Avionics Safety
Mode Confusion, Timidity Factors

Ever since computers and airplanes came together, modal confusion and pilot perplexity have gone hand in hand. Now and again, they hook up with grave consequences.

Case in point is the Jan. 3, 2004, crash of a Flash Airlines Boeing 737-300 at Sharm el Sheikh, Egypt. It disappeared off ground radar at 4:44 a.m., Cairo time, about three minutes after takeoff. The airplane was bound for Cairo and was slated to go on to Paris. Most of those killed among the 135 passengers were French tourists, along with eight flight attendants and the cockpit crew of three: the captain, first officer and an observer in the jumpseat.

The aircraft took off, climbed normally and began a left climbing turn, as scheduled. But at 2,000 feet the turn slowly inverted to the right. The aircraft progressively rolled until it was banked 90 degrees at about 5,460 feet. It then rapidly lost height and dived into the Red Sea with no distress call.

The Egyptians produced a fact-finding report of the accident. Senior Egyptian investigator Shaker Kelada said at a press conference that it was too early to determine what had happened. "In the next stage, we will cross-examine the data we have collected, and we will then observe [whether it] was the result of a faulty automatic pilot or human error by the pilot."

However, while the investigation winds its stately course, it is possible to make a few informed judgments from the facts at hand.

The captain was the pilot flying. He was experienced, with 7,444 flying hours, although only 474 hours on the B737. An element of that experience may prove significant. He had much time in the Egyptian Air Force MiG-21, where the Russian-based artificial horizon presentation is different from the standard display in Western-made instruments. Specifically, in the Russian display, the "wings" of the aircraft symbol move, presenting the bank angle on the outside lower portion of the instrument. The pilot sees the aircraft's actual position with respect to the horizon, as if he were observing from outside and in trail behind the aircraft. The horizon line also moves with the aircraft.

On the Western-type artificial horizon, the roll of the aircraft is shown by the slope of the horizon line, and pitch is represented by the position of the horizon line with respect to the nose of the aircraft. In the Russian display, pitch is decoupled, presented by a moving index that is separate from display of the aircraft's bank angle.

It is well known that in stressful situations one tends to fall back on previous experience, and in this case the horizon line may for a moment have been presumed to be the bank angle, hence the pilot's tendency to impart a right bank. Is such confusion possible? In the Swiss investigation of a Cross Air crash of a Saab 340 on Jan. 10, 2000, investigators theorized that the captain was "confused about the precise attitude and flight path."

"It suggests...at least temporary misinterpretation of the FD [flight director] display as an attitude display, by analogy with the aircraft symbol in the Russian horizon, occurred," the Swiss investigators theorized. The captain came from Moldavia and had been trained initially on Russian aircraft.

The second element of the Egyptian case involves the first officer. He was relatively junior, with just 788 hours of experience and only 242 hours on the B737. From the cockpit voice recording transcript, he shows little understanding of his vital intervention role. This despite having a good appreciation of the developing situation--although not fully understanding its cause and effect. This lethal hesitancy was, in equal parts, cross-cockpit authority gradient and lack of the moral fortitude to intervene. Cockpit resource management (CRM) trainers perhaps need to teach junior first officers to identify the ramifications of not acting responsibly and assertively.

The third element to the case may be the most significant. The B737 autopilot will not engage if there is any pressure being applied to the control column at the time. If one tries to engage autopilot in a turn, it takes a bit of practice to unload, or center the column, and then engage the autopilot. Older B737-300s were equipped with very positive paddle switches that had a magnetic lock when engaged. If they didn't engage, they very positively sprang back to the OFF position. By this means, pilots knew the autopilot had failed to engage.

Later models of the B737 were equipped with a press-button, comparable to the other switches on the mode control panel. This was a giant leap backward: in order to verify that the autopilot has engaged, the mode annunciator panel must be cross-checked. It wouldn't be difficult for a crew, especially a tired one--which may be the case here--to push the button while a control input was in, believe the autopilot was engaged, and miss the lack of the green annunciator on the upper EADI display.

The Egyptian Ministry of Civil Aviation's factual report on the Flash Airlines crash informs us that, "If certain required conditions are met, the selected autopilot will synchronize the roll channel autopilot servo to the current position of the ailerons [emphasis added]." The captain called for autopilot after takeoff, but then said, "Not yet," most likely because he was still in (or rolling out of) a turn.

Unfortunately, the first officer, possibly distracted by simultaneous transmissions from an inbound aircraft, went ahead and engaged the autopilot. It kicked back due to nonsynchronization, and the disconnect warbler sounded. A radio transmission may have drowned out the sound, but someone (either pilot) reflexively cancelled the cavalry charge warbler, and the situation became as though it had never sounded at all.

The captain and first officer both assumed that the autopilot was engaged. It's an infectious mindset. The captain, selecting turn directions via control wheel steering (CWS) inputs to his yoke, quickly became confused when it fails to function as designed, i.e., limit bank angles to 30 degree and roll out on selected headings. An indication that the No. 1 slat stayed in the extended position during flap retraction (as confirmed by the flight data recorder) may have compounded the problems of engaging the autopilot and may explain the aircraft's persistent right banking.

But this does not explain why the crew did not take over manual control when the autopilot disconnected. Instead they tried over and over again to find a solution by attempting to reengage the autopilot while outside of engagement parameters--to no avail. Try to understand the confusion of limited appreciation, ineffective cross-cockpit communication, and a manifest inability to cope with the suddenly evident non-normal event. Ponder the crutch that the autopilot has become for those whose scan and ability to function under a high workload is otherwise deficient.

An Automation Confusion Accident?

Selected timeline of the Jan. 3, 2004, crash of a Flash Airlines Boeing 737-300

Timeline/Comment

04:43:55 -- the Captain calls "Autopilot."

There was no immediate response from the flight officer (F/O) or mode changes recorded on the flight data recorder (FDR) (likely due to radio traffic),

04:43:58 -- Captain states, "Not yet."

i.e., "Don't engage autopilot until I've rolled wings level?"

04:43:59 -- FDR records the autopilot engaged, and that the Roll mode transitioned to Control Wheel Steering (CWS-R) mode. This transition would have resulted in loss of Heading Select mode.

F/O misunderstands and engages autopilot (A/P) anyway (1 second later). Major implications ensue ... on a very black night, over the Red Sea.

04:44:00 -- F/O states, "Autopilot in command, sir."

04:44:01 -- Captain states "EDEELO," (an Arabic exclamation expressing a sharp response of some kind).

A result of A/P being engaged while rolling (ailerons and even spoilers deflected) is it then "kicks" and induces a disconnect due to no synchronization with the aileron servo-actuators. In addition the left outboard (No.1) slat was faulty and may have remained extended, inducing a minor rolling moment to the right (not a major malfunction).

04:44:02 -- Cockpit voice recorder (CVR) records the A/P disconnect warning and the FDR recorded the A/P disengaged. The aural warning lasted for 2.136 seconds.

But the pilot (busy exclaiming) evidently fails to register what it was conveying and reflexively cancels the autopilot warbler -- then forgets about it (outta sight or outta hearing equals outta mind).

During this time, an increase in pitch and decay in airspeed were observed. Crew is unaware that neither pilot nor autopilot is now in control... aircraft is flying itself.

04:44:05 -- Captain requests Heading Select mode.

i.e. the Pilot still assumes that the autopilot is engaged and has control.

04:44:07 -- F/O states "heading select" and the FDR records Heading Select mode engaging. This mode transition would have resulted in the reappearance of the flight director roll command bar (for direct pilot guidance). During this sequence, the aircraft's left bank continued to decrease at a slow rate until the airplane was briefly wings level. Beginning at this time, the FDR records a series of aileron motions that command a CWS right bank and subsequent right turn.

Less than a minute now to impact. F/O positive response tends to confirm A/P is doing its duty (even though the F/O has only "hit" the Heading Select button).

Pilot thinks that his yoke input is using CWS-R and that the aircraft will roll out on its selected heading.

Consequently the Pilot is making only the necessary CWS roll initiation inputs to the yoke.

04:44:18 -- Captain says, "See what the aircraft did?" At this point the aircraft bank angle was about 12 degrees to the right. (extended No.1 slat may have been inducing a right roll).

Aircraft has gone through the ordained heading without rolling out. Captain is now confused, solidly convinced that the autopilot is still engaged and that he's using CWS-R.

04:44:27 -- F/O states, "Turning right, sir." Three seconds later, the captain responds, "What?" At the same time, his bank angle is 17 degrees to the right and the FDR records that his aileron motions are to increase the right bank.

Confusion by pilot between displayed bank directions (left for right) and rolls further right? Are the command bars obscuring his interpretations of aircraft roll attitude or is he more likely confusing Western and Russian-style artificial horizon (AH) displays?

04:44:31 -- F/O states, "Aircraft is turning right." One second later, the captain responds, "Ah."

02:44:35 -- Captain states, "Turning right." At this point, the bank angle was 23.6 degrees to the right.

F/O attempts to keep the captain informed. A misreading of a 30-degree banked right display for a 30-degree left? Has the captain reverted to "seeing" his MiG-21's AH presentation?

04:44:37 -- Captain states, "How turning right?" Bank angle was 29.7 degrees. (i.e., "How come it's turning right?" Puzzlement.)

Up to this point, pilot is possibly using either CWS (i.e. his yoke) or the inoperative A/P turn controller to counter the adverse turn, or is misreading the electronic attitude display indicator's (EADI) bank presentation and confusing it with a MiG-21's.

04:44:41 -- Captain states, "OK, come out." At this point, the bank angle was slightly more than 40 degrees right bank and the FDR records the ailerons' returning to just beyond neutral, the high roll-rate to the right stopped and a momentary left roll-rate occurred resulting in a slight decrease in the right bank from 43 to 42 degrees before additional aileron movements command an increase in the right bank.

25 seconds to impact. Pilot confusion evident, he's attempting to get the CWS back within 30░ angle of bank to enable its CWS-R ability to auto-roll out on the heading bug, but he's misreading the EADI's depiction of bank attitude, possibly because of the presence of the FD command bars, but equally plausibly, because he's seeing it as a MIG21 attitude instrument display.

04:44:41.5 -- F/O states, "Overbank." The bank angle at this time was just beyond 50 degrees right bank. The airplane reaches its maximum altitude of just over 5,460 feet.

04:44:41.7 -- Captain states, "Autopilot." He repeats the statement at 02:44:43.4.

Pilot is disoriented; a situation perhaps compounded by the FD command bars or reversion to interpreting a Russian-style AH display.

He now suspects the autopilot is at fault or disconnected, and wants his autopilot re-engaged/reset, but it's now way outside its engagement limits anyway.

04:44:44 -- F/O states, "Autopilot in command." No A/P engagement was recorded on the FDR. The bank angle was approaching 60-degree right bank. Pitch angle was zero and altitude was 5,390 feet.

Only a reassurance by the F/O. He himself still believes that the A/P remains engaged. An F/O cannot visually discern any difference between manual control and use of CWS-R via the yoke. But this unhelpful reassurance serves to further mislead the captain.

04:44:46 -- Captain again states, "Autopilot."

Pilot still wants autopilot engaged because he feels that he's "lost the plot." The situation now turns critical as aircraft attitude quickly goes extreme.

04:44:48 -- F/O states, "Overbank, Overbank, Overbank." The bank angle was passing through 70 degrees right bank, pitch angle was 3 degrees nose down and altitude was 5,330 feet. Two seconds later, the captain responds, "OK."

The aircraft's nose is falling naturally due to overbank. CRM dictates that an F/O should now assume disorientation and take control, but this F/O also believes A/P is in control and is quite undecided. He's naturally reassured by the captain's throwaway acknowledgment of, "OK." (Note the perils of mutual reassurance.)

The FDR continues to record aileron motions that increase the right bank.

Pilot is disoriented, misreading the unusual beyond-his-experience EADI presentation and rolling the wrong way. Per the CrossAir SAAB 340, you don't get to make that mistake even once, and get away with it ... not in this scenario. Situation is now irretrievable.

04:44:52.8 -- F/O again states, "Overbank." Bank angle was approaching 90 degrees, pitch attitude was 23 degrees nose down, and the altitude was 4,860 feet.

04:44:53.4 -- Captain responds, "OK, come out." The FDR records aileron motions to increase the right bank.

Pilot continues to roll the wrong way, i.e. towards the inverted

04:44:56 -- F/O states, "No autopilot commander." Bank angle was 102 degrees, pitch attitude was 37 degrees nose down, and the altitude was 4,100 feet.

Has F/O been trying to engage the A/P, (but it's outside its engagement parameters)? Or has he just had a dawning realization (or confirmed via its annunciators) that the A/P is off?

04:44:58 -- Captain states, "Autopilot." At the same time the FDR records a large aileron motion to the left and the airplane begins rolling back toward wings level. The maximum bank angle recorded was 111 degrees right. Pitch attitude at the time was 43 degrees nose down and altitude was 3,470 feet.

Captain is confused by the EADI display and still sees the autopilot as being either his salvation (or the cause). However his recovery actions are via the yoke and now in the correct sense. He has recognized the unusual attitude and started a positive recovery, although too late to affect the outcome (8 seconds from impact).

04:44:58.8 -- The observer states, "Retard power, retard power, retard power."

04:45.01.5 -- Captain states "Retard power," and the FDR records both engine throttles being moved to idle. The bank angle was 51 degrees right bank, pitch attitude was 40 degrees nose down and altitude was 2,470 feet.

04:45:02.0 -- The CVR records the sound of the overspeed warning. The FDR records the airspeed as 360 knots indicated airspeed (KIAS). Recovery from severe right bank and nose down pitch continues.

04:45:04.3 -- Captain states, "Come out."

Bank angle is 14 degrees right, pitch attitude is 31 degrees nose down, altitude is 760 feet, and airspeed is 407 KIAS.

Unrecoverable parameters; insufficient height available. Note how fast loss of control can occur.

04:45:05 -- The CVR records a sound similar to ground proximity warning. Aircraft impacts the water at 04:45:06 with bank angle 24.6 degrees to the right; pitch angle 24 degrees nose down; vertical G load 3.9g/angle of attack 5.46 degrees, speed 416 knots / HDG 316 degrees.

Source of CVR: www.civilaviation.gov.eg/flash.pdf

 

Automatons and Automations: Computers Continue to Perplex Pilots

Crash investigations again highlight prominence of human error and mode confusion

Ever since computers and airplanes came together, modal confusion and pilot perplexity have gone hand in hand. Now and again they hook up with grave consequences and there's an unintended outcome. Herewith we provide two such examples. The first, the June 2003 controlled flight into terrain (CFIT) fatal crash of a Canadair RJ near Brest, France, is fairly simple. The crew missed a step, stumbled, and the pilot died (see ASW, Jan. 10, for a roundup of CFIT incidents).

The second is less simple. The three-man crew of the Flash Airlines 737-300 completely lost the bubble -- and everybody died. The illogicality of what happened there has left everybody in disbelief.

The final report on the first accident, from the French Accident Investigation Bureau (BEA), was released on Jan. 7. It is available (only in French) at http://www.bea-fr.org/docspa/2003/f-js030622/htm/f-js030622.html, but it contains some sobering color imagery. It cries out for an English translation because there are many lessons to be learned, and they cannot be done justice via a rudimentary Internet translation service. Thus, it has to be concluded that the BEA is being very parochial in not providing one.

The conclusions we draw from the second accident are based upon a little insight and the initial factual report by the Egyptian Ministry of Civil Aviation at http://www.civilaviation.gov.eg/conf/files/flash.pdf.

In the first accident, the French BEA found that the crew failed to select the approach (APPR) mode prior to the approach and that they were first focused on vertical, and thereafter only on horizontal, navigation, failing to note their dangerous descent in time to avoid landing a kilometer short -- despite their state-of-the-art Head-up Display (HUD). Looking at the diagrams in the report, you wonder whether pilots are capable of assimilating that level of clutter of abstruse symbology. Ponder whether the absence of a critical symbol or mode annunciator is sufficiently attention-getting.

In the second accident, a Boeing 737-300 operated by Flash Airlines of Egypt (SU-ZCF) departed from runway 22R at Sharm el Sheikh (HESH) at night on Jan. 3, 2004. The visibility was 10k+, 17 deg C, light winds and SU-ZCF was bound for Cairo and then Paris, but it disappeared off radar at 4:44 a.m. Cairo time, three minutes after takeoff. Wreckage was soon spotted in very deep water in the Red Sea, seven miles south of its departure point. The 135 passengers and 13 crew of Flight FSH604 died in a crash that was close enough and violent enough to shake the windows of the coastal resort.

The aircraft took off and climbed normally and began a left hand turn as scheduled. But at 2,000 feet the turn slowly inverted to the right and the aircraft progressively rolled until it was banked 90 degrees at about 5,600 feet. It then rapidly lost height and dived into the sea. No mayday call was made.

Terrorist activity was quickly ruled out. Looking back at 737 "accidents" over the past 30 years, it was noted that this one ranked as the 2nd worst. In terms of French nationals killed, it was the worst air disaster for France since the 1960s. Most of the passengers were French tourists.

In the days and weeks that followed, the company, founded six years previously by a consortium of Egyptian and Italian businessmen, was held in the spotlight and found wanting. The Egyptian air company Air Flash had not been allowed to land on or fly over Swiss territory since October 2002. The Swiss took this precautionary measure after spot tests made by the Swiss Federal Aviation office (BAZL) at Zurich-Kloten airport had failed Air Flash on its safety standards "due to important technical faults." The Swiss Federal Aviation office had then put a report in the European Civil Aviation database -- where it was ignored. The faults allegedly included:

  • Several instruments in the flight deck were unserviceable;
  • Flight crew (cockpit) oxygen masks were missing;
  • Emergency oxygen bottles were missing;
  • Emergency exit lights were unserviceable;
  • Quite a few life jackets were missing; and
  • Passenger seatbelts were partly unserviceable or unusable.

While not constituting potential accident causes, such breaches are indicative of an airline's safety culture as well as its supervisory and regulatory environment. The Swiss Federal Office for Civil Aviation (FOCA) said it had inspected one of the company's aircraft in April 2002 and found that navigation documents were missing, fuel reserves were not calculated to international standards and the signposting of emergency exits was partly "in unusable condition."

"In addition, obvious maintenance deficiencies were found in the areas of the landing gear, the engines and the aircraft steering," it said in a statement. FOCA said the inspection of a second Flash Airlines aircraft in October 2002 had revealed "essentially the same defects". After the airline failed to provide sufficient proof that it had remedied the defects, it was barred from landing in Switzerland a few days later, the office said. One Norwegian passenger filed a complaint with the Norwegian CAA that this company had seats without seat belts. This led Norwegian Tour Operators not to contract with Flash anymore. One of Flash's two 737s had an emergency landing at Geneva Airport in early 2003 (despite it being banned from Swiss airspace), following an earlier one caused by engine failure in Athens (at the end of 2002). Flash Air returned its remaining aircraft to its lessor on March 6, 2004, and ceased trading as Flash. It's believed that this Phoenix has resurfaced on the same routes in the guise of Cairo Aviation. It's called sticker-change.

Swiss airworthiness inspectors work in conjunction with the Joint Aviation Authorities' (JAA) Safety Assessment of Foreign Aircraft (SAFA) and both France and Italy were apparently notified about the FOCA reservations regarding Flash. France initially denied this, and the Italians questioned that they'd been told. It then came to light that Flash had passed subsequent French tests in the fall of 2003. Flash airlines also had its operating license revoked in Poland in 2002 but, following some maintenance, it was reinstated in 2003. The ill-fated aircraft had had seven different registrations since delivery by Boeing [BA] in 1993. Eventually the European Aviation Authorities got its act together and evolved a harmonized information-sharing protocol for highlighting marginal operators. All of these disclosures were beginning to focus the inquiry upon possible technical failure related to poor maintenance.

An Italian news agency reported the aircraft had operated four sectors on Friday Jan. 2 from Sharm to Turin and Sharm to Venice. On arrival back at Sharm it only spent a short time on the ground before departing for Cairo and Charles de Gaulle (CDG). Six of those killed were a slip crew. Obviously maximum airframe utilization was the name of the Flash game.

The takeoff was from RWY 22R. The last mode C transponder height reading seems to have been 4800 feet. No distress call was made. Sharm radar recorded that the climb to 4800 feet occurred without problem, followed by an abrupt, near 180 degree turn and a dive descent from nearly 5400 feet, with the end of the recording (and presumably the crash) 17 seconds later (that's a mean vertical speed of 17,000 ft/min and an impact velocity of about double that; about 336 knots straight down).

Spatial Disorientation Suspected

The aircraft should have been flying faster than crossover speed in the takeoff regime so the ailerons would have been easily able to overpower a fully hard-over rudder. With the climb over a black sea, and instant transition into a terminal velocity dive, it was beginning to look like spatial disorientation (SD) and recalled the fate of the GulfAir A320 at Bahrain. But that A320 had been turning, accelerating and leveling at a much lower level over the inky blackness of the Gulf. What could have induced loss-of-control in this 737's wings-level climb on a smooth night? Could crew fatigue have been a factor? An Italian newspaper reported this "heavy" (augmented) crew had flown (Egypt)/HESH/Turin/HESH/Venice/HESH before this final leg to Cairo. The max duty-time for a "heavy" crew, for a day departure would be around 16 hours; a single crew 13 hours. By Jan. 8, 2004, the attached 37.5khz acoustic pinger had localized the flight data recorder (FDR) at 1030m and the cockpit voice recorder (CVR) 1500m away at 400m. They were later recovered by the deep submergence vehicle Scorpio 2000. Suicidal actions by the pilot were ruled out and the process of scenario elimination tracked inexorably towards what would still be a dumb-founding revelation.

SU-ZCF had accumulated 25,603 hours and 17,976 cycles, a history that was representative of its species. The 430-page factual report on the accident provides a second-by-second account of the facts recorded by the two recorders. It transcribed the technical data of the flight and the conversations of crew members between takeoff at 0242 GMT and its crash off the coast three minutes later. Once airborne, and into its cleared climbing left turn for overhead passage and intercept of the 306 VOR radial outbound, the copilot had shouted "Bank angle" three times during the aircraft's steady roll into an unscheduled right turn -- but without any response from the captain. Momentary incapacitation? Possibly, but the CVR's very last lines describe how the captain said "Come out!" as his plane was diving and he was attempting recovery from a highly over-banked roll angle, one second before the ground proximity warning that was the last information recorded by the flight data recorder.

It was beginning to sound like that perennial piloting problem of, once without a visual horizon, "which way is up?" Pulling while rolling always establishes an aircraft in a plummeting high-g graveyard spiral. Unusual attitude recovery techniques emphasize the prerequisite of first leveling the wings before pitching -- either back to the horizon or, if without a reliable attitude instrument reference, until the altimeter slows and then "pegging it" with ever smaller inputs until it stops.

Pilots who don't regularly practice that rigmarole, or who get suddenly "caught out," are likely to "screw the pooch" (as the test-pilot book "The Right Stuff" describes a pilot's failure to recognize or react correctly to dynamic cues). Dynamic is the operative word. Airline pilots typically are not "into" dynamics-- unless they have a military background. They are into stability and anything other than dynamics. Dynamic flying is what causes passengers to complain and fill sick bags. But, perversely, the necessary dynamics of an unusual attitude recovery is likely to rapidly over-extend even a mature airline pilot well beyond his experience and currency. You can talk about upset and loss of control all day. However, it is the mind-numbing physiological effects of the event itself that always come up against that unforgiving fourth dimension of time available and the sucking fifth dimension of gravity. Of course, lingering in the back of a pilot's mind is always the possibility of exceeding the ultimate design load and pulling the wings or tail off.

What is the likelihood of a successful recovery from a full-blown unusual attitude on a moonless night in a high inertia heavy aircraft, without a visual horizon or untoppled attitude indicator, or while suffering "the leans"? It is less than 10 percent. Yet it is always a single pilot task -- but it's one for either pilot. Avoidance must be the name of this game, and that's the crew task and it requires good crew resource management (CRM) (mutual cooperation, coordination and collaboration, with no authority gradient entering into the formula).

Senior Egyptian investigator Shaker Kelada said that it was too early to determine what had caused the crash. "In the next stage, we will cross-examine the data we have collected and we will then observe whether the crash was the result of a faulty automatic pilot or a human error by the pilot." He stressed that the factual report was only the sum of a fact-finding effort, including the black box readings and the results of back-driven engineering simulator testing at Boeing's headquarters in Seattle, Wash. In the coming months, the report will be analyzed by the Egyptian, French and U.S. parties involved and a final report determining the cause of the crash is expected to be issued this coming June.

"We have established how, now we have to determine why," Kelada said in a press conference.

"The plane took a shallow right turn which turned into a steep right turn," Kelada said. "Recovery was attempted, but there was not enough recovery before it dived into the sea." Enough information is available to interpret a likely sequence of events. This is best assimilated by taking onboard the comments annotated in the Factual Report's timeline below. But first, a few pre-rambles...

Spatial Disorientation Explained

Type 2 SD is related to vertigo, disorientation and illusions. Type 1 (pilot unaware and distracted) allows an unusual attitude to develop into loss of control (LOC) because of inattention and/or an attitude change-rate below the perceptive threshold (e.g., a very slow roll-rate). It took 40 seconds for this Type 1 situation to develop in Flash Airlines Flight FSH604 to the point of dawning realization, with a further 24 seconds until impact. Positive and assertive unusual attitude recovery action was taken only eight seconds before impact.

The first officer (F/O) shows no indication of understanding his vital intervention role, despite having a good appreciation of the developing situation (although not fully understanding its cause and effect). This lethal hesitancy is assessed as being equal parts cross-cockpit rank-related authority gradient and the product of a cultural block. He didn't have the boasted 5000 hours. He had less than 800. He lacked the moral fortitude to intervene. CRM tutors must start teaching F/O's to identify the ramifications of not acting responsibly and assertively, once put squarely "on the spot."

Instrument Twinning Could Have Helped

The 737-300 standby attitude indicator for both pilots is in the middle of a wide panel, quite remote (outta sight, outta mind) from the pilot and copilot's flight instrument panels...virtually useless. Disparity in response, roll-rate and comparative bank-angle is just not going to be noticed because of this wide separation.

The concept of twinning places the Standby Attitude Indicator and the main EADI (electronic attitude display indicators) in very close conjunction so that any disparities become glaringly and instantly obvious (see ASW, April 5, 2004, "Getting your Attitude Together"; and Apr 13, 2003, Oct. 19, 2003, Aug. 4, 2003). This also recognizes that a pilot under duress tends to narrow and focus his scan (aka "tunnel vision"). In addition, this captain had a lot of experience on the Mig21, where the Soviet-based artificial horizon (AH) presentation is just the opposite (upside-down) and in a different color code to Western-made instruments. It is well known that in such stressful situations one tends to fall back on previous experience. This also happened to a Moldavian crew, flying a CrossAir Saab 340 that crashed upon departure from Zurich.

Russian AH displays are based on the "outside-in" principle as opposed to the Western "inside-out." That means that the horizon line moves with the aircraft and the wings-model is gyro stabilized. The wings give the bank angle on the outside lower portion of the instrument. The pilot sees the aircraft's actual position with respect to the horizon as if he were observing from outside and behind the aircraft.

To summarize the CrossAir Saab 340 crash on Jan. 10, 2000:

The Saab pilot was probably concentrating on his flying with respect to the flight director but not "seeing-through" it and monitoring the raw data behind.

When at some point he perceived a navigational discrepancy, his attention was further taken from the AH. When challenged by the pilot not flying (PNF) about his direction of turn and returning his gaze to the AH, he was presented with information that he could no longer correlate to his mental model of a left turn (as cleared). The AH picture (0║ANU and 40║+ right bank) was probably closer to the "inverted" Russian AH picture of a left turn with the horizon line stepping in for the Russian bank line. Hence, his reaction to "lift" the left wing, but in actuality he dropped the right one into a tightening turn. From this attitude to impact took 12 seconds.

These two crashes look very similar: Manual flying; distraction; perception reversal; loss of attitude control; lack of assertive action by PNF. There are also issues regarding the "Russian" attitude (for lack of a better term) toward automation in general. This was borne out by the Uberlingen mid-air collision over Germany (see ASW, May 31, 2004). The "Russian" pilot followed human commands as opposed to those of a machine (among the other factors, of course).

The training issue is also center stage here: CRM and all the other aspects, but also the tendency to train with "clean system failures" -- engine out, auto-throttle off, etc. Either it works or it doesn't and you have to fly manually. Unfortunately, in the real world, electronic glitches and partial failure or erratic behavior of systems are never clear-cut. NASA's (and others') studies pertaining to automation highlight this. Time is lost identifying the discrepancy first and more time is lost finding how to deal with the loss of performance. A series of accidents come to mind in this department: the Nov 14, 1990, Alitalia in Zurich (FD bars not retracted), KAL747F in Stansted, 757 Charter in Punta Plata, etc. For pilots assimilating the newer technologies and not just adapting from the old, it is a question of both attitude and aptitude.

Autopilot Engagement

The 737 autopilot will not engage if there is any pressure being applied to the control column at the time. If you try to engage it in a turn it takes a bit of practice to "unload," or centralize the column, then engage the A/P. Older 737-300s had very positive "paddle" switches that had a magnetic lock when engaged. If they didn't engage, they very positively sprang back to the OFF position, so you knew immediately if it hadn't gone in. Later ones had a press-button of the same type as the other mode control panel's (MCP) switches. With this giant leap backward, in order to verify the A/P has engaged, you MUST check the Mode Annunciator Panel. It wouldn't be hard for a (tired?) crew to push the button while some control input pressure was in, believe the A/P was engaged, and miss the lack ofthe little green "CMD" annunciator on the upper EADI display.

The Egyptian Ministry of Civil Aviation report on Flash Airlines Flight 604, on pp. 22-26, informs that: "If certain required conditions are met, the selected autopilot will synchronize the roll channel autopilot servo to the current position of the ailerons" (emphasis added). At 02:43:58 after takeoff, the captain calls for autopilot but then says, "Not yet" -- most likely because he was still in (or rolling out of) a turn. Unfortunately, the F/O, possibly distracted by simultaneous transmissions from an inbound aircraft, goes ahead and engages it. It kicks back due to non-synchronization and the disconnect warbler sounds. It too may have been drowned out by a transmission, but someone (either pilot) reflexively cancels that cavalry charge warbler, and the situation becomes such that it had effectively never sounded at all.

The pilot and F/O both assume that the autopilot is engaged, but nobody is actually flying the aircraft. It's an infectious mindset. The captain is selecting turn directions via Control Wheel Steering (CWS) inputs to his yoke and quickly becomes confused when it fails to do what CWS-R does (limit bank-angles to 30 degrees and roll out on selected headings). An indication that the number 1 slat stayed in "ext" (extended position) during flap retraction (as confirmed by the flight-data recorder) may have compounded the problems of engaging the autopilot and may explain the persistent right banking tendency of the airplane.

But it does not explain why the crew did not take over manual control when the autopilot disconnected, yet instead tried over and over again to find a solution by attempting to reengage the autopilot while outside of engagement parameters -- to no avail. Note how this situation develops over a period of 50 seconds in the timeline below. Try to understand the confusion of limited appreciation, consideration, cross-cockpit effective communication and a manifest inability to cope with the suddenly evident non-normal event. Ponder the crutch that the autopilot has become for those whose scan and ability to function under a high workload is otherwise deficient.

 

An Automation Confusion Accident?

Timeline of the Jan. 3, 2004, crash of a Flash Airlines Boeing 737-300

02:41:59 -- Take off initiated with standard call outs.

02:42:02 -- TOGA (take off go around) mode engaged, then disengaged at 02:42:04 (old style 737 Classic computer?)

Aileron movements during T/O roll and lift-off were consistent with crosswind.

02:42:43 -- As the airplane was climbing through 440 feet the captain requested Heading Select. The first officer (F/O) confirmed the command and the flight data recorder (FDR) records that Heading Select mode was engaged.

02:42:48 -- Captain requests "Level Change."

02:42:49 -- The F/O announces, "Level Change, MCP speed, N1 armed, Sir."

02:42:59 -- the F/O announces "one thousand." At the same time, ATC reports the departure time and confirmed left turn clearance. The F/O acknowledges the clearance. This was the last ATC transmission from the flight crew. The aircraft rolled to 20? left bank and began a climbing turn. The turn continued as the magnetic heading approached 140? (at an altitude of 3600 feet), at which point the bank angle decreased to approximately 5? left bank.

02:43:19 -- EgyptAir Flight (MSR 227), a flight from Hurgada inbound to Sharm el-Sheikh, called ATC. Conversations between ATC and MSR 227 continue for approximately 60 seconds.

02:43:37 -- The captain calls for the After Takeoff checklist. There was no audible response from the F/O.

02:43:55 -- the Captain calls "Autopilot." There was no immediate response from the F/O or mode changes recorded on the FDR (likely due to callsign MSR and ATC transmissions)

Timeline: 02:43:58 --Captain states, "Not yet."

ASW comment: i.e., "Don't engage autopilot until I've rolled wings level"?

Timeline: 02:43:59 -- FDR records the autopilot engaged, and that the roll mode transitioned to CWS-R mode. This transition would have resulted in loss of Heading Select Mode.

ASW comment: F/O misunderstands and engages autopilot (A/P) anyway (1 sec later). Major implications ensue ... on a very black night, over the Red Sea.

Timeline: 02:44:00 -- F/O states, "Autopilot in command, sir."

02:44:01 -- Captain states "EDEELO," (an Arabic exclamation expressing a sharp response of some kind).

At the same time, the FDR records momentary movements of aileron surfaces. The right aileron deflects to 7.2 degree TEU for one second.

ASW comment: A result of A/P being engaged while rolling (ailerons and even spoilers deflected) is that it then "kicks" and induces a disconnect due to no synchronization with the aileron servo-actuators. In addition the left outboard (#1) slat was faulty and may have remained extended, inducing a minor rolling moment to the right (not a major malfunction).

Timeline: 02:44:02 -- Cockpit voice recorder (CVR) records the A/P disconnect warning and the FDR recorded the A/P disengaged. The aural warning lasted for 2.136 seconds.

ASW comment: But the pilot (busy exclaiming) evidently fails to register what it was conveying and reflexively cancels the autopilot warbler -- then forgets about it (outta sight or outta hearing = outta mind).

During this time, an increase in pitch and decay in airspeed were observed.

ASW comment: Crew is unaware that neither pilot nor autopilot is now in control... aircraft is flying itself.

Timeline: 02:44:05 -- Captain requests Heading Select mode.

ASW comment: i.e. the Pilot still assumes that autopilot is engaged and has control.

Timeline: 02:44:07 -- F/O states "heading select" and the FDR records Heading Select mode engaging. This mode transition would have resulted in the reappearance of the flight director roll command bar (for direct pilot guidance). During this sequence, the aircraft's left-bank continued to decrease at a slow rate until the airplane was briefly wings level. Beginning at this time, the FDR records a series of aileron motions that command a CWS right bank and subsequent right turn.

ASW comment: Less than a minute now to impact. F/O positive response tends to confirm A/P is doing its duty (even though the F/O has only "hit" the Heading Select button).

Pilot thinks that his yoke input is using CWS-R and that the aircraft will roll out on its selected HDG.

Consequently the Pilot is making only the necessary CWS roll initiation inputs to the yoke.

Timeline: 02:44:18 -- Captain says, "See what the aircraft did?"

At this point the aircraft bank angle was about 12 degrees to the right. (extended #1 slat may have been inducing a right roll).

ASW comment: Aircraft has gone through the ordained heading without rolling out. Captain is now confused, solidly convinced that the autopilot is still engaged and that he's using CWS-R -- (or rather, thinks that he is).

Timeline: 02:44:27 -- F/O states, "Turning right, sir." Three seconds later, the captain responds, "What?" At the same time, his bank angle is 17 degrees to the right and the FDR records that his aileron motions are to increase the right bank.

ASW comment: Confusion by pilot between displayed bank directions (left for right) and rolls further right? Are the command bars obscuring his interpretations of aircraft roll attitude or is he more likely confusing Western and Soviet-style artificial horizon (AH) displays?

Timeline: 02:44:31 -- F/O states, "Aircraft is turning right." One second later, the captain responds, "Ah." Timeline: 02:44:35 -- Captain states, "Turning right." At this point, the bank angle was 23.6 degrees to the right.

ASW comment: F/O attempts to keep the captain informed. A misreading of a 30 degree banked right display for a 30 degrees left? Has the captain reverted to "seeing" his MIG 21's AH presentation?

Timeline: 02:44:37 -- Captain states, "How turning right?" Bank angle was 29.7 degrees. (i.e., "How come it's turning right?" Puzzlement.)

ASW comment: Up to this point, pilot is possibly using either CWS (i.e. his yoke) or the inoperative A/P turn controller to counter the adverse turn, or is misreading the electronic attitude display indicator's (EADI) bank presentation and confusing it with a MIG 21's.

Timeline: 02:44:41 --Captain states, "OK, come out." At this point, the bank angle was slightly more than 40 degrees right bank and the FDR records the ailerons returning to just beyond neutral, the high roll-rate to the right stopped and a momentary left roll-rate occurred resulting in a slight decrease in the right bank from 43 degrees to 42 degrees before additional aileron movements command an increase in the right bank.

ASW comment: 25 seconds to impact. Pilot confusion evident, he's attempting to get the CWS back within 30 degrees AoB, for to enable its CWS-R ability to auto-roll out on the heading bug, but he's misreading the EADI's depiction of bank attitude, possibly because of the presence of the FD command bars, but equally plausibly, because he's seeing it as a MIG21 attitude instrument display.

Timeline: 02:44:41.5 -- F/O states, "Overbank."

The bank angle at this time was just beyond 50 degrees right bank. The airplane reaches its maximum altitude of just over 5460 feet.

Timeline: 02:44:41.7 -- Captain states, "Autopilot." He repeats the statement at 02:44:43.4.

ASW comment: Pilot is disoriented; a situation perhaps compounded by the FD command bars or reversion to interpreting a Soviet-style AH display.

He now suspects the autopilot is at fault or disconnected and wants his autopilot re-engaged/reset, but it's now way outside its engagement limits anyway.

Timeline: 02:44:44 -- F/O states, "Autopilot in command."

No A/P engagement was recorded on the FDR. The bank angle was approaching 60 degrees right bank. Pitch angle was zero and altitude was 5390 feet.

ASW comment: Only a reassurance by the F/O. He himself still believes that the A/P remains engaged. An F/O cannot visually discern any difference between manual control and use of CWS-R via the yoke. But this unhelpful reassurance serves to further mislead the captain.

Timeline: 02:44:46 -- Captain again states, "Autopilot."

ASW comment: Pilot still wants autopilot engaged because he feels that he's "lost the plot." The situation now turns critical as aircraft attitude quickly goes extreme.

Timeline: 02:44:48 -- F/O states, "Overbank, Overbank, Overbank."

The bank angle was passing through 70 degrees right bank, pitch angle was 3 degrees nose down and altitude was 5330 feet. Two seconds later, the captain responds, "OK."

ASW comment: The aircraft's nose is falling naturally due to overbank. CRM dictates that an F/O should now assume disorientation and take control, but this F/O also believes A/P is in control and is quite undecided. He's naturally reassured by the captain's throwaway acknowledgement of "OK." (Note the perils of mutual reassurance).

The FDR continues to record aileron motions that increase the right bank.

ASW comment: Pilot is disoriented, misreading the unusual beyond-his-experience EADI presentation and rolling the wrong way. Per the CrossAir SAAB 340, you don't get to make that mistake even once, and get away with it ... not in this scenario. Situation is now irretrievable.

Timeline: 02:44:52.8 -- F/O again states, "Overbank."

Bank angle was approaching 90 degrees, pitch attitude was 23 degrees nose down, and the altitude was 4860 feet.

Timeline: 02:44:53.4 --Captain responds, "OK, come out." The FDR records aileron motions to increase the right bank.

ASW comment: Pilot continues to roll the wrong way, i.e. towards the inverted

Timeline: 02:44:56 --F/O states, "No autopilot commander."

Bank angle was 102 degrees, pitch attitude was 37 degrees nose down, and the altitude was 4100 feet.

ASW comment: F/O has perhaps been trying to engage the A/P, but it's outside its engagement parameters OR maybe he's just had a dawning realization (or confirmed via its annunciators) that the A/P is OFF.

Timeline: 02:44:58 -- Captain states, "Autopilot."

At the same time the FDR records a large aileron motion to the left and the airplane begins rolling back toward wings level. The maximum bank angle recorded was 111 degrees right.

Pitch attitude at the time was 43 degrees nose down and altitude was 3470 feet.

ASW comment: Captain is confused by the EADI display and still sees the autopilot as being either his salvation (or the cause). However his recovery actions are via the yoke and now in the correct sense. He has recognized the unusual attitude and started a positive recovery, although too late to affect the outcome (8 seconds from impact).

Timeline: 02:44:58.8 -- The observer states, "Retard power, retard power, retard power."

Timeline: 02:45.01.5 -- Captain states "Retard power," and the FDR records both engine throttles being moved to idle. The bank angle was 51 degrees right bank, pitch attitude was 40 degrees nose down and altitude was 2470 feet. Timeline: 02:45:02.0 -- The CVR records the sound of the overspeed warning. The FDR records the airspeed as 360 KIAS (knots indicated airspeed). Recovery from severe right bank and nose down pitch continues.

Timeline: 02:45:04.3 -- Captain states, "Come out."

Bank angle is 14 degrees right, pitch attitude is 31 degrees nose down, altitude is 760 ft, and airspeed is 407 KIAS.

ASW comment: Unrecoverable parameters; insufficient height available. Note how fast loss of control can occur.

Timeline: 02:45:05 -- The CVR records a sound similar to ground proximity warning. Aircraft impacts the water at 02:45:06 with: Bank Angle 24.6deg to the right; Pitch Angle 24deg Nose down; Vertical G. Load 3.9g / AoA 5.46deg; Speed 416 Kts / HDG 316deg