Computers need to know what they are doing

[Derfred]

That's why they should get to work on it right away

Who said they aren't?

[Radu Poenaru]

Ok, sorry but reading that sentence over and over again is killing me inside:

Real time simulation means 1 sec computer simulation = 1 sec real-time.
You are not predicting any future, you are simulating as time goes along : https://en.wikipedia.org/wiki/Real-time_simulation

(... bunch of other rants and censored screaming ... )

Ok, that's better, I can go to sleep now.

[em3ry]

Not anything new? Then why didn't the computer warn the pilot that he had forgotten to give it thrust when he was attempting that go around?

[em3ry]

I guess on the fly would have been better than in real time. Actually I thought they were synonymous. I guess I was wrong.

[cattletruck]

Computers need to know what they are doing.

WRONG!

Pilots need to know what the computer is doing.

Otherwise switch it orf.

Yes, it really is that simple.

[Volume]

all I said was computers can be made smarter and that doing so would have prevented some of the recent accidents

You will never be able to make a computer smart. You can enlarge the database a computer is working with, you can optimize algorithms, you can monitor more parameters, and yes, you can prevent some accidents that way. But by relying more on computers, you will also see additional accidents.
Let the computers do what they can do best, and allow pilots to switch them off when the "assistance" they offer does in fact not help.

If it takes an automotive company 5 years to develop and certify a lane-warning system on a car, you can bet it would take 15 years to do something similar on an aircraft.

In fact it took an automotive company to develop 50 years to make a car do what a Trident already was able to do. Get to your destination. Automatic. Even in fog so dense, no sensor can see the road markings.
The reliability of some of the modern car equipment is simply ridiculius compared to some 20 year old aircraft equipment. Autopilots crashing into turning trucks, satnav systems showing a ferry as a bridge, automatic wipers wiping in the bright sunshine, lane warning systems that want you to stay with the white marks in a construction site... It will take them at least another 15 years to reach aircraft reliability standards

[em3ry]

Originally Posted by Volume

Let the computers do what they can do best, and allow pilots to switch them off when the "assistance" they offer does in fact not help.

Isnt that exactly what I just said?

[em3ry]

Sure let's just make all the pilots omniscient and infallible and that will solve all the problems. Good luck with that

[Ian W]

Originally Posted by em3ry

not to beat a dead horse but that's exactly why they need to know what they are doing and that's why it needs to be able to run a simulation in real time with current conditions and look ahead to see what is going to happen so it can take the appropriate action.

Computers do what their manufacturers designed them to do. That is not a limit on computing that is a limit on what the manufacturer thought they could sell. There would be immediate pushback from the community here if someone gave the FMC more intelligence and reduced the role of the pilot. Similarly, to make the computer do more costs more and may initially be non-economic. Those limitations are rapidly disappearing.

Computers can do multiple simulations and select the optimal compared to the system optimization goals. Several years ago I saw just that kind of approach to sequencing traffic into a busy airport with multiple runways and all the WTC rules. With an hour of sequencing modeled in less than a second.

It is commercial pressure and risk that are the limits, not computing power or capability. There are multiple fast time simulations on the market that effectively 'fly' every aircraft in a center's airspace in accordance with their performance, fly them on routes and procedures, land them at destination and taxi them in then out for takeoff while at the same time sequencing and deconflicting for efficient use of the runways and taxiways and the airspace route structure. They will do that simulation in fast time with several hours traffic taking seconds on a relatively standard PC. They do that because that is what they were designed to do.

The FMC's that go into degraded mode and hand control to the pilot on some events, do that because that was what they were designed to do, not because they cannot cope with those events. It is just cheaper and (supposedly) less risk to use the flight crew rather than write handlers for exceptions.

[Derfred]

Em3ry,

The discussion of the man-machine interface on airliners is an interesting one, but is not a new one. There are threads on this topic on this forum dating back forever.

You have added nothing of interest to this topic. You read an article about Google Cars. Fascinating. Do you have anything else interesting to say?

The general etiquette for posting on forums is to provide something of value to the readers, rather than yourself.

Out.

[em3ry]

The topic is about running a simulation on the fly in order to see what is about to happen.

[pax britanica]

Couple of points
An airliner doesn't need a pilot it needs a crew , Ok one is in overall charge and normally has more experience but they swap the handling and monitoring roles.

We all know that when computers get confused they just stop - no good having 'Err 404' or 'no internet connection' at 200ft on finals is it.

Someone used the financial trading analogy but that is a cowboy industry as we have now all learned and using the computers like they do and the disasters caused we would be seeing a tens of thousands of people killed every ten years or so when the computers on airliners ran into the depression/panic selling modes the markets do.

At the end of the day i don't think even the most ardent lo cost at any price /fly to an airport 100Km from your destination at 0300/ Buy crap food on board and lotto tickets/ have no customer service at all / passenger will ever get on a plane with no windows up front and no living breathing forms behind each one.

However with automation confusion being a big cause of accidents these days it would seem training needs some revision , engine out at V1 was a regular occurence on pistons and still quite frequent on 707 era jets but today?????

[The Flying Pram]

You can program a computer for every conceivable problem, and combination thereof. Then a problem occurs that no-one conceived of and the computer has no answer, what then? You need a human with the experience to solve the problem there and then

The Sioux City, Iowa DC10? As I remember it McDonnell Douglas never envisaged all 5 hydraulic systems failing.

And the computer to fail safe and help out when required

I dare say Sully was grateful for that aspect when gliding down to the Hudson.

It goes to show there are good reasons for having both computers AND pilots on an airliner, but I would like the pilot to have the final say.

[Ian W]

Originally Posted by em3ry

The topic is about running a simulation on the fly in order to see what is about to happen.

Unfortunately, that is not how simulations work.
All simulations can do is simulate the possibilities that the simulation script writer thinks may happen. Types of simulation vary so some are relatively deterministic, some are stochastic but the possibilities of what may happen have already been thought of by the simulation designer. This is the same as the basic FMC issue, the software analyst/designer has to think of all possible cases then decide which to give to the crew and any unexpected cases (the otherwise cases) are automatically given to the crew.

A simulation can only play the probability game with things that are already expected so by definition it cannot simulate the unexpected. That is why the pilots are still in the cockpit.

At system design time all the variables that are possible all the boundary cases and all the time related issues are all simulated as a means of verifying and validating the system. The results of those tests using simulation run inputs are then used to correct any shortcomings in the systems being tested. But it is not possible to think of every potential eventuality and every possible mix of unrelated circumstances there are simply far too many variables. That is at _testing_ phase before the system is even in final development.

There is no way that the airborne systems can run simulations varying every possible input and initialization state in real time. Not only that but by definition this is being done to deal with the unexpected unknown - if it is unexpected and unknown it is not going to be part of the simulation. The other problem is that the FMCs because of a rather old fashioned view of computer safety are required to be mathematically proven as correct. So chips, microcode, firmware, software all has to be mathematically modeled and proven correct using maths. This is a somewhat 1980's concept but still limits the hardware that can be used by FMCs to the extent that current generation multi-core chips with predictive fetch and preemption cannot be used as there is no mathematical proof that can cope with infinite levels of preemption in the chip operation. In consequence there is more power in some watches than there is in advanced FMCs. In my view this is not the correct way to go in the same way that the OSI/ISO communications model is no longer seen as the way to go for reliable and safe communications. Nevertheless, the current FMCs are beasts of very little brain and very constrained in what they are allowed to do.

So in summary. Simulation can only simulate what is expected, if it is expected it is not a problem. FMCs do not have the grunt or the safety clearance do do anything other than a very constrained set of processing due to certification rules and limitations that are around 40 years old. (I am sure someone here will correct me )

Google and others have a real advantage with driverless cars as they do not (yet) have the dead weight of bureaucratic certification rules rooted in the past. Even there, they are unlikely to be running simulations of what might happen.

[em3ry]

The whole point of a simulation is to find things that you wouldn't expect

As for there being too many possibilities well as I said earlier how many possibilities are there in a chess game? Yet computers play chess just fine. And unlike a chess game you know the exact ideal route that you would like to take.

[Ian W]

Imagine a chess game where there was suddenly a new type of piece on the board with different moves but you don't know anything about it. Now simulate its effects.
That is what you are asking for.
Chess is extremely easy to simulate every piece has a constrained method of movement only one at a time so there may be a huge number of potential variations so it is a large problem but they are all KNOWN. Making the right decision is then a case of comparing many simple and forecastable moves. That is nothing like the difficulty of simulating the complexities of an aircraft in flight in real time.

Your idea will not work until you find a way of adding one or more things into a simulation that you don't know about yet - not at all - not in any way.

[BleedingAir]

I'm thinking we've got a subtle troll here, I'd let it go.

[Tourist]

Originally Posted by The Flying Pram

The Sioux City, Iowa DC10? As I remember it McDonnell Douglas never envisaged all 5 hydraulic systems failing.

You use Sioux city as an example of where you need a human, however the reality is that actually it is an area where computers excel.

This from Scientific American


July 26, 2004

Crippled but Not Crashed

Neural networks can help pilots land damaged planes

By Mike Corder

On July 19, 1989, as United Airlines flight 232 cruised over Iowa, the fan disk of the tail engine on the DC-10 broke apart, and the debris cut through all three of the plane's hydraulic lines. Because the pilots could not move any of the jet's control surfaces--the ailerons on the wings and the elevators and rudder on the tail--a horrific crash seemed inevitable. But by carefully adjusting power to the two remaining engines, the crew managed to maneuver the plane to the Sioux City airport. Although the jet flipped over and caught fire after hitting the runway, 184 of the 296 passengers and crew members survived.

The pilots of flight 232 proved that it was possible to control a modern airliner using only the engines. And this discovery led some innovative engineers to wonder if they could program flight computers to achieve the same feat, making it easier for a crew to safely land a heavily damaged aircraft. This research has been gradually progressing over the past 15 years, and the technology could be incorporated into commercial and military planes in the not too distant future. To judge how well these computer-controlled flight systems perform, I decided to see if they could enable a moderately experienced pilot like myself to fly a crippled jet.

But first, a little background. On early aircraft, the control stick and rudder pedals were directly connected to the control surfaces with wires or rods or cables. But as planes got faster and larger, pilots found it hard to move the stick. So engineers added "power steering," connecting the cables to hydraulic servos that amplify the pilot's efforts. Then, with the advent of the digital age, aircraft makers developed control systems that feed the input from pilots into a computer. This so-called fly-by-wire system can greatly improve an airplane's performance. For example, a fighter jet may fly well when lightly loaded but not so well when it carries bombs on its wings. With a computer in the loop, the control rules can be modified to make the plane behave more consistently. Fly-by-wire also allows the creation of safeguards: if a pilot tries to do something that would cause the aircraft to break apart or plummet to the ground, the computer can ignore the inputs and take the plane only to the edge of the flight envelope.

Shortly after the crash of flight 232, Frank W. (Bill) Burcham, Jr., then chief propulsion engineer at the NASA Dryden Flight Research Center in Edwards, Calif., began an effort to develop software that would enable jet engines to compensate for damage to a plane's control surfaces. Initially the research was considered too far-out to be funded, but a few engineers at Dryden volunteered their spare time. The project, which became known as Propulsion Controlled Aircraft (PCA), eventually received a small budget and proceeded to flight tests with an MD-11 jet. On August 29, 1995, the PCA team brought the plane in for a smooth landing at Edwards Air Force Base using only the computer-controlled engines to maneuver the craft. The NASA engineers felt they had demonstrated that airliner safety could be significantly enhanced just by modifying a plane's software. Unfortunately, none of the aircraft manufacturers chose to adopt the technology.

A few years later researchers in the Intelligent Flight Control (IFC) group at the NASA Ames Research Center in Mountain View, Calif., followed up on the PCA work by developing a system that would allow the computer-controlled engines of a damaged aircraft to work together with any control surfaces that remain functional. The system is based on neural-network software, which mimics the behavior of the human brain by learning from experience--the network's connections strengthen with use and weaken with disuse. The neural networks in the IFC system compare the way the plane should be flying with the way it actually is flying. Differences may be caused by inaccuracies in the reference model, normal wear and tear on the plane, or damage to the aircraft's physical structure. The networks monitor these differences and attempt to minimize them.

For example, if you want to make an undamaged airplane climb, you pull back on the control stick, which raises the elevators. But if the elevators are not working, the IFC system will raise both ailerons to lift the airplane's nose. (Ailerons typically move asymmetrically, with one rising as the other falls.) If this maneuver does not correct the error or if it reaches the limits imposed to prevent the aircraft from rolling over, the IFC system uses the thrust of the engines to achieve the desired pitch.

The Ames researchers tested their system by inviting professional airline pilots and NASA test pilots to fly in the lab's simulator. First, the pilots operated the simulated aircraft under normal conditions. Then the researchers mimicked a variety of failures and observed how the pilots reacted using different types of control systems. In almost every case, the IFC system performed better than a conventional fly-by-wire control system. When the engineers simulated the failure of all tail controls, only half the pilots could safely land the plane using the fly-by-wire system, but all of them made it back to the runway using IFC.

So what's it like to fly a plane equipped with neural networks? At the invitation of Karen Gundy-Burlet, head of the IFC group, I recently spent several hours in its lab to see the system firsthand. I am a private pilot with no experience flying larger aircraft. The IFC simulator was set up to represent a very big plane: the U.S. Air Force's four-engine C-17 transport jet. The simulator features a large wraparound screen to show the animated landscape and a mockup of a glass cockpit, which replaces the traditional flight gauges with flat-panel color displays.

Gundy-Burlet set me up on a 12-mile final approach to the San Francisco airport and let me embarrass myself trying to get an undamaged plane to the ground. Don Bryant, a retired U.S. Navy fighter pilot who works with the IFC group, was polite enough not to openly laugh at my ham-handed attempts to control the craft. My biggest problem was my unfamiliarity with the glass cockpit, which is only now starting to appear in private planes. I spent more time staring at the simulated display trying to find familiar values such as airspeed and altitude than I did actually flying the aircraft. That said, I got a basic feel for how the undamaged plane flew.

Then Gundy-Burlet reset the simulator to the initial location and said, "Captain, I'm sorry, but you've lost all the control surfaces on the tail." Both the elevators and rudders were inoperative, which would probably be a death sentence for an amateur pilot in the real world. But I was pleasantly surprised to find that the simulated aircraft was pretty controllable. I made a few gentle turns to get a feel for the plane while also trying to stay on the right heading. The damaged jet was sluggish in roll and pitch, but its behavior seemed more natural once I slowed down my steering. This change was undoubtedly facilitated by the neural networks, which were training themselves to compensate for the damage. As the networks adjusted to the new conditions, the plane kept getting easier to fly. Within a few minutes, I was able to safely land the simulated craft, although it did stray from the runway.

The overall experience was fairly tame, almost ordinary. It was only later that I recognized the true magnitude of this advance. A private pilot who had never flown a large aircraft was able to land a heavily damaged four-engine jet without killing anybody (in a simulation, at least).

How quickly might this technology see actual use? NASA researchers plan to flight-test the IFC system on F-15 fighter jets and C-17 transport craft over the next two years. The earliest adopters will most likely be the makers of military aircraft. Damage-compensating flight controls should be particularly useful to pilots who fly aircraft that get shot at from time to time.


Mike Corder is a freelance writer in Santa Cruz, Calif., who is building a Van's Aircraft RV-7A plane in his spare time.

[em3ry]

What do you mean it won't work? All I'm saying is that there is a way to make computers much smarter.

No it will not be omniscient. No it will not be infallible. No it will not replace the pilot. But it will be much smarter.

Anybody that thinks that smarter computers is a bad thing has rocks in their head.

A smarter computer would have prevented several of the recent crashes

[DozyWannabe]

Hullo all, just thought I'd stop by...

I'm seeing a fair bit of misunderstanding as to the status quo (and possible future) of aviation/computer interaction, so figured I'd weigh in briefly:

To start with, it's a fallacy to conflate the concept of FBW with that of autoflight (FMC/FMS) - they serve separate purposes and are engineered very differently.

Originally Posted by Goldenrivett

Very true [re:computers only dealing with programmed scenarios]
...the simultaneous actions of both crew members on the sidesticks, not considered in the design...

From a purely technological point of view, following this accident Airbus modified the ELAC software's "AoA Protection" activation logic to take into account turbulent conditions. As the report says :

With these modifications the protection level is maintained against dynamically aggressive manoeuvres made by the pilot, but the premature activation of the AoA protection triggered by wind gusts is inhibited, and a de-activation in flight at low height under less stringent conditions is allowed.

The report itself is fairly thorough, but doesn't seem to question the crew's actions in terms of continuing an approach despite weather conditions being considerably worse than they were expecting. Those conditions, along with both crew pulling hard on the sidesticks (a no-no as far as handling training is concerned) created what some engineers call an "edge case", where a very specific set of circumstances defeats the design. That it took some 13 years for that edge case to be found implies that the design and implementation was pretty damned thorough.

Airbus FBY Normal Law computers don't allow the pilot to over ride them.
(B777 & B787 FBY computers do permit the pilot to over ride them)

This gets brought up a lot, but as far as the above accident is concerned it's a bit of a tangent. Yes, the conditions and crew actions defeated the logic - but on finals at 60ft RA in windshear conditions, being able to override the AoA protection wouldn't make any material difference to the outcome. Also, in the 30 years the B777 has been around there has only been a single known incident where overriding the flight control computers could have been appropriate (Malaysian B777 9M-MRG over Perth, Australia; a dodgy accelerometer feeding the ADIRU caused an in-flight upset), but for whatever reason the crew did not do so.

Originally Posted by pax britanica

We all know that when computers get confused they just stop - no good having 'Err 404' or 'no internet connection' at 200ft on finals is it.

Real-time, fault-tolerant software engineering is an entirely different kettle of fish from the processes used making the software in the machines we use from day-to-day. Safety-critical embedded systems also tend to use obsolete/proven hardware precisely because it is a known and predictable quantity.

As far as the OP goes; sorry em3ry, but you're a bit off in some of your assumptions as far as I can tell. For starters, that Google patent you linked to is clearly linked to their "self-driving car" efforts. Now, a car's behaviour is relatively simple to model and control - applying/reducing power or braking, steering in a given direction etc. results in a near-instant change of trajectory and closure rate. A fixed-wing aircraft is a massively different proposition because it's ability to manoeuvre is reliant on a far more complex form of energy management. For example, if an autonomous car wants to avoid an obstacle, a combination of acceleration, braking and steering can be applied to quickly remedy the situation. An aircraft responds much more slowly - and additionally it needs to have enough airspeed to stay aloft, but cannot exceed a certain airspeed without risking structural damage - an avoiding manoeuvre first requires that there is sufficient energy to pull it off, and there is (particularly with jet engines) a significant lag between applying power and that power translating into useful energy. This lag massively increases the amount of "look-ahead" any simulation must perform, which in turn exponentially increases the number of variables that simulation must take into account. Multiply that by the number of scenarios it has to model and there simply isn't a feasible way to implement it practically and cost-effectively using state-of-the-art hardware, let alone the obsolete and proven hardware required for aviation certification purposes.

Originally Posted by em3ry

A smarter computer would have prevented several of the recent crashes

Which ones, and how so?