Cali Crash Questions Safety of Automated Flight
Just 11 seconds before American Airlines First Officer Don Williams and 159 other people died, he grabbed the control column of Flight 965 and took direct command of his aircraft. For the first time in hours, Williams--not a computer--was flying the plane.
“Pull up, baby,” he pleaded with his Boeing 757 as the alarmist computerized voice of the “ground proximity warning system” blared, “Pull up! Whoop! Whoop! Pull up!”
Williams’ desperate attempt to climb above the summit of a Colombia mountain failed by 200 feet.
That crash near Cali last Dec. 20 has sent tremors through the commercial airline industry. Top airline officials and “human factors” academicians alike say it may become the event that forces aviation to deal with a question safety specialists and pilots have been asking for more than a decade: Has automation gone too far? Have pilots been been turned into computer-system monitors instead of aircraft commanders?
American, stunned by its first jet crash in 16 years, is planning to end its policy of training pilots to try to “sort out” in-flight anomalies with their computers instead of turning off the computers and flying the plane manually.
As Bob Baker, American’s vice president for flight operations, said in an interview, “Maybe we got the priorities mixed up here.”
Some airlines, led by Delta’s “turn-it-off” program, already have reversed philosophy and are using the American crash to reinforce their training.
“When you have a tragedy like this, it’s horrible, but the only thing that’s good about it is you’ve got everybody’s attention,” said Clay Foushee, vice president for operations at Northwest, which prints, “FLY THE AIRPLANE, DO NOT HURRY,” in red block letters at the top of its flight manual section on handling emergencies.
After the Cali crash, Foushee called his top operations management, fleet directors and chief pilots to Minneapolis headquarters to “give ourselves hell for a day.”
Few crashes provide such a textbook case of pilots’ depending on automation to solve a problem rather taking manual control.
It will be months before the National Transportation Safety Board and Colombian authorities settle on official causes of the Cali crash, but they know from flight recorders that there was confusion in the cockpit while the pilots reprogrammed their computers.
Capt. Nicholas Tafuri, 57, and Williams, 39, were flying the 757 by typing instructions on its sophisticated flight-management system--a computer. It is capable of causing the plane to fly a pre-programmed course from shortly after takeoff through hours of flight to an automatic landing with no human intervention.
Pilots do modify the programs for new weather information or air traffic control instructions, and that’s what happened in this case. A new instruction from the Cali controller was the first in a sequence of events in the six minutes before the crash. The crew was told to report when it had passed over a radio-navigation beacon named Tulua.
It took Tafuri 90 seconds to look up the correct code for Tulua and program it into the flight-management system. But by the time he had done that, the plane already had crossed the beacon, unknown to the pilots.
So the 757’s computer did exactly what it was told to do: Find the beacon and cross over it. The computer began to turn the plane around in the leisurely manner airline computers employ to provide the smoothest ride possible for passengers. During this entire sequence, the plane was continuing to descend.
In moonless darkness, with no lights on the ground to give them a clue, Tafuri and Williams apparently did not notice this long, slow left turn for more than a minute. When they did, they turned off the flight-management computer in favor of a different computer, one that directs the plane’s autopilot through “heading select” dials.
They dialed in the heading they thought they were supposed to be flying, and the plane began another computer-directed correction, this time turning gently to the right while continuing its descent.
Not quite two minutes later, the ground-proximity warning blared.
Aviation automation has spread rapidly in the last 15 years and for the most part has contributed greatly to safety. The tactical collision-avoidance system has all but eliminated collisions in the air. The ground-proximity warning system has greatly reduced, but not eliminated, crashes that occur when planes land short of the runway.
Those devices have been developed to address known safety problems. Cockpit automation, although it tends to aid safety, was primarily a cost-cutting tool. It allowed jets, even the largest 747s, to be flown with two pilots and eliminated the need for a flight engineer.
The debate over the two-person cockpit was fought out by the airlines, the pilots’ unions and the Federal Aviation Administration in 1981 and 1982. In the end the FAA approved the two-person cockpit but wrote tight rules requiring pilot proficiency in operating the plane through its computers.
“The FAA said it was more important that they could type on a computer rather than fly the airplane,” said Jim Sovich, president of the Allied Pilots Assn., which represents American pilots.
Sovich complained that pilots have grown to trust automation, and to depend on it. “They have built in a high comfort level,” Sovich said. “The airplane will do what it’s told to do.”
As Tafuri and Williams drifted down a dark valley toward Cali, they were fully complying with FAA requirements and doing exactly what American had trained them to do.
American already is changing that policy. In meetings with pilots across the American system, Operations Vice President Baker has emphasized that they can turn off the computer any time, even if they simply feel uncomfortable for reasons they can’t pinpoint.
Many in the human-factors community are asking, in effect, “What took you so long?”
Earl Wiener of the University of Miami is one of aviation safety’s senior thinkers, and a man who has warned for years that excessive reliance on cockpit automation dulls the reactions and thought processes of pilots. “When workload is low, automation relieves workload; when workload is high, then automation increases workload,” he said. “It’s kind of a perverse effect.”
David D. Woods of the Cognitive Systems Engineering Laboratory at Ohio State University, in a 1994 speech called “Apparent Simplicity, Real Complexity,” said that cockpit automation creates new demands on a pilot that “can create opportunities for new kinds of human error and new paths to system breakdown that did not exist in simpler systems.”
American, the union and the FAA have begun a yearlong effort to “look under every corner of every rug and under every rock,” Baker said.
American pilots flying into Latin America now must observe “sterile-cockpit” procedures--no extraneous conversation--below 25,000 feet, not the standard 10,000 feet. Other changes are being made or considered.
Baker said American is committed to installing a new-generation ground-proximity warning system that would warn more than a minute ahead that the plane was on course to fly into the ground. This “enhanced ground prox” would rely on a terrain relief map of the world programmed into the flight management computer.
