Rage against the machine

4430

Contributor Adrian Park investigates China Airlines Nagoya A300 flight 140 and ‘the fight’ between man, mode and machine that cost 264 lives.

Flight 140, an Airbus 300 approaching Nagoya Airport at night, was about to fall victim to serious automation errors. The flight from Taipei International Airport on April 26, 1994 had been uneventful, and the crew were no doubt looking forward to disembarking on schedule as they began their final approach.

At this point the mental mode of the pilots was in synch with the autopilot mode of the aircraft, but this would change dramatically. Soon the mode of the aircraft’s automation state would be in dissonance with the pilot’s mental mode and subsequently cause the death of all but seven of the 271 occupants.

A mode is not experienced merely on the flight deck as an autopilot or flight director function, but in everyday life and everyday communication. For example, what’s the difference between the following two statements?

‘Go around.’

In contrast to…

‘Go around.’

If you answered ‘nothing’ you are correct (and also a little boring). What’s the difference now, with some context?

‘Go around!’ shouted a desperate aircraft captain as he realised the aircraft was dangerously slow, nose high and in a perilous ‘out-of-trim’ condition.

In contrast to …

‘Go around’ mumbled the aircraft captain absentmindedly as he casually sipped his extra strong black coffee and scrolled through the latest edition of Flight Safety Australia on his EFB.

The second verbalised command in this fictitious example is exactly the same, but the mode, in the second ‘go around’ describes a markedly different volume, tone and rate—with the expectation of a markedly different response. The mode in which the first ‘go around’ command is delivered is one of extreme urgency. The mode of the second ‘go around’ is stated is conversational—almost lazy. In more familiar terms it’s the difference between screaming ‘stop!’ to a driver about to drive his car (with you in it) off a cliff and declaring ‘stop’ because you spotted a sidewalk coffee cart and you’re craving a latte—same words but a different mode which then equals a different result (or should).

‘It is the most successful automated systems, with rare need for manual intervention, which may need the greatest investment in human operator training.’

In an Airbus 300, and other modern passenger aircraft, the same controls in a different mode will equal a different (and sometimes unexpected) result. Just as the aircraft is required to transition from different autopilot modes for different phases of flight—take-off, altitude, landing, go around etc.—so too crews must transition from different mental modes depending on the stage of the flight: their mode awareness must match the modality of the aircraft and of the context.

But what happens when the mode isn’t rightly understood, either psychologically or functionally? What happens when crews fail to transition from one mental mode to another in a timely way? And what happens if a mental mode dangerously interferes with an existing mode? Flight 140 was about to provide a terrible example.

It was a fine night and no doubt the first officer was keen to improve his approach and landing skills. Upon passing the outer marker and receiving landing clearance, he disengaged the autopilots and proceeded to fly the approach manually. Ironically, given what was to happen next, this was a normal practice designed to keep basic flying skills sharp. At this stage the pilot mode of expectation matched nicely the aircraft functional mode, with normal manual inputs from the pilot resulting in normal aircraft responses: same mode, same controls, normal aircraft responses. However, as the Airbus 300 descended below 1000 feet, the first officer knocked the go-around switch (known as the ‘go lever’) and the autothrottles responded to the mode change; for 15 seconds the increased thrust pushed flight 140 well above glide path. In the same 15 seconds the mode of the crew decoupled from the mode of the aircraft. The pilot’s mental mode of expectation was now out of synch with the aircraft mode and within 90 seconds that out-of-synch state would lead to catastrophe.

Bainbridge, during her research into automation in the 1980s helpfully pointed out what she famously called the final irony of automation: ‘It is the most successful automated systems, with rare need for manual intervention, which may need the greatest investment in human operator training.’

Her lesson was clear: the strength of automation is also its weakness. In offloading pilot workload, automation causes pilots’ skills to perish. When these skills are most needed (due to automation failure or misinterpretation) they are found lacking, because the very automation that had so ably assisted them for so long has also dulled their abilities. Relating this to flight 140, one of the key skills essential for proper autopilot management (which seemed to have perished just in time for it to be needed the most) was the skill of mode awareness.

On flight 140, the captain was mode-unaware of the go lever activation for a significant time, so that when he instructed the first officer to get the aircraft back on glideslope the aircraft was already too high for a normal, stabilised approach. Nonetheless the first officer dutifully attempted to comply by reducing thrust, pushing the control yoke forward and re-engaging the autopilots. However, the go-around mode was still active—activation of the autopilot commanded a pitch up; that meant the autopilot mode was now radically different to the mental mode of the crew.

For the next 30 seconds or so, and another 300 feet perilously closer to the ground, the first officer essentially made forward yoke inputs (mentally ‘modalised’ for landing) while the autopilot dutifully trimmed out the pilot inputs—thus neutralising the pitch control available to the pilots.

The fight between man, mode and machine could only continue to a point and that point was reached when the trimmable horizontal stabiliser (THS) reached its down limit. With maximum forward yoke having little effect, the first officer attempted to correct the out-of-trim condition with the manual trim wheel. Again modal confusion reigned. The manual trim wheel was inoperative because the autopilot was engaged. At this point it must have seemed all too hard for the first officer and he disengaged the autopilot completely. This did nothing to change the position of the THS and by now, due to the reduced thrust earlier set by the first officer, the aircraft had bled airspeed to a dangerous low.

This triggered a new mode: the alpha floor mode. To protect the A300 from the excessive angle of attack, an increase in thrust and a pitch up was commanded and at this point the first officer completely lost the ability to pitch the aircraft down with the control yoke—there was simply not enough aerodynamic grunt from the elevator to overcome the maximally trimmed-down THS.

With only a few hundred feet between it and the ground, the 150 tonne aircraft with 271 people on board was no longer controllable in pitch and was losing even more airspeed as the nose insisted on coming up still further. The captain, finally emerging from a ‘you fly; I’ll monitor’ mode, took over.

Several mode changes behind the aircraft, the captain attempted to reclaim the approach by pushing forward on the yoke and retarding the throttles. However, the aircraft continued to pitch up, and realising something was terribly wrong, the captain called for a go around. Ironically the aircraft mode was back to where it started and where the crew now wanted it—in go-around mode. But now, due to the extreme disparity between the THS and the elevator, the aircraft was now working against itself and its occupants.

The underslung engines powered up, irresistibly pushing the nose even further up, and the aircraft uncontrollably zoom-climbed, bleeding airspeed the whole way. As the aircraft increased its angle of attack and reached 52 degrees nose up, turbulent drag ate up more and more effective lift across the wings. At 1700 feet above the ground the A300 flipped downwards in an all-enveloping stall. The captain, who had been pushing the yoke forward, now pulled back, desperately trying to recover from the dive, but the stalled lifting surfaces had nothing left to give and the machine crashed violently into the ground.

Notwithstanding the fact that this particular Airbus had not been upgraded with a software patch that would have alleviated the mode confusion, there were at least three types of mode error that night: mode dissonance, mode interference and mode inertia.

Mode dissonance was evident when the co-pilot attempted to control the aircraft as though it was still in a manual mode of operation, when in fact the autopilots were commanding a go-around mode. The dissonance meant the pilot’s mental state was writing checks the aircraft mode could never cash. Ironically, the harder the pilot pushed, the less and less control he had. This, in turn, led to the next mode error: mode inertia.

Mode inertia was evident in the inordinate time it took the aircraft captain and the first officer to recognise the inappropriate mode and take steps to correct it. Early in the approach, the crew were only one mode out of synch with the aircraft (aircrew in manual mode versus aircraft in go-around mode) and while the captain recognised and asked the co-pilot to correct for the ‘go lever’ being pushed, he was soon behind the aircraft mode again. This can be seen where the captain, with the aircraft in an alpha floor mode, and no pitch control left, was still attempting to land the aircraft. It is also evident in the co-pilot, who failed to warn the captain in a timely manner that it was increasingly difficult to push the nose forward. Both error states were, until very late in the approach, being amplified by another mode error: interference.

Mode interference occurred when the captain’s mental ‘I need to land mode’ overcame the clear need for a go around. What is perhaps most gripping about this accident is that despite the ever-worsening pitch control problem, the crew’s ‘landing mode’ state of mind overrode what should have been a go around much earlier on in the approach. While confusion and inertia caused the crew to get further and further behind the aircraft, there was still enough of an imperative in the captain’s mind (which interfered with demand for an early go around) to ‘push on’, despite everything feeling flat-out wrong. This imperative, this mode, interfered with what should have been a clear decision to go around—instead of 271 people landing late, 264 of them never landed at all.

This accident illustrates several things vividly. Firstly, the mode of the plane must match the mode of the pilot: experience does not make a pilot immune to mode confusion (the captain had over 8000 hours experience). Secondly, the mode of the pilot must keep pace with the mode of the aircraft. And finally, beware the third modal lesson: ‘felt’ pressure to land can easily bring a mode of thinking that interferes with recovery from mode error and further exacerbates other errors.

And this is perhaps another automation irony we could add to Bainbridge’s list: the moment when a pilot requires the greatest mode clarity is the moment said pilot is least likely to have it.

And that means, early rather than later, and despite the numerous commercial pressures, if it is feeling awfully wrong, ‘go around’ really does mean … ‘GO AROUND’.

Suggested Reading

‘Aircraft Accident Investigation Report China Airlines, Airbus A300B4-622R, B1816’, Nagoya Airport, April 26, 1994.

‘Ironies of Automation’, Discussion Paper, Lisanne Bainbridge, Department of Psychology, University College London 1983.

LEAVE A REPLY