China Airlines Flight 006 When automation silently removed the aircraft from stable reality

China Airlines Flight 006 is one of the most dramatic automation-induced upsets in aviation history. Cruising at 41,000 feet over the Pacific, the Number 4 engine flamed out. The autopilot, attempting to maintain heading and altitude with asymmetric thrust, gradually increased bank angle to compensate. The bank angle reached the limit of autopilot authority. The autopilot disconnected. The aircraft entered an uncontrolled spiral dive from 41,000 feet to 9,500 feet — a loss of over 30,000 feet — before the crew recovered.

No one died. The aircraft was structurally damaged beyond economic repair. The event is the precursor to Air France 447 in its essential human factors core: automation managing a problem silently, the gradual development of a situation the crew was unaware of, and the sudden, catastrophic presentation of full control authority to a crew unprepared for the aircraft’s state.

China Airlines 006 is Air France 447 without the fatalities. The automation managed the problem, the crew was unaware, and when the automation stopped being able to manage it, the crew received a fully-stalled, rapidly-descending aircraft with no preparation. They survived. AF 447 did not.

Date	19 February 1985
Flight	CI 006
Aircraft	Boeing 747SP-09
Operator	China Airlines
Fatalities	0 — all 274 on board survived (2 seriously injured)
Category	Automation / Upset Recovery / Autopilot Disconnect / Spatial Disorientation
Location	Pacific Ocean, northwest of San Francisco

The Event

CI 006 cruises at FL410 over the Pacific in IMC conditions
The Number 4 engine flames out; the crew begin restart procedures
The autopilot compensates for asymmetric thrust by gradually increasing bank to the right
The crew, focused on engine restart, do not notice the developing bank angle
The bank reaches the autopilot’s authority limit; the autopilot disconnects
The aircraft is now in a steep right bank, nose-low, in cloud, at 41,000 feet
The aircraft enters an uncontrolled spiral dive, accelerating to Mmo (maximum operating Mach number)
The crew recover at approximately 9,500 feet — a descent of over 30,000 feet in approximately 2.5 minutes
The aircraft has experienced structural overload; two passengers are seriously injured
The aircraft is diverted to San Francisco; all 274 on board survive

The Boeing 747SP suffered significant structural damage during the recovery from the spiral dive. The investigation found that the pull-out loads had exceeded the aircraft’s design limit loads. The aircraft was subsequently considered beyond economical repair.

Systems Engineering Perspective

From a systems engineering perspective, CI 006 exposes the autopilot’s silent compensation limit problem: the autopilot managed asymmetric thrust by gradually increasing bank — a compensation that was technically within its design capability — without any alert that the bank angle was developing toward its limit. When it reached the limit, it disconnected silently into an aircraft in an extreme and potentially irrecoverable attitude.

An autopilot that compensates for a developing problem silently, without alerting the crew to the developing bank angle, and then disconnects into an extreme attitude without warning, has not managed the problem — it has deferred it and then presented it at the worst possible moment.

Silent Bank Angle Compensation — The Invisible Development

When the Number 4 engine flamed out, the autopilot maintained heading by banking to the right — using the differential lift from the remaining engines and aerodynamic surfaces to compensate for the yaw. This is normal autopilot behaviour. The bank angle increased gradually. The autopilot did not alert the crew to the increasing bank angle. The crew were focused on the engine restart procedure.

By the time the autopilot reached its bank angle authority limit, the aircraft was at an extreme attitude from which the autopilot could no longer maintain controlled flight. The disconnect presented the crew with a fully-developed upset — not the gradual development that they might have addressed if they had been monitoring attitude continuously.

An autopilot that develops an attitude requiring correction without alerting the crew creates a situation where the correction must be applied in extremis rather than gradually. Silent bank angle development is a hazardous automation characteristic.

Spatial Disorientation in IMC at Recovery

The crew recovered the aircraft from the spiral dive in instrument meteorological conditions. In a spiral dive, spatial disorientation is extreme — the vestibular system is providing false information about attitude and rotation. Recovery required reliance on flight instruments alone, in a high-stress, time-critical environment, after a sudden and unexpected autopilot disconnect.

Human Factors Perspective

The human factors analysis mirrors Eastern 401 and Adam Air 574: the crew’s attention was captured by a secondary problem — engine restart — while the autopilot managed a primary hazard silently and eventually beyond its capability.

Channelised Attention — Engine Restart vs Attitude Monitoring

The Number 4 engine flamout commanded the crew’s attention. Engine restart is a procedurally intensive, time-critical task with direct safety implications. The crew’s cognitive resources were appropriately directed at the restart. The autopilot was managing attitude. The autopilot was not alerting them that it was increasingly struggling to do so.

When an autopilot is silently managing a developing attitude problem, the crew’s attention to a secondary task is not an error — it is a predictable response to the operational context. The system design must alert them to the developing problem.

Recovery From Extreme Upset — Survival Without Training

The crew recovered from a spiral dive at over Mmo, in IMC, with structural loads exceeding design limits, without specific upset recovery training for this scenario. Their survival reflects the quality of their basic airmanship and their ability to apply fundamental aerodynamic principles under maximum stress. The accident contributed to the development of upset recovery training requirements.

System Interaction Breakdown

1. Autopilot Silent Bank Angle Development

The autopilot compensated for asymmetric thrust with increasing bank without alerting the crew. The bank developed to the limit of authority without crew awareness.

2. Autopilot Disconnect Into Extreme Attitude

The disconnect presented the crew with a fully-developed upset from 41,000 feet in IMC — the worst possible presentation of a problem that had been developing for minutes.

3. Channelised Attention on Engine Restart

The crew’s attention was appropriately directed at the engine restart while the autopilot managed attitude — but the management was silent and eventually unsuccessful.

China Airlines 006 is Eastern 401 at 41,000 feet. The mechanism is identical. The outcome was survival. The lesson was the same.

Significance in Aviation Risk

1. Autopilot Bank Angle Alerting Standards

The accident contributed to autopilot design standards requiring alerts when bank angle approaches the limit of autopilot authority — giving the crew warning before the disconnect.

2. Upset Recovery Training

CI 006 was among the precursor events that drove the development of upset prevention and recovery training requirements — long before AF 447 made them mandatory.

Closing Perspective

China Airlines 006 is the case that proves that silent autopilot management of a developing problem is not safe management — it is deferred management with a catastrophic handover. The bank angle developed for minutes. The crew were unaware. When the autopilot reached its limit, it handed a fully-developed spiral dive to a crew with no warning and no preparation.

The 274 people on board survived. The aircraft was destroyed. The lesson — that automation must alert crews when it is managing a developing hazard, not just when it can no longer manage it — contributed to every autopilot alerting standard that followed.

CI 006 is AF 447 without the deaths. The automation managed silently, handed over catastrophically. The lesson is identical. The outcome was luckier.