Can automated systems deal with unique events?

[Ian W]

An interesting discussion.
There are three main approaches to automation in the presence of humans.

1. Human in the loop
2. Human On the loop
3. Human out of the loop

Human in the loop
In this level of automation there is decision support to the human, and there may be support like flight control augmentation auto-stabs etc, but the human is 'flying' the aircraft.


Human on the loop
In this level of automation the human does not fly the aircraft directly but informs the automation what is required and the automation then implements that requirement



Human out of the loop
Full autonomous operation where the human may be able to intervene but without intervention the aircraft will fly as the automation wants.


Note that these states may exist in different phases of a single flight. Hands on control initially (human in the loop) then giving the aircraft to the FMS (human on the loop) then a CATIIIb autoland (human out of the loop)



The problems occur when a pilot who has rarely been 'in the loop' and has spent the last hundred or more flights out of the loop with occasional on the loop inputs, is required to jump into the loop and take control.



Failure Modes and Exception Handling
It is unfair to blame pilots for more errors, as they usually have had to pick up the pieces when the automation 'fails'. However, why does the automation fail? It is unfair on the automation to say it has 'failed' it actually behaved as designed. It is very costly to program for the 'otherwise' cases. These are the ones that fall outside the design conditions and so after checking for all reasons the programmer/system designer has something else to identify. But these are rare more complex faults and more expensive to program for. It is easier, knowing a pilot is there, to have the automation hand the bag of bolts to the pilot with a 'get out of that' ECAM message. Or to put it another way, the software design relies on the pilot being there so it does not have to cope with complex or rare failure modes. Passing the bag of bolts over to the pilot is a design feature that saves time and energy for the systems builders.


Certification Costs and Validation Testing
It is perfectly possible to program learning software, software that will share its learning, fully capable of dealing with aircraft damage way beyond
the worst nightmares of a QANTAS 380 uncontained engine failure. There are military aircraft flying with adaptive software that can correct for loss of control surfaces for example, and the software works so well that it is not easy for the pilot to realize that there is something wrong. So that's fine let's put it on the next Boeing 797 or Airbus 390.....?


Well no Certification Costs for complex tests for variable response and learning software are extreme, that is if anyone from the certification bodies could be found to agree the tests. As by definition the learning software will have a different response each time this is an anathema to certification testing and raises all sorts of flags in regression testing. Civil systems just cannot cope with the potential risks involved.



Sensors and Sullenberger
There are already systems that spend all their time doing what every good pilot should do - but hugely faster - identifying where the automated (usually unmanned) aircraft will put down given a list of potential effects from problems caused by an automated failure mode analysis. Again, certification of these is prohibitive even when compared with the cost of a lifetime employment of first officers especially in time. This is because the mathematicians managed to convince TPTB that every statement in 'safety critical software' needed to be mathematically proved. This is infeasible in a real time network of sub-systems all capable of pre-empting each other.





So do I believe that there will be fully automated passenger carrying aircraft yes absolutely, we have some flying already where they are 'optionally piloted' and can recover autonomously if the command link fails. Do I believe that there will be fully automated passenger carrying civil aircraft? Only over the dead bodies of an entire generation of 'safety engineers' who have set standardization safety tests that such autonomous aircraft cannot ever meet because they work differently to current crewed aircraft. I am even uncertain whether the single pilot crew will ever pass safety certification requirements.



So the military will have these systems probably for decades before a new generation of safety engineers perhaps with a more sophisticated approach allows them for civil aviation. I won't hold my breath.