Lion Air crash shows cockpit computers are no substitute for pilot skills

A member of the Indonesian National Commission of Transportation Safety shows the cockpit voice recorder recovered from a Lion Air jet that crashed off Indonesia in 2018.

Feb. 4, 2019 11:25 AM PT

When an altitude sensor failed on a Turkish Airlines Boeing 737 flight to Amsterdam in 2009, the jetliner’s computerized flight controls erroneously cut the engine thrust. The pilots didn’t understand what happened in time to prevent a crash.

The accident had striking similarities to the recent Lion Air tragedy in Indonesia, which took the lives of 189 people. A failed sensor led flight computers to put the 737 Max jetliner into a series of dives, based on the erroneous calculation that it was losing lift and about to stall. The crew didn’t diagnose the problem, which could have been remedied with the flip of a switch, and the plane fell into the Java Sea. The investigation into the crash is ongoing.

Aviation experts say automated systems have made planes safer than ever and are a major reason why crash rates have declined all over the world. The push to automate — which also reduces airlines’ training costs — is only growing stronger. Boeing has a research project in the works to develop a fully automated jetliner. A company spokesman said last month that testing was ongoing.

But automated flight systems are also implicated in a series of incidents in which they made the wrong decisions and pilots did not fully understand the complex software that adjusts flight controls constantly during automated takeoffs, landings and high-altitude cruising.

“A lot of the optimization that the computer is doing is not made clear to the pilot,” said Douglas Moss, an instructor at USC’s Viterbi Aviation Safety and Security Program. He is a former United Airlines captain and before that, an Air Force test pilot, as well as an attorney. “The pilot is sitting there for 10 or 15 seconds trying to figure out why the computer is pitching up the nose or adjusting the throttle. I can think of thousands of times when the autopilot or flight management system would do something that caught me by surprise. Almost always, it is the right thing to do, but it is the pilot who is responsible for the safety of the flight.”

The two accidents also highlight the potential risks of basing automated flight control decisions on readings by only two sensors — which can create uncertainty when one fails.

Boeing and Airbus, the dominant international manufacturers of large jetliners, declined to provide detailed information about how many sensors their aircraft models have for various critical measurements, such as altitude, airspeed and angle of attack, citing the ongoing Lion Air investigation.

But Federal Aviation Administration documents reviewed by The Times, along with interviews of union officials and aviation experts, point out that some, though not all, aircraft have three sensors for critical readings, allowing a computerized voting system to eliminate a discrepant sensor.

Aviation experts say the pilots’ authority, certainly outside of the U.S. and Western Europe, is being gradually encroached on by automated control systems that offer air carriers lower training costs and crew expenses in an increasingly competitive international industry. It has led to a decline in basic manual flying skills, the ability to use the stick, rudder and throttle to keep a plane at the correct speed, pitch and altitude, a wide range of safety experts say.

“Pilots are not being told or taught everything they need to know about their airplanes,” said Chesley Sullenberger, the renowned pilot who made an emergency landing on the Hudson River a decade ago that saved every person on board.

“It is not easier or cheaper or requires less training to fly an automated airplane. It frequently requires more, because you have to have a deep understanding of how a system works, including the dark corners, the counterintuitive things it might do in certain circumstances. Many foreign carriers are trying to take people with zero flying experience, put them in simulators and quickly put them in the right seat of a jetliner. They don’t have the experience, knowledge, skills and confidence to be the absolute master of the aircraft start to finish.”

Dennis Tajer, an American Airlines captain and spokesman for the Allied Pilots Assn., agrees automated systems should result in more pilot training, not less.

“It makes the aircraft a bit more complicated, so understanding that, being able to utilize it and making it a part of your safety standard is critical,” he said. When a piece of equipment fails, it’s incumbent on the pilot to keep control of the plane, he said, adding, “stick and rudder skills save lives.”

The U.S. airline industry agrees, and Boeing doesn’t dispute the value of pilots.

Company executives have questioned where global airlines are going to get all the pilots needed to fly the planes that are on order and expected over coming decades.

As air travel increases rapidly around the world, many foreign carriers are coming to depend on automated controls to help flight crews that do not routinely have the deep experience, military background and intensive training that is common among major U.S. and Western European airlines. American experts are growing increasingly concerned that such crews are reluctant to fly aircraft manually and lack the skills necessary to intervene when computers make the wrong decisions.

Those concerns were at the forefront in the crash of an Asiana Airlines Boeing 777 in San Francisco in July 2013, which killed three and injured 187. The crew had inadvertently disengaged the auto throttle, which is akin to cruise control on an automobile, as it made its final approach. The airspeed and altitude varied widely over the prescribed glide slope and the plane’s landing gear and tail hit the concrete sea wall at the far edge of the runway. Federal investigators blamed the accident on improper speed and altitude control, noting that Asiana Airlines emphasizes the use of cockpit automation. As a result of similar policies, many crews from nations around the world have limited hands-on manual flying skills.

In the Turkish Airlines and Lion Air accidents, the pilots should have been able to manually fly the planes out of harm’s way, experts say.

In the Turkish Airlines flight, one of the aircraft’s two radar altimeters reported that the plane was eight feet below the ground, leading the computer to think it was about to land and triggering an automatic reduction in the throttle. In fact, the aircraft was at about 2,000 feet and the crew was trying to reduce airspeed on the approach. But the crew did not realize the power settings had been cut to idle until it was too late, and the plane crashed a mile short of the runway. Nine people were killed.

In the Lion Air accident, one of the plane’s two angle-of-attack sensors, which measure the angle at which the wings are moving through the air, failed on takeoff from Jakarta. The aircraft’s autopilot disregarded the good sensor and followed readings of the discrepant left side, or captain’s sensor. As a result, it triggered software meant to offset the aircraft’s tendency for the nose to pitch up.

Such a nose-high attitude can reduce lift and potentially stall the jetliner. But in this case, the software — the maneuvering characteristics augmentation system, or MCAS — was responding to wrong data and putting the plane into a dive. It is similar to what is known as a “runaway trim,” which can be caused by as many as five problems. Some experts say the crew should have known how to flip off the MCAS and manually fly the plane, which is what another crew had done the day before in the same plane. Instead, the captain repeatedly attempted to pull up the nose and never correctly diagnosed the problem.

An Asiana Airlines Boeing 777 lies burned near the runway after it crash-landed at San Francisco International Airport in 2013.

“Automation complacency is a huge issue,” said Andrew Skow, founder of Tiger Century Aircraft, which develops cockpit safety systems, and a former Northrop Grumman chief engineer and flight test director. “If an automation system has control and is right most of the time, you become complacent.”

Skow said automation systems often fail to consider unintended effects, which occurred in the Turkish Airlines and Lion Air accidents. He also faults Boeing’s design of the MCAS, saying it trimmed the nose down at too fast a rate, because it was designed to be engaged at a lower speed. At 250 knots, it was generating violent nose-down movements that the crew could not counteract.

Boeing declined to comment on the matter, citing the pending investigation.

A third angle-of-attack sensor may have allowed the flight computers to determine which sensor was giving a bad reading, Skow said, a view shared by other experts.

Tajer, the pilots union spokesman, said airline flight manuals indicate Boeing planes have two AOA sensors, while Airbus models have three. Could three sensors have made a difference in the Lion Air accident?

“I think Boeing is very much asking itself that question,” said Steve Wallace, the former director of the FAA’s office of accident investigation and now an aviation safety consultant.

But Wallace and others don’t make the case that three sensors would have necessarily changed the outcome. William Tuccio, a former aerospace engineer at the National Transportation Safety Board, said engineers rely on what’s called failure mode and effects criticality analysis as one way to assess risk probabilities and determine the proper amount of protections. Additional sensors may be unnecessary and could be a waste of money or an increase in complexity, he said: “If you’re going to answer a single question about reliability or engineering resilience, just asking how many AOA sensors is an incomplete question.”

Wallace pointed out that no jetliner has crashed while on an automated landing, though there have been accidents because of the crew’s incomplete understanding of the automation. “Fundamentally, automation is a huge plus for aviation safety,” he said. “You still need to know the basics of stick and rudder flying.”

And then there is the cost versus benefit. “How many backups to your backups do you need?” said Michael Barr, the former director of the USC safety program. “Nobody wants to talk about cost.”

No one in aviation expects automation to slow down, though there are sharp disagreements among experts about how far it should go.

As far as a fully automated aircraft, Sullenberger, who retired as a commercial pilot in 2010, is skeptical that it will happen for a long time and doubts he would fly in one. “Unless it is actually capable of learning in the moment and improvising, unless it could be essentially human, I don’t see how you ever have the same level of confidence.”

Robert Ditchey, a safety consultant, expert witness and former airline executive, says the day there is no pilot in the cockpit is when he will stop flying. “We have the ability to autonomously land a spacecraft on Mars, but do we want to put people on board? I don’t think so.”

But Wallace is a big fan of automation and where it is headed. “I drive my Tesla with Autopilot on all the time. It keeps a safe distance.”

Milestones in aviation automation

1917 — Sperry Corp. develops the first rudimentary autopilot that uses gyroscopes to reduce pilot workload.

1932 — First instrument landing at Berlin-Tempelhof Central Airport, using the Lorenz beam system.

1949 — Bill Lear wins the Collier Trophy, aviation’s most coveted award, for development of the Automatic Pilot and Automatic Approach Control System at Santa Monica. Two years earlier a U.S. Air Force C-54 made a transatlantic flight, including takeoff and landing, completely under the control of the Lear autopilot.

1964 — First fully automatic landing using an instrument landing system, at Bedford Airport, United Kingdom.

1982 — The first modern flight management system, including an autothrottle that operates like cruise control in a car, introduced in the Boeing 767.

1987 — The first use of a fly-by-wire system on a passenger jet on the Airbus 320. Fly-by-wire takes pilot input and calculates the control-surface movements required to deliver the result.

1995 — Boeing’s new 777 has a fly-by-wire system with flight envelope protection, which is supposed to prevent stalls or excessive stressful movements, though a pilot can override them.

2016 — Boeing introduces the 737 Max, which incorporates the maneuvering characteristics augmentation system, or MCAS. It helps control an aircraft’s tendency to pitch up in certain conditions.

2018 — Boeing announces a program to research a pilotless commercial jetliner.

[email protected]

Follow me on Twitter @rvartabedian