The report on the crash of the AirAsia A320 into the Java Sea last year is out and is providing fresh grist for the mill of the anti-tech crowd.
The A320 had a problem with the rudder travel limiter system that was caused by a faulty solder joint. The pilots kept getting warnings from this malfunction. They pulled the circuit breaker, which was prohibited. This disconnected the autopilot and the automatic stall protection system. The crew apparently didn’t know this would happen. The airplane zoomed and rolled into a steep bank. Some time, about nine seconds, elapsed between the start of the roll and any pilot attempt to take control.
The airplane stalled at 37,400 feet and descended out of control to the sea. There was confusion and contradictory flight control inputs from the two pilots on the way down and it did not appear that the stalling condition was fully recognized.
Another Air France?
There are enough similarities between this and the Air France A330 that plunged into the Atlantic a while back to lift an eyebrow or two. In both cases, the autopilot disconnected and the crew did not know how to deal with the aftermath. And it both cases it will be said over and over that good basic airmanship would have saved the day.
Before going on, it has to be considered that this latest accident occurred in a land far away and involved a different culture and probably a completely different approach to the art of flying. In the report it was actually stated that the pilots were not trained in upset recoveries because the airplane design prevented it from becoming upset. I would suggest that those folks might want to buy a certain bridge, but they might have already made the purchase.
Some might say that was an airline accident and means nothing to us. That is sticking the old head in the sand because we can learn something from any and all aircraft accidents and over the years private aviation has seen a lot of autopilot-related accidents.
Change the scene to central Florida where the pilot of a Bonanza A36TC was having problems with instructions to stay out of Class B airspace. In explaining why he wasn’t following instructions, the pilot said that he was unable to disconnect the autopilot, that he needed to get the airplane on the ground, and that he needed assistance. Then the pilot told the controller that he had to use “full force” and asked if anyone knew how to turn the autopilot off. An unknown voice on the frequency told him to pull the circuit breaker. The pilot responded that he was pushing as hard as he could on the control yoke and that he had pulled the circuit breaker. The airplane crashed into a lake.
The A320 pilots might not have known that their autopilot would disconnect if they pulled that rudder travel limiter circuit breaker. The A36TC pilot might not have understood the relationship between the autopilot, the electrical trim system, and what is and is not allowed in the certification process. Certainly he apparently did not understand what pulling the autopilot circuit breaker would do, or not do, to help with his problem.
Only one pilot can fly at a time and if the autopilot is flying, the human pilot has to keep his paws off the controls. Why? If you exert elevator pressure, the autopilot will run the trim against that pressure. Pull, for example, for long enough and full nose-down trim will be run. Autopilot certification requirements do not address the power of the airplane’s trim system even though the autopilot uses it and normal pilot strength might not be adequate to overpower a full trim condition.
When in doubt, disconnect the autopilot and use that big trim wheel.
Can you pull the circuit breaker to fix this? Not completely. Pulling the breaker would only stop the trim from running. Then the manual trim would have to be used to properly retrim the airplane.
That has been true forever and has been written about many times but there will probably always be accidents related to this.
The debates about over-reliance on technology will rage on, too, but I think, in light of these and other accidents, we need to once again step back and examine the relationship between live pilots and autopilots.
In private aviation this all started with the Lear L-2 (sometimes written L2) autopilot. As you may have guessed, this came from the fertile mind of Bill Lear (as in Learjet) and was a remarkable achievement. It was heavy (40 pounds) and expensive for the day but it was a pretty fine autopilot for 1951.
From the beginning, the reaction to a full autopilot, with altitude hold and approach coupling, reflected interesting ideas about the benefits of an autopilot.
A Lear ad in the June, 1951, issue of Air Facts, featured 13 testimonials. One was from Max Karant who was then editorial director of AOPA and would remain active in the organization well into the 1980s.
Max said, “It may well be that Bill Lear has contributed one of the most important missing links to the development of private flying. It is quite conceivable that the L-2 right now could very well boost the average utility of a plane owned by a typical AOPA member from, say, and average of 50% to something like 90%. Such an increase in utility could, by itself, put civil aviation in the position of being one of the nation’s healthiest, more striving industries.”
Other testimonials were equally or more ebullient. From reading them I got the feeling that all these pilots would be getting a new library card so they would have plenty to read while flying along. They said thing like, “Now we can fly 12 hours a day,” and “I no longer hesitate to fly anywhere,” and “Definitely superior to the drive-in theater.” You can conjure up you own double entendre to fit that last one. If you can’t, ask a senior citizen for a little help.
From this it seems that pilots flying with that autopilot felt enabled to do things that they would not, or could not, do without the autopilot. That was, and still is, a potentially dangerous thought.
“One of the most important missing links to the development of flying.”
It was interesting to me that not a lot of editorial ink was given to the L-2. It was straightforward and simple and it flew the airplane well so what else was there to say? In 1951, little thought was given to how to use or to get the most from an autopilot and certainly nothing was said about any pitfalls. It might have seemed like magic but it got surprisingly little attention
Marion Rice Hart was a frequent Air Facts contributor in those days. She was a great friend of Air Facts and wrote many articles about flying her Bonanza all over the world. She did love her L-2 autopilot, too. Her experience with it countered some the arguments from autopilot skeptics.
We were in Dallas, at an NBAA convention. The weather was terrible. Marion showed up, having arrived in her Bonanza. We didn’t really know whether or not she even had an instrument rating. When asked how she had gotten into Love Field in the low weather, she shrugged and said, “Bill Lear flew a perfect approach.” Marion quite obviously depended on that autopilot.
A lot of people were sure the eccentric (and wonderful) old lady would come to an end in her Bonanza. Marion flew until she was 87 and was 98 when she died of natural causes. Maybe an understanding of technology was in her genes because her father founded the Electric Boat Company. The fact that she sailed a 72-foot ketch around the world might have helped her understand risk. She was also a graduate of MIT. The point being that she probably understood what she was doing and the risks she was taking better than most.
My first experience with automatic flight control came in the Piper Pacer I bought from Air Facts (my father) in 1954. It had a Javelin autopilot which was a simple device that detected turn and pushed on the rudder to stop the turn. That wasn’t really an autopilot but it did free up a little time for cockpit chores. Another rudder-only autopilot was the Lear Arcon (automatic rudder control). An ad for that one showed an out-of-control situation on the verge of being fixed by the Arcon.
I only flew with an L-2 a few times and my first extensive experience with more complete autopilots came with Piper house brands (made by Mitchell) called Autocontol and Altimatic. This was in the early 1960s. The goal of these autopilots was to do what an L-2 would do for far less cost.
The Autocontrol was an ailerons-only unit that would hold a heading and the Altimatic controlled pitch as well and had a truly crude altitude-hold feature. Autopilots were becoming popular and while no other airframe manufacturer had a house brand (yet), all were installing autopilots from companies like Tactair, Brittain, Mitchell and others.
“Travel as a ‘guest’ in your own plane…” Worst headline ever?
I came to quickly distrust the pitch control feature of the Piper Altimatic. It malfunctioned one day and wanted to nose down. I held the airplane level and the autopilot disconnected with a loud pop. I think it had a ball/socket connection in the pitch system that was designed to let go at a certain force. That particular system did not use the airplane’s trim system so once the autopilot was out of the pitch control system things reverted to normal.
My suspicion was heightened when a Comanche was dismantled in flight during a test hop after autopilot maintenance. What could have happened was the pilot allowed the airspeed to build far beyond Va when the autopilot malfunctioned. The overstress of the structure could have come when the autopilot let go and the pilot’s force took over. I decided then that autopilots could indeed be deadly and that prudent risk management suggested a healthy dose of suspicion.
For a number of years, I flew Altimatic-equipped Comanches and Twin Comanches that were leased by Air Facts and I hand-flew them all the way. The first thing I would do on my checklist was pull the autopilot circuit breaker.
When Piper introduced electric trim I had a discussion about it with a person named Piper. He explained it thoroughly including word that some of the system was adapted from technology use on the electric windows of Chrysler cars. That made me forever suspicious of electric trim systems on light airplanes.
I found booby traps in other autopilots, too. I was doing an evaluation trip in an autopilot-equipped Baron and was trying to learn about the autopilot by using it. Trouble was, if you bumped the electric trim control it would disconnect the autopilot and there was no disconnect warning. After realizing that I had unknowingly disconnected the autopilot a few times I just pulled the breaker and hand flew.
My suspicion of autopilots was enhanced when Cessna bought ARC and launched its own brand of avionics and autopilots.
The top-of-the line autopilot was the Cessna 400 and it was installed in most of the demo airplanes that I flew from the 182 through all the piston twins. I didn’t return many to the Cessna factory with the 400 autopilot functioning properly. At best they flew more like a spastic than an automatic pilot and at worst they didn’t work at all. The pitch function was the weakest link and I often suggested to Cessna that they should fix it where the pitch function could be disabled and the roll function could still be used.
My favorite avionics technician once told me that if pilots knew how some of those autopilots were designed and built they would hopefully know not to put any trust in the devices.
If you really want to know how I managed any potential autopilot risks, I’ll tell you. After I went to work for FLYING in 1968, I bought five new or nearly-new airplanes. They were a 182, Cherokee Six, 172, 177RG and P210 Not a single one of them had a full autopilot and none had electric trim. I had every other electronic device known to man at the time I owned the airplanes and treasured having the technology. The last avionics go-around for my P210 put in a Bendix/King IHAS-8000 system that included traffic, weather, ground prox and vertical profile radar. I flew the first-ever GPS approach with a fully approved system in that P210 and when the airplane was retired from service, it had a simple ailerons-only S-TEC autopilot because that was all I wanted. I did think it was necessary to have that much autopilot.
Newer digital autopilots, complete with “straight & level” buttons, are a major improvement.
Now the caveat. My thoughts about autopilots were formed in the days of gyros and vacuum systems. Those things in themselves were as low tech as you could get and adapting them to autopilot operation was a stretch at best. The last year that I flew, I used a new Skylane and Columbia 400. Both had a Garmin G1000 and Garmin autopilot. No vacuum and no gyros. I didn’t use the autopilot much in the Skylane because I was used to hand flying regular old Cessnas. I used it more in the 400 because it flew that airplane so well. I learned how to use it for everything and considered it to be far more trustworthy than anything I had used before. Were I younger and buying a new airplane, I might shock everyone by including one of the new autopilots.
Some pretty good safety features have come by way of autopilots, too. Some now have a panic button that will return the wings to level if things are getting out of hand. (The Lear Arcon did that in the 1950s.) Most turbine airplanes have autothrottles which are a wonderful safety device and should actually be on all turbine airplanes.
It is my opinion that the debate over basic airmanship v. high-tech has become confused. Advances in information technology have done wonders for all forms of aviation and should be embraced by all. I think the jury is still out on some forms of automation though autopilots have gotten a lot better. They can still be deadly in the hands of a pilot who doesn’t fully understand the system.
Just yesterday I read of a new Airbus A350 that automatically rejected its inaugural takeoff from JFK because the onboard system decided the runway wasn’t long enough. It did that 18 seconds into the takeoff roll. If the bloody thing had any real sense, and if the runway had really been too short (it wasn’t), you’d think it would have figured that out before starting the takeoff.
Did I use the Killer Autopilots title just to attract attention? No, I used it because misunderstood or malfunctioning autopilots have, for a fact, killed a lot of people, including a wonderful friend and his wife on a dark but not stormy night. I think my suspicion of autopilots and electric trim systems was of great benefit to my risk management efforts over the years.
That’s not to say that others haven’t found benefits, as did Marion Hart years ago. As for the person in the Lear ad who found an autopilot to be definitely superior to a drive-in movie, I’ll leave that risk/reward equation to your imagination.
- From the archives: how valuable are check rides? - July 30, 2019
- From the archives: the 1968 Reading Show - July 2, 2019
- From the archives: Richard Collins goes behind the scenes at Center - June 4, 2019
If we go back to basics, I would say that a decent AP is a must. I fly with a wife and three young kids regularly, the AP is a great ” second set of hands” and I would not do a 2-3 hour trip without it. Can I hand fly for 3 hours? Yes… Would I like too ? No, very much no. And while touch and gos with a monster like the cherokee six is not my idea of fun, I do it anyway, keeps me sharp, keeps me hands on, np AP in the pattern. So I guess it’s a balancing act.
Thank you Mr. Collins. As a USAF trained autopilot technician and having worked on Lear, Sperry, and other systems installed on both large and small aircraft, I agree with your idea of not trusting them 100%. I remember a brand new KC-135 coming out of the Seattle factory in 1964, and the pilot having fits when he finally got into debriefing. The a/p would porpoise a thousand feet every time it was either engaged or disengaged. That was the longest six hours that pilot every flew, according to him. It took us about six months to finally find and fix that cold solder joint, as well as one of our in-flight technicians getting a serious headache when the plane did a sudden nosedive, with that system, and his head got planted into the cabin ceiling near the avionics bay.
There were many sleepless nights on that cold flightline ripping apart those miles of wiring bundles searching for the problem, then getting them put back together before she had to go on another mission. (As per USAF/SAC policy at that time, the autopilot was not considered a “flight essential system,” therefore the plane would not be deadlined, or red Xed, because of any problems with that system.)
Such a Christmas present your a/p Art story . I read it first and while in it i was Just asking myself who so splendid explain so well all these facts. Then.. I read your name. thank you Sir Collins and I ask your permission to forward your gift to my Aviator group FLAPA. MERRY CHRISTMAS!
Autopilots are just another part of the aircraft systems that a qualified pilot should know intimately (especially how to disengage it) to fly the airplane safely. All aircraft systems are subject to failure at any time, from engines to landing gear to flight control surfaces, to fuel systems, to avionics and instruments. Autopilots are really no different and should not be trusted to perform better than any other system on the airplane.
So a pilot who doesn’t know how to disengage the autopilot is just as ignorant and ill-equipped to fly as a pilot who doesn’t know how to control the airspeed or angle of attack with the stick, or who doesn’t know how to use the nav equipment or radios, or who doesn’t know how to fly a landing pattern without lawn-darting into the ground.
For some folks the autopilot must seem a particularly trustworthy system, which trust is unearned. And for some folks like Richard Collins, autopilots seem a particularly untrustworthy system.
So autopilots don’t kill pilots and their passengers – but pilot error, including inability to deal with an autopilot or any other system malfunction, does apparently kill a lot of people. It’s always necessary to not trust any system on any aircraft, and be prepared to overcome when some system inevitably fails, often when we least expect it.
A flight instructor I know told me that every airplane he’s ever flown was trying to kill him, and it was his job to foil the airplane.
Modern airmanship includes knowledge of autopilots and their function as well as
any modern avionics. It also includes, as it always has, the ability to fly the airplane when said conveniences decide to take a holiday and the ability to stay ahead of the aircraft at all times.
As always Richard you have expressed again the absolute essence of fundamental truth in the context of flying! Having personally flown a Boeing 727 from KORD to KSAN with an inoperative autopilot (it was a deferrable item) I can attest to the dependence on autopilots many of us developed over the years. It was a wakeup call for me, and changed my entire assessment of proper systems management. As “Duane” alluded to, an autopilot is just another system with its own “Abnormal Operations” procedures and “Emergency Operations” procedures. Every pilot needs to have command of all of his “Normal”, “Abnormal”, and “Emergency” procedures whether he flies an LSA or an Airbus 380.
Great article … an interesting read …George
I have experienced this on a sim, fight the autopilot, cause it to overtrim, and disengage. If you are not expecting it, or are at a low altitude, you are unlike to recover in time. I daresay this has been the case in many accidents.
One of my students told me that his grandmother was a passenger on that flight. She was found strapped in the seat, upright position in the mud away from the fuselage. She was sitting there completely confused when one of the flight attendants found her. She suffered minor scratches. It was back in the mid- eighties and he had no problem pursuing a pilot career. Good student and great pilot !!!!
43 years ago, Eastern Air Lines Flight 401, a four-month-old Lockheed L-1011-1 Tristar carrying 163 passengers and 13 crew members, left New York’s JFK Airport on Friday, December 29, 1972 at 9:20 p.m., en route to Miami International Airport.
The aircraft was under the command of captain Robert ‘Bob’ Loft, 55, a veteran Eastern Air Lines pilot ranked 50th in seniority at Eastern. His flight crew included first officer Albert Stockstill, 39, and second officer (flight engineer) Donald ‘Don’ Repo, 51. A company employee—technical officer, Angelo Donadeo, 47, returning to Miami from an assignment in New York—accompanied the flight crew for the journey.
The flight was routine until 11:32 p.m., when the flight began its approach into Miami International Airport. After lowering the gear, first officer Stockstill noticed that the landing gear indicator, a green light identifying that the nose gear is properly locked in the “down” position, did not illuminate. This was discovered to be due to a burned-out light bulb. The landing gear could have been manually lowered either way. The pilots cycled the landing gear but still failed to get the confirmation light.
Loft, who was working the radio during this leg of the flight, told the tower that they would abort their landing and asked for instructions to circle the airport. The tower cleared the flight to pull out of its descent, climb to two thousand feet, and then fly west over the darkness of the Everglades.
The cockpit crew removed the light assembly and second officer Repo was dispatched into the avionics bay beneath the flight deck to check visually if the gear was down through a small viewing window. Fifty seconds after reaching their assigned altitude, captain Loft instructed first officer Stockstill to put the L-1011 on autopilot. For the next eighty seconds, the plane maintained level flight. Then, it dropped one hundred feet (30 m), and then again flew level for two more minutes, after which it began a descent so gradual it could not be perceived by the crew. In the next seventy seconds, the plane lost only 250 feet (76 m), but this was enough to trigger the altitude warning C-chord chime located under the engineer’s workstation. The engineer (second officer Repo) had gone below, and there was no indication by the pilot’s voices recorded on the CVR that they heard the chime. In another fifty seconds, the plane was at half its assigned altitude.
As Stockstill started another turn, onto 180 degrees, he noticed the discrepancy. The following conversation was recovered from the flight voice recorder later:
Stockstill: We did something to the altitude.
Loft: What?
Stockstill: We’re still at 2,000 feet, right?
Loft: Hey—what’s happening here?
The jetliner crashed at 25°51′53″N 80°35′43″W25.86472°N 80.59528°W
The location was west-northwest of Miami, 18.7 miles (30.1 km) from the end of runway Nine Left (9L). The plane was traveling at 227 miles per hour when it flew into the ground. The left wingtip hit first, then the left engine and the left landing gear, making three trails through the sawgrass, each five feet wide and more than 100 feet (30 m) long. When the main part of the fuselage hit the ground, it continued to move through the grass and water, breaking up as it went.
In all, 77 had lived through the ordeal—69 of the 163 passengers and 8 of the 10 flight attendants survived the crash, with 99 initial fatalities. Of the cockpit crew, only Flight Engineer Repo survived the initial crash, along with technical officer Donadeo who was down in the nose electronics bay with Repo at the moment of impact. Stockstill was killed on impact, while Captain Loft died in the wreckage of the flightdeck before he could be transported to a hospital. Repo was evacuated to a hospital, but later succumbed to his injuries. Angelo Donadeo, the lone survivor of the four flight deck occupants, eventually recovered from his injuries and died on October 4, 2004.
Sir, If you remember, the L1011 had an AP function, called CWS (Control Wheel Steering). In vertical mode the AP would take inputs from the wheel/yoke. If the Captain or FO put press on the wheel in small increments the AP would respond to the inputs and not disconnect. In attempts to rpl the gear position ind bulb, the Captain or FO applied fwd or down input pressure to the yoke causing the airplane to descend without disconnecting the AP.
I think what got them was darkness. If they had some daylight they would have some outside visual reference if somebody had gone outside. It gets awful black over them Everglades at nite, like the Atlantic ocean.
I sometimes think the AF disaster, if memory serves, it was AF 447 in the Atlantic might’ve had a different out come if it hadn’t been on the backside of the clock.
Anybody here remember GCA? The Brits had it down pretty pat, course their WX dictated some solution. I once rode one as a FE on a KC-97G back in the fifties. You certainly gain an appreciation for focus, concentration and good airmanship. I think this was CRM before CRM.
KERRY,
Your points are excellent !!!
Thank you !!!!
Regarding British weather and GCA….it reminded me of something.
There’s the famous story of one of the British airlines demanding that Boeing install Cat III ILS capability as a standard feature on the jets that they had ordered. The Boeing representatives in the meeting pointed out that if you had conditions that low, you could just divert and pointed out that there were only two or three airports in all of the US capable of such a landing.
The Brits then asked how they would like to divert to Canada on a regular domestic flight because that’s the equivalent of what Boeing was basically asking. Americans are so used to having so many airport options and such broad expanses that they didn’t have the concept of how fog and cloud could enshroud an entire country.
We see here ( after NTSB investigates) that in every accident there was a small error, omission or lack of knowledge of one or more small things.
One broken link in an otherwise strong chain.
The weak link brings the plane down,with disastrous results.
Overdepentence on one system or another is a potential “weak link”. Thankfully now we have ORM that if used properly identifies the hazards.
For every accident flight, thankfully we have millions of safe operations to consider and learn from. Crews that work together in harmony for a safe outcome. Single pilots who pay full attention before during and after the landing. Pilots who leaned to do a thorough not just pre flight but also after flight inspection.
Fly the airplane first and fly it again in your sleep, you might learn that you got away with something and fix it before it becomes a statistic. What you don’t know, can kill you.
I learned that from experience. Learning is endless !!!!
This article came a few days after I had to cancel an approach shortly after being cleared. On the infamous Aspen LOC/DME approach I was about to enter IMC at 16000ft when my GPS linked A/P decided to take me to a different destination (DBL VOR that I had just left). There is no question in my mind that it was pilot error (the A/P should have been in loc mode but still the GPS was set up to my destination) but I decided to get a few vectors and then went back to fly the approach by hand using the GPS as a backup displaying my position on the approach. A/P are wonderful but not forgiving.
I have an Autotrol II in my humble PA28-180 that I regulary use it on crosscountry trips, mostly in heading hold mode. For IFR tips, I do the autopilot pre-flight check out by the book. I use the electric trim only enroute. I have added a pre-take off checklist step of checking and then disengaging the electric trim. For pre-approach, I have added an electric trim disengage step as well. I greatly appreciate these features, but watch them closely.
A few years ago I inadvertently flew a Cirrus SR22 into an embedded thunderstorm. At the time we were cruising at 10,000′ using the Cirrus (G1000) Perspective GFC705 autopilot.
I had fortunately given some thought as to what I might do in a severe turbulence encounter: Set the Altitude Selector to the LSALT (5,500′) and deselect ALT mode resulting in pitch wheel control (PIT). As we rocketed up through 12,000′ in severe turbulence (I had already selected 50% power for a theoretical IAS approximating just under Va) I made some gentle changes to pitch attitude in the desired direction.
My passenger was as white as a sheet and yelled that he would give me his entire net worth if I got him out alive – he was a pretty wealthy guy so I wasn’t going to give up the fight!
As the plane was pounded by turbulence I made a mental note that I would take over from the autopilot if it ever exceeded 45 degrees of bank or 15 degrees of pitch (don’t ask me where those numbers came from but they felt about right). That Garmin autopilot just kept on delivering and was most likely doing a better job than I could have done until we were spat out of the storm some minutes later.
After landing I inspected the plane and found some paint missing at one of the wing roots which probably meant they were flexing a whole lot during the encounter. There was fortunately an authorised Cirrus mechanic on the ramp at the time who declared no harm done.
When I reminded my passenger about his remark about handing over his entire net worth during the turbulence he replied that he was in shock and couldn’t remember saying anything! I figured that getting it in writing at the time would have been impossible anyway.
A modern autopilot in this situation proved that when used correctly can be a great asset to safety. Too bad they can’t make you wealthy.
Charles, actually I think you were richly rewarded by that autopilot.
I was sitting in an EAA IMC club event listening to an IFR accident scenario when the fellow next to me said the pilot in question should never have been IFR without an autopilot. Imagine my surprise having survived 400 or so hours of actual IFR without an autopilot. Having said that, I have, as a passenger survived a couple landings into Heathrow without seeing the runway lights until after touchdown. Your advice to know your equipment is spot on. Trust but verify.
People give STEC grief for taking a rate based approach to autopilots, but getting the attitude indicator out of the autopilot loop is one of the best things you can do to improve GA autopilot reliability.