. My idea of "abnormal" is having the Autopilot stall the airplane. That's not abnormal - it's unsafe. Some examples follow:
MD-82 Accident Venezuela 16 Aug 2005
In the MD-82 accident that precipitated this outburst, the stab was continuously retrimmed by the autopilot until it reached 10.8 units nose up at an AOA of +7.7. It remained there for the rest of the flight. The autopilot was trimming nose up to maintain FL330 while the autothrottles were trying to maintain M 0.75. When the engines couldn’t maintain the speed, it decayed - requiring the autopilot to trim more and more nose up to maintain the altitude. The speed decayed to M 0.60 and the airplane started descending, unable to maintain the selected altitude. The pilot then disconnected the autopilot with the severe mistrim now in place. He never corrected it. 40 seconds later, with the autothrottle still engaged, the stick shaker activated and the stall warning went off. The airplane entered a deep stall from which it never recovered.
My position is, pilot aptitude not withstanding, the auto systems were able to place the airplane in a flight regime where it should not be. That’s wrong.
ANZ A-320 Perpignon, France 27 Nov 2008
The ANZ A320 accident at Perpignon was even more egregious. Here, an airplane on an acceptance flight test was brought into an approach to stall at about 4000 ft. In this case, there were unit failures (AOA vanes) that prevented the Airbus “flight protections” from “doing their thing” - namely protecting the airplane from the pilot - Airbus’ flight control philosophy. But, despite problems with the AOA sensors, the normal Flight Management Computer actions were available and in use. (Note: In a highly automated airplane using FBW systems, it is difficult to differentiate between the FMC and the autopilot. Disconnecting the autopilot still leaves the pilot flying a computer based system, one that not only votes on the pilot’s “requests”, but actually has the “Final Vote.” Specifically germane to this paper is the fact that the autopilot trimmed the stab to its nose up limit, where it remained for the remainder of the flight. The Airbus stall warning activated normally and appropriately, and the pilot initiated a normal stall recovery. TO/GA power was applied - which exacerbated the pitch up problem. However, the FMC flight control law had passed to Direct law due to the loss of the Normal law operating conditions. The auto-trim system was thus no longer available. (The changes of Law that followed did not allow the auto-trim system to move the stab from the nose-up position.) Manual trim was still available, but the Captain did not react with any input on the trim wheel at any time or to reduce engine thrust in any prolonged manner. Due to the position of the stabilizer at full pitch-up and the pitch-up moment generated by the engines at maximum thrust, the crew lost control of the aeroplane during the increase in thrust.
At one point, during this flight, the autoflight/FMC system had actually trimmed the stab full nose up, while simultaneously commanding the elevators full nose down. (The poor pilot at this moment was commanding elevators full nose up - but he was “out-voted.”) I suggest, for the purposes of this paper, that somewhere in the S&C and software writers community, there must be a line-of-code lite bulb that goes off and would identify and prevent such a grossly misconfigured airplane condition from occurring. Again, the authority of the autoflight systems is excessive and allows the airplane to be handed off to the pilot, after having created a very bad situation.
THY 737-800 Amsterdam 25 Feb 2009
The Turkish 737-800 accident at AMS is yet another example. The airplane was making a coupled ILS approach using autopilot and autothrottle. Descending through 1950 ft, the LH radio altimeter malfunctioned and suddenly showed -8 ft, prompting the autothrottles to fully retard the thrust levers to Idle power - where they remained for essentially the remainder of the flight. The airplane was configured for landing and intercepted the glide path normally at 1330 ft and 169 kts. With Idle thrust, tracking the glide slope caused a decay in airspeed. The autopilot responded with continual nose up pitch commands and trimmed the stab. At 460 ft, the stick shakers activated, the speed was now 110 kts, the pitch angle was 11 degrees nose-up, and the AOA was +20. By 420 ft, the autothrottle was disengaged followed by the autopilot. Although the pilot attempted to recover, there was insufficient altitude to effect a successful recovery. The aircraft struck the ground at low speed with a high sink rate and 22 degrees nose up attitude. The accident report does not specify the stab setting except to say the jackscrew was found in a high nose-up trim position.
Again, pilot proficiency and malfunctioning RA notwithstanding, the autoflight systems had blithely brought the airplane into a stall situation with a grossly mistrimmed configuration. Actually, when the stick shaker activated, the co-pilot pushed the throttles (and control column) ahead, but the autothrottle - still being engaged at that time - immediately retarded them again to Idle. Bad business in my book.
Thompsonfly 737-300 Bournemouth 23 Sep 2007
An almost identical near-accident event occurred on 23 Sep 2007 to a Thompsonfly 737-300 which stalled on approach to Bournemouth, UK. This airplane was also performing a coupled ILS approach. When the Capt selected a reduced speed, the autothrottle reduced the thrust to Idle, and then disconnected. The disconnect went unnoticed by the crew. The autopilot tracked the glideslope accurately, and with only Idle thrust, adjusted the aircraft pitch upwards while trimming the stab accordingly. Airspeed continued to decay down to 110 kts at 1540 ft altitude, when the stick shaker activated at an aircraft pitch attitude of +12 degrees and the stab at +7.9 units nose up.
The Capt moved the throttles full forward and pitched the nose down to +5 degrees to counteract the expected pitch-up from power. The airspeed decayed to 101 kts. Four seconds after applying full power, the autopilot - engaged all the while - disengaged, and the nose pitched up (because of the large amount of nose-up trim from the stab.) Although the pilot had moved the control column fully forward, the nose continued to pitch up, reaching 22 degrees nose-up. (Stab trim over-powered the available elevator authority.) Both engines were now producing substantially more than rated go-around power. The co-pilot reselected flaps from 40 to 15 (which would adversely affect stalling speed and reduce the flaps’ nose-down pitching moment.) The nose continued to pitch up passing +27 degrees, while both pilots applied full forward on their control columns. They reported “they had no pitch control authority.” The stick shaker was going, CAS fell below 107 kts, and a roll to the left developed.
Aircraft pitch passed 36 degrees nose up with a 22 degree left wing down roll. Pitch finally reached 44 degrees nose up and airspeed fell to 82 kts. At this point, and with no change in the full nose down elevator position (this not being a T-Tail aircraft), the aircraft stalled, the nose fell through (normally - unlike the A320) and pitch rate went from positive to negative. The aircraft pitch fell to +20 degrees over 10 seconds, and fell a further 15 degrees (to +5 degrees) over the next 2 seconds, while the airspeed increased rapidly. The Capt then stabilized the airplane at 3000 ft with a 5 degree nose-up attitude and 147 kts airspeed. The airplane was then circled around and landed normally - there was no damage and no injuries to the 137 occupants - a happier outcome than the previous three incidents.
There were a number of “culprits” in this incident - such as failing to notice the autothrottle disconnect, or adequately monitor the decaying airspeed. However, from the airplane side - there were no malfunctions and everything operated “normally.” The fact is, the autoflight systems ALLOWED this situation to develop, and possessed the authority to do so. The stab was trimmed excessively (my opinion) by the autopilot to maintain vertical flight path on the glideslope, and resulted in a badly mistrimmed airplane that pitched up radically when the autopilot was disconnected, and go-around power applied. The mistrimmed stab was sufficient to easily overcome full down elevator.
Actually - in common with the three accidents described above - the stab was not manually retrimmed by the crew until the entire event was over. They were lucky in that they had more altitude to play with than the Turkish airplane, (but less than half that of the ANZ A-320) and that the airplane had the benign stall characteristics that allowed it to go into a full stall with accompanying nose break and be recovered conventionally with minimal loss of altitude (about 600 ft.)
Well - here you have four recent events that make my case - I could add more, or you can take my word for it. Autoflight systems have too much authority - especially over the horizontal stabilizer. Stabs on (most) modern jetliners are large and powerful. Trimming them to large, mostly airplane nose-up, positions creates a poorly configured airplane and sets up the flight crew for a bad “gotcha" when the autopilot is disconnected. Very few human pilots would think of trimming the stab to such large values, and almost certainly would never wind up with a hand flown situation like the automated ANZ A-320. (Note in the NW 727 probe icing accident - while the crew maintained up elevator throughout the flight - the stab remained in a near neutral position.)
All four events I described above involved badly mis-trimmed stabs and autoflight systems that transferred control to the crew after having badly botched the airplane’s situation. Yes, it can be easily argued that the crews in each case needed to have done a better job monitoring what the automation was doing. I assert that, in addition to humans being lousy “systems monitors,” which is well-known, the autoflight systems created the problem in a very insidious manner. We used to be concerned about stab runaways, and installed stab trim lockout brakes. Now we have stabs that “slowly” runaway, and trim to extreme positions, not only with our being mostly unaware, but with our blessing.
Autoflight systems also need to have a “does this make sense” logic that will kick them off when they find they are commanding the airplane to be doing something outside its normal envelope. Autopilot needs to talk more to Autothrottle - or at least more than I think it is talking. (If Autothrottle is disconnected - and power is at Idle - Autopilot should not be trying to maintain an altitude or track the glideslope without regard to airspeed. Does the A/P even know what the airspeed is? If so, how can it run the airplane down into stick shaker??? And below.)
Autopilot Stab trim should be limited, and this limit should act to reinsert the pilot in the control loop early - in time to analyze what’s going on and take corrective action. In no case should the automation be able to stall a perfectly good airplane, which is exactly what happened in the above examples. Automated flight path control is supposed to make flying safer; none of the above events would have occurred in a hand flown situation. Automation, at least indirectly, caused these accidents.
Stalling large jet transport airplanes is best left to the manufacturer’s test pilots - not to line pilots - and especially not in the middle of the night.
Today’s systems do our bidding - no matter how contradictory it might be. Like personal computers, they are more dumb than smart. So, we have stabs at one extreme while the elevators are at the opposite - all in their electronic quest to show us how nubile they are at doing our bidding, and how wondrous are those software engineers who write the lines of code making it all happen.
NOT!.... I say. We can do better. We NEED to do better.
Just - My two cents. Feel free to tell me I'm AFU.
An interesting article I ran across while researching this epistle speaks to stab trim position “awareness”. I used to think the 707 / 727 /737 airplanes with their manual trim wheels made autopilot trimming obvious - unfortunately, not so.
Note: Autopilot misconfiguration of the airplane is a recognized problem in the turboprop regional airliner world, where several accidents related to airframe icing have occurred. The problem is the autopilot masks the handling characteristic changes that are occurring while a dangerous ice build-up occurs. When the autopilot is disconnected, the pilot suddenly discovers he has control of an airplane with badly impaired flying qualities, pitch-up, and loss of control. To rectify this problem, the recommendation is to hand fly the airplane during icing conditions. Apparently, there’s still a place for the human pilot and his often superior skillset.
Note 1 - Cockpit Automation - Canadian Report on wake turbulence encounter AC A319 and UA 747-400 A08W0007
Out-of-the-loop performance problems are well documented as a potential negative effect of automation. Under certain circumstances, such as when an automatic system is managing an unusual event but there is no direct indication of this action provided to the pilot, it is possible for the pilot to misdiagnose the emergency as an automation failure. This can result in the pilot responding to a presumed automation failure rather than to the actual emergency. In essence, the understanding that the operator has developed of the aircraft and its environment is incorrect because the pilot has not been directly interacting with the aircraft controls. The more complex the situation, the less capable the human is of entering the loop when an emergency occurs. As a result, being outside the control loop can result in adverse aircraft-pilot coupling as a pilot responds to a sudden emergency.
When startled by a sudden unexpected event, a pilot is susceptible to delayed reactions, which are based on previous training and experience. This may lead to making inappropriate control inputs for the conditions at hand.
From one correspondent:
This is probably simplistic. But whenever a class of accidents punches through the noise level I would assume the company is interested. Boeing used to lead these sort of topics, even to the point of involving our competitors. In some cases the result was a "Training Aid". In some cases we revised design. In some cases we did both; for example wind shear.
I'll mention one more factor on Bob's investigation: this type of accident is not limited to airplanes with autothrottles installed and operating. GA airplanes are susceptible to the autopilot-induced-stall as are some smaller transport category airplanes with no autothrottle installed.