History of the flight
At FL 400, in the London terminal control area, the crew requested descent clearance from ATC to coincide with the top of descent point which had been calculated by the aircraft’s flight management computer (FMC). The aircraft was heading in a north-westerly direction. The pilots were aware the aircraft might encounter a forecast northerly jetstream during the descent. The commander, who was PF, stated to the operator that the margin below the aircraft’s maximum operating Mach number (MMO) was small due to the aircraft’s high altitude.
ATC issued the crew with a descent clearance to FL200 and requested that they fly at 270 kt on speed conversion, which was higher than the operator’s default conversion speed of 245 kt. The aircraft then initiated its descent on the intended descent path at 0.77-0.78 Mach and with 109 nm to touchdown. The autopilot and autothrottle were engaged, with the autopilot coupled to the PF’s flight guidance, in accordance with standard operating procedure. The aircraft’s flight path was controlled by lnav and vnav path autopilot modes, and the FMC econ speed schedule. No turbulence was present and the passenger seatbelt signs were off.
Recorded data showed that from FL392 in the descent, the windspeed displayed on the primary flight display (PFD) started to rise gradually. Then, when passing FL367, it increased at a greater rate, rising by 22 kt over 28 s. This corresponded with an increase in the aircraft’s speed from 0.78 M to a maximum of 0.818 M, where an overspeed was recorded. The commander recalled that the speed trend vector had simultaneously extended rapidly well into the overspeed warning zone by around a corresponding 15-20 kt. The commander reported that because the autopilot appeared not to be correcting the condition, and thinking that he had little time to react, he simultaneously pressed the autopilot disengage button on his control wheel and pulled back on the control column. His intention was to avoid the overspeed as smoothly as possible using manual control inputs.
The following parameters were recorded. There were marked changes in normal acceleration on the aircraft over a short period. Further analysis of the data by the manufacturer showed that in the one second during which the autopilot became disengaged the force exerted on the control column by the commander changed from -0.51 lbs to +42.76 lbs. Immediately following autopilot disengagement, the overspeed protection logic caused the vertical flight mode to revert from vnav path to level change.
Figure 1 Example image of a PFD under conditions similar to EI-EBW just prior to autopilot disengagement
During the event, two cabin crew standing in the rear galley fell to the floor. One sustained a fractured ankle. All passengers were seated throughout. The co-pilot reported to the operator after the event that, when the autopilot disengaged, he cancelled the aural alert and followed through with the control column inputs being made. The commander stated that he had not noticed the windspeed indication on the PFD increasing. Both pilots reported to the operator that they noted and discussed the ensuing airspeed increase. The commander reported that he was aware of the possibility of encountering a jetstream in the descent, but had not seen the airspeed increase to this extent before. He perceived that there was startle effect in his response due to both the rate of the airspeed increase towards MMO, and by the magnitude of the impending overspeed indicated by the speed trend vector. At the time, he believed he was managing the manoeuvre gently but with hindsight he suspected that startle effect caused him to exert more force on the control column than intended.
Figure 2 Recorded information
Operating procedures
Descent planning The pilots planned the aircraft’s descent according to standard operating procedures. The operator’s Operations Manual Part A covers ‘Pre-descent considerations’, and states:
"The top-of-descent point shall be determined taking into account the standard descent distance adjusted for wind component, anticipated ATC routing and possible holding, icing, safety heights, and runway in use. This is computed by the FMC based on routing and constraints entered. The descent will be conducted in such a way as to achieve fuel economy. This is best achieved by VNAV and ECON speed."
The manufacturer’s Flight Crew Operating Manual (FCOM) and Flight Crew Training Manual (FCTM) form part of the operator’s standard operating procedures. The FCOM ‘Descent and Approach Setup and Briefing’ section states:
"Threat and Error Management is a dynamic process by which pilots identify threats and errors, and implement management strategies to maintain safety margins. It should not be seen as a “box-ticking” exercise at the beginning of briefings, but rather as a tool to prevent undesired aircraft states through effective management techniques. The pre-descent briefing shall use the acronym “DALTA” which stands for Descent, Approach, Land, Taxi and Apron."
The section, ‘Threats – Pilot Flying and Pilot Monitoring’, states:
‘Prior to commencing the DALTA process, crew shall anticipate and discuss the threats that could be associated with their departure and initial climb. Subsequently, crews should be in a constant state of anticipation as the descent, approach and landing phase progress. These typically might [include]… overspeed’
Overspeed procedures
The FCTM section on ‘Overspeed’ states:
‘VMO/MMO is the airplane maximum certified operating speed and should not be exceeded intentionally. However, crews can occasionally experience an inadvertent overspeed. Airplanes have been flight tested beyond VMO/MMO to ensure smooth pilot inputs will return the airplane safely to the normal flight envelope. During cruise at high altitude, wind speed or direction changes may lead to overspeed events. Although autothrottle logic provides for more aggressive control of speed as the airplane approaches VMO or MMO, there are some conditions that are beyond the capability of the autothrottle system to prevent short term overspeeds. When correcting an overspeed during cruise at high altitude… If autothrottle corrections are not satisfactory, deploy partial speedbrakes slowly until a noticeable reduction in airspeed is achieved. When the airspeed is below VMO/ MMO, retract the speedbrakes at the same rate as they were deployed. During descents at or near VMO/MMO, most overspeeds are encountered after the autopilot initiates capture of the VNAV path from above or during a level-off when the speedbrakes were required to maintain the path… During descents using speedbrake near VMO/MMO, delay retraction of the speedbrakes until after VNAV path or altitude capture is complete. Crews routinely climbing or descending in windshear conditions may wish to consider a 5 to 10 knot reduction in climb or descent speeds to reduce overspeed occurrences. This will have a minimal effect on fuel consumption and total trip time. When encountering an inadvertent overspeed condition, crews should leave the autopilot engaged unless it is apparent that the autopilot is not correcting the overspeed. However, if manual inputs are required, disengage the autopilot. Be aware that disengaging the autopilot to avoid or reduce the severity of an inadvertent overspeed may result in an abrupt pitch change During climb and descent, if VNAV or LVL CHG pitch control is not correcting the overspeed satisfactorily, switching to the V/S mode temporarily may be helpful in controlling speed.’
The FCOM mentions another aspect of the autopilot’s overspeed protection logic in the ‘VNAV Descent and Approach Path’ section:
‘Note: When passing top of descent and using high target speeds (within approximately 6 knots of Vmo/Mmo), VNAV may revert to LVL CHG to prevent overspeed…’
In the case of EI-EBW, this mode reversion occurred just after the autopilot disengagement. Subsequently the flight director commanded a pitch-up to slow the aircraft. The commander stated that at the time of the accident he was aware of the content of these overspeed procedures, and the automatic protections.
Aircraft information
Control column input The aircraft’s Flight Control Computer had been loaded with software version P8.0. One of the effects of the P8.0 software update was a change in the autopilot’s response to force override through the control column or wheel. Prior to the update, force override would result in an automatic transition to pitch and/or roll control wheel steering (CWS)14 mode when the autopilot was engaged or at the time of engagement. With installation of the P8.0 software, this method of transition to CWS mode was removed. The manufacturer’s Service Letter 737-SL-22-065-A states:
‘Application Program Changes: 1) For a column and/or wheel force override of single channel autopilot, in either the approach or non-approach modes, the autopilot will disconnect and set the standard autopilot disconnect warning while maintaining any active flight director pitch and roll modes…’
Therefore, on EI-EBW force override would result in the autopilot disconnecting. The aircraft’s control column is mechanically linked to the elevator actuators and, except for small effects involving cable stretch, any motion of the control column results in motion of the elevator actuators and elevators. Three forces are applied to the mechanical linkage: the feel computer, the autopilot servos and pilot control column input. The sum of these three forces will determine the position of the mechanical linkage, and thus the inputs to the elevators.
The feel computer behaves like a centering spring whose stiffness varies with airspeed. It provides a restoring force towards the neutral position of the control column. The autopilot servos are limited to 25 lb of force for single channel operation. Separate force sensors measure pilot column input and the autopilot will disconnect if the force applied by the pilot(s) exceeds 21 lbs. To have any effect on elevator position with the autopilot engaged, the pilot input force must overcome the sum of the autopilot applied force and the feel computer. If the autopilot acts to keep the control column in its neutral position, both the autopilot and the feel computer will be resisting any pilot input. In this case, the 21 lb manual input threshold will be reached before the autopilot actuator needs to exert an opposing 25 lb to maintain the column’s neutral position, resulting in the autopilot disconnecting before there is any motion transmitted to the elevators.
Parameters relevant to autopilot disconnection for this accident were recorded. The sample rate was such that the timing of disconnnection could be determined within a window of 0.3 s. The column force exerted by the commander rose above the autopilot disconnect threshold of 21 lb during such an interval of 0.3 s. Accordingly, it was not possible to determine whether autopilot disengagement was caused by force override or by the commander’s use of the autopilot disengage button. The manufacturer performed a simulation to ascertain how abrupt the pitch change would have been if the autopilot had been disengaged using the button only, without any control column input by the pilot. The simulated pitch rate was approximately 1.1° per second, whereas the pitch rate during the event on EI-EBW at disconnect was 4.6° per second.
High altitude aerodynamics
As an aircraft climbs, its flying characteristics change as the air density reduces. At higher altitudes, a given control movement results in a higher pitch rate, less aerodynamic damping15 and a higher angle of attack16. Furthermore, the margin between MMO and the stall speed for a given load factor decreases with altitude. Accordingly, it is necessary to use careful handling at high flight levels. Previously, at the request of the FAA, the NTSB had formed an industry working group to address high altitude loss of control accidents and incidents. The group produced a document entitled ‘Airplane Upset Recovery – High Altitude Operations’ (Rev. 2, 2008).
‘At altitudes where the operational envelope is reduced: Be alert… Do not use large control movements… Be smooth with pitch and power to correct speed deviations’ ‘The [high altitude] upset startle factor: When not properly avoided, managed or flown – assures a self-induced upset’
Meteorology
A Met Office aftercast showed that the actual weather around the time of the accident approximately matched that forecast at the time the crew would have been performing their pre-flight preparations. The aftercast showed that an area of high pressure was centred to the southwest of the UK, causing a northerly airflow. Some moderate turbulence was present between FL220 and FL380 due to a 100 kt jetstream aligned north to south over the UK. Satellite imagery showed that the sky was clear of cloud. No significant meteorological information reports (SIGMETs)19 had been issued in the London FIR that day, suggesting that there had been no aircraft reports of severe turbulence. The weather for Manchester Airport between 1620 and 1720 hrs was reported as: surface wind of 7-9 kt from 300°; visibility 10 km or more; no cloud; temperature 6°C; and QNH 1021 hPa. The following table shows the forecast winds for the descent which were annotated on the Operational Flight Plan provided to the pilots, along with the actual wind speeds recorded by the aircraft. The latter are rounded to the nearest thousand feet.
Personnel
The commander had an EASA ATPL. At the time of the accident he had 4,997 total flight hours, of which 4,833 hours were on type. The co-pilot had an EASA ATPL. His total hours at the time of the accident were 2,984 hours, of which 2,833 hours were on type.
Training
The commander completed his type rating with the operator in 2010, the co-pilot in 2012. Training records indicated that throughout their employment the operator considered both pilots’ simulator performance as satisfactory, with the commander achieving mostly grades 3 (‘good’) and 2 (‘very good’). The records indicated that both pilots completed the following training prior to the accident unless otherwise stated.
High altitude operations
Mach buffet training was included in both pilots’ type rating courses. The recurrent simulator session (RST) during 2014 and 2015, covered high altitude operations. Its associated presentation explained the reduced speed margins at higher flight levels, g load awareness, and outlined the actions to take in the event of an overspeed, as follows:
‘Ideally, leave autopilot engaged; If autothrottle response is unsatisfactory, deploy partial speedbrakes slowly; Once speed is less than Vmo/Mmo, retract speedbrakes at the same rate of deployment.’
Instructors were asked to inform crew of another operator’s accident in which a cabin crew member was seriously injured when the pilots took manual control. The guidance notes explained:
‘There are increased risks associated with manual flight input during high altitude operations; on this [EI-CVA] occasion “An abrupt manual pitch input resulted in higher than usual g forces being experienced by the Cabin Crew Members”’.
Since the accident both pilots have undergone an RST which included g awareness. The pre-simulator study guide stated:
‘[At] high altitude [and] high Mach number/TAS, even small column deflections can induce significant G loading on the aircraft. [At] low altitude [and] lower Mach number/TAS, the aircraft is not as sensitive to control column inputs, and will not generate the higher G loads for the same control deflections.’
Flight path management
The pilots type rating courses included: acceleration to and deceleration from VMO/MMO; auto flight director system (AFDS) speed limiting and reversion modes; and ‘VNAV speed training.’ Each pilot certified that they had watched “Jet upset and recovery” training videos. The RST in 2012 and 2013, included fundamental aerodynamics for large aircraft, and energy management training. The co-pilot did not undertake this session because he was completing his initial type rating. In 2014, use of the AFDS was discussed. The pre-simulator study notes stated:
‘Responsibility for flight path management remains with the pilots at all times... pilots should remember; first and foremost – fly the aeroplane. At any time, if the aircraft does not follow the desired airspeed or vertical or lateral profile do not hesitate to change to a lower level of automation…’
In 2015 and 2016, pilots practiced raw data manual handling. The associated presentation discussed energy management and automation23 management, and reviewed the autothrottle overspeed protection at VMO. The pre-simulator study guide states:
‘More specifically the training will focus on the following: smooth and accurate aircraft control, appropriate to the situation; detecting deviations from the desired aircraft trajectory and taking appropriate action; keeping the aircraft within the normal flight envelope; controlling the aircraft safely using the relationship between aircraft attitude, speed and thrust; maintaining the desired flight path while managing other tasks and distractions’
Since the accident, both pilots have completed an RST which focussed on overspeed recovery. It demonstrated autothrottle overspeed protection at VMO, recovery from an overspeed using speedbrake and AFDS reversion to lvl chg in conditions of impending overspeed.
Related occurrence
In March 2017 a Boeing 737 (VH-VZZ) encountered an increasing headwind during descent which resulted in indications that the aircraft would overspeed. The pilot flying responded using a manual control input which caused the autopilot to disengage. Two cabin crewmembers suffered injuries during the resulting aircraft manoeuvre. The aircraft manufacturer has indicated that it is aware of other similar occurrences.
Analysis
The FCTM highlights that the primary response to an aircraft overspeed is to use the speed brake, and that the autothrottle logic provides some overspeed protection through more aggressive speed control as the aircraft approaches VMO/MMO. The effects of this autothrottle logic had been demonstrated in the simulator to both pilots. The FCOM mentions that further overspeed protection is offered by the vertical mode transitioning from vnav path to lvl chg in conditions of impending overspeed. The FCTM overspeed procedure also states:
‘pilots should leave the AP engaged unless it is apparent that it is not correcting the overspeed. However, if manual inputs are required, disengage the autopilot’.
The aircraft’s speed rose from 0.78 M to almost 0.82 M in 28 s. If the commander only realised the severity of the impending overspeed just before it occurred – and believed that the autopilot was not correcting the condition – then he may have felt compelled to disengage the autopilot, as described in the procedure. Pilots are reminded during training that they must not hesitate to use a lower level of automation if required to maintain the aircraft’s flight path. When taking manual recovery action at high altitude it is important to consider the need for careful handling. Whilst an overspeed is undesirable, there is typically a large margin between the onset of the overspeed warning and any undesired aerodynamic characteristics. Hence, there is often less risk in exceeding VMO/MMO slightly than there is in manual manoeuvring. In this instance, the pilot considered that he was startled by the increasing speed and magnitude of the trend indication. Whilst he believed at the time that he was manoeuvring gently, the resulting overriding force on the control column was 42.76 lb – approximately double that required to disconnect the autopilot – and was large enough to cause a manoeuvre sufficient to unbalance the two cabin crew and for one to suffer a serious injury. As well as recovery techniques for a high altitude overspeed event, some preventative measures exist, such as flying at a lower altitude, descending early, and slowing down when able do so – if necessary declining ATC requests to fly a higher speed. These activities, requiring active monitoring, may also reduce the risk of startle. The commander commented that he learned from this experience, particularly in relation to managing the reduced operational margins and handling sensitivities of the aircraft at high altitudes.
Conclusion
The serious injuries suffered by a cabin crew member occurred because significant manual control inputs were applied in response to an impending overspeed, which resulted in the aircraft manoeuvring abruptly. An increasing headwind associated with a jetstream had caused the airspeed to rise. The narrow speed margins and handling sensitivities of the aircraft at high altitudes were contributory factors.
Safety action
After this event, the operator released a memo to all pilots entitled ‘Overspeed (Impending/Actual) Recognition and Recovery’, dated 3 May 2017. This document reiterates the manufacturers FCTM guidance on overspeed, and provides supplementary guidance for use of the mode control panel (MCP), speed brake, autothrottle and autopilot in an overspeed condition. It states:
‘…this guidance applies to all phases of flight. Crew, however, must recognize the difference between correcting an overspeed in level flight and correcting an overspeed when climbing or descending. Furthermore, when attempting to correct an overspeed condition, crew must also recognize the additional challenges associated with disengagement of (1) the auto throttle and (2) the autopilot.’
The memo also provides guidance for use of the MCP, speed brake, autothrottle and autopilot during the different phases of flight, in relation to overspeed recovery. In relation to descent it states:
‘Autopilot: Monitor. Disengage ONLY if [the] autopilot [is] exacerbating the overspeed, or if required due to severe turbulence’
The aircraft manufacturer stated that it is considering a revision to the overspeed guidance in the 737 Flight Crew Training Manual to state more explicitly that the preferred response to impending overspeed at high altitude is to leave the autopilot engaged and instead deploy partial speedbrakes slowly.
Read the full AAIB report here |
EI-EBW 737-800 Overspeed recovery causes injury
