The Human-to-Engine Interface

It wasn't until I got to the GV that I had an airplane that allowed you to engage the autothrottles for takeoff and then simply forget about them until after landing. And, I must admit, sometimes I forget about them. But mostly I don't trust them during the climb because, with the wrong mode of the autopilot they can result in a stall. Oh yes, I don't trust them en route because changing environmental conditions can leave us short of thrust. And then there is the descent. And don't get me started about the approach phase! Okay, okay. I guess I just don't trust them. But I do use them from takeoff to landing, they free my brain up for other things.

Why so paranoid? There have been a lot of accidents over the years where autothrottles had a role to play leading up to the scene of the accident. Here are just four, each with an autothrottle problem. Let's see if we can come up with a solution.

1 — Case study: 2004 Gulfstream GIV GMAC

2 — Case study: 2009 Turkish Airlines 1951

3 — Case study: 2013 Asiana Airlines 214

4 — Case study: 2016 Emirates 521

5 — Fixing what is broken

Problem:

There has been a divergence of opinion in the Gulfstream world on the proper way to engage and disengage the autothrottles. There are two sets of switches, forward and aft of what were still called throttles. The switches forward will only disengage and the ones aft will engage or disengage. You can only engage with the switches aft of the throttle stems so no debate there. I believe you should only disengage using the forward switches, since there is no chance you will engage the autothrottles with a "double click." But Gulfstream gives us the option and it seems many pilots use the aft switches for everything.

On December 1, 2004, a crew destroyed a perfectly good airplane while landing at Teterboro Airport (KTEB), New Jersey. The pilot disengaged the autothrottles at 570 feet AGL. It is unclear who or why, but the autothrottles were reengaged at 38 feet. The GIV cannot be landed with the autothrottles engaged and I speculate that the pilot hit the aft engage/disengage switches at the last moment to ensure they were disengaged. Over course that engaged them.

After landing when the speed decayed below the target approach speed, the autothrottles pushed the thrust levers forward, making it impossible for the pilot to lift the reverse levers out of their stowed detent.

With available runway disappearing the pilot activated the emergency brake, which does not have anti-skid protection, and the airplane departed the runway. Everyone survived the landing except the airplane.

The NTSB blames the crew's inadvertent engagement of the autothrottles and failure to recognize that during landing. They also list the lack of autothrottle switch guards and a lack of an audible engagement tone. But all of that misses the point.

Once the airplane had been landed the pilot should have noted the throttles moved forward and he should have slapped them back. I am speculating that the pilot's right hand was not on the throttles during the final phase of the approach and landing until he wanted the reversers.

Solution:

Keep your hands on the throttles during approach and landing, mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.

More about this: Case Study: Gulfstream GIV GMAC

Problem:

Does this sound topical: a Boeing 737 equipped with two sensors used by the automated flight system was designed to use only one of those sensors at a time, ignoring the opposite sensor. Then one day the sensor being used went bad and the airplane crashed, even though the opposite sensor could have saved the day. It has nothing to do with the 737 MAX of the Lion Air 610 era; this was ten years ago.

In a nutshell, here is what happened to Turkish Airlines 1951, on February 25, 2009.

• The captain's radio altimeter malfunctioned to read -8 feet in flight,
• The crew were slam dunked into Schiphol Airport, a common occurrence,
• A poor design allowed the autothrottles to use the left radio altimeter while the first officer flew the ILS with the autopilot coupled to the right autopilot.
• As the aircraft intercepted the ILS from above, the autothrottles had all they needed to go into "retard" mode,
• Neither pilot seemed to correlate a cascading series of warnings, including a low airspeed and the resulting high deck angle, with the radio altimeter failure.
• The aircraft ran itself out of speed at about 500 feet, at which time it stalled.
• The airplane impacted short of the runway, 9 of the 135 people on board were killed. The airplane was destroyed.

The Dutch accident investigators placed the blame on Boeing for the design of the radio altimeter / autothrottle interface while giving the crew an additional mention, as if they were bystanders to the crash.

Well I guess they were bystanders. Here's my take:

• The radio altimeter system was one of the leading maintenance squawks for the Boeing 737-800 of the time, in fact it was the top squawk at Turkish Airlines.
• Boeing knew the faulty radio altimeter could cause an autothrottle "retard" mode while in flight but reasoned that the cockpit had more than enough warning systems to alert the crew.
• In fact, the very airplane involved in this mishap had the "retard" mode happen in two previous flights in the previous 48 hours. But each crew noticed the "Retard" annunciation, the decaying airspeed, the low speed cue, and the higher than usual deck angle. Each crew disconnected the autothrottles and flew the jet to a successful landing.
• This crew did not. The captain was busy training a new first officer but there was a third pilot on the flight deck as a safety pilot. They got rushed with the slam dunk but nobody noticed the visual cues and five audible warnings until the stick shaker alerted them, too late.

Solution:

Keep your hands on the throttles during approach and landing, mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.

More about this: Case Study: Turkish Airlines 1951

Problem:

Airlines in South Korea have a long history of crashing airplanes because their pilots had difficulty when they were deprived of an ILS signal and their crews were unwilling to challenge the most senior pilot on the flight deck. (See Airlines of Korea.) This particular crash fits that mold, but the design of the autothrottle system combined with poor pilot technique was certainly a factor.

On July 6, 2013, Asiana Flight 214 was on approach to San Francisco International Airport (KSFO), California on a clear day with no real challenges to speak of, except maybe one. The ILS glideslope was out of service. While most U.S. pilots prefer visual approaches, most Korean airline pilots seem to fear them. The crew started the approach too high, made a few automation mistakes that caused them to get even higher, and then as they were plummeting down to briefly pass through the correct glide path (at a very high descent rate), they ended up with the autothrottles in a mode that would not correct their speed. They got too low and slow to safely recover and impacted short of the runway.

There is much to unpack from this accident and I encourage you to do that here: Case Study: Asiana Airlines 214. But for our purposes here, let's look at the Boeing 777 autothrottle system.

The autothrottles have several modes that should be familiar to most autothrottle users:

• Thrust reference (THR REF) — Thrust set to the reference thrust limit displayed on EICAS.
• Speed (SPD) — Thrust applied to maintain target airspeed set using the MCP or FMC.
• Thrust (THR) — Thrust applied to maintain the climb/descent rate required by AFDS pitch mode.
• Idle (IDLE) — Occurs when A/T controls the thrust levers to the aft stop.
• Hold (HOLD) —Occurs when A/T removes power from the servo motors. In this mode, A/T will not move the thrust levers.

Before reading this case study I was not familiar with the HOLD mode, but more on that shortly.

Airplane speed can be controlled by the AFDS [Autopilot Flight Director System] or the A/T (Autothrottle). When the AFDS is controlling speed, this is informally called “speed-on-elevator,” as the speed is controlled by modifying the pitch of the airplane through elevator movement. This is typically during a climb when the thrust is set at an upper limit or during a descent when the thrust is set to idle. When the A/T is controlling speed, this is informally called “speed-on-throttle,” as the speed is controlled by movement of the thrust levers. The A/T controls speed only when it is in SPD mode. This is typically at times other than a climb or descent, such as in cruise or on an approach.

In FLCH SPD mode, A/T is limited by the thrust limit at the forward range of thrust lever travel and by idle at the back range of travel. During a FLCH descent, HOLD mode will engage when the thrust levers reach the aft stop or if the pilot manually overrides the A/T. During a FLCH climb, HOLD mode will engage only if the pilot manually overrides the A/T. When the HOLD mode engages, the annunciation for the A/T mode will change from “THR” to “HOLD,” and the annunciation will be surrounded by a green box for 10 seconds. The A/T will remain in HOLD mode until one of the following conditions is met:

1. The airplane reaches the MCP target altitude.
2. The pilot engages a new AFDS pitch mode or new A/T mode.
3. The A/T arm switches are turned off.
4. The thrust is manually commanded to increase past the thrust limit.
5. The A/P is disconnected, and both F/D switches are turned off.

This seems nonsensical at first. If you are in an idle descent why do you want the autothrottles to essential stop moving once they hit idle? To rationalize a reason, visualize a typical descent with autothrottles that don't do this. You start down and the autothrottles go to idle. As the speed target changes from Mach in KCAS or altitude changes, the speed is momentarily too low and the autothrottles move forward only to move back again. This back and forth makes it harder to descend quickly and can be annoying in the cabin as the power comes up and back again. So, I guess, there is a reason for this behavior.

But isn't it dangerous? Typically you are descending to a target altitude on the MCP at which point the HOLD mode is released. But the sequence of events for Asiana 214 left the throttles in HOLD until it was too late. They were too high coming down rapidly. Their MCP target altitude was set to 3,000 feet, which was the missed approach altitude for the ILS. The pilot wanted to increase his descent rate and selected the FLCH mode, wanting the autothrottles to command an idle descent. But the autothrottles increased thrust for a climb, because the MCP target altitude was above them. The pilot manually overrode the autothrottles, pulling them to idle and placing the autothrottles into the HOLD mode, where they would stay until one of the conditions noted above was met. But most of those were unlikely to happen: the MCP target altitude was above their actual altitude, they were flying a visual approach and were unlikely to change that, and they normally left the A/T arm switches on. Interestingly, Asiana standard operating procedures called for the PM to turn off both F/D switches to off and then his own to on during a visual approach. Had the PM done this, the A/T would have released the HOLD mode, but the PM simply turned the PF's F/D switch off and left his own on, and the HOLD mode persisted as a result. By the time the PF realized he needed more thrust, it was too late.

Note that in many accidents where automation is a factor, the investigators never fail to point out that the mode in question is clearly given to the pilot. An important factor in this case was that the pilots failed to realize the autothrottles were in HOLD mode when it was clearly annunciated at the top of their pilot flight displays:

I'm not so sure. There is a lot of information on that display and the "HOLD" is tucked away on top with other things that compete for attention. Of course the pilot should have spent some time looking at the airspeed indicator and the approaching amber band and barber pole. There is a trend vector forecasting what is to come. But there was an even better predictor of what was to come in this Boeing: the throttles which move even when being manipulated by the autothrottle system.

Solution:

Keep your hands on the throttles during approach and landing, mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.

More about this: Case Study: Asiana Airlines 214

Problem:

This was a surprising accident on many fronts. First, Emirates has a sterling safety record; they were perfect with the Boeing 777. Second, from the what I've seen of Boeing manuals they take all of this very seriously. And finally, the incident itself seemed at first to be one of those cases of a perfectly good airplane destroyed for reasons unknown.

On August 3, 2106, this Emirates Boeing 777 appeared to be coming off a stable approach into gusty winds and a hot runway with thermals. Everything appeared normal into the flare. While the touchdown was a little late, it wasn't too bad. The airplane appeared to go around, climb briefly, and then fall to the runway. Passengers evacuated (some with their carry ons in hand) and the airplane was engulfed in flames. The captain initiated the flare 15 feet earlier than he should have. (As someone I used to fly the Boeing 707 with used to say, "I've done worse and bragged about it.") The combination of shifting winds (headwinds to tailwinds) and hot runway thermals made it difficult to touch down in the touchdown zone, so the captain elected to go around.

The captain wasn't aware that the aft set of wheels on the trucks of his main landing gear were going in and out of ground mode, which made the airplane think it was on the ground for a second. When the captain pressed the Takeoff / Go-Around (TO/GA) button, the go-around thrust mode of the autothrottles were disabled because they were "on the ground." The captain did not realize he was at idle thrust as he pitched up for the go around. The airplane ran out of speed. As the airplane began to sink, the captain realized his power state and manually advanced the power, but it was too late.

It appears to me that the crew did everything right all the way to the flare. Briefs, callouts, crew coordination. Very good.

The airplane survived the initial impact but not the ensuing fire. Incredibly, the only fatality was a fire fighter. It was a tremendous loss, especially considering two things. First, had the captain simply flown the airplane onto the runway, none of this would have happened. Second, the go around was only missing one thing: somebody should have pushed the throttles forward when the autothrottles didn't.

Solution:

Keep your hands on the throttles during approach and landing, as well as the go around, mentally connect what they are doing against what you want them to do. If there is a disagreement, put the throttles where you want them.

More about this: Case Study: Emirates 521

In my current aircraft the autothrottles come on when you engage the autopilot, the two are linked. While you can use one without the other, that is not its modus operandi. I find it helpful to think of the autothrottles as an extension of the autopilot, which we know bears considerable watching. A common theme to many autothrottle accidents is that pilots simply stopped thinking about the throttles at all.

In the case of the Teterboro Gulfstream GIV, the pilot disengaged the autothrottles, pulled them to idle and assumed they would stay there until it was time to pull on the reverse levers.

In the case of the Turkish Airlines flight, once the airplane was on the approach the pilots busied themselves with helping the autopilot to catch up with their "slam dunk" approach and assumed the autothrottles would take care of airspeed until the "RETARD" message appeared, which ironically is exactly what happened.

In the case of the Asiana Airlines flight, the autothrottles behaved as designed, but not as expected. But here again the pilots were provided the information they needed to survive, but the information wasn't in a place they could receive it because their eyes were not on their instruments during the visual approach and the pilot's right hand was not in "receive mode" for the one critical piece of missing information.

Finally, in the case of Emirates 521, the crew did just about everything right, but failed to realize the engines were not doing what they expected because their human-to-engine interface was disconnected.

Years ago I had a mechanic complain that one of our pilots was putting too much wear and tear on the throttle quadrant. This was in a Gulfstream GV where the throttle quadrant is not much more than two thrust levers connected to Rotary Variable Displacement Transducer (RVDT) that translated the physical movement of the levers into digital signals for the engine's Full Authority Digital Engine Control (FADEC). The throttle quadrant was a $300,000 item and we had already broken two of them. This caused me to think about my usual hand on throttle technique.

I place my hands on the throttles for takeoff, I remove them at V₁. I'll watch them closely during the climb, cruise, and descent. But I typically don't rest my hands on them until the gear is down again on approach. And I keep them there during the approach, landing and rollout. I've done a few go-arounds over the years and my hand will stay on the throttles until we are at our missed approach or pattern altitude again.

Is my technique right or wrong? I will leave that to you, but I encourage you to read each of these four case studies and the recommended solution to each.

Air Accident Investigation Sector (AAIS) Accident Final Report, Case No: AIFN/0008/2016, Runway Impact During Attempted Go-Around, Emirates, Boeing 777-31H, A6-EMW, Dubai International Airport, The United Arab Emirates, 3 August 2016

Aircraft Accident Investigation Report, PT.Lion Mentari Airlines, Boeing 737-8 (MAX); PK-LQP Tanjung Karawang, West Java, Republic of Indonesia, 29 October 2018, Komite Nasional Keselamatan Transportasi (KNKT.18.10.35.04), Republic of Indonesia

Aircraft Crashes Record Office

Dutch Safety Board, "Crashed during approach, Boeing 737-800, near Amsterdam Schiphol Airport, 25 February 2009," The Hague, May 2010 (project number M2009LV0225_01)

NTSB Accident Docket, Atlas Air 3591, DCA19MA086, November 19, 2019

NTSB Aircraft Accident Report, AAR-14/01, Descent Below Visual Glide Path and Impact With Seawall, Asiana Airlines Flight 214, Boeing 777-200ER, HL7742, San Francisco, California, July 6, 2013