One Hundred Seconds of Confusion: The crash of China Airlines flight 140
On the 26th of April 1994, a China Airlines Airbus A300 was on final approach to Nagoya, Japan when it climbed steeply, stalled, and plunged suddenly to earth, slamming belly-first into the ground beside the runway with a great burst of flame. Although rescuers rushed to the scene, the aircraft had disintegrated utterly, and from the shattered fuselage just seven of the 271 passengers and crew would emerge alive.
The crash turned out to be the bleak apotheosis of a prior series of near misses involving unfavorable interactions between humans and automation on Airbus A300 flight decks. In each case, some seemingly minor trigger escalated into a complete loss of control because the pilot and the autopilot began fighting each other, only for the human pilot to win a pyrrhic victory, leaving the aircraft in a dangerous and precarious configuration. The extent to which these events were connected, as well as the allocation of responsibility, became major subjects of debate among experts assigned to the case, and because no accident ever has a single cause, it would be equally inappropriate to say that there was one right answer. But the story of China Airlines flight 140, and the final 100 seconds in which it went awry, nevertheless hold valuable lessons as a sobering example of the fatal feedback loop that can develop when pilot and plane find themselves on radically different trajectories.
◊◊◊
Between 1985 and 2007, Taiwan’s flag carrier China Airlines maintained a wide-body fleet consisting primarily of Boeing 747s for its heaviest routes and Airbus A300s for the next tier below. In service since 1974, the A300 was Airbus’s first production aircraft and the first ever wide body airliner with only two engines, pioneering a format that has since come to dominate the long-range market. China Airlines began experimenting with the model in the second half of the 1980s with the purchase of two A300s, followed by two more in 1990 and 1991, for a total of four; a major buying spree between 1996 and 2000 would ultimately expand its cumulative fleet to 18 (although the first several had already been retired or written off by the time the 18th was added). Despite their long-range capabilities, China Airlines most often used the A300s on high-volume routes within East Asia, where soaring demand allowed them to reliably fill the 264-seat airplanes on flights as short as two hours.
In 1994, one of four A300s in China Airlines’ fleet was B-1816, purchased in February 1991. At just over three years old, it was still early in its lifespan when, on the 26th of April, 1994, it was called upon to operate China Airlines flight 140 from Taipei to Nagoya, Japan, a metropolitan center southwest of Tokyo that is home to some 10 million people. The evening flight that day was almost full, as every economy class seat had been sold, leaving only a smattering of vacant seats in business class; in total, 256 passengers boarded. Also scheduled to fly that night were 13 flight attendants and a cockpit crew of two, consisting of 42-year-old Captain Wang Lo-chi and a young, 26-year-old First Officer, Chuang Meng-jung. Captain Wang had a respectable 8,340 hours of experience, including 1,350 on the A300, but the bulk of his career — over half — had been spent flying Douglas C-47 Skytrains for the Taiwanese Air Force. His First Officer had no such background: his total flight time was about 1,600 hours, including about 1,000 on the A300, and he had come up through China Airlines’ in-house training program with no prior military or airline experience.
At 16:53 local time (17:53 Japan time), flight 140 departed Chiang Kai-shek International Airport in Taipei and climbed to its cruising altitude of 33,000 feet, with an estimated total en-route time of two hours and 18 minutes. First Officer Chuang was at the controls, which is normal practice in order to help first officers gain experience, and Captain Wang provided him with a nearly constant stream of handy tips and suggestions intended to improve his flying, although he was not an instructor. Nevertheless, the continuous instruction did not distract the crew from their normal duties, and First Officer Chuang completed a normal descent briefing before they were cleared to begin descending into Nagoya at 19:47 Japan time. Captain Wang thereafter continued to provide advice on descent and landing techniques, ranging from how to deal with optical illusions on touchdown to the benefits of flying the final approach manually. “The more you fly and practice, the better you can fly,” he commented.
Amid clear weather with good nighttime visibility, the descent proceeded normally, and Captain Wang made it clear that he expected First Officer Chuang to see the landing through himself using the advice he had given up to that point. “You do it by yourself,” he said. “I will not bother you. Don’t ask me, do it yourself. Make decision. I will remind you just before the situation reaches the point that I cannot cover.”
“Yes,” Chuang agreed.
“You do it by yourself, okay?” Wang repeated.
“Yes sir,” said Chuang.
Continuing the descent, flight 140 successfully achieved the speeds asked of it by air traffic control, aligned with the runway, and commenced an instrument landing system (ILS) approach to runway 34. Both pilots commented on wake turbulence from preceding aircraft, but the bumpiness did not rise above the level of a minor annoyance, and at 20:11 they successfully intercepted the glideslope down to the runway. At that point, First Officer Chuang disconnected the autopilot to fly the approach manually, following the flight director overlay on his attitude indicator, which displayed the control inputs needed to keep the plane on the glideslope. The flight was on course and properly configured, so he had no difficulty hitting the bullseye, and by 20:12 they were number one in line and cleared to land. The pilots completed the landing checklist and lowered the landing gear, and the flight attendants made the final cabin announcement, expecting to be on the ground in less than two minutes. Ironically, it was at that very moment that the seemingly perfect approach began to go off the rails, because at precisely 20:14 and 6 seconds, at a height of 1,070 feet, First Officer Chuang accidentally triggered the go-around lever.
The go-around lever or switch, a feature of all modern airliners, is a small lever located on each of the A300’s thrust levers where it can be quickly and instinctively actuated in the event that the crew decides to abandon an approach and “go around.” On the A300, pulling the go-around lever, or “go lever” as pilots normally call it, immediately configures the autoflight systems for a swift climb away from the approach to a preset go-around altitude. If the autopilot is engaged, it will automatically hold the wings level and pitch up into a climb at a predetermined angle, and if it is not engaged, then the flight director will instruct the pilot to climb manually. In either case, the autothrottle system will also automatically engage and increase thrust in both engines.
It is unknown how exactly First Officer Chuang managed to trigger the lever accidentally, although the fact that it was inadvertent is certain. One possibility is that he bumped it with his fingertips while pulling the thrust levers back to reduce power; a second is that his hand struck the lever due to a jolt from the wake turbulence; and yet another hypothesis holds that he intended to press the nearby autothrottle disconnect button in order to control thrust manually, but accidentally hit the go lever instead. But whatever the reason, the result was the same: the autoflight system entered go-around mode, the flight directors began commanding a pitch up, and the autothrottle began increasing thrust in order to climb.
On the Airbus A300, the term “autoflight system” refers collectively to the autopilot, autothrottle, and flight director, which work in unison according to an overarching mode, which in turn engages sub-modes applicable to each component. (The A300 actually has two autopilots, but this had no effect on the following events, and the phrase “the autopilot” will be used throughout this article even though both autopilots were active during the accident flight.) During the ILS approach to Nagoya, the active mode was “LAND,” which tracks the instrument landing system and guides the aircraft all the way through the landing flare just before touchdown. In this mode, with the autopilot disengaged, the flight director was providing guidance to hold the glideslope and maintain alignment with the runway, and would continue to do so until just above the ground, at which point it would instruct the pilot to pitch up for the landing flare, enabling a smooth and successful touchdown. However, pressing the go lever immediately changed the active mode to “GO-AROUND,” which resulted in all of the effects described in the previous paragraph.
As thrust began to increase, Captain Wang exclaimed, “Eh, eh, ah,” and then said, “You, you triggered the go lever.” Evidently he had checked his flight mode annunciator and observed that the active mode was now “GO-AROUND.”
“Yes, yes, yes. I touched a little,” said First Officer Chuang.
Because the A300’s engines are mounted below the wings, placing them below the center of gravity, an increase in engine power tends to cause a pronounced increase in pitch. Intuitively, you can imagine a 2-D airplane pinned to a wall, with the pin through its center of gravity. If you grab the 2-D plane below the pin and push forward, the plane will rotate about the pin and the nose will rise. (Conversely, if you grab the plane above the pin and push forward, the nose will drop.) Therefore, as the autothrottle increased thrust for the go-around, the plane began to pitch up, straying above the glideslope to the runway. Instinctively, First Officer Chuang countered by reducing thrust slightly and pushing forward on his control wheel to pitch down. But these actions were insufficient, and the plane started to level off at approximately 1,000 feet.
“Disengage it,” said Wang. With the autothrottle still engaged in go-around mode, it would quickly increase thrust again unless Chuang disengaged it or switched out of go-around mode; which course of action Wang meant is uncertain, but it was surely one of these two.
“Aye,” said Chuang. But he did not disengage the autothrottle, nor did he switch the autoflight system out of go-around mode.
Instead, moments later, at 20:11 and 18 seconds, Chuang re-engaged the autopilot. Why he did this is unknown. After all, the active autoflight mode at this point was still GO-AROUND, so engaging the autopilot would naturally cause the plane to automatically pitch up, which was not what he wanted. The most likely explanation is that Chuang pressed the “LAND” button in an attempt to re-engage LAND mode, and then immediately engaged the autopilot to help him regain the glideslope, but if so, then he must have been unaware that LAND mode cannot be selected while in GO-AROUND mode. The design logic is presumably rooted in the fact that once a go-around has been declared, no airline on earth provides pilots with the option of changing their minds, so there is no need to enable disengagement of GO-AROUND mode by pressing the “LAND” button. Furthermore, initiating a go-around usually causes the plane to rise above the glideslope, while LAND mode is designed with the assumption that the glideslope will be intercepted from below, not above, rendering it useless once a go-around has begun. Instructions for correctly cancelling GO-AROUND mode were contained in The Flight Crew Operations Manual (or FCOM), but at 1,000 feet on approach, nobody was going to be flipping through manuals, and Chuang had likely never needed to disengage GO-AROUND mode at any point in his career, so it seems plausible that he did not know how. However, there is no direct evidence that he ever pressed the LAND button, so we will never know his thought process for certain.
In any case, as soon as the autopilot was engaged, it began working to make the aircraft climb. However, First Officer Chuang was still pushing forward on his control wheel in an attempt to descend, and on the A300 pilot inputs on the yoke override the autopilot. However, in GO-AROUND mode, these inputs would not disengage the autopilot — a distinction that was about to become very important.
The problem here originates from the fact that all jet airliners, including the A300, have not one, but two means of pitch control. Jet pilots are intimately familiar with this concept and can skip this paragraph, but for everyone else, some basic background is helpful. When a pilot pushes forward on the controls, they are making inputs using the elevators, which are hinged to the back of the horizontal stabilizer. When the pilot lets go, the elevators are aerodynamically forced back into the neutral position, and the plane resumes whatever trajectory it was on before. However, on jets, pitch stability is controlled by tilting the horizontal stabilizer itself, which alters the neutral point for the elevators, and thus the stable pitch angle of the aircraft. Therefore, in order to establish a stable climb (for example), a pilot will pull up using the elevators to initiate the climb, and then move the horizontal stabilizer in a nose up direction so that the climb will continue after they let go of the controls. On the A300, the horizontal stabilizer can be adjusted automatically by the autopilot, or manually by the human pilot using either the manual trim wheels attached to the center pedestal, or the electric trim switches, located on the pilots’ control wheels. Inputs via these mechanisms move the horizontal stabilizer up for nose down, or down for nose up, via a jackscrew that resists aerodynamic forces, thus the stabilizer remains wherever it is set, unlike the elevators. This overarching stability control concept is referred to as “pitch trim;” adjusting the horizontal stabilizer is known as “trimming;” and the autopilot’s pitch trim control function is often called “autotrim.”
Now, returning to the cockpit of flight 140, recall that First Officer Chuang was pushing forward on his control wheel, pitching down using the elevators and overriding the autopilot. However, because the control wheel does not control the horizontal stabilizer, his actions overrode only the elevators and did not override the autotrim function, so even as he continued to push the nose down, the autopilot began trimming the horizontal stabilizer in the opposite, nose up direction in order to establish a climb configuration. Then, with the horizontal stabilizer increasingly forcing the nose up, Chuang had to apply even more nose down pressure using the elevators to prevent the plane from climbing, which in turn prompted the autopilot to trim even farther nose up, in a rapid feedback loop.
Recognizing that his control wheel inputs were proving insufficient, Chuang tried several times to trim nose down using the electric trim switches, but these are inhibited when the autopilot is engaged. If he wanted to override the autotrim function, he should have either disconnected the autopilot (ideally), or used the manual trim wheel, but he did not appear to recognize this, and so the situation only continued to escalate.
“Push down, push it down, yeah,” Captain Wang said, urging Chuang to return to the glideslope. “You, that [unintelligible] disengage the throttle,” he added, again suggesting that Chuang disengage the autothrottle to prevent thrust from increasing, although by this point the nose up trim inputs by the autopilot were the bigger issue. He almost certainly was not aware that the autopilot was engaged, because Chuang had not told him.
“Uh, too high,” said Chuang.
“You, you are using the go-around mode,” Wang said, pointing out that the autoflight mode had not changed. “It’s okay, disengage again slowly, with your hand on,” he continued.
First Officer Chuang disengaged the autothrottle and reduced thrust to idle; the plane decelerated and consequently began to descend in a nose-high attitude.
“You disengaged the engine thrust?” Wang asked again.
“Yes, sir, disengaged,” said Chuang.
“Push more, push more, push more,” Wang encouraged.
“Yes.”
“Push down more. It’s now in go-around mode,” Wang repeated.
By this point, the horizontal stabilizer had reached 12.3 degrees leading edge down, which corresponds to the maximum nose up position, while First Officer Chuang was pushing the elevators almost to maximum nose down. With the thrust levers at idle, their speed was decreasing and the plane was descending at a rate of 1,000 feet per minute, but the pitch angle was abnormally high, at +8.6 degrees, and the angle of attack — the angle of the wings into the oncoming airstream — was +11.5 degrees, which is also too high. At this point, Chuang appeared to realize that he was fighting against the autopilot, so at 20:14 and 49 seconds he disconnected it, announcing, “Sir, Autopilot disengaged.” But while this did stop the autotrim, the mere act of disengaging the autopilot does not alter the existing pitch trim setting, so the stabilizer remained at maximum nose up, and where to move it from there was entirely Chuang’s problem.
However, Chuang did not seem to be aware of what the autopilot had done to their trim setting, and the fact that he had to keep pushing almost fully forward even after disconnecting it surprised and confused him. “Sir, I still cannot push it down,” he said.
“I, well, LAND mode?” Wang asked, appearing to express confusion about why they were not in LAND mode. He then said, “It’s okay, do it slowly.”
At that moment, at an altitude of 570 feet, the angle of attack increased to the point that the Airbus’s “alpha floor” protection system automatically engaged. On all Airbus aircraft, the “alpha floor” function is designed to automatically increase engine power if the angle of attack gets too high in order to prevent the plane from stalling. In general, as speed decreases, angle of attack (or AOA) increases, until the AOA exceeds the critical threshold and the airplane stalls; therefore, increasing power should increase speed and help decrease the angle of attack. On later Airbus models, such as the A320, the alpha floor system works in concert with computerized flight envelope protections that physically limit the airplane’s maximum AOA, pitch angle, and other parameters, but the older A300 was not a fly-by-wire aircraft with computerized controls, and it had no such protections. Instead, while the alpha floor would increase thrust if the AOA approached the stall threshold, the pilot was expected to take action to establish a safe pitch angle and AOA if the autopilot was not engaged. Increased engine power was automatically provided only to assist the pilot in avoiding the stall. However, as mentioned earlier, the A300’s low-slung engines mean that an increase in thrust also causes the nose to rise, so when the alpha floor engages, the pilot must actively push the nose down to prevent the pitch angle, and by extent the AOA, from increasing even further.
Based on the above description, you might already see the problem. With the horizontal stabilizer trimmed fully nose up, First Officer Chuang needed to apply nearly full nose down elevator to prevent the plane from climbing. So when the alpha floor protection engaged and rapidly moved the thrust levers toward maximum power, he physically could not push the nose down any more than he already was, and so the increase in thrust caused the nose to immediately swing even higher, making the situation still worse.
At that moment, noticing that the thrust levers were moving to maximum power, First Officer Chuang said, “Sir, throttle latched again!”
With the sudden pitch up and the unexpected thrust lever behavior, Captain Wang finally decided that the situation was beyond his First Officer’s abilities and took control himself. “Okay, I have got it, I have got it, I have got it,” he said, reaching for his control wheel. He immediately decreased engine power and tried to pitch down, but he soon discovered the exact same reality that Chuang was already facing: no matter how hard he pushed, and no matter how much he reduced power, the nose wouldn’t go down. “What’s the matter with this?” he exclaimed, expressing consternation.
Due to the high pitch angle and temporary increase in thrust, the plane bottomed out at 500 feet, then began to climb. At this point, realizing that they were off course and that a safe landing could not be accomplished, Wang decided that they needed to go around for real. Ascending through 600 feet, he called out “Go lever,” and then increased thrust back to go-around power. Once again, the increase in thrust caused the nose to pitch up, and with his control wheel already pushed fully forward, Wang was unable to stop it. Their speed momentarily increased, then began to decrease again as the plane entered an extremely steep climb, rocketing unsustainably upward. “Damn it, how come [it is] like this!?” Wang said, fighting to bring the nose down. He also briefly thumbed the electric trim switches, reducing the horizontal stabilizer angle from 12.3 to 10.9 degrees nose up, but what would have been a reasonable input under normal circumstances wholly failed to address the scale of the trim problem that he was facing. Consequently, the pitch angle only continued to increase, and their speed continued to fall.
Calling air traffic control, First Officer Chuang announced, “Nagoya tower, Dynasty, going around.”
“Eh!?” Captain Wang said, again expressing confusion.
“Roger, standby further instruction,” the Nagoya tower replied.
Chuang began retracting the flaps and slats in accordance with the go-around procedure, but amid the confusion he retracted them one notch too far, reducing lift more than expected, and no one ever raised the landing gear, causing increased drag. Both of these factors worsened the already dire situation, and as their speed continued to drop, Wang exclaimed, “Eh, if this goes on, it will stall!”
At that moment, the angle of attack exceeded 18 degrees, which triggered another Airbus safety feature, called “alpha trim.” Active only at the hairy edge of a stall, this function kicks in to trim the horizontal stabilizer nose down in order to assist in stall avoidance. Unlike the alpha floor, on flight 140 its activation was entirely beneficial, but it was also too little, too late. As it began moving the stabilizer nose down, the stick shaker stall warning activated, alerting the crew to the impending stall, although Wang was already well aware of the danger. Two seconds later, however, the stall warning ceased because their airspeed dropped below 75 knots, a speed so anomalously slow that the plane’s air data computer rejected the reading as invalid. Because the plane’s internal AOA calculations rely on valid airspeed data, this also caused the alpha trim function to shut off, leaving the stabilizer at 7.4 degrees nose up, although the system’s authority was limited to 4 degrees of motion, so it could not have moved the pitch trim below 6.9 degrees nose up anyway. The difference might have prolonged flight 140’s final seconds, but it would hardly have saved them.
In fact, by this point, their pitch angle had reached an astonishing 52.6 degrees nose up, far beyond what the fully loaded jet was capable of sustaining. In a futile effort to bring the nose down, Captain Wang tried decreasing thrust, but while this did reduce the pitch angle slightly, it also caused their airspeed to decrease even faster, hastening the already-inevitable stall. Moments later, with a pitch angle of 43.8 degrees, an off-the-charts high angle of attack, and an impossibly low airspeed, the airplane stalled. Reaching a peak altitude of 1,730 feet, the plane abruptly lost lift, rolled over, and began to plunge uncontrollably toward the ground, even as the pilots fought helplessly to recover.
“Quick, push nose down!” Chuang said. “Set, set, push nose down!”
“It’s okay, it’s okay, don’t, don’t hurry, don’t hurry!” Wang said, trying to keep calm.
“TERRAIN, TERRAIN,” the ground proximity warning system blared. Wang let out a cry of alarm, and First Officer Chuang shouted, “Power!”
Unfortunately, it was obvious that there would be no recovery. With almost no forward airspeed, the plane pitched steeply nose down as it lost lift, prompting Captain Wang to pull back hard on his controls in an attempt to avoid the ground, but there was nothing he could do. He uttered a word that has variously been translated as “Finish” or “It’s over,” even as Chuang continued to yell, “Power, power, power!”
Moments later, at 20:15 and 45 seconds, flight 140 slammed to earth in a clear area just to the right of runway 34, pitched slightly nose up and banked slightly to the left, but descending rapidly. The devastating impact immediately shattered the airplane, ripping open the fuel tanks and triggering a massive explosion, as a wave of disintegrating wreckage hurtled forward across a drainage ditch and onto the neighboring Komaki Air Base, destroying several trees and a shed before coming to rest strewn across an aircraft parking apron.
Air traffic controllers activated the crash alarm as soon as they spotted the explosion near threshold of runway 34, and firefighters from both Nagoya Airport and Komaki Air Base hurried to the scene. What they found was nothing short of devastation. What had been an Airbus A300 not three minutes earlier had been reduced to a pile of mostly unrecognizable burning rubble, save for a few large pieces, such as the horizontal stabilizer, left forlorn amid the wreckage trail, and two large sections of the upper fuselage skin from the front of the plane, including the cockpit windows, which were intact but devoid of their contents, the floor and seats having been torn out from below.
Although the first impression of the firefighters was that no one could possibly have survived the crash, that assumption was shattered when someone spotted a person crying out for help amid the sea of debris. By some miracle, a small number of passengers had been thrown in their seats through the maelstrom as the plane disintegrated without ever quite experiencing a fatal deceleration, and had improbably survived the crash despite the almost total destruction of the aircraft. Amid bodies and seats stacked like cordwood, rescuers hurried to find anyone showing signs of life, and by the time the fire was extinguished, 16 ambulances were rushing to area hospitals, each containing a gravely injured passenger. So severe was the extent of their injuries, however, that six of the transported victims were declared dead on arrival, and another three would die in hospital over the next five days, ultimately leaving just seven survivors out of 271 passengers and crew. All seven had been seated in the economy class section forward of the wings between rows 7 and 15, primarily on the right side of the plane, which not-so-coincidentally was also the last part of the aircraft to hit the ground.
◊◊◊
With 264 people dead, the crash of China Airlines flight 140 was then and still is today the second worst air disaster in Japan and the worst involving a Taiwanese airline. The accident shocked both countries and forced the director of Taiwan’s Civil Aviation Authority to resign, while the airline ordered simulator checks of all its pilots. In the meantime, media speculation mostly missed the mark: many early reports picked up on witness accounts of fire coming from the engines, which was not the cause of the crash, but rather its result, as the extremely high angle of attack in the final seconds of the flight disrupted airflow into the engines and triggered visible surging. Additionally, early toxicology tests found ethanol in the blood of both pilots, prompting media reports alleging drunkenness, even though it was soon discovered that the pilots’ bodies had been left unrefrigerated in a warm hangar for more than 24 hours before being tested, resulting in post-mortem ethanol production as a byproduct of decomposition.
The actual cause of the accident, as revealed by the black boxes, was anything but simple. On the most basic level, the crash was the result of a pilot-induced “out of trim” upset. The term “out of trim” refers to any situation in which the horizontal stabilizer is trimmed incorrectly, necessitating constant control force by the pilot to maintain the desired flight path. Such a situation arose when the First Officer accidentally activated go-around mode, then engaged the autopilot before switching to another mode, causing the autotrim function to trim nose up in order to climb. The First Officer’s continued attempts to pitch down and resume the approach caused the autopilot to continue trimming nose up until the stabilizer reached its nose-up stop, causing a severe out-of-trim condition where the plane was only flyable with the constant application of nearly full nose down elevator. Subsequently, a large increase in thrust exacerbated the already precarious nose-up pitch angle, resulting in a “nose high” upset, loss of airspeed, and low-altitude stall from which recovery was impossible.
Put together, the flight data and the cockpit voice recording painted a picture of an escalatory series of actions by both pilot and plane that turned a normal approach into disaster in less than 100 seconds. The fundamental problem was that the pilots and the automation were never on the same page from the moment the go-around mode was activated. First Officer Chuang’s attempts to salvage the situation were ineffective because he did not accurately assess what the automation was doing under his feet, as he made the erroneous decision to engage the autopilot while the plane was still in go-around mode; did not perceive the activation of the autotrim; and did not understand why his difficulties continued after the autopilot was disengaged. Subsequently, Captain Wang also did not perceive the true nature of the situation in time to prevent an irrevocable loss of control.
In their efforts to understand why this occurred, investigators from Japan, Taiwan, and France (representing Airbus) developed a number of questions that became subjects of academic debate. This article has already discussed possible reasons why Chuang engaged go-around mode and why he decided to engage the autopilot, but investigators also considered the question of why neither pilot realized that the autopilot was continuously trimming nose up. There were various indicators available that could theoretically have alerted them to the stabilizer movement, including the physical motion of the manual trim wheels, which are back-driven by the stabilizer, and the horizontal stabilizer position indicator, located on the center pedestal. However, with the cockpit lights dimmed in order to better see the runway at night, these unlit indicators would have been much less prominent cues than the simple fact that the plane was not pitching down when commanded to do so. The resistance encountered by First Officer Chuang was a sure sign that something was pushing the nose up, and in such a situation, the horizontal stabilizer should, at least in theory, be the number one culprit. Instinctively, when prolonged resistance to control inputs is encountered, a pilot should attempt to cancel out that resistance by “trimming” the stabilizer in line with their inputs until the forces go away. In fact, Chuang did try to do this, but he did so without disengaging the autopilot, so his inputs via the electric trim switches were inhibited. Failing to appreciate this nuance, the lack of any change in control feel as a result of his attempts to trim down could have caused confusion that further degraded his situational awareness. Taiwanese investigators also contended that because the initial pitch up was caused by an increase in thrust, it could have quite easily escaped his notice when the stabilizer later became the source of the resistance he was feeling.
At issue was the question of whether the cues available to Chuang were sufficient, or whether the airplane itself should have done more to alert him to what was happening. Japanese and Taiwanese investigators both pointed out that on many aircraft, autotrim activation triggers a “stabilizer in motion” warning horn known as the “whooler.” The A300 did have a “whooler,” but it was only activated by continuous manual adjustment of the stabilizer, and was inhibited when the movement was automatic. As it turned out, Airbus originally intended for the whooler to announce any stabilizer movement, but during certification of the A300 in the 1970s, the United Kingdom’s CAA objected to this feature, arguing that the sound was distracting and unnecessary, given that the autotrim often made numerous inputs during normal approaches. After the Nagoya accident, the French Bureau of Inquiry and Analysis, or BEA, continued to back this position, and history is probably on their side. Anecdotally, on aircraft with aural warnings of automatic trim movement, the sound is heard so frequently that it turns into little more than background noise, and multiple accidents have occurred in which pilots did not perceive that the “whooler” was sounding when it should not have been. From a design perspective, it also made sense that the crew need not be warned of normal stabilizer movement while in go-around mode, because such movement is not only expected, but desired.
In any case, despite his increasing difficulty with the controls, Chuang did not mention this to Captain Wang, nor did he announce that he had engaged the autopilot, leaving Wang unaware of the seriousness of the situation for nearly a minute. Wang’s repeated commands to “pitch down more” indicated a belief that Chuang was not pushing hard enough, when in fact he was pushing with considerable force and was not getting the response he expected. As a result, Wang did not consider taking over control until the alpha floor protection system increased thrust again, at which point he suddenly found himself flying a plane that was in a deeply precarious situation. If he had intervened earlier, he might have been able to correct the situation using his greater experience, but by the time he did so, they were essentially out of control. Japanese investigators argued that Wang should have taken control sooner than he did, but Taiwanese investigators disputed this, pointing out that since the primary indication of the stabilizer position was control resistance, and he was not the one flying, he couldn’t have known what was happening unless Chuang told him. I would also add that just a few minutes earlier, Wang had emphasized that he wanted Chuang to fly the approach independently, without his assistance, a comment that was well-intentioned but might have caused Chuang to delay asking for help until the situation became completely untenable.
By the time Wang took control, the stabilizer was still at full nose up, and the plane was climbing steeply with decreasing airspeed, a serious situation that required immediate intervention. He probably could have recovered by aggressively trimming nose down, but he didn’t have much time in which to do so. When he took over at 20:15:03, the alpha floor protection had just increased power, resulting in a large pitch up, and his immediate response was to reduce thrust back to where it was before, indicating a desire to continue the approach. However, when this failed to correct the problem, he increased power again to go around, and the plane pitched up so suddenly and to such a high angle that recovery probably became impossible within a very short time. In fact, only 22 seconds passed between his announcement that he had control and the sound of the stall warning, and he spent the first eight of those attempting to continue the approach.
Wang’s intermittent nose down trim inputs indicate that he considered using the stabilizer to correct the situation, but he would have needed to make a large, continuous input to bring the aircraft in trim. Making such a large trim input is never called for in normal flight — in fact, it’s strongly discouraged. But on the other hand, if he had recognized that the stabilizer was at full nose up, he could have applied the “abnormal pitch behavior” procedure, which calls for the pilot to crank the manual trim wheel in the proper direction until the plane is “in trim,” without regard for how many turns that might take. French investigators questioned why he didn’t do this, while Taiwanese investigators contended that he would have been reluctant to touch the manual trim wheel, since it would require taking one hand off the control wheel at a time when he was trying desperately to hold the wheel at the full nose down stop. Stepping into the debate, I would contend that the question probably never crossed his mind at all, because there’s no evidence he ever realized that the stabilizer was positioned at full nose up in the first place.
In the end, neither the pilot nor the alpha trim function was able to trim nose down in time to prevent the plane from pitching up into a stall, and with almost no forward momentum and only 1,700 feet in which to recover, disaster became inevitable. But except for First Officer Chuang’s clearly misinformed decision to engage the autopilot early in the sequence of events, it was difficult to pinpoint clearly definable errors. For the most part, the pilots appear to have taken action based on a mental model that was missing a key element from the beginning, making decisions that seemed sensible in the moment but were not responsive to the reality of the situation. In the end, the story of those 100 critical seconds vividly illustrates how they let the aircraft get away from them, but at the same time, we will probably always be left asking why, when the nose kept pitching up, they didn’t simply try trimming down more. And while we can speculate all day, we were not there, and we will never know for sure.
◊◊◊
Regardless of the answer to the above question, it became clear early in the investigation that Wang Lo-chi and Chuang Meng-Jung were not the first pilots to find themselves in such a situation. In fact, investigators identified three previous incidents involving the Airbus A300 and the similar A310 that bore a number of remarkable similarities.
The first incident occurred in 1985 at an unspecified airline as an A300 was descending for approach to an airport. The pilots had earlier entered an altitude of 4,200 feet into the autopilot control panel, but they had since received clearance to descend lower, and they believed that the autopilot had been disconnected. However, the autopilot was actually still engaged, and as the plane neared 4,200 feet, it entered “altitude acquire” and then “altitude hold” mode in order to level off at the selected altitude. To stop the descent, the autopilot pitched up using both elevators and pitch trim, prompting the pilot to pitch down in an attempt to continue descending. Just like on flight 140, this situation continued until the stabilizer was at full nose up and the pilot was holding the control wheel at full nose down. The plane had by now reached 10 degrees nose up, and the pilots tried reducing thrust to bring the pitch angle down, but their speed decreased to an uncomfortably low 119 knots. In order to prevent any further decrease, they increased power suddenly, which caused a large nose up moment that sent the plane into a steep climb. Pitched 24 degrees nose up, the plane ascended sharply until it reached 4,200 feet, at which point the autopilot again tried to capture the selected altitude, this time by trimming down. This brought the plane out of the climb, and the captain subsequently attempted to correct the trim setting using the manual trim wheel, which disconnected the autopilot. As a result of these actions, control was regained, and the plane landed safely.
In response to the 1985 incident, Airbus changed the A300’s autoflight logic so that control wheel pressure greater 15 kg would disconnect the autopilot in most modes, preventing sustained, contradictory inputs that could lead to an out-of-trim situation. However, the changes did not apply in LAND mode below 400 feet, or in GO-AROUND mode at any altitude. In these modes, pressure on the control wheel would continue to override, but not disconnect, the autopilot.
It was this exception that allowed the second incident to occur. In 1989, an Airbus A300 was descending below 1,000 feet on approach to Helsinki, Finland when the captain accidentally pressed the go lever. The autothrottle began increasing thrust while the autopilot worked to maintain a nose-up pitch angle. Desiring to avoid this, the captain disconnected the autothrottle, reduced thrust, and pushed his control wheel forward, but the autopilot remained engaged and continuously trimmed the stabilizer nose up. The stabilizer reached 8 degrees nose up before the autopilot disconnected for unknown reasons, but the pilots believed that it was still engaged because the plane appeared to be resisting their efforts to pitch down. In fact, this was because the airplane was still out of trim. The captain then decided to go around, so he pressed the go lever again. The autothrottle re-engaged and rapidly increased thrust, and since the plane was already trimmed nose up, it immediately began to climb steeply. The pitch angle reached 35.5 degrees even as the captain held his control wheel at full nose down. Their speed dropped catastrophically, reaching a minimum of just 94 knots, but the captain recognized what was happening and managed to avoid a stall by frantically cranking the manual trim wheel toward nose down.
Although this incident illustrated the continuing danger of overriding the autopilot in GO-AROUND mode, no further corrective action was taken until another, much more harrowing near-catastrophe in the Soviet Union two years later.
On February 11th, 1991, an Airbus A310 operated by the soon-to-be-liquidated East German flag carrier Interflug was at 1,200 feet on final approach to Moscow, USSR, when air traffic control instructed the flight to go around and climb to 2,200 feet. With the autopilot and autothrottle engaged, the pilot selected go-around mode, and the thrust levers advanced to go-around power while the autopilot held the normal go-around pitch angle of about 15 degrees. However, the plane was more than half empty and low on fuel, leaving it with considerable excess performance, so it began to climb rapidly. Fearing that they would overshoot their cleared altitude, the pilot began pushing the nose down in an attempt to reduce their rate of climb. The autopilot responded by trimming nose up in an attempt to maintain the programmed go-around pitch angle, creating a feedback loop that continued until the stabilizer reached full nose up, while the pilot held the control wheel at full nose down. The plane continued to climb steeply until it got close to the selected altitude of 2,200 feet, at which point the autopilot switched to “altitude acquire” mode. Since this was a mode in which 15 kg of control wheel pressure would disconnect the autopilot, and since the pilot was already pushing nose down with all his might, the autopilot instantly disengaged, leaving the stabilizer at full nose up.
With the engines at full power, the stabilizer at full nose up, and the plane half-empty, the climb continued to steepen until the A310 was shooting upward like a fighter jet on full afterburner. Within moments, it reached an unbelievable pitch angle of 88 degrees nose up, and the airspeed decreased to just 30 knots, slow enough that the jet would only have barely outpaced Usain Bolt on the 100-meter dash. Hanging vertically in the air, its nose pointed directly at the heavens, the plane finally stalled at 4,200 feet, lost lift, and abruptly pitched over into a terrifying nosedive, hurtling downward toward the outskirts of Moscow. However, because the stabilizer was still set to full nose up and the engines were still at full throttle, the plane pulled out all on its own at 1,500 feet above the ground, then rocketed up into a second climb almost as steep as the first. This pattern ultimately repeated four times as the pilots fought desperately for control, climbing higher and higher each time, until finally, after the fourth peak at 11,750 feet, one of the pilots reduced thrust, and someone accidentally pushed the electric trim switch toward nose down. These actions were sufficient to allow the crew to regain control at 8,700 feet on the fourth descent, and they landed the plane minutes later without ever realizing that they had been out of trim the whole time.
As a result of this terrifying Soviet rollercoaster ride, Airbus recognized that it would be helpful if they extended the autopilot disengage logic introduced in 1985 to include go-around mode. Therefore, in June 1993, Airbus issued a service bulletin to all A300 and A310 operators recommending that they modify their flight control computers so that the autopilot will disconnect with 15 kg of control wheel pressure in GO-AROUND mode above 400 feet. If this feature had been implemented on B-1816, the aircraft that crashed in Nagoya, then the autopilot would have disconnected before applying much if any nose up trim, and the accident would never have happened.
Unfortunately, because the modification was only “recommended” and not mandatory, China Airlines was not required to implement it by any particular deadline. China Airlines officials told investigators that the company did not possess the capability to modify the flight control computers in-house, so it would have to send them to a specialized third-party facility in Singapore, which would be expensive and slow. Consequently, the airline decided to send each FCC to Singapore only when it experienced a failure that would require it to be sent there for repairs anyway. But no A300 FCCs failed at China Airlines between receipt of the service bulletin in June 1993 and the crash in April 1994, so the changes were never made. The airline also pointed out that the service bulletin listed only passenger comfort-related reasons for the modification, and not safety reasons, contributing to their decision not to treat it as urgent. This led Japanese investigators to criticize Airbus and the French Directorate General of Civil Aviation, which is responsible for Airbus, for failing to adequately brief operators on the connections between the 1985, 1989, and 1991 incidents and the corresponding significance of the FCC modification. However, the French BEA disagreed, pointing out that letters describing each event were sent to all A300 operators when they occurred, and the issue was addressed at length at a 1990 Airbus conference attended by China Airlines representatives.
Additionally, following the 1989 Helsinki incident, Airbus decided to modify the Flight Crew Operations Manual to specifically warn against overriding the autopilot in GO-AROUND mode, a change that ended up being implemented just days after the near disaster in Moscow. Ever since then, the FCOM had included a warning that stated the following:
“CAUTION: On the longitudinal axis, the autopilot override does not cancel the AP autotrim orders. So with AP in CMD [Command], if the pilot counteracts the AP (elevators order) the AP will move the THS [Trimmable horizontal stabilizer] (autotrim order) so as to maintain the A/C on the scheduled flight path. A risk of out of trim is real and may lead to a hazardous situation in land and go-around mode only.”
Although this caution clearly warned against the exact scenario that befell flight 140, it was evident that the crew of that flight had not understood it. Japanese investigators wrote that the caution was poorly written, a claim that French investigators called unsubstantiated. But even so, it should have been reinforced with the introduction of a simulator training scenario, developed after the Moscow incident, that was supposed to demonstrate “autopilot misuse in GO-AROUND mode” and its consequences — more or less the flight 140 accident scenario. Training records indicated that First Officer Chuang most likely did undergo this module, or at least it was checked off. However, Captain Wang did not receive the training, because when he was trained to fly the A300 in the summer of 1992, China Airlines had not yet incorporated the new module.
As for whether First Officer Chuang actually underwent the training, there was some disagreement. French investigators stated categorically that he did, but Taiwanese investigators stated almost as categorically that he did not, regardless of what the records said, because the third-party Thai Airways flight simulator where he underwent training was “never capable” of simulating autotrim behavior while overriding go-around mode. According to them, the simulator was found to trim with, rather than against, the pilot’s inputs when overriding go-around mode, which was opposite to its actual behavior. Japanese investigators ultimately wrote that the significance of this fact “could not be determined.”
In the end, regardless of the details, it’s evident that while actions were taken after the previous incidents, the underlying principle — that one should never try to override go-around mode without first disconnecting all autoflight systems — never made it to the pilots of flight 140, for one reason or another. Unfortunately, this is not all that uncommon in the aviation industry, as it takes time for lessons to permeate down through the system to those who need them the most: the people who actually fly the airplanes. Communicating new lessons was once one of the most challenging aspects of ensuring global flight safety, and although the internet has made it much easier, the problem hasn’t entirely gone away.
On a completely different note, the crash also illustrated some of the reasons why Airbus moved beyond the A300’s autoflight concept and embraced the fly-by-wire future. All Airbus aircraft incorporate autotrim, but modern fly-by-wire Airbuses leave it on all the time and rarely call upon the pilots to make manual trim inputs. At the same time, if the aircraft finds itself in a steep climb, the stabilizer will trim nose down all by itself if necessary, and any out-of-trim event will run up against the flight envelope protections before a loss of control can occur. Additionally, while the A300’s rudimentary alpha floor protection ironically made the situation worse on China Airlines flight 140, it works beautifully when installed as part of a unified flight envelope concept that encompasses all axes of motion. In this way, the shortcomings of the A300 lay bare the particular genius behind the models that came after it.
◊◊◊
After the disaster in Nagoya, the French DGCA mandated that all A300s be modified in accordance with the 1993 service bulletin within two years, and the United States Federal Aviation Administration proactively tightened that deadline to 60 days for A300s in the US. But at China Airlines, some of the lessons of the accident unfortunately did not stick. In fact, four years later, on the 16th of February 1998, another China Airlines A300 crashed during an attempted go-around in Taipei, killing all 196 people on board and 7 more on the ground, under similar circumstances. In that case, the autopilot attempted to climb on final approach after crossing a false glideslope, prompting the captain to override the autopilot by pitching down. This caused the autopilot to disconnect, as it was designed to do after the 1985 incident, but the captain did not notice. He subsequently ordered a go-around, and the increase in thrust caused the plane to pitch up excessively. As mentioned earlier, pilots often have to push forward during a go-around to prevent the pitch angle from exceeding the desired value, but because he believed the autopilot was still controlling the plane’s pitch, he did not do so. Consequently, the plane simply kept pitching up until it stalled and fell from the sky, with insufficient room to recover. Although the cause was not exactly the same as that of flight 140, it was yet another case of a China Airlines pilot whose insufficient understanding of the A300’s autoflight systems left him unaware that critical intervention was necessary.
All of the accidents and incidents described in this article share the common theme of “automation surprise” — the tendency of pilots to become confused and lose situational awareness when an automated system encounters an unfamiliar edge case and behaves unexpectedly. In all of these incidents, the autoflight systems worked exactly as designed, but in each case, the pilots found themselves in an unexpected situation where they failed to predict what the automation would do next. While every effort should be made by both pilots and engineers to meet in the middle, ensuring that automated systems are both understandable and understood, automation surprises can still happen to anyone, and the solution is simple: disconnect everything, establish a familiar configuration, and fly the airplane manually. If First Officer Chuang had done that as soon as he bumped the go lever, then 264 people would still be alive. Instead, when faced with an unfamiliar situation, he tried to lean even more heavily on automation by engaging the autopilot — a decision that had negative cascading effects. By the time he realized his mistake and disconnected the autopilot, the damage was done; he was hopelessly behind the airplane and he never caught up.
◊◊◊
In the end, it cannot be said that the crash of flight 140 was the fault of any single person or company, although it could have been prevented at many levels, from Airbus to China Airlines to the ill-fated flight crew. It should rather be viewed as a confluence of events and decisions that snowballed out of control, at first building slowly over several years before escalating rapidly in the space of 100 terrifying seconds. No one started the snowball rolling, but many people could have stopped it, right up until the A300’s final, fatal climb — at which point the last shred of hope withered away into dust, and 271 lives hung briefly outside of time, suspended at 1,700 feet above runway 34, their fates already written but not yet consummated. And then, with a shout, a plunge, and a flash, for almost all of them it was over, leaving the rest of us to search for some meaning amid the wreckage.
_______________________________________________________________
Don’t forget to listen to my new podcast (with slides!), Controlled Pod Into Terrain, where I discuss aerospace disasters with my cohosts Ariadne and J! Check out our channel here, and listen to our latest episode, featuring Paninternational flight 112. Alternatively, download audio-only versions via RSS.com, or look us up on Spotify!
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 250 similar articles
_______________________________________________________________
Note: this accident was previously featured in episode 57 of the plane crash series on October 6th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
