MODULE 14

AUTOMATION

Table of Contents

Session plan ........................................................................................................................ 2

Automation ......................................................................................................................... 3
Progress of technology and automation................................................................... 8
Automation ....................................................................................................................... 14
Study to address the deficiencies related to automation ..................................... 15
Automation as a contributory cause of accidents ................................................. 18
Experimental study of vertical flight path mode awareness ................................. 20
References ........................................................................................................................ 23

© Global Air Training Limited 2015 14.1

MODULE 14
AUTOMATION

Module 14

Automation

Session plan

Module no 14

Module title Automation

Duration 1 hour and 30 minutes

Optimal class size 6 to 12

Learning On completion of the module the student will understand the benefits and risks of
Objectives automation on flight safety.

Delivery method Facilitation

Trainer Trainer to have completed 5 day CRM Trainer core course.

qualifications

Student None
prerequisites

Trainer materials PowerPoint

Whiteboard
Flipchart
Video if avail – EVS examples

Participant Handout – Problems and concerns regarding flight deck automation

materials

© Global Air Training Limited 2015 14.2

 MODULE 14
AUTOMATION

Automation
Slide – Header slide

Slide – Automation

Slide – Design considerations and implications

© Global Air Training Limited 2015 14.3

 MODULE 14
AUTOMATION

Question

Aircraft have been designed for many different purposes. List as many variations under
the following headings as you can (trainer may wish to split group in to 4 and give subject
to each group)
1) Operation & purpose
2) Powered by
3) Routes/range
4) Size and configuration

Slide – Variations

Whiteboard/flipchart – List the student answers to types of aircraft/operations

Compare the student’s answers to the following examples:

Type of operation
 Military (Fighters, Bombers, Surveillance).
 Airlines.
 Corporate.
 Air Taxi.
 Helicopters.
 Training.
They can be powered by different methods.
 Jet.
 Turbo prop.
 Piston.
There are many other operational variations
 International and domestic routes.
 Long, mid and short haul.

© Global Air Training Limited 2015 14.4

 MODULE 14
AUTOMATION

 Operating at large International small domestic airports, tarmac or

grass airstrips. Some having sophisticated Nav aids whilst others have
little or nothing.
Variations in size and configuration
 Single or multi crew operation.
 Cabin crew, no cabin crew.
 Wide or narrow bodied.
 Single or multi deck.
 Short or long cabin length.
Within these variations of operation and aircraft type, there are a lot of designs and many
different ways of doing the same thing.
Some systems or automation that works very well in one aircraft or situation won’t
necessarily work well in another. Some systems that work well in benign weather, VMC or
daylight won’t work well in poor weather, IMC or night.

Mixed fleet
There are many aviation companies who operate mixed fleets, take for example British
Airways who have aircraft with many of the variations we have just listed. The BA fleet as
at April 2014 comprised the following large aircraft, including:
 57 x Boeing 747.
 52 x Boeing 777 (300 & 200).
 08 x Boeing 787 on order.
 21 x Boeing 767.
 03 x Boeing 757.
 19 x Boeing 737.
 12 x Airbus A380 on order.
 11 x Airbus A321.
 41 x Airbus A320.
 33 x Airbus A319.
 02 x Airbus A318.
 07 x Embraer 190 – (operated by City Flyer).
 06 x Embraer 170 – (operated by City Flyer).
 Plus some smaller aircraft used in the company's regional business.
It is important therefore, that the type of aircraft and nature of operation of the aircraft is
taken into account when designing SOPs and training criteria. What works for one may not
work for all.

© Global Air Training Limited 2015 14.5

 MODULE 14
AUTOMATION

Another possible factor is preconditioning. If an aircrew member has worked on one

aircraft type for a long period of time and then transfers to a new type, there is the
possibility for reversion in the event of overload or underload.

General design considerations

The human in the cockpit is the critical and the most flexible component of the aviation
system. His/her performance in the cockpit is the last opportunity to compensate for any
combination of weakened system defences that can lead to accidents or incidents.
There are wide variations in individual size, individual limitations, and in individual
performance. It is not surprising that a great deal of effort is made to maximize the
performance of all crewmembers.
One problem in cockpit design involves the use of colour. One of the reasons is that there
are no international rules regarding the use of colours, although there is a growing
recognition that this is a problem area that is rife with international complications.
A difficulty is that not all cultures view some specific colours in the same light. In the US
and a majority of the western world, the principal aviation colours of red, amber, and green
are now specified as follows:
 Red for warning lights (lights indicating a hazard which may require
immediate corrective action).
 Amber, for caution lights (lights indicating the possible need for future
corrective action).
 Green, for safe operation lights.
Other colours including white, can be used for other lights provided the colour differs
sufficiently from those previously mentioned.
There are 3 main elements involved in developing aircrew stations in a new aircraft. These
are:
 The size and shape.
 The reach.
 Vision of the prospective population.

The size and shape

The size and shape of the prospective user population can become very involved, both
because of the number of combinations possible and because of the shortage of data for
populations other than European and American males.
A typical computer model uses 14 external body dimensions of the 5th, 50th and 95th
percentile groups of potential pilots in order to ensure that aircrew members are able to
reach their controls from various positions in the flight compartment. The designer is
forced to utilise all available data and then use informed judgement to cover gender and
racial differences.

Reach
A second element is reach. Reach has three variables: restraint configuration (utilising
three positions of the shoulder harness), type of grip (fingertip, pinch, or grasp), and type

© Global Air Training Limited 2015 14.6

 MODULE 14
AUTOMATION

of clothing. Twenty-seven combinations of reach can be simulated. One manufacturer has

stated that it examined the sizes and shapes of 3,600 individuals in determining limits
that were acceptable.

Vision
The third element involved in developing the crew station for a new airplane is vision. Here
consideration must be given for both displays within the cockpit and for the external
environment. External vision requirements can define the configuration of the windshield.
Requirements consider among other things, the blocking obscuration of such items as fire
handles and control wheels.
An interesting concept in the visual element involves the visual cone. It is well known that
the field of vision narrows under periods of high concentration or stress. In order to
recognise this phenomenon, information necessary during critical periods of flight is
displayed within what is known as the primary vision cone. This has been defined as the
limits of vision associated with eye motion alone. The secondary vision cone includes the
area that can be visually covered with a combination of both head and eye motion.
Recently, increased attention has involved crash injury protection. The National Highway
Transportation Safety Board developed a computer program to analyse the reaction of
passengers in automobile crash situations. The program was adapted by the Air Force to
analyse aircraft crash scenarios and the program was later modified to extend to
commercial transports. It has been used in recent times to specify acceptable locations for
head-up displays in present aircraft.

The sidestick
There have been many innovations in air transport cockpits with human factor implications
in the past few years, but none that was more dramatic and initially controversial as the
Airbus Industries sidestick. The initial controversy about the sidestick subsided as
experience with it increased.

Question

What are the advantages of a sidestick?

Answer

It’s comfortable and frees up space in front of the pilot. The smaller size of the sidestick
allows for greater precision of movement and it doesn’t obscure the lower instruments and
controls directly in front of the pilot.

Question

Why did Boeing not introduce a sidestick?

Answer

Although the sidestick has many advantages it also brings a few problems. One is that the
Pilot cannot monitor the pilot flying’s control inputs through control movement. Also, the
autopilot’s input can be monitored more easily through observing the movements of the
control yokes.

© Global Air Training Limited 2015 14.7

 MODULE 14
AUTOMATION

The use of a ‘small displacement controller’ also makes exerting high control forces to
indicate the edges of the flight envelope nearly impossible. As a result Boeing would have
had to affect hard limits on the flight controls rather than the desired soft limits.
Boeing made a detailed analysis using an in- flight simulator and found the control yoke to
work better. The Boeing 777 –300 uses a somewhat smaller yoke than other Boeing
models.
It should be understood that there are many pilots who do prefer the sidestick controller
and in general Airbus aircraft. Certainly both manufacturers have made significant
contributions with their design elements and both produce excellent aircraft.

Progress of technology and automation

Slide – DC3

Slide – DC3

Old style technology

© Global Air Training Limited 2015 14.8

 MODULE 14
AUTOMATION

Slide - B777

The Boeing 777 blends a sophisticated fly-by-wire flight control system with familiar Boeing
flight deck design principles. This has the effect of allowing pilots transitioning from earlier
Boeing aircraft to feel comfortable and familiar with their surroundings. In fact the fly-by-
wire system is almost transparent to pilots in normal use.

Slide – A380

Fly-by-wire, sidestick control, full sized computer screen along with a QWERTY key board
and mouse allowing the operator to jump from one display to the other with ease (like a
windows system on your own PC).

© Global Air Training Limited 2015 14.9

 MODULE 14
AUTOMATION

Slide - Easy (Enhanced Avionics System) flight deck – Falcon 2000

EASy is based on Honeywell's new Primus Epic integrated avionics architecture and
features four 14-inch Primus Epic screens in a ‘T’ arrangement for optimum crew
coordination. The first EASy flight deck was certificated in late 2003 on the longer-range
4500-nautical-mile Falcon 900EX.

Slide – DC3 & EASy

Comparison of old to new

© Global Air Training Limited 2015 14.10

 MODULE 14
AUTOMATION

Slide – Sidestick

Slide – Flight Mode Panel

Modern Flight Mode Panel differences

 Global Express
 Boeing
 Airbus

© Global Air Training Limited 2015 14.11

 MODULE 14
AUTOMATION

Slide – EVS example 1

Slide – EVS example 2

The Collins Enhanced Vision Systems (EVS) is designed to enhance pilot situational
awareness during the approach and landing phases of flight at night or during poor
weather conditions by providing an infrared (IR) camera view of the outside environment.
The imagery will be displayed conformably on the combiner of the Flight Dynamics HGS®-
4000 Head-up Guidance System, increasing both safety and operational capability of the
aircraft.

© Global Air Training Limited 2015 14.12

 MODULE 14
AUTOMATION

Slide – Synthetic Vision Systems

The Synthetic Vision System (SVS) is a virtual reality display system for cockpits. The
system can offer pilots a clear, electronic picture of what’s ahead outside their window, no
matter what the weather or time of day.
The technology utilises GPS, terrain databases and graphical displays. It incorporates data
into displays in aircraft cockpits and draws three dimensional moving scenes that show
terrain, ground obstacles, air traffic, landing and approach patterns, runway surfaces and
other relevant information to the flight crew.
The type of accidents that can happen in poor visibility can be eliminated when pilots can
see the terrain hazards outside. The danger is not updating the database.

Slide – Euro Fighter with DVI

Direct Voice Input (DVI) allows the pilot to control non safety-critical and data entry
functions (such as displaying fuel status, changing radio frequency, etc) as an alternative
to using manual methods. There are over 130 commands recognised by the Eurofighter
DVI system.

© Global Air Training Limited 2015 14.13

 MODULE 14
AUTOMATION

Automation
One approach taken to improve the situation in the cockpit during high activity phases is
automating as many processes as possible.
Flight deck automation on commercial transport aircraft has been well received by pilots
and the aviation industry as a whole.

Question

What processes are automated?

Write answers on whiteboard

The positive side to automation is the fact that accident rates for advanced technology
aircraft are generally lower than those of comparable conventional aircraft.
Nevertheless there is a negative side. Pilots, scientists, and aviation safety experts have
expressed concerns about flight deck automation in that, to a certain degree, the control,
or part of the control, is taken from the pilot and in some cases, decisions are made by
computers. Transferring control from a human to a computer system is not always entirely
advantageous.

Group task – Implications of automation

I would like you to split into two groups. Using the flipchart paper I would like group ‘A’ to
list as many positive points for automation as you can and group ‘B’ list all the negative
points.
Allow groups to talk through their results positive first and then show video clip of A320
and continue with negative issues.

Slide –Mulhouse–Habsheim air show crash

Air France Flight 296 was a new fly-by-wire Airbus A320-111 operated by Air France. On 26
June 1988, it was flying over Mulhouse–Habsheim Airport as part of an air show. The low-
speed flyover (with landing gear down) was supposed to take place at an altitude of 100
feet AGL (above ground level); instead, the plane performed the flyover at 30 feet,

© Global Air Training Limited 2015 14.14

 MODULE 14
AUTOMATION

skimmed the treetops of the forest at the end of the runway, and crashed to the ground—
killing three passengers. This was the first crash of an A320 aircraft.
The plan was that as they approached the airfield, they would extend third-stage flap,
lower the landing gear, and line up for level flight at 100 feet. The Captain would slow the
aircraft to its minimum flying speed with maximum angle of attack (nose-up attitude),
disable the "Alpha Floor" (the function that would otherwise automatically increase engine
thrust when the angle of attack reached 15°) and rely on the First Officer to adjust the
engine thrust manually to maintain 100 feet. After the first pass, the First Officer would
then apply TOGA (Take Off, Go Around) power and climb steeply before turning back for the
second pass.
Habsheim aerodrome was too small to be listed in the aircraft's flight computer, therefore
requiring a visual approach; both pilots were also unfamiliar with the airfield when they
began their descent from 2,000 feet only 6 nautical miles from the field. This distance was
too short for them to stabilize the aircraft's height and speed for the flyover.
Additionally, the Captain was expecting to do the pass over Runway 02 (3,281 feet long,
paved) and was preparing for that alignment. But as the aircraft approached the field, the
crew noticed that the spectators were gathered beside Runway 34R (2,100 feet long,
grass). This last minute deviation of the approach further distracted the crew from
stabilizing the aircraft's altitude and they quickly dropped to 40 feet.
From higher up, the forest at the end of 34R had looked like a different type of grass. But
now that the aircraft was performing its flyover at only 30 feet, the crew noticed the
aircraft was lower than the now-identified hazard that they were fast approaching.
First Officer: "TOGA power! Go around track!"
The crew applied full power and the pilot attempted to climb. However, the elevators did
not respond to the pilot's commands, because the A320 computer system engaged its
'alpha protection' mode (meant to prevent the aircraft entering a stall.) Less than five
seconds later, the turbines began ingesting leaves and branches as the aircraft skimmed
the tops of the trees. The combustion chambers clogged up and the engines failed. The
aircraft fell to the ground.
Traditionally, pilots respect the inherent dangers of flying at low speeds at low height, and
normally, a pilot would not attempt to fly an aircraft so close to stalling with the engines at
Flight Idle (minimum thrust). But in this instance, the pilots involved did not hesitate to fly
the aircraft below its normal minimum flying speed because the whole purpose of the
flyover was to demonstrate that the aircraft's computer systems would ensure lift would
always be available regardless of how the pilots handle the controls. The Captain's
previous experience flying the aircraft type at the edge of its limits may have led to
overconfidence and complacency.

Study to address the deficiencies related to automation

Recent accidents involving advanced technology aircraft have served to underline some of
the concerns.
With backing from the FAA, a team of researchers from Oregon State University completed
a study to address the deficiencies related to automation.

© Global Air Training Limited 2015 14.15

 MODULE 14
AUTOMATION

Their work produced a list of flight deck automation human factors issues, over 700
instances of evidence related to those issues. This study of flight-deck automation
highlighted many perceived problems and concerns.

Handout – Problems & concerns re. Flight-deck automation

To illustrate, there are some quotes from various sources regarding a few of these
examples on the reverse of the handout (ASRS = Aviation Safety Reporting System)
Pilots may be out of the loop. Pilots may be out of the control loop and peripheral to the
actual operation of the aircraft and therefore not prepared to assume control when
necessary.

"...the captain allowed himself to remain removed from the 'control loop' by
leaving the autopilot engaged." (NTSB, 1986).

Manual skills may not be acquired. Low time pilots assigned to advanced technology
aircraft may not acquire manual flying skills, which are still required.

"'Standard' approaches are rarely made on the Air Inter network (about three
per pilot per year), and pilots receive much less training in manual procedures
than for ILS approaches. On this aircraft, the requirement to qualify on type is
three VOR approaches and one NDB approach per crew. A VOR approach is
required for the final check. Finally, the Air Inter route conversion instruction
manual recommends to instructors that a VOR/NDB approach or an ILS
approach without glide is practised each time it is compatible with the airport
traffic. Statistics of some 25 trainees show that each trainee practises only
five or six VOR or NDB approaches before entering airline service." (Ministere
de L'Equipement, des Transports, 1993).

Information overload may exist. Large amounts and/or poor formatting of information may
increase pilot workload.

"Advances in technology now make it possible to generate and display, in an

unlimited variety of formats, much more information than the human operator
can assimilate and interpret." (Air Transport Association of America, 1989).

Failure recovery may be difficult. When automation fails, pilots may have difficulty taking
over monitoring, decision-making, and control tasks.

"Two occasions going into Gatwick there were frequent re-programming on

the descent. The CDU went blank showing ‘FMS’ indicating the Flight
Management Computers had gone out of synch and were in the process of re-
interrogating each other. This takes a couple of minutes and requires the pilot
navigate horizontally and vertically by reference to the charts and raw data
during this particularly busy time. When the computers come back they must
be re-programmed and checked if they are to be used for the remainder of
the arrival." (Aviation safety analyst).

Pilots may be reluctant to assume control. Pilots may be reluctant to assume control from
automation. When automation malfunctions, this may lead to unsafe conditions.

© Global Air Training Limited 2015 14.16

 MODULE 14
AUTOMATION

"... some pilots remain reluctant to interfere with automated process, in spite
of some evidence of malfunction." (ICAO, 1992).

Sidesticks may not be coupled with each other or the autopilot, possibly reducing
awareness of the other pilot's or the autopilot's inputs and resulting in reduced situation
awareness and/or improper control actions.

The sidesticks aren't connected to each other. I don't know if unusual

attitudes are being caused by turbulence or the other pilot." (A320 Captain).

Controls of automation may be poorly designed. Automation controls may be designed so

they are difficult to access and activate quickly and accurately, or easy to activate
inadvertently.

The vertical speed and altitude selection knobs of the flight control unit (FCU)
are close to each other, and instead of operating the vertical speed knob , the
pilot CM.2 had inadvertently operated the altitude selection knob...the Court
has specifically suggested a design change with respect to the two knobs..."
(Ministry of Civil Aviation; Government of India, 1990).

Scan pattern may change. Display layout in automated flight decks may change the
traditional instrument scan pattern, possibly leading to loss of skills which may be needed
upon transitioning to conventional aircraft.

"The only problem I can think of is dependence on it. A pilot's scan tends to
slow down and narrow." (B737 captain).

Interface may be poorly designed. The pilot automation interface may be poorly designed
with respect to human factors considerations, possibly resulting in poor pilot performance
or pilot dissatisfaction.

"Because of aircraft design I am not able to see the horizontal situation

indicator when properly seated and aligned as it is positioned behind the
control column." (ASRS report number 60408).

Disengagement may be impossible. Pilots may not be able to disengage automation,

resulting in limits to pilot authority.

"...the crew was unable to override the [braking system] lockout and to
operate ground spoilers and engine thrust reversers." (Main Commission
Aircraft Accident Investigation, 1994).

Mode transitions may be uncommanded. Automation may change modes without pilot
commands to do so, possibly producing surprising behaviour.

"As identified in recent research, unanticipated mode changes are a concern,

particularly when transitioning from climbing/descending to level flight."
(B757 captain).

© Global Air Training Limited 2015 14.17

 MODULE 14
AUTOMATION

Pilots may lack confidence in automation. Pilots may lack confidence in automation due to
their experience (or lack thereof) with it. This may result in a failure to use automation
when it should be used.

"I am beginning to distrust the alt arm mode of the autopilot to the point
where I'd rather fly most approaches manually!" (ASRS report number 62983)

Manual operation may be difficult after transition from automated control. In some
situations flight control may be difficult after transition from automated to manual flight.

The captain lost control of the airplane when, after disengaging the autopilot,
he failed to make the proper flight control corrections to recover the airplane."
(NTSB, 1986, p. 34).

Envelope protections may limit pilot authority. Envelope protections may prevent
necessary correction manoeuvres in critical situations, such as when recovering from
unusual attitudes.

On board computers override a pilot's input - An unusual or abrupt control

manoeuvre may avoid an accident and potential loss of life." (B737300
captain).

Automation as a contributory cause of accidents

Question

Can you think of any accidents where automation was a contributory factor? Some
examples follow:

Slide – Turkish Airlines 25 February 2009

A Turkish Airlines Boeing 737 – 800(8F2) out of Istanbul crashed on the approach to
Amsterdam Schiphol with the loss of 9 lives including the three man flight crew. Due to
ATC positioning the aircraft for a ‘short approach’, the aircraft was ‘fast and high’ on the
glideslope. As it approached 2000ft (610m) the captains radio altimeter suddenly altered
from indicated 1950m (590m) to -8ft (-2.4m). The FOs radio altimeter continued to
function correctly. Workload in the cockpit was increased as the pre landing checks were
still being conducted below 500ft, (the company SOPs state that if pre landing checks are
not completed by 1000ft IMC/500ft VMC then the approach is to be considered unstable
and a go-around must be initiated).
The throttles were pulled back to idle thrust to slow the aircraft and acquire the glideslope
but due to the failed radio altimeter, the autothrottle unexpectedly reverted to ‘retard flare’
mode which is designed to automatically decrease thrust below 27 ft (8.2). As the Auto
pilot was using the correctly functioning radio altimeter, it raised the nose as the thrust
decreased in order to stay on the glide slope.
As the pitch angle increased and the speed continued to decrees the airspeed indicator
changed colour and began to flash (programmed to do this below 126kts). The AH showed
that the nose of the aircraft was far to high but no signs of anything untoward were picked
up by the crew until the stick shaker went off at 460ft (140m). At this point the FO who

© Global Air Training Limited 2015 14.18

 MODULE 14
AUTOMATION

was Pilot flying, pushed the nose and the thrust leavers forward. The captain took control
interrupting the fully forward thrust leaver selection and the autothrottle (not yet
disengaged) returned the thrust leavers to idle.
The autothrottle was then disengaged but no extra thrust was selected for nine seconds
until the leavers were pushed fully forward but at by then the aircraft had stalled with
insufficient height to recover.

Slide – Air France June 2009

Operating from Rio de Janeiro to Paris, flight 447an Airbus A330-203 crashed into the
Atlantic with the loss of all onboard (3 flight crew, 9 cabin crew and 216 passengers).
The initial emergency occurred in the cruise (37000ft) and involved icing in the pito tubes
and failure of the airspeed sensors. This caused the autopilot and autothrust to drop out.
Unfortunately the flight director was not disengaged as per procedures for ‘unreliable
speed’. The flight director then continued to suggest a nose high attitude was required
despite the aircraft entering a stall.
The PF continued to follow the flight director not recognising that it was continually
changing modes and giving spurious readings. The PF made several inputs on the flight
control, raising the nose further and exacerbating the stall while agreeing with the PM and
Captain (who had been resting during the initial incident and returned to the flight deck 1
min 40 seconds after the loss of speed indication) that a nose forward input was required.
Despite the attitude and stall warning indications, it is believed that the crew never
considered stall recovery or understood that the aircraft had departed from normal flight.
The aircraft impacted the sea in a level attitude 3minutes and 30 seconds after the initial
failure.

Slide – Asiana Flight July 2013

Asiana flight 214 crashed on landing at San Francisco after a flight from Seoul. The Boeing
777 200ER carried 307 people, 3 passengers lost their lives, 12 others were seriously
injured and 181 others were treated for injuries.
The ILS to runway 28L SFO was NOTAM’d out of service and so, in good weather, the
aircraft was cleared to a visual approach. Eighty-two seconds before impact, at an altitude
of about 1,600 feet (490m) the autopilot was turned off, the throttles were set to idle, and
the plane was operated manually during final descent. Autoland was not selected.
During the approach the crew noticed they were above the glide path, then on the glide
path, then below the glide path. Seven seconds before impact, one pilot called for an
increase in speed. The FDR showed the throttles were advanced from idle at that time.
The stick shaker went off four seconds before impact. There was another call for a go-
around. Airspeed reached a minimum of 103 knots (34 knots below the target speed)
three seconds before impact, with engines at 50% power and increasing. The crew called
for a go-around 1.5 seconds before impact. At the point of impact, the airspeed had
increased to 106 knots.
All three pilots told NTSB investigators that they were relying on the 777's automated
devices for speed control during final descent. The NTSB emphasized it is the pilot's
responsibility to monitor and maintain correct approach speed.

© Global Air Training Limited 2015 14.19

 MODULE 14
AUTOMATION

Experimental study of vertical flight path mode awareness

Introduction
Loss of pilot awareness about the commanded autopilot descent modes is a reported
cause in several recent incidents involving Airbus A320 aircraft.
With the new autopilot systems of this aircraft, the pilot can command several vertical
flight path modes, including a specified Flight Path Angle or a specified Vertical Speed.
These two modes share the same selector knob and display, have only a simple push-
button toggle to switch between them, and have similar mode indicators.
Therefore, the presentation and selection of these modes combined with the potentially
severe consequences of an error generate several serious questions about the supervisory
control task required of the pilot by these new systems.

Case history
In January 1992, an A320 crashed during a non-precision approach into Strasbourg
airport, killing 86 passengers. The descent rate of the aircraft has been estimated to be
3300 fpm, resulting in impact with high terrain.
This differs dramatically from the descent detailed in the approach plate; the aircraft
should have followed a gradual 'step-down' approach, which can be approximated by a 3.3
degree descent.
It is speculated the flight crew inadvertently placed the aircraft into the wrong descent
mode and did not recognize the problem during the following 47 seconds up to impact.
This problem with mode awareness may have been influenced by the command pilot's
likely primary flight reference, a Heads Up Display (HUD) with no mode annunciation, and
by the lack of a GPWS.
Two other incidents involved the same confusion about descent mode during approach.
Fortunately, these errors were recognized in time to prevent ground impact and were later
reported by the pilots of the aircraft.

Experiment
An experimental simulator study was run to test the pilot detection of an error in autopilot
mode selection.
Active airline crew were asked to fly landing approaches by commanding the Flight Path
Angle mode while monitoring the approach with both Head Up and Head Down Displays.
During one approach, the Vertical Speed mode would be intentionally triggered, causing a
high rate of descent below the intended glide path.
Of the 12 pilots, 10 did not act to decrease the high descent rate prior to significant glide
path deviation.

Simulator setup
The simulator had:
A Head Up Display (HUD) was situated in front of the pilot.
A radar altimeter indication was shown at heights below 500 feet above ground
No ground proximity aural alerts were given, imitating the Air Inter A320's lack of a GPWS.

© Global Air Training Limited 2015 14.20

 MODULE 14
AUTOMATION

The Flight Control Unit displayed all annunciations and selected values in the same
manner as the A320,

Experiment procedure
The 12 crew were current airline pilots. Ten flew larger transport aircraft such as the MD-
80 or Boeing 767; the remaining two flew commuter aircraft with glass cockpits.
All were briefed on the displays and controls of the simulator, especially the HUD.
The crew were then told that the objectives of the study were to “Test use of Heads Up
Display and new autopilot systems for non-precision approaches in low visibility”.
They were told to execute a sequence of five final approaches in low visibility conditions by
commanding the autopilot to follow a localizer and a specified flight path angle. After
making visual contact with the runway they were to take manual control of the aircraft.
During the briefing they were told that the point at which they took manual control would
be of interest.
At the start of each approach, the aircraft was two miles outside of the Final Approach Fix.
Therefore, the start of the approach involved a high workload however, once the pilots
were established on the approach and in landing configuration, pilot workload dropped
and the crew had ample time to monitor the approach and search for the runway through
the HUD.
During the fourth approach, the erroneous Vertical Speed mode was triggered by an
experimenter, acting as Pilot Not Flying.
Once the pilot recognized the severe descent of the vertical speed mode approach and
took any action to change it, the time of recognition was recorded. If the pilot took no
action the descent was allowed to continue until ground impact.

Results

Slide - Altitudes at which pilots took action

 One pilot of the twelve immediately noticed the extreme pitch down of
the aircraft on the HUD.
 One pilot safely took manual control after the aircraft had descended
approximately 1500 feet.

© Global Air Training Limited 2015 14.21

 MODULE 14
AUTOMATION

 Six pilots took control after a descent of approximately 2800 feet, when
the aircraft was approximately 500 feet above ground level and the
descent of 3200 fpm was well established which would have resulted
in ground impact in the Strasbourg accident.
 Four of the pilots did not take action before the aircraft impacted the
ground as it was set in the simulation.
Questioning revealed that the pilots who took manual control were reacting to the severe
descent, the cause of which they had not been able to identify. The pilots intended to
stabilize the aircraft manually and then attempt to ascertain the cause of this severe
descent.
All of the pilots, even those who did not take any action, were confused and concerned by
the increasing descent rate and its accompanying speed build up when in the
unanticipated Vertical Speed mode. Some pilots attempted to reduce these particular
aircraft states directly by requesting speed brakes and/or a somewhat shallower flight
path angle.
The altitude at which pilots took action has been examined for differences between pilots
with different characteristics. No significant differences can be found between pilots with
high and low levels of experience (as indicated by their flight hours), nor can differences
be found between pilots of different ages.

Conclusions
The pilots showed a lack of awareness of the commanded descent mode and were
confused by the resulting aircraft states.
All but one of the pilots allowed the aircraft to deviate significantly from the intended glide
path, with ten pilots allowing the aircraft to reach altitudes where ground impact either
happened or would be difficult to avoid. This indicates that pilots had a serious lack of
autopilot mode and aircraft state awareness when given the displays used in the study.
All of the pilots were concerned and confused by the vertical speed, pitch attitude and
speed build up that ensued from the descent, but many were reluctant to act because of
confusion or a belief that these extreme states were required to maintain the expected
flight path angle.

© Global Air Training Limited 2015 14.22

 MODULE 14
AUTOMATION

Slide – Any questions

References
1) Aircraft Accident Report controlled flight into terrain American Airlines
Flight 965 Boeing 757-223, N651AA near Cali, Colombia December 20,
1995 / Aeronautica Civil of the Republic of Colombia
2) Bibliography
3) Billings, C.E. (1991). Human-centered aircraft automation: A concept
and guidelines (NASA Technical Memorandum No. 103885). Moffett
Field, CA: NASA-Ames.
4) Sarter, N.B. & Woods, D.D. (1992). Pilot interactions with cockpit
automation: operational experiences with the flight management
system. In The International Journal of Aviation Psychology, 2. (pp. 303-
321). Hillsdale, NJ: Lawrence Erlbaum Associates
5) Wiener, E.L., Chidester, T.R., Kanki, B.G., Palmer, E.A., Curry, R.E., &
Gregorich, S.E. (1991). The impact of cockpit automation on crew
coordination and communication: Vol. I. (NASA Contractor Report No.
177587). Moffett Field, CA: NASA-Ames
6) Maurino, Daniel E., James Reason, Neil Johnston, and Rob Lee. Beyond
Aviation Human Factors: Safety in High Technology Systems. Brookfield,
VT: Avebury Aviation, 1995
7) Boeing 757 Flight Crew Loses Situational Awareness, Resulting in
Collision with Terrain Flight Safety Foundation - Accident Prevention
July-August 1997
8) Boeing 757 CFIT Accident at Cali, Colombia, Becomes Focus of Lessons
Learned Flight Safety Foundation - Flight Safety Digest, May-June 1998
9) The Dutch Air Safety Board Crashed during approach, Boeing 7373-800
near Amsterdam Schiphol Airport, 25 February 2009
10) Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile
accident report 2012.

© Global Air Training Limited 2015 14.23