Thinking Like a Computer: The crash of Indian Airlines flight 605
On the 14th of February 1990, an Indian Airlines Airbus A320 touched down on a golf course short of the runway in Bangalore, India, sending the plane careening into an earthen embankment. As the battered airliner came to a stop, fire tore through the passenger cabin, forcing badly injured survivors to flee for their lives; of the 146 people on board, 92 died in the crash and the inferno that followed. Indian investigators faced great pressure to find the cause of the crash, which was the first involving the A320 in regular passenger service. The investigation soon revealed a series of escalating human errors involving the use of the plane’s advanced autopilot during the approach to Bangalore, as the crew made a disjointed effort to get back onto the proper glide path. The crash fueled an ongoing controversy around the radical design of the A320. Were the pilots really to blame, or did responsibility lie with a poorly designed user interface? Looking back at the accident today, the answer seems to be a little bit of both — the defining feature of a series of crashes involving the Airbus A320, of which Indian Airlines flight 605 was neither the first nor the last.
Indian Airlines was a fully state-owned carrier run by the government of India, which specialized in domestic routes to complement the long-haul flights offered by the country’s other flag carrier, Air India. Near the end of the 1980s, Indian Airlines launched a major initiative to overhaul its fleet, replacing early generation Boeing 737–200s with the latest innovation in short-to-medium range passenger jets: the Airbus A320.
First introduced in 1988, the Airbus A320 was nothing short of revolutionary. It was the first aircraft ever to incorporate a fly-by-wire system, whereby pilot inputs were fed to computers which then moved the flight controls proportionally with respect to the aircraft’s speed and configuration. The plane had no traditional control columns; instead, it had a pair of side sticks which the pilots could move with one hand. Instead of huge banks of analog gauges, the cockpit was dominated by six large computer screens that displayed a wide variety of flight parameters, autoflight information, and automated fault messages. Within its complex software architecture, so-called “alpha floor” protections lay in wait to respond swiftly and without prompting to any dangerous attitude that could develop in flight. Pointing to all these changes, Airbus hailed the plane as both easier to fly and safer than conventional airliners.
But many in the industry questioned this design philosophy right out of the gate, arguing that the extensive role of computers in basic aspects of flight obscured how the plane was responding to pilot commands and increased the probability of errors. On June 26th 1988, those fears gained new credibility. During the first ever passenger flight of an Airbus A320 — a low altitude flyby at an air show, followed by a sightseeing trip around Mont Blanc — the plane failed to clear trees past the end of the runway during its flyby and crashed into a forest, killing 3 passengers and injuring more than 50. The cause of the crash is still a source of controversy to this day. The official investigation found that a lack of flight planning before the flyby was the main cause of the crash. This lack of planning led the pilots to perform the flyby too close to the ground while unaware of the presence of the forest, which they did not attempt to avoid until it was too late.
But the pilots, who survived the crash, insisted that the flight computers had gone into landing mode when they got close to the ground and prevented them from applying max power to avoid the forest. Although there was no real evidence that this occurred, enough circumstantial evidence existed to suggest that there could be more to the story, and the controversy surrounding the crash never died down. After all, the optics were bad: a crash occurred on the very first passenger flight of a radical new aircraft, and any explanation that didn’t fault the design was likely to be seen as a cover-up orchestrated to protect the finances of one of France’s biggest employers.
Meanwhile, Indian Airlines forged ahead with its plan to purchase 18 Airbus A320s, which began to arrive early in 1989. Like any airline incorporating a new plane into its fleet, it faced a conundrum: Indian law required that a pilot have 100 hours as first officer on a particular aircraft type before he or she could be promoted to captain, but there were no qualified A320 captains in India under whom these pilots could serve as first officers. Therefore, a large group of Indian Airlines pilots (most of whom had been flying the Boeing 737) were granted an exemption to this rule so that they could attend a special training course at the Airbus headquarters in Toulouse, France, before returning as qualified captains to teach others what they had learned. Among these pilots was Satish Gopujkar, an experienced 737 captain with over 10,000 flying hours. After attending the rigorous introductory course in Toulouse, he was appointed as a training captain on the A320, where he would conduct the final line checks for other Indian Airlines pilots in the process of upgrading to captain on the new airplanes.
One of the Indian Airlines pilots undergoing training early in 1990 was Captain Cyril Fernandez, another 737 pilot who had almost as much experience as Gopujkar. Upon returning from Toulouse, he was slated to begin flying his line checks — 10 regular passenger flights performed under the supervision of a training captain. Upon completion of these checks, he would be fully certified as captain on the A320. The first of his line checks was to be Indian Airlines flight 605 on the 14th of February 1990, a short domestic flight from Bombay to Bangalore in southern India. Flying in the first officer’s seat to monitor his ability as captain was Satish Gopujkar, who by this point had accumulated 255 hours on the Airbus A320. Although Gopujkar could still be considered a rookie, Fernandez, with only 68 hours on the type, was a complete novice. On such a new aircraft, however, 255 hours was about as much as anyone could be expected to have.
At 11:58 a.m. local time, Indian Airlines flight 605 departed Bombay with 139 passengers and 7 crew on board, climbed to its cruising altitude, and proceeded toward Bangalore. All was normal as the flight contacted Bangalore control and began its descent, and at 12:53 they received clearance to perform a visual approach to runway 09.
Understanding the events that took place during the descent into Bangalore requires some basic knowledge about how to fly the Airbus A320. During normal flight, everything revolves around the autoflight systems — specifically, what modes they are in. A large part of the job of an A320 pilot consists of keeping track of the autoflight modes, and using the Flight Management System (FMS) to select new modes as needed for different phases of flight.
On the A320, there are three main autoflight regimes: the lateral regime (heading); the vertical regime (altitude and descent rate); and auto thrust, which controls airspeed and engine thrust. Each of these parameters has two basic types of guidance: “managed,” in which the pilots determine a desired trajectory and the computer moves the flight controls and adjusts engine power to maintain that trajectory; and “selected,” in which the pilots fly the plane by directly issuing commands, either to the autopilot or with the flight controls. By managing these modes through the FMS, pilots can fly the plane essentially from takeoff to touchdown without ever touching the side stick.
Of particular note in this case are the A320’s selected vertical modes. One mode in this regime is “Vertical Speed” mode (V/S), in which the pilots select a target altitude and a target rate of climb or descent, which the airplane then maintains. The vertical mode is coupled to the autothrust system, so when vertical speed mode is engaged, the autothrust switches to “Speed” mode (SPD), in which it automatically modulates engine power to maintain the requested rate of climb or descent. At the same time, the autopilot will constantly adjust the plane’s pitch to maintain the airspeed selected by the pilots.
Another vertical mode is called Open, which in turn consists of “Open Climb” (OP CL) and “Open Descent” (OP DES). These modes cause the autothrust to enter “Thrust” mode (THR), in which the throttles are fixed at either climb power or idle power, respectively. The pilots must then adjust the pitch of the airplane to control climb/descent rate and airspeed. (To more easily remember the autothrust modes, recall that in “Speed” mode the autothrust maintains a particular speed, and in “Thrust” mode it maintains a particular thrust level.)
While descending into Bangalore, the crew of flight 605 found themselves slightly above the normal glide path — a common occurrence, and one which is easily corrected by temporarily increasing the rate of descent. To accomplish this, Captain Fernandez set the vertical mode to “Open Descent,” causing the airplane to descend toward a previously selected target altitude while the auto thrust held engine power at idle. In this case, that target altitude was 4,600 feet above sea level, or about 1,700 feet above the ground, the altitude to which they had been cleared by air traffic control. In Open Descent mode, the auto thrust will not adjust engine power to maintain a selected airspeed. Therefore, the it was Fernandez’s responsibility to keep a careful eye on his flight director — a set of overlays on his primary display which tell him whether to pitch the plane up or down — in order to maintain the proper approach speed, which in this case was 132 knots (244km/h). (By pitching down, speed increases, and by pitching up, speed decreases.) As expected, Captain Fernandez followed the flight director commands and easily maintained the target speed.
As the plane approached the target altitude of 4,600 feet, the vertical mode changed to ALT*, or Altitude Capture, an intermediate mode during which the plane levels off at the target altitude and the FMS awaits a new command. Captain Gopujkar called out the mode change, and Captain Fernandez said, “Okay, give me go around,” asking Gopujkar to enter the altitude to which they would fly if they decided to abandon the approach — in this case, 6,000 feet.
“Go around you want?” Gopujkar asked. At this point flight 605 was still above the glide path, but there was no indication that Fernandez actually wanted to go around; rather, he probably wanted this value entered so that he could select it quickly if needed.
“6,000,” Fernandez affirmed.
“Or do you want Vertical Speed?” Gopujkar asked. He never did select 6,000 feet, for reasons that remain unclear.
Fernandez decided to go along with Gopujkar’s suggestion. “Vertical speed,” he said.
“How much?”
“1,000,” said Fernandez, offering a slightly higher-than-normal descent rate to get them back on the glide path. Gopujkar therefore used the vertical speed knob to enter a descent rate of 1,000 feet per minute, changing the vertical mode to “Vertical Speed.” Coinciding with this move, the auto thrust returned to “Speed” mode and resumed its efforts to hold their airspeed at 132 knots. Although he did not say so, Gopujkar also reset the target altitude to 3,300 feet, the minimum altitude for that phase of the approach.
A short while later, as the aircraft approached 3,300 feet, the vertical mode again changed to ALT* as the flight computer (FCU) prepared to level the plane. Recognizing that they had now intercepted the proper glide path and were beginning to descend below it, Captain Fernandez requested that Gopujkar change the rate of descent to 700 feet per minute. “Missed approach is…” Gopujkar started to say.
What happened at this moment was never conclusively determined, and two main theories have been put forward. According to one theory, Gopujkar followed up his comment on the missed approach by selecting and engaging the go around altitude of 6,000 feet, but quickly realized that this would trigger Open Climb mode. To correct his mistake, he spun the knob down toward zero to prevent the plane from climbing, selecting a target altitude that was below ground level. Selecting a target altitude lower than the present altitude while in ALT* mode will engage Open Descent.
According to the other theory, Gopujkar had been about to select the go around altitude and had his hand on the altitude knob when Fernandez requested a descent rate of 700 feet per minute, causing him to accidentally select “700” with the altitude knob instead of the vertical speed knob. Again, selecting this lower target altitude (which was also below ground level) would have changed the vertical mode to Open Descent. Regardless of which sequence of events took place, at that moment the FCU entered Open Descent mode, and the plane began to drop toward the ground with the engines at idle.
With Open Descent mode active, their descent rate began to increase again, and the plane continued to fall below the glide path. In Open Descent mode, the auto thrust held engine power at idle and it became Captain Fernandez’s responsibility to follow the flight director commands in order to maintain the target airspeed. But Fernandez was not aware that the FCU was in Open Descent mode. Consequently, he didn’t make any attempt to maintain airspeed, which began to drop below 132 knots. As a result, the plane descended even more.
Some 11 seconds after entering Open Descent, Captain Gopujkar finally noticed the mode indication on the FMS and said, “You are descending in ‘Idle — Open Descent,’ ha, all this time.”
The radio altimeter called out, “Three hundred,” informing them that they were 300 feet above the ground.
Gopujkar knew that in Open Descent the auto thrust would not hold the proper airspeed, and he thought knew a quick way to get the auto thrust back to “Speed”mode. Because safe flight in Open Descent relied on the use of the flight director to maintain airspeed, turning off both pilots’ flight directors would cause the auto thrust mode to immediately switch to Speed mode, where it would automatically maintain the selected airspeed of 132 knots. Therefore, Gopujkar said, “You want the flight directors off now?”
“Yeah,” said Fernandez, switching his flight director off. “Okay, I already put it off.”
“But you did not put off mine,” said Gopujkar. This probably confused Fernandez, since it was the job of the pilot not flying to turn off the flight directors. Fernandez never replied, and Gopujkar never switched off his own flight director. As a result, Fernandez no longer had any flight director commands on his display, but the FCU remained in Open Descent mode, since one flight director was still active. This muddled attempt to switch to Speed mode had done nothing but make the situation worse.
“Two hundred,” said the radio altimeter. They were 174 feet below the glide path, descending at 600 feet per minute, with airspeed at a sluggish 118 knots and dropping. At an altitude of 175 feet, Fernandez finally seemed to notice that something was wrong, and he began to pull back with his side stick in order to climb.
“You are on autopilot still?” Gopujkar asked, apparently trying to figure out why the auto thrust had not switched to Speed mode.
“It’s off,” said Fernandez.
Suddenly, Gopujkar noticed that they were just barely above the ground and descending rapidly. “Hey, we are going down!” he exclaimed. At that exact moment, the airspeed dropped low enough and the angle of attack became high enough to trigger one of the A320’s alpha floor protections, which automatically began to accelerate the engines to maximum power to prevent a stall. But it takes eight seconds for the engines to spool up from idle to max power, and they didn’t have eight seconds.
“Captain, captain, still going!” said Fernandez.
The ground proximity warning system called out, “SINK RATE!” Fernandez jammed the throttles forward, unaware that the alpha floor protection system had already done so. Unfortunately, it was too late.
A couple seconds later, Indian Airlines flight 605 touched down in the middle of the Karnataka Golf Club, some 2,300 feet short of the runway. At first, some of the passengers and flight attendants thought it was a normal landing. But within a couple of seconds, this illusion was shattered as the plane bounced back into the air, sliced off the tops off of some trees, and crashed back down near the 17th green. The A320 then slammed headlong into a 4-meter-tall earthen embankment, which severely damaged the forward fuselage and ripped off the landing gear and both engines. The crippled aircraft briefly became airborne again before coming back down in a rocky field just short of the airport perimeter wall, where the ruptured fuel tanks immediately burst into flames.
On board the aircraft, chaos reigned. Virtually everyone had survived the crash landing, but many people were seriously injured, and fire began to pour into the cabin almost immediately. A flight attendant opened the left rear exit and people began to stream out of the plane. Meanwhile, someone opened the two overwing emergency exits on the left side, and a few passengers escaped that way; a couple of others found a break in the fuselage near the front of the plane and managed to get out there as well. But for most of the people in the front part of the cabin, there was no time to escape — fire overtook them before they could reach any exit. Among those who never made it out were Captain Gopujkar and Captain Fernandez, who were seen struggling to open a window before flames engulfed the cockpit. By the time fire trucks began to arrive, the fight for survival was all but over; the fire had already spread backwards through most of the passenger cabin. Of the 146 people on board, only 56 made it out, and of these two soon died in hospital, bringing the final death toll to 92 with 54 survivors. Out of the 92 victims, at least 83 died in the fire, not on impact, although about one third of these suffered serious leg and head injuries during the crash which might have prevented them from escaping.
Because this was the first crash of an Airbus A320 in regular passenger service, coming only two years after the deadly demonstration flight in 1988, considerable international attention was paid to the crash of flight 605. The Indian government appointed Justice Shivashankar Bhat to oversee the inquiry into the cause of the accident, which many people already speculated might have something to do with the advanced technology on board the plane. In the meantime, Indian Airlines was asked to ground its 17 remaining Airbus A320s, which it soon chose to sell in order to stop hemorrhaging money.
But did the design of the plane’s flight control systems really have anything to do with the crash? Accident investigators, the Indian Directorate General of Civil Aviation, and Airbus all agreed that it most likely did not. The argument focused on a few key moments. The first point at which things began to go wrong occurred about 35 seconds before impact, when Captain Fernandez requested a descent rate of 700 feet per minute, and the FCU instead entered Open Descent mode. The flight data recorder simply noted that this had happened; it did not explain what prompted the change. Investigators felt that because the FCU was working correctly both before and after this point, the most likely explanation was that Captain Gopujkar had simply entered something that triggered the mode change. Either he accidentally used the altitude knob instead of the vertical speed knob, or he inadvertently made a selection which would trigger “Open Climb” and then reversed his input.
The second key link in the chain of events came when Gopujkar realized they were in Open Descent mode and suggested that Fernandez turn off the flight directors. Had they actually turned off both flight directors, the auto thrust would have entered Speed mode, the proper approach speed would have been restored, and the crash would have been averted. Why Gopujkar never turned off his own flight director, when it was his duty to turn off both, was difficult to explain. The data recorder registered no fault with the flight director, so the investigation could only conclude that he never attempted to turn it off, for reasons unknown. It was worth noting that he also could have engaged Vertical Speed mode by pulling the vertical speed knob outward and then using it to enter a value, which would also have restored the auto thrust to Speed mode, but he never attempted to do this.
The third critical moment came shortly before impact, when the alpha floor protection activated and the pilots began to realize something was wrong. About 9 seconds prior to impact was the last point at which an acceleration to maximum thrust could have saved the plane. At that moment, Fernandez had already pulled his side stick back to raise the nose, but he had not moved to increase engine power. Had he increased engine power before raising the nose, the crash might, just barely, have been averted. So why didn’t he? One explanation was that he expected his large nose up input at low speed to trigger an alpha floor protection which would do this for him. But Airbus revealed that there is a delay of up to 1.2 seconds between the alpha floor conditions being met and the protections actually activating. It was difficult to say with certainty, but those 1.2 seconds could have meant the difference between life and death. Lawyers representing Indian Airlines pilots argued that this was a performance shortfall — that if the engines had responded as fast as advertised, the crash could have been avoided. Airbus argued that the 1.2 second delay was itself the baseline. Tempers flared in the courtroom as the two sides faced off over a single second that may or may not have meant anything at all.
There remained one final question: why did neither pilot notice that their airspeed was too low and they were descending below the glide path? After all, both pilots’ airspeed indicators included a prominent magenta-colored triangle that represented the calculated approach speed, and they were taught not to let airspeed drop below this triangle. Although the investigation merely stated that they did not monitor their airspeed, modern knowledge of the way humans interact with automation gives us a possible answer as to why. Since both pilots thought the auto thrust was in Speed mode, where it would maintain airspeed automatically, they probably trusted it so completely that they never checked to see whether it was doing its job. Even in the few short weeks they had been flying the A320, it was possible that they became so convinced of the autoflight systems’ reliability that they relaxed their guard right when vigilance was most needed. Later crashes involving a wide variety of aircraft types have shown that this is a common phenomenon — one which pilots need to be specifically taught to combat.
All the way to the end, the airline pilots’ union insisted that two captains as experienced as Gopujkar and Fernandez wouldn’t have made such elementary mistakes, and that a major computer failure must have caused both the entry into Open Descent and the failure of the second flight director to turn off. They did not attempt to explain why, with the attempt to engage Speed mode having failed and disaster just seconds away, neither pilot applied go-around power until it was too late. Justice Bhat eventually ruled that the probable cause of the crash was a failure by the pilots to appreciate the danger that their plane was in as it sank toward the ground, and their consequent failure to take decisive action until it was too late. To this conclusion, the Indian government added that most probably Captain Gopujkar had accidentally selected 700 feet with the altitude knob instead of the vertical speed knob, and that this error, along with the failure to turn off the other flight director, were the main contributing factors to the crash. The pilots’ unions protested that there was no evidence that Gopujkar had actually done this, but there was no evidence of their alternative theory either.
Today, more than 30 years after the crash, it is possible to look back at it in a different context than was available to those who worked on it and argued about it in 1990. Some of the arguments have aged better than others.
A little over a year after the publication of the final report on Indian Airlines flight 605, another brand new Airbus A320 crashed in the mountains near Strasbourg, France. Air Inter flight 148 would prove to be the third deadly incident in the ongoing debate over the Airbus A320, as many of the same problems that led to the crash of flight 605 seemed to have appeared again. The instigating error which led to the crash of flight 148 occurred when the captain accidentally entered a target vertical speed instead of a target flight path angle. Not realizing that the vertical mode was set to Vertical Speed and not Flight Path Angle, he entered “33” intending for this to be an angle of -3.3 degrees, but it was read as -3,300 feet per minute instead. Neither pilot noticed their excessive descent rate until it was too late, and the plane flew into a mountain, killing 87 of the 96 passengers and crew. The two pilots on that flight had even less combined experience than Gopujkar and Fernandez. They also weren’t the first to make that exact mistake: in 1988, an A320 with an unspecified airline almost landed 5 kilometers short of the runway at London Gatwick after one of the pilots attempted to enter a 3-degree flight path angle while still in vertical speed mode.
All these incidents of mode confusion on the A320 fueled criticism of its flight guidance technology and all the modes that came with it, which many people thought were too confusing. There seemed to be too many edge cases, too many different ways to get into unwanted modes, too much obscure software architecture that only a few engineers understood. The criticism was certainly not unwarranted — in its original state, there were serious problems with the A320’s user interface that made it more difficult to notice when unwanted mode changes occurred. But the real factor underpinning all these accidents and near misses was probably nothing more than inexperience. The pilots involved in the incidents all had very little time on the A320. Even though they were experienced airmen, as the Indian pilots’ unions rightly pointed out, a lot of that experience didn’t translate well to the Airbus A320. It took time for pilots to get used to how the new systems behaved, since they had never seen anything similar before. Once pilots around the world gained more experience on fly-by-wire aircraft, the crashes caused by mishandling of the A320’s automation stopped happening. Although it got off to a rocky start, the A320 went on to achieve a better safety record than most traditional aircraft types. And although there have been a couple of close calls, no Airbus has ever crashed because of the sort of computer failure that skeptics so deeply feared.
The fact that the A320 has a good safety record today should not be taken for granted, however. As a result of the crash of flight 605, a number of safety efforts were initiated to prevent crew errors while using the flight guidance systems. Prior to the crash, the US Federal Aviation Administration had no rules in place for how such systems must be designed. As a result of the accident, the FAA issued a new regulation describing the minimum requirements which a flight guidance system must meet, including that all information must be presented in a “clear and unambiguous manner” and “enable flight crew awareness… of the effects on the airplane or systems resulting from flight crew actions;” that “operationally relevant behavior” of the system “must be predictable;” and that the systems must allow pilots to “manage errors” so that those errors don’t spiral out of control. Additionally, Airbus made several changes to the A320. The airspeed display is now easier to read; there is now an aural warning that will alert pilots if their speed is too low; the vertical mode will now revert from Open Descent to Vertical Speed if the aircraft’s speed drops below normal approach value; and selecting a new altitude while in ALT* mode will now engage Vertical Speed mode instead of Open Descent or Open Climb. These changes effectively prevented flight crews from accidentally entering Open Descent mode while close to the ground, and made it much easier to notice if it somehow happened anyway. Alongside all of these modifications, the team that investigated the crash issued no less than 62 recommendations intended to improve the safety of both the A320 and Indian aviation more broadly, of which most were accepted by India’s Directorate General of Civil Aviation.
The significance of the crash of Indian Airlines flight 605 lies in the fact that it was, by some measures, the first “modern accident.” Although the number of accidents overall is trending down, a greater proportion of crashes in recent years have been related to the interactions between pilots and sophisticated forms of automation. This is not only an Airbus problem; if anything, Airbus has learned its lesson, and the problem is now more acute with Boeing, which has only recently followed in its footsteps. Many parallels can be drawn between Indian Airlines flight 605 and the 2013 crash of Asiana Airlines flight 214. A trainee captain on the Boeing 777 made an error while using an automated flight guidance system, allowed his error to spiral out of control, and then failed to appreciate how the resulting mode changes affected the airplane’s ability to help him when he attempted to recover from a low speed, low altitude situation. The names of the modes were different, but in many ways the sequence of events was the same. The lesson is that at the end of the day, there will always be inexperienced pilots working with these advanced autoflight systems, and it is the job of the manufacturer to ensure that those systems live up to the promise that they will make airliners easier to fly.
______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read over 150 similar articles.
You can also support me on Patreon.
