Selection from NTSB
Report: Pilot Action Scenario* (pgs. 37-42)
*Note: Highlighted and italicized text are a result of the Author's intended
emphasis and not included in the original NTSB document.
Simulations showed that certain combinations of pilot inputs could result
in elevator motions consistent with those recorded by the accident airplane's
FDR and a flightpath consistent with the FDR and radar data for the accident
airplane. (104) Therefore, the Safety Board evaluated the actions of the pilots
as recorded on the CVR, in the context of all of the evidence gathered in this
investigation, to determine whether pilot action provided a possible explanation
for the accident scenario.
Events Before and During the Initial Descent, While the Relief First Officer
Was Alone in the Cockpit
About 20 minutes after takeoff (about 0140), the relief first officer suggested
that he relieve the command first officer. A transfer of control this early
in the flight was contrary to the EgyptAir practice typically agreed-upon by
flight crews of waiting until 3 or 4 hours into the flight before relieving
the command crewmembers. The command first officer initially reacted with surprise
and resistance to the relief first officer's suggestion that he assume first
officer duties at that time, indicating that the relief first officer's suggestion
was unexpected. However, after some discussion, the command first officer agreed
to the change, and sounds recorded by the CVR indicated that, about 0142, the
command first officer vacated and the relief first officer moved into the first
officer's seat.
About 0147, the relief first officer asked an unidentified crewmember to return
a pen to another first officer, who was in the cabin. The unidentified crewmember
agreed and left the cockpit. At 0148:03, the command captain excused himself
from the cockpit, saying that he wanted to "take a quick trip to the toilet...before
it gets crowded." While the command captain was excusing himself, the CVR recorded
the sound of an electric seat motor, presumably the captain's, as he maneuvered
to leave his seat and the cockpit. (105) At 0148:18.55, the CVR recorded a sound
similar to the cockpit door operating.
The Safety Board considered whether another flight crewmember might have
been in the cockpit with the relief first officer during this time period. However,
careful laboratory examination of the CVR recording indicated that the CVR did
not record any speech or human sounds other than those attributed to the captain
and relief first officer from 0148:30 until the end of the recording at 0150:38.47.
(106) The Board determined that the possibility that another person, especially
a pilot, was present during the airplane's sudden transition from cruise flight
to steep descent and did not audibly express surprise at the abrupt change in
the flight situation (as the captain did when he returned to the cockpit) or
offer help/suggestions on how to deal with the emergency situation was extremely
unlikely. Therefore, the evidence indicates that the relief
first officer was alone in the cockpit from about 0148:19, when the command
captain left the cockpit, to 0150:06, when he returned to the cockpit.
Ten seconds after the unintelligible comment was made (at 0148:40), the relief
first officer stated quietly, "I rely on God." At 0149:18, the CVR recorded
a "whirring sound similar to [the] electric seat motor operating." Because
the relief first officer's seat was likely moved into an aft position because
the command first officer had vacated the seat, and in light of the autopilot
disconnect and subsequent flight control movements, the whirring sound is consistent
with the relief first officer moving his seat forward into a position from which
he could manually fly the airplane. (107) Thus, all manual flight control
inputs made after 0148:19, until the command captain's return to the cockpit
at 0150:06, must have been made by the relief first officer.
The absence of an autopilot disconnect warning tone on the CVR recording when
the autopilot disconnected at 0149:45 is consistent with the autopilot being
manually disconnected by rapidly double-clicking on the control yoke-mounted
autopilot disconnect switch. Because the relief first officer was alone in the
cockpit, the evidence indicates that he manually disconnected the autopilot.
The Safety Board's examination revealed no evidence in the CVR, FDR, ATC, or
radar data of any system malfunction, conflicting air traffic, or other event
that might have prompted the relief first officer to disconnect the autopilot;
therefore, there was no logical operational reason for the relief first officer
to disconnect the autopilot while in cruise flight over the ocean. Further,
as previously stated, the Board's testing and evaluation of the 767 elevator
system showed that none of the failure modes examined during this investigation
would have resulted in control column movements without concurrent identifiable
movements of the elevators, which would have been observed in the FDR data.
The FDR did not record any unusual or alarming elevator
movements before the autopilot was disconnected; therefore, it is unlikely that
the relief first officer was prompted to disconnect the autopilot because he
sensed unusual control column movements.
Aside from some very slight elevator movements and a very gradual left roll,
the airplane remained in level flight at flight level 330 for about 8 seconds
after the autopilot was disconnected. As previously discussed in the section
titled, "767 Autopilot Information," such slight movements are normal and expected
when the autopilot is disengaged and the pilot takes manual control of the airplane.
There was no indication of an upset or loss of control at this time.
At 0149:48, the relief first officer again quietly stated, "I rely on God."
At 0149:53, the throttle levers were retarded (moved from their cruise power
setting to idle). This throttle lever movement occurred at a rate that was more
than twice that which the autothrottle can command. Further, the throttle levers
moved 10º to 15º beyond the minimum position that the autothrottle would have
been able to command at the existing flight conditions to the throttle levers'
full aft idle stop, about 33º. (108) Movement of the throttles aft of the autothrottle
commanded position requires a manually applied force of about 9 pounds on the
throttle levers to override the autothrottle servomotor clutch. Thus,
it is apparent that the throttle lever movements at 0149:53 were caused by the
relief first officer's manual inputs and were not the result of autothrottle
commands. (109)
At 0149:54, the FDR recorded a very slight movement of the inboard ailerons
and both elevator surfaces beginning to rapidly pitch nose down (to about 3.6°
nose-down deflection). The nose-down elevator movement
began after the throttle levers started to move to idle; therefore, the relief
first officer did not move the throttle levers to idle in response to the nose-down
elevator movement. As previously noted, the relief first officer did
not audibly express surprise or seem anxious or disturbed by the airplane's
sudden and extreme nose-down movement or the reduction in load factor to near
0 G, nor did he call for help during the accident sequence. Again,
there was no evidence in the CVR, FDR, ATC, or radar data of any system malfunction,
conflicting air traffic, or other event that would have prompted the relief
first officer to adjust the throttle levers at all, let alone take an action
as drastic as moving the throttle levers to the idle position while in cruise
flight at night over the ocean or to then command a sustained nose-down elevator
movement.
About 11 seconds after the initial nose-down movement
of the elevators, the FDR recorded additional (larger) movements of the inboard
ailerons and the elevators started to move further in the nose-down direction,
decreasing the airplane's load factor to negative G loads. The relief
first officer would have been gripping the control wheel with his hand(s) when
he applied these significant nose-down elevator control column inputs. It is
unlikely that he could make such significant control column inputs without (intentionally
or unintentionally) also affecting the control wheel's lateral position and
thus providing some input to the ailerons. Therefore, these inboard aileron
movements, and those that occurred at 0149:54 (both of which were coincident
with changes in the relief first officer's inputs to the control column), are
consistent with evidence indicating that the relief first officer was providing
manual inputs to the flight controls during the accident sequence.
Events After the Command Captain Returned to the Cockpit
Immediately after this increase in nose-down elevator movement, at 0150:06,
the CVR recorded the command captain exclaiming, "What's happening? What's happening?,"
as he returned to the cockpit. (110) At 0150:08, the captain repeated his question.
While the captain was still speaking and moving toward his seat in the forward
portion of the cockpit (at 0150:07 and again at 0150:08), the relief first officer
quietly repeated, "I rely on God." (111) However, the relief first officer did
not answer the captain's question. The Safety Board considers it unlikely that
the captain--who was likely focusing on getting into his seat, troubleshooting
the upset, and attempting to regain control of the airplane--would have suspected
at this point that the relief first officer's actions were directly contributing
to the airplane's dive. (112) Rather, the captain likely would have assumed
that the relief first officer was also attempting to regain control of the airplane
and would work cooperatively with him.
As previously discussed, the relief first officer's passive behavior in response
to the airplane's nose-down movements and the captain's questions is not consistent
with what would be expected from a pilot who was dealing with an unexpected
or undesired airplane problem. To the contrary, the timing
of the increased nose-down elevator movement and the corresponding decrease
in load factor was consistent with the relief first officer having increased
the forward control column pressure when the captain returned to the cockpit.
At 0150:15, as the airplane continued to descend rapidly in a 40° nose-down
attitude, the captain again asked, "What's happening, [relief first officer's
first name]? What's happening?" Again, the relief first officer did not respond
to the captain's question. Although the relief first officer remained unresponsive
to the captain's queries, there is no specific evidence to indicate that the
captain suspected at this point that the relief first officer's actions were
causing the airplane's dive.
At the same time, as the airplane was descending through
about 27,300 feet msl, both elevator surfaces began moving to reduced nose-down
deflections. Shortly thereafter, the airplane's rate of descent began to decrease.
Because there was no evidence that the relief first officer had attempted to
regain control of the airplane before this, the Safety Board considers it likely
that these movements were the result of nose-up flight control inputs made by
the captain after he returned to the cockpit. (113) Six seconds later (at 0150:21),
both elevator surfaces passed through their neutral positions into nose-up deflections.
However, less than 1 second later, the right surface reversed its motion and
moved back in the nose-down direction, and the left surface continued to move
in the nose-up direction.
According to Boeing's tests and research, with the elevator PCAs operating
normally, the accident airplane's elevators would have only been minimally affected
by the aerodynamic forces that would have resulted from the small sideslip angle,
roll rates, and the Mach numbers that existed during the accident sequence.
Therefore, it follows that the elevator split recorded by the FDR was the result
of flight control inputs to each elevator surface and not the result of aerodynamic
forces on those surfaces. (114) (In contrast, Boeing indicated that an outboard
aileron split recorded between 0150:27 and 0150:32 could be explained by the
aerodynamic effects of the small sideslip angles and roll rates calculated to
have been present at that time.) (115)
Testing confirmed that the left and right elevator surfaces could be moved
in different directions by differential column movements from the relief first
officer and captain in the cockpit. As intended by the elevator control system
design, the elevators would split, each surface following the movements of the
control column on its side (the left elevator moving in response to the left
column movement, and the right elevator moving in response to the right column
movement). The opposing control column inputs likely existed during the 7 to
8 seconds before the elevator split (when both elevators were moving in a trailing-edge-up
direction); however, the elevator split would not occur until the difference
between the two control column forces was great enough to engage the override
mechanism. Tests conducted in a 767 simulator and airplane (on the ground) demonstrated
that pilots with heights and weights similar to those of the command captain
and relief first officer could apply enough force on the control column to produce
and maintain the split elevator condition recorded by the FDR.
The captain's actions just after the elevator split
began were consistent with an attempt to recover the airplane and the relief
first officer's were not. In rapid sequence, just after the elevator split began,
the engine start lever switches were moved to the cutoff position, the throttle
levers were advanced to full throttle, and the speedbrakes were deployed. (116)
After the throttle levers were advanced (but the engines did not respond), the
captain reacted with surprise, asking the relief first officer, "What is this?
What is this? Did you shut the engine(s)?" (117) The timing and direction of
the left elevator motions during this time suggest that the captain, who had
likely been using both hands to pull aft on the left control column, released
his right hand to advance the throttles and deploy the speedbrakes, resulting
in a decrease in his total aft pressure on the control column, which was reflected
in the decrease in the left elevator's nose-up deflection that was recorded
by the FDR at this time. Subsequently, when the captain likely had returned
his right hand to the control column, the FDR recorded a corresponding increase
in the left elevator's nose-up deflection. As previously stated, tests and simulations
demonstrated that a pilot seated in the captain's position could easily have
advanced the throttles, moved his hand a little to the left, and deployed the
speedbrakes in the 3 to 4 seconds it took for these events to occur.
Concurrent with the brief downward motion of the left elevator that was recorded
when the throttles were advanced and the speedbrakes deployed, a brief downward
motion of the right elevator was recorded. This movement of the right elevator
suggests that when the captain's aft pressure on the left control column decreased,
the relief first officer's sustained forward pressure on the right control column
caused that column to move forward briefly. Although it would have been physically
possible for the relief first officer to have advanced the throttles and deployed
the speedbrakes, the evidence does not support the notion that the relief first
officer performed these actions. Rather, the evidence indicates that the relief
first officer moved the engine start lever switches to the cutoff position (a
counterproductive action, in terms of recovery), whereas the captain deployed
the speedbrakes in an attempt to arrest the airplane's descent.
Additionally, the surprised reaction from the captain when the engines did
not respond to the throttle movement ("What is this? What is this? Did you shut
the engine(s)?") suggested that it was he (not the relief first officer) who
advanced the throttle levers. This response clearly indicated that the captain
was unaware that the engine start lever switches had been moved to the cutoff
position, that such an action was at odds with his intentions, and that it was,
therefore, not part of a mutual, cooperative troubleshooting exercise between
the captain and relief first officer.
At 0150:26.55, the captain stated, "Get away in the engines," and at 0150:28.85,
he stated, "shut the engines." (118) At 0150:29.66, the relief first officer
responded for the first (and only) time after the captain returned to the cockpit,
stating, "It's shut." Between 0150:31 and 0150:37, the captain repeatedly asked
the relief first officer to "pull with me" on the control column. However, the
FDR data indicated that the elevator surfaces remained in a split condition
(with the left surface commanding nose up and the right surface commanding nose
down) until the last data were recorded by the FDR at 0150:36.64.
As with the earlier portion of the accident sequence (before the captain's
return to the cockpit), the relief first officer's responses during this portion
of the accident sequence did not indicate that he was surprised or disturbed
by the events. Similarly, his rate of speech and fundamental
frequency when he repeated, "I rely on God," and stated, "It's shut," did not
indicate any significant increase in his level of psychological stress. In contrast,
the captain's fundamental frequency was about 65 percent higher when he repeatedly
asked the relief first officer to "pull with me" during the elevator split period
than it was during routine flight, reflecting an increased level of psychological
stress.
As previously discussed, simulations showed that even if a failure condition
had affected the elevator system, it would have been possible to regain control
of the airplane at any time during the recorded portion of the accident sequence
and to have restarted the engines and recovered the airplane during the climb
after the recorders stopped. However, those simulations assumed that there were
no opposing pilot inputs. The captain's failure to recover the airplane can
be explained, in part, by the relief first officer's opposing flight control
inputs. It is possible that efforts to recover the airplane after the airplane
lost electrical power were also complicated by the loss of electronic cockpit
displays.
In summary, the evidence establishes that the nose-down elevator movements
were not the result of a failure in the elevator control system or any other
airplane system but were the result of the relief first officer's manipulation
of the airplane controls. The evidence further indicates that the subsequent
climb and elevator split were not the result of a mechanical failure but were
the result of pilot inputs, including opposing pilot inputs where the relief
first officer was commanding nose-down and the captain was commanding nose-up
movement. The Safety Board considered possible reasons
for the relief first officer's actions; however, the Board did not reach a conclusion
regarding the intent of or motivation for his actions.
Relevant Notes:
(104) For additional information, see Systems Group Chairman's Factual Report
and its appendixes and addendums, Flight Data Recorder Group Chairman's Factual
Report and its attachments, Cockpit Voice Recorder Group Chairman's Factual
Report and Sound Spectrum Study, and Aircraft Performance Group Chairman's Aircraft
Performance Study and its attachments and addendum.
(105) This electric seat motor was recorded by the cockpit area microphone
(CAM) but not by the hot microphone at the first officer's position, which (as
previously discussed) was likely stowed at the first officer's side of the airplane.
Because of its position on the right side of the airplane and its directionally
sensitive nature, it is likely that all seat motions recorded by the hot microphone
at the first officer's position after 0141 represented motions of the right
seat.
(106) As previously discussed, about 0148:30, the CVR recorded an unintelligible
comment that could not positively be attributed to any previously identified
crewmember. Two speech characteristics of the unintelligible comment (fundamental
frequency and formant dispersion) more closely resembled values displayed by
the relief first officer than by the other voices evaluated.
(107) This electric seat motor sound was recorded by both the CAM and the
hot microphone at the first officer's position, further confirming that this
sound represented a motion of the relief first officer's seat.
(108) This throttle lever position was consistent with manually input throttle
lever positions recorded by the FDR earlier in the accident flight.
(109) The Safety Board notes that several of its incident and accident investigations
(including EgyptAir flight 990) might have benefited from a visual record of
cockpit images/events. On April 11, 2000, the Board issued Safety Recommendations
A-00-30 and -31. Safety Recommendation A-00-30 asked the FAA to require that
all aircraft operated under 14 Code of Federal Regulations (CFR) Part 121, 125,
or 135 and currently required to be equipped with a CVR and FDR be retrofitted
with a crash-protected cockpit image recording system by January 1, 2005. Safety
Recommendation A-0-31 asked the FAA to require that all aircraft manufactured
after January 1, 2003; operated under 14 CFR Part 121, 125, or 135; and required
to be equipped with a CVR and FDR be equipped with two crash-protected cockpit
image recording systems. The Board specified that the cockpit image recording
system should have a 2-hour recording duration and be "capable of recording,
in color, a view of the entire cockpit including each control position and each
action...taken by people in the cockpit." Safety Recommendations A-00-30 and
-31 are currently classified "Open--Unacceptable Response."
(110) Although the CAM recorded all of the captain's remarks, the "What's
happening? What's happening?" comments at 0150:06 were of a poorer recording
quality and less audible than similar remarks made at 0150:08 and 0150:15. The
evidence from both microphones was consistent with the captain speaking from
outside the cockpit or the rear portion of the cockpit when he made the earlier
statement and from the forward portion of the cockpit when he made the later
statements, suggesting that the captain was moving forward as he made these
statements. Further, the content and tone of the captain's statements were consistent
with his trying to understand an unexpected situation upon his return to the
cockpit. When the captain asked, "What's happening? What's happening?" at 0150:06,
his words were not recorded by the hot microphone at the first officer's position;
however, the hot microphone recorded the captain's subsequent remarks until
it stopped recording cockpit conversation at 0150:25. (None of the relief first
officer's comments during the accident sequence were recorded by the hot microphone.
For additional information, see the section titled, "Audio Information Recorded
by First Officer's Hot Microphone.")
(111) The Safety Board considers it likely that the captain never heard any
of the relief first officer's "I rely on God" statements. None of these statements
were recorded by the hot microphone at the first officer's position, suggesting
that they were spoken very quietly. (By contrast, the hot microphone at the
first officer's position did record the captain's statements of "What's happening?"
as he moved to his seat at the forward portion of the cockpit [at 0150:08] and
again after he was seated in his seat [at 0150:15], despite the fact that the
captain was farther from that hot microphone.)
(112) The visual difference between pushing forward on the control column
and pulling aft on the control column to create elevator movements of the magnitude
recorded on the FDR would not have been readily apparent to the captain in the
darkened cockpit during the unexplained crisis, especially when he was trying
to understand the many abnormal events and sensations that were occurring during
the dive.
(113) During the Safety Board's tests and simulations, a pilot similar in
height and weight to the EgyptAir flight 990 command captain was physically
able to move from the aft cockpit into the captain's seat, to brace himself
against the control console or floor structure, and to apply enough back pressure
on the control column to match the physical pulling forces computed to have
been required to generate the split elevator condition recorded by the FDR.
However, the pilot stated that it was physically difficult or uncomfortable
for him to manipulate the control column while kneeling on the floor or standing
behind the captain's seat and suggested that, given his build and his need to
manipulate the controls, the captain of EgyptAir flight 990 would almost certainly
have attempted to enter his seat immediately upon his return to the cockpit.
As previously discussed, the simulator did not duplicate the accident airplane's
actual flight conditions in every way; for example, the simulator did not duplicate
the negative G loads recorded by the FDR. However, once the captain was normally
seated and effectively braced, these forces should not have substantially affected
the maximum fore-and-aft forces he could generate. Further, the G loads on the
accident airplane did not remain negative for long; FDR data show that the G
loads increased to greater than 1/2 G within 2 to 3 seconds of the start of
the recovery.
(114) For additional information, see Boeing's April 16, 2001, letter in the
public docket for this accident.
(115) For additional information, see Boeing's April 12, 2001, letter in the
public docket for this accident.
(116) Tests and simulations demonstrated that the magnitude of the elevator
split would vary, but a split could be maintained even when the pilot in the
left seat temporarily removed his right hand from the control yoke to advance
the throttles and deploy the speedbrakes and the pilot in the right seat temporarily
removed his left hand from the control yoke to move the engine start lever switches
to the cutoff position.
(117) The Safety Board notes that the captain's statement "What is this? What
is this? Did you shut the engine(s)?" might reflect the beginning of a suspicion
that the relief first officer's actions were not appropriate for recovery.
(118) This sentence, "Get away in the engines," is an example of a phrase
where direct translation of the Arabic words into English with no attempt to
interpret or analyze the words resulted in an awkward or seemingly inappropriate
phrase. In this case, it is possible that the captain, surprised to realize
that the engines had been shut off, was trying to tell the relief first officer
to leave the engines alone. However, research indicates that poor word choice,
improper grammar, and the use of incomplete phrases can be symptomatic of high
levels of psychological stress in a speaker.