When has the automation gone too far???

[joycer_01]

G'day everyone - just doing some research for a class and I'm curious to know what people opinions are regarding the levels of automation between aircraft types. Airbus's mode of taking the pilot out of the control loop; Boeing's method of having the pilot make the final call, or MD's, with the computer having control in addition to either aural or visual systems alerting the pilots to the levels of automation. Would like to hear everyone's opinion, but especially those of you that have flown one or two of the above manufacturers comparing them with some others.

[Phoenix_X]

Airbus's mode of taking the pilot out of the control loop

What makes you say that? Since when is the pilot out of the control loop on the 'Bus?

I've flown both 737 classic and NG, and the 'Bus is better on all fronts. When does automation go too far? It's difficult to say, but I'd say it goes too far when the airline forbids it's staff to fly manually. When SOPs dictate using the automatics 100%, then it doesn't matter wether it's a Boeing, MD or Airbus; automation has gone too far.

[LEM]

I say: automation has gone too far when it removes the sensorial feedback from the loop, alienating the pilot, and also when it displays information in a "modern" way which is less instinctive because you loose the geometric picture of the round dials.
Check this (http://www.pprune.org/forums/showthread.php?s=&threadid=90889&highlight=airbus+shock) thread for more (and for some fun also!)


;)

[John Farley]

joycer_ 01

If we take your question (and ignore what you wrote afterwards) I would offer a simple answer

Automation has gone too far when it increases the accident rate.

So far automation has reduced the accident rate and increased the operational capability (poor weather ops) which appeals to most people.

However pilots are not most people, and some pilots prefer the bad old days. Please note my use of some.

Regards

JF

[Lu Zuckerman]

AUTOMATION

1) The automatic operation or control of equipment, a process, or a system.
2) The techniques and equipment used to achieve automatic operation or control.
3) The condition of being automatically controlled or operated.


Automation of the complex systems within an aircraft is great and, in this case the operative word is COMPLEX.

Assurance engineering personnel at the factory that produces the individual elements of this complex system must analyze every element within the system. These analyses determine the relative reliability of each component and if necessary how that element effects flight safety.

In some cases where an element can effect flight safety the integrating contractor will specify a failure rate of 10 9 or one failure in a billion hours of operation. When this happens the assurance engineer is forced to use very unrealistic failure rates in the process of the analysis in order to meet the design failure rate. The fact that the assurance engineer states that the part will meet the requirement or possibly exceed the requirement does not come close to the actual reliability of the part.

The integration contractor will then join these parts with wires that have their own failure rates and they will then calculate the overall reliability and by definition systems safety of the combined system

Lets say that the FAA or any other certification authority states that certain system failure rates must meet a minimum of 1 catastrophic failure in a billion hours. In order to meet this failure rate the individual parts within the system must far exceed the 10 9 failure rates. No commercial aircraft flying meets or has ever met this requirement. However if the manufacturers of the individual parts that comprise this automatic system and the integration contractor can show the certification authorities that they have met the safety requirements (showing the numbers) then the certification authorities will certify the system and the aircraft.

Automation can bite you in the ass when you least expect it.


:E :E

[John Farley]

Dear Lu

You are absolutely right from a theoretical standpoint.

But the fact is the airline industry use of automatics has turned out to be safer than your oft repeated theories would indicate. Year after year.

What does that make you think?

Regards

John

[Lu Zuckerman]

To: John Farley

It takes a heap of flying for a given fleet to accumulate 1 Billion flying hours. In the mean time systems will fail and airplanes will crash. The only thing that protects highly automated aircraft is a high level of redundancy and even with redundancy failures can occur that were never even conceived of during the analytical phase.

Several years ago two 767s lost all electrical power. Granted the 767 is not highly automated but they reflect the state of the art for those days. Another 767 was lost when a thrust reverser deployed in flight. Boeing only performed a computer analysis and determined if it happened the aircraft could be safely flown. The deployment was the result of a designer not really assessing his design for possible failure modes. As the saying goes “Sh!t happens and when it happens on a commercial airliner it draws a lot of attention.

:E :E

[Blacksheep]

Leaving the world of flight decks for a moment, consider the automation used by single-handed round-the-world sailors. From Sir Francis Chichester onwards, no sailor could have managed to circumnavigate the globe without the use of automatic self-steering gear. It was that gear which made solo circumnavigation possible in the first place, for everyone needs to sleep at least occasionally. That's not to say the self steering gear performed the feat, it simply made it possible for a human operator to manage the voyage, paying full attention to navigation and weather conditions and tending to the sails. It would seem therefore that the ideal amount of automation is that which permits the operator to direct and manage the voyage or flight to a successful conclusion.

The ideal amount of automation for an aircraft then, would enable an aircraft to automatically take-off, fly en-route, avoid bad weather and other aircraft then approach and land at its destination. The pilot's function would be to direct his whole attention to overseeing the process, intervening by adjusting the auto-flight control system settings only when necessary.

We aren't far off that capability now, but I don't see how we could go further than that. I suppose that too much automation for a passenger aircraft would be that which eliminated the human pilot altogether, but that's never going to happen, if only for psychological reasons.

[John Farley]

Dear Lu

Thanks for that. The last line of my previous post was not very helpful, so I am not surprised you have not exactly answered it!

What I should have said was that 50 years ago when the RAE boffins were looking to achieve experimental autolands their first concern was that the automatics would properly control the aircraft and achieve a standard of approach and landing that was at least as good as the best human pilot on a good day. Once they had achieved this the next issue that had to be addressed was reliability.

At that stage of history the stats showed that human pilots were causing a fatal landing accident about every six million landings. The CAA therefore said that to certificate an autoland system you must show that it will only cause a fatal accident every seven million landings.

When the boffins looked at this requirement and did the failure analysis sums that you are so familiar with, they realised they could NEVER demonstrate such a reliability unless the system was only critical for a few seconds per approach. This led to the notion that the human pilot had to be able to take over and carry out a safe overshoot (or go-around) for all except the last few seconds before touchdown. The pilots said if we are to do this at the last moment then the way the autos fail must be a simple OFF and not a hard over failure. To ensure such a benign failure the systems were made multi channel and initially voted out a bad channel when it arose. If the remaining channels could not agree subsequently then the system was disconnected (the OFF case) and the human took over.

Now we had a plan and we progressed from Varsity workhorses to the Comet 3 and the Trident .

The Trident (as I am sure you know) was certificated for autolands in fine weather only and with specially trained BEA crews. After many years of such ops with no problems the first poor weather landings were allowed, then later when even more data had been accumulated, fog landings were allowed providing there was enough RVR for the pilot to control the direction during the rollout.

So what does all that mean? It means that the failure rates of these very complex systems turned out to be less than predicted or if you prefer the estimates were on the safe side – and a good thing too.

You and I are both in our 70’s. We have both worked in the industry all our lives – you with the emphasis on the theoretical and me with the emphasis on the practical. All I would suggest to you now is that experience has shown that in practice automatic systems have been better in service that might have been expected. I know of not a single autoland crash - unlike the ILS/GCA approach crashes that happened with monotonous regularity 50 years ago.

The prediction of simple structural fatigue has a huge scatter when correlated with practice. We are used to that. I suspect it may be time to review some of the assumptions made when predicting complex auto systems failures now we have so much experience of them in service.

Regards

John

PS I can well remember the afternoon in the mid 60’s when as a safety pilot on a BLEU Comet 3 doing high crosswind autolands being amazed at how well the automatics handled the aeroplane. Every touchdown was on the centreline in exactly the correct place and that after kicking off a drift angle that was gobsmacking. I said to the crew “I can’t do that, so if the system dumps we will have to find a runway closer to the wind.” At the time I was young, switched on, very used to flying 6-8 different types each month (some of which were quite pointy) so I think my handling skills were as good as the next blokes at that time. But I knew I could not compete with those autos.

J

[karrank]

Maybe automation has gone too far when the aircraft spend the night bitching on PPROON on what their clod-hopper pilots did to them that day.:uhoh:

[john_tullamarine]

karrank ... point well-scored, sir.

[Ignition Override]

How about automation which confuses pilots about how to do a go-around, either manually or on autopilot? Let's not forget numerous incidents/accidents...

Doing a go-around at night near the mountains of Las Vegas (because Approach Control suddenly put a 737 in front of us-with no warning) is no place for confusion as to how to fly the plane. In the 757 right seat, I told the captain that we would stay only over ground lights in the valley (which also helped over ABQ, NM), in case ATC were to make a heading or altitude mistake.

From a personal viewpoint, it has possibly gone too far when a pilot does not feel like he/she is truly a pilot any more, at least some of the time on a four-hour leg. It is nice to have VNAV into LaGuardia or LAX (for that $#!^&, insane Civet Arrival). But the newer planes don't need you there much during cruise. That is one reason I looked forward to the extra challenges of flying the old technology again-and I still like it. (..being captain helps...):cool:

[S. Dumont]

I'm working on an academic research about "automation and the transition of pilots from 'classic cockpit' to 'glass cockpit'". I was wondering if you could help me with a quick question.

What was the first commercial airplane with an autopilot system? I mean in service, not just in tests.

If you could provide me some sources, It would be even better.

Thanks a lot.

[Avman]

Whilst it can be argued that automation increases safety, it also compromises safety to a larger degree when it is temporarily not available (due to failure or maintenance). The Uberlingen mid-air will for me always serve as a primary example of this. We are becoming over reliant on automation and our 'manual' skills are rapidly eroding.

[Hudson]

Re automation complacency. In the 737 simulator an experienced (11,000 hours on type claimed) pilot was radar vectored to a locator holding pattern for a sector entry into an ILS. Full use of automatics took place. Outbound in the pattern, the instructor asked the pilot to disconnect the autopilot and auto throttle in order to demonstrate basic handling competency.

The FD remained on. The pilot requested the OK to delay disconnecting the auto-pilot for a little while longer. Permission granted.

One minute later when turning inbound in the pattern the instructor repeated his request that the pilot demonstrate hand flying albeit with the FD on. Maybe he spoke too quietly. The pilot pretended not to hear. Request repeated by the instructor who by now smelt a rat. No response from pilot-under-test who hung grimly on to LNav and all automatics.

Instructor got the message, and asked the PNF to disconnect the autopilot, auto throttles and now the FD. Simple raw data. PNF, embarrassed, did as instructed, announcing each disconnect action to PF.

Within seconds the altitude wobbled up and down plus or minus 200 feet and instead of tracking to the locator which signified the GS intercept point, the pilot seemed to lose situational awareness and bypassed the locator with full localiser deflection.

Eventually the ILS was flown in a fashion, but was never stable. With the runway lights and VASIS coming into view with 4 kms visibility set in the simulator, the pilot looked up and then began almost frantic over-controlling on the ailerons.

A GA was made and he allowed the aircraft to pitch up to 30 degrees body angle and increasing before the freeze button was used in mercy.

Automation is a wonderful thing, but not if you allow basic instrument flying skills to erode to a degree that hand flying becomes dangerous.

[NickLappos]

Great discussion, guys, but the basic question is assuming the answer. Automation means taking the same job and doing it without direct human intervention. That is not what we should seek for our machines. We should want the basic tasks changed to help us do the real job - safe transport.

Illustration 1: Old fashioned elevator, needed a person (white gloves optional) to guide the machine manually to each floor by aligning marks. Opened inner and outer doors in sequence, all manual. Today we use a button wielded by an untrained person and all the action takes place inside a computer.

Illustration 2: Trolley moves people at an airport, no person involved in any way. A perfect single degree of freedom autopilot used in public transport.

The important thing, I think, is to ask yourself the question "What are the tools I need to do the job safely and efficiently" and press on. Blacksheep has it right, look for the gear that does the job, and if necessary, change the job.

BTW, nobody asks the simple question, "What makes what we now do so wonderful?" A glance at accident causes tells us we are the biggest contributor to the accident rate!

Why should a 737 need constant attention to keep on path? Why is the control scheme that the Wright bros developed the best way to control an air vehicle? For helos, we have developed velocity controllers that basically do all the attitude control, and simply go to the heading, speed and altitude selected by the pilot. They are stable, and their sensors provide 10e9 reliability, about the same as the control tubes on a 737.

[Lu Zuckerman]

They are stable, and their sensors provide 10e9 reliability, about the same as the control tubes on a 737.

10e9 reliability can only be achieved on paper and can never be demonstrated.

The basic reliability of an individual component in the electronic system (or any other type of system) is derived by selecting numbers taken from an Air Force database which are then manipulated by multiplying that number by other numbers that represent the environment that the unit will operate in. This assumed reliability is then manipulated by placing the individual units and multiplying the assumed reliabilities of the individual units in the string. If the unit contains built in redundancy there is a formula to calculate the reliability of the unit but this number is based on the numbers in the Air Force database which may or may not be truly representative of the parts that make up the actual component.

Once this number is derived it is cast in concrete that is until the manufacturer has to show reliability growth and to do this he mainly selects better numbers from the database. In rare cases testing and development achieve this reliability growth but as I said it is rare.

The component and its' numbers are then given to the airframe manufacturer who will then calculate the reliability of the system to include the wires, connectors, terminal strips and everything that goes into the system. He uses numbers for the wires and the other components that are taken from another Air Force database that in almost every case are not representative of the actual elements in the system. In order to show the best reliability the airframe manufacturer will select the best numbers. If he has to show reliability growth and has used the best numbers available he is allowed to show growth by the use of engineering judgement, which is totally acceptable.

Once the system reliability has been calculated the airframe manufacturer will calculate the safety of the individual systems and then feed these calculations into a fault tree representative of the entire aircraft.

In calculating the safety of both the systems and the entire aircraft they manipulate the numbers which may not be representative by the use of Boolean algebra to calculate the overall safety.

The FAA stipulates That the death of a passenger or loss of the aircraft can occur no more frequently than 1 10e9. This is at the system level not the aircraft level. In almost every case the manufacturer can show that he can give even better numbers than required. I worked on one program where the airframe manufacturer showed his safety calculation was 1 10e18.

The key to this is the fact that the airframe manufacturer is not required to show the safety of the aircraft. If they took the collective systems and their individual safety numbers and multiplied them using the same Boolean algebra the overall safety of the aircraft would be about 1 10e7 which is slightly better than the safety demonstrated by the collective commercial aircraft fleets.

What I am about to say is representative of what went on in the past. In the specification for the Apache the Army required a total safety level of one hull loss with loss of crew every 34,000 hours of operation.

This had to be demonstrated or bettered on paper using the exact same calculation methods and numbers and the same databases used in the calculation of the safety of commercial aircraft. Eighteen months later the manufacturer had to show reliability growth. He did this by selecting better numberss and he had not changed the design.

In real life the figure 1 10e9 is a myth and only exists on paper and in the minds of the certification authorities.

By the way a control tube in a 737 would be calculated from the Air Force database using the following number 4.7237 10e6. This number is from some unknown source that is listed as ground mobile possibly a truck. This number must then be manipulated first to transpose it from ground mobile to aircraft. This number must then be further manipulated to show if it is located in a pressurized temperature controlled installation or in a wing where it is non pressurized and exposed to the ambient temperature environment. At the very best the reliability of a control tube would be 10e7 or by some stretch of the imagination 1 10e8.
.
In short they have changed black into white and this is totally acceptable by the certification authorities and the US Military. The UK uses Def Stan. 00-41 which is taken directly from the US Military documents so, they do it the same way.


:E :E