China Airlines 006: a 747 autopilot masked a developing loss of control while the captain, fixed on a failed engine, stopped watching his instruments

On 19 February 1985 a China Airlines Boeing 747SP cruising at 41,000 feet over the Pacific lost thrust on its outboard right engine. The autopilot did exactly what it was built to do: it held the wings level by winding in more and more opposite aileron and spoiler, without telling anyone. Once it ran out of lateral authority, the airplane began rolling right, and the crew inherited an aircraft on the edge of an upset. The jet rolled through the inverted, fell from about 41,000 feet to roughly 9,500 feet, and pulled loads that tore parts of both horizontal stabilizers off before the captain recovered and landed at San Francisco. Nobody died among the 274 people on board, but the US National Transportation Safety Board's final report named over-reliance on the autopilot as a contributing cause, one of a series of mid-1980s NTSB findings that an automated system can hide a developing emergency from the humans supervising it.

What happened over the Pacific

Flight 006 was roughly 300 nautical miles northwest of San Francisco, about ten hours into a Taipei to Los Angeles service, when the trouble began. The autopilot was engaged and coupled to the aircraft's Performance Management System, which was holding 41,000 feet and Mach 0.85 by commanding the autothrottles. In light clear-air turbulence the airspeed fluctuated and the system moved the throttles back and forth to hold the commanded Mach number. When it pushed the throttles forward again, three engines accelerated and the No. 4 engine hung near idle.

The flight engineer worked the No. 4 throttle manually with no response, then reported a flameout. The NTSB later concluded the engine had not actually flamed out at that point but had "hung" at around 1.0 engine pressure ratio, and that the flight engineer did not close the relevant bleed air valve switch before advancing the throttle, though the Board said it could not state the engine would have recovered even if he had. The captain directed a relight attempt at 41,000 feet even though the maximum restart altitude was 30,000 feet, and told the first officer to ask air traffic control for a lower altitude. None of that, by itself, endangered the aircraft; the NTSB concluded that losing one engine in cruise should not cause an experienced crew to lose control. What endangered the aircraft was that, while the crew worked the engine problem, nobody was watching what the autopilot had to do to hold the wings level, and nobody was watching the attitude indicator.

The autopilot ran out of authority

The 747SP's autopilot used only ailerons and spoilers for lateral control. It had no access to the rudder or rudder trim, the controls a pilot would normally use to balance asymmetric thrust. As thrust on the right side sagged and the airspeed slowly bled off, the autopilot compensated by rolling in progressively more left-wing-down control wheel. The flight data recorder showed that deflection growing from about 7 degrees to about 20 degrees, and by 1013:43 to 22.9 degrees, the maximum the autopilot could command. From there it had nothing left. With the wheel pinned at its limit and the airspeed still decaying, the aircraft began rolling right, passed wings level, and kept going.

The autopilot stayed engaged for what the NTSB measured as a three minute forty second deceleration. The heading changed only about four degrees in the first three minutes of that window, then swung nearly 60 degrees in the final 50 seconds as the roll developed, the attitude indicator showed close to wings level for much of it, and the captain's attention was on the airspeed indicator and the engine. Until the autopilot saturated, the single cockpit cue that would have exposed the worsening situation was the control wheel's growing deflection, which was not part of the captain's instrument scan and which, not being hands-on, he never felt. Once the aircraft began rolling right, the attitude indicator beside his airspeed indicator did show the bank passing 23 and then 45 degrees; the Board found he never looked at it until after he disconnected the autopilot. By the time he disconnected the autopilot at 1014:50, the aircraft was already 64 degrees right-wing-down and four degrees nose down.

Thirty thousand feet in about two and a half minutes

What followed was a near-vertical loss of control in cloud. Recorded data showed the aircraft pitching to 68 degrees nose down, rolling onto its back and completing what amounted to a full aileron roll, with control wheel deflections swinging 59 degrees one way and 57 degrees the other. Between 1014:50 and 1017:15 it descended from about 40,400 feet to roughly 9,600 feet, with recorded vertical accelerations of 4.8 G and 5.1 G during the recovery, and parts of the data recorder output going unreliable entirely.

The airframe paid for it. A section of the left horizontal stabilizer roughly ten to eleven feet long, including the entire left outboard elevator, tore away, and the right stabilizer suffered a similar separation. The auxiliary power unit came off its mounts. Landing gear doors were lost and the No. 1 hydraulic system drained. The crew initially told Oakland Center that conditions were normal and that they would continue to Los Angeles, then reconsidered once the flight engineer saw the gear and hydraulic indications, levelled at 27,000 feet with gear extended, and diverted. They re-declared an emergency at 1038:39, reporting injured people on board, and landed on runway 28L at San Francisco International Airport. Of the 274 people aboard, the NTSB recorded two serious injuries: a cabin crew member with an acute back strain and a passenger with lacerations and bone fractures of the right foot.

What the investigators concluded

The Safety Board adopted its report on 29 March 1986. It found the probable cause to be:

the captain's preoccupation with an inflight malfunction and his failure to monitor properly the airplane's flight instruments which resulted in his losing control of the airplane.

NTSB/AAR-86/03

It then added a second finding that is the reason this case still gets taught: contributing to the accident was the captain's over-reliance on the autopilot after the loss of thrust on the No. 4 engine. In the analysis the Board was blunter about the mechanism, concluding that the captain over-relied on the automation and that this was causal "since the autopilot effectively masked the approaching onset of the loss of control of the airplane." Boeing's own training material, as summarised in the report, told crews to disengage the autopilot following an engine failure and to trim manually. The report also noted that the loss of thrust itself was the precipitating event but not a contributing cause, because more than three minutes elapsed between the engine hanging and the loss of control, which was ample time to respond correctly.

The report devoted a section of its human performance analysis to automation, observing that the 747SP could be programmed to fly essentially the entire route automatically, leaving the crew as monitors for almost the whole flight, and citing laboratory research and prior accidents for the proposition that people are poor monitors of systems they are not physically controlling. Among the precedents it drew on were the 1972 Eastern Air Lines Lockheed L-1011 crash in the Florida Everglades, where a crew distracted by a landing gear indicator failed to notice an inadvertent autopilot disconnect from altitude hold, and a 1979 Aeromexico DC-10 stall during climb over Luxembourg.

Early reporting got several details wrong

Contemporaneous wire coverage diverged from the eventual findings in ways worth flagging. United Press International's dispatch on the day of the accident reported 268 people aboard rather than 274, said the Federal Aviation Administration had attributed the event to wind shear, described the aircraft as dropping from 41,000 feet to 9,000 feet, and put the injury toll at about 55, most of them minor bruises from unbelted passengers hitting the overhead compartments. It also relayed the airline's statement that the No. 4 engine had lost power but that a flameout alone should not have produced the dive. UPI's follow-up the next day reported that an airport spokesman said nobody would know what happened until the NTSB analyzed the flight recorder, with a federal team travelling from Washington to interview crew and passengers.

The NTSB's final accounting supersedes those early figures: 274 aboard, two serious injuries under the agency's regulatory definition; the NTSB tabulated the other 252 people aboard as 'minor/none' without separating the two, so the only count of minor injuries is UPI's figure of about 55, most treated for bruises, recovery at around 9,500 feet, wind shear as the cause of the initial airspeed fluctuations and throttle movements, but not of the dive itself, and an engine that hung rather than flamed out at the moment the trouble began. One thing the wire copy captured that the accident report could not was what the cabin felt like. UPI quoted a Los Angeles passenger:

'People were popping up like popcorn,'

UPI, 19 February 1985

Why it moves the needle

Flight 006 is a foundational case of an automated system degrading safety precisely by succeeding at its narrow objective. The autopilot was not broken, did not exceed its design, and did not do anything its engineers had not anticipated. It held the assigned attitude, absorbed a growing asymmetry, and gave no indication that it was consuming its entire control margin to do so. The failure was in the interface between a competent automated controller and the humans nominally supervising it: the system's silent compensation removed the very cues that would have told the crew how bad things were getting, and by the time the captain took control back, there was almost nothing left to take back.

That pattern - automation that absorbs a deteriorating condition until it saturates, then reverts to a human who has lost the thread - recurs across four decades of subsequent automation-related loss-of-control accidents, and it is the same structural problem that now shows up in driver-assistance handovers and in supervisory control of autonomous systems generally. The NTSB's decision to write "over-reliance on the autopilot" into an official probable cause statement in 1986, and to reason explicitly about monitoring research in the analysis, gave that risk class a formal regulatory footing. That a 747 with 274 people aboard survived a full roll and a 30,000-foot descent is a tribute to the airframe and to the recovery, not evidence that the underlying failure mode was mild.