Modern aircraft are, mostly, not designed to be flyable/flown without pilots. Therefore they're designed to hand control back extremely readily and designed with minimal contingencies for what to do in the event that something does go wrong - this was really obvious with MCAS where Boeing's assumption was simply "the pilots will see the runway stabiliser and handle everything". It's also what happened with AF447: the plane knew there were irregularities in some of the air data so dropped protections, but knew it was stalled. If it had been designed with more redundancy and better handling of sensor failures so that it never left normal law, it would have easily recovered from stall (and not stalled in the first place). The plane didn't communicate that well to or between the pilots but the pilots (especially FO) certainly didn't handle having control thrown at them either...

Continued acceptance of FMS fuel predictions during fault conditions (especially gear stuck down) is similar. There's no reason the full tables from the FCOM can't be programmed into them, let alone actively learning from measured fuel burn vs energy state (i.e. accounting for climb rate and acceleration). This has been a known issue for near 30 years causing a couple of forced landings.

Counting every autopilot disconnect as a time the pilots 'saved' the plane is a bit like counting every time a smoke detector goes off as a time your house otherwise would have burnt down. If it was designed to be unoccupied, it would be designed differently.

Classic 'no true Scotsman'. No properly trained pilot should need GPWS, gear warnings, or checklists either, right?

I'd argue virtually all of that can be handled by beefed-up Dispatch, ATC, or other ground staff, with onboard cabin crew/unruly pax/medical decisions mostly made by the Purser. Many of those already are. You also have much better access to information and coordination if you have weather radar and accurate turbulence reports from all aircraft, not just the one you're in plus what you get via voice radio.

Is it any more predictable with human pilots? Planes have crashed for far, far fewer distractions.

Flight control computers don't negotiate with/take orders from terrorists, don't lose consciousness from depressurisation if they don't don a mask in time, and don't get distracted causing them to run out of fuel or roll over while troubleshooting a minor fault. Pilots have done all of the above leading to mostly mass casualties.

The case of Air France is an indication that when you have too much automations and you end up with pilots with serious lack of basic flying skills. We don’t need more redundancy but more pilot training on hand skills. If they only maintained their pitch and thrust nobody would have heard of AF447. Only that would have saved everybody on board. Same goes for the Turkish Airlines 1951, if they were flying with No Auto throttle or properly trained to monitor their PFD, speed/engine parameters they would certainly not have crashed. Asiana flight 214 same thing. I can think of many cases like these were the use of automation and/or malfunction instead of handlfying ended in a disaster or upset situation. I love the automation on A320 and in my opinion we don’t need more than that. But we definitely need more basic training cause many pilots don’t remember the basic pitch and thrust anymore.

But is that basic skills or basic theoretical knowledge?

AF447: every pilot should know that at high altitude, 20° pitch up is unsustainable. It is even unsustainable at lower levels. That is basic aircraft performance.

But on the topic of pilot skill: the military fighter flying his "relaxed static stability" F-16 knows he can't fly without computers so he has to bail out and that is expected safe behaviour in the military.

That same process of thought for AF447: if the pilots had let go of all controls, closed their eyes and didn't touch anything at all, the aircraft would have recovered. That's what I mean with "1 error for automation is used justify 100 human errors". The pilot thinking his skills will solve the situation is becoming a danger. That FBW did not make the aircraft unstable. It's easy to blame automation, however it is the pilot action that crashed a perfectly safe and stable aircraft. He didn't need to know pitch & power, he needed to NOT do anything.

With good application of automation, the aircraft only becomes a very basic easy to fly stripped down version of what it was before and the "targets" for the pilot become very easy stripped down (and this is ie where Boeing missed things when it came to MCAS).

we should not be chasing certainty; we should be chasing not knowing
 

In this type of discussion the tendency is to simplify complex situations and reduce the many interacting contributions to 'either / or' choices. In addition, events or aspects of accidents are selectively chosen to fit the argument.

AF447 is a widely used example, where debate fails to consider why in the 20 or so preceding events all of these aircraft landed safely. They were reported as unwanted incidents, but not investigated to determine aspects of success.

Aircraft have design and certification requirements; there are none for humans. The industry relies on judgement to calibrate human performance and limitations. This aspect often contributes to accidents, but is overlooked or hidden under 'training', without consideration of the situation at the time and how naturally variable humans might have interpreted this.

The world and our industry is increasingly complex, which implies greater difficulty in identify rare challenging situations. We forget that issues which we are unable to foresee can neither be trained for or automated.

Humans abhor uncertainty, but as R Feynman noted "we should not be chasing certainty; we should be chasing not knowing."

I would suggest that any future cockpit design that eliminates certainly 1, if not 2 pilots, will have a satellite link back to airline HQ where a desk pilot can take over and fly the plane. This would cover a lot of the failure cases people are suggesting dooms the project.

Obviously this brings up issues of it's own, such as the reliability of the link and the alertness/current skills of the desk pilot, but the advantages far outweigh the disadvantages.

Take AF447, I would say a desk pilot, or better yet 2 or 3 looking over somebody's shoulder, would have spotted what was happening.

What we don’t want in any aircraft is the pilot at the controls lacking either the knowledge of how the auto pilot works “What’s it doing now? What’s it supposed to do next?” Or, more importantly “What action am I going to take if it doesn’t do that? Do I have the basic hands, feet skills and aircraft system knowledge to take control and manually fly this aircraft safely? Am I confident enough not to freeze on the controls in fear and slack jawed wonder as, by my inaction, I proceed to endanger all aboard?”

The big question is how do we achieve that goal.

A variation of the automation discussion is ground based aviation equipment. In recurrent a minimum fuel scenario was discussed, non augmented ASOS reported clear skies when in reality it was a broken deck at about seven hundred feet with good visibility beneath. The clouds happened to avoid detection by the limits of the sensor capabilities. Flight running late, Captain decided to try the visual approach to save some time assuming clear skies and good visibility. A lot of moving parts, too many to add here but after passing up an approach transition and making it to the airport with no luck of sighting it, they ended up backtracking
to the transition and flew the full procedure. Due to a long taxi at the departure airport and flying lower than filed,they landed min fuel, close to emergency fuel. Poor decision making coupled with limits to the automated weather reporting landed the crew in the CP's office for a discussion they didn't want to have.

I think a ground-based 'emergency' control station is necessary, but I don't think a 100%-time human monitor would be necessary or useful. Having a mix of local and remote pilots sounds like a CRM nightmare to me.

Computers are good at working out when something is exceeding normal limits, if they're set up to do that. We saw that with AF447; the aircraft recognised it had lost airspeed data, threw alarms, and threw a bunch of protections out the window. I'm not sure a modern airliner has ever crashed in a way that pilot input could have prevented the crash, but EGPWS/other warnings didn't go off before the crash was unavoidable, excluding situations like runway overruns/bad flares where there is no significant reaction time.

Handing over control to a ~5-person 'situation room' when the computers believe something is seriously wrong would be my preference (discussed way upthread, this also mitigates many security concerns). There is no reason to have 1:1 remote monitoring during cruise, and probably climb/descent too. I could see an argument for takeoff/landing when reaction times need to be quicker.

Having more automation does not necessarily mean you need to use it all the time.

Imagine we classify flight automation into three groups:

1. Critical for continued flight; if this fails you're probably falling out of the sky, miracle pilots or not, and needs to be redundant/reliable enough for that duty, e.g.:
   1. Engine internals i.e. FADEC etc.
   2. At least some instruments
   3. Some kind of connection between the sidestick/yoke and the flight control surfaces (including mechanical backup, backup flight computers etc.)
   4. Hydraulics/electrics necessary for the above
2. Always-active automation that's not switched off unless it fails or you're in flight test, but isn't critical for flight e.g.:
   1. Normal law stuff
   2. TCAS
   3. Flap overspeed protection
   4. Stick shaker/pusher
   5. Electric trim
   6. Fuel management
3. Nice-to-have or workload reduction stuff:
   1. A/P
   2. A/T
   3. Auto-trim
   4. Moving-map taxi

It seems to me the issue isn't the amount of automation in total. It's stuff being moved from group 3 to group 2 so that pilots aren't used to the aircraft without it, but it's not reliable enough to be in group 1 so they have to be able to fly the aircraft without it.

This is my view/concern too. There's a lot of situations where operators fail to understand what the machine is doing and react instinctively, taking far more severe actions when little or nothing is necessary, worsening the situation. Not unlike pilot-induced oscillations. Or shutting down the wrong engine. Having a 'disable all automation' button as a first response (or at all) risks worsening issues because you've now disabled useful automation. A high-reliability straight-and-level-only autopilot could be very useful in many failure scenarios.

As automation gets better, the number of situations where it's necessary to intervene against the automation will of course reduce. Even if we stick with the existing level of automation and do nothing but bug-fix and improve reliability.

The number of situations where pilots intervene but didn't need to will remain much the same.

The ratio of the latter to the former will increase without limit. Classic false-positive vs false-negative situation.

Plagiarised text and adaptation from a parallel forum; although the original considered another issue, the points apply equally to 'automation', and current thinking.

"The problem isn’t automation. The problem is how we designed the problem, how we think.
We’ve engineered systems that overvalue efficiency and undervalue understanding.
We obsess over automation, and reducing headcount, and call it progress.

But we’re only solving symptoms, not the underlying causes.
Change is human. So is ambition. So is talent. But we’ve distorted talent, over-promoted competence into incompetence, and treat complexity as something to eliminate rather than understand.

With more automation we double down: "People are the problem, so let's remove them." Our thinking is using linear logic in a nonlinear world.
Automation won’t fix poor leadership, won’t rescue broken thinking, and no tech will ever substitute for clarity, context, and human connection.
The trap? We can't even define "talent" in a way that respects human variability and sensitivity to change.
The threat? We keep reacting to perception shifts (the last accident), not the deeper design flaw, within - industry, regulation, aircraft, operator, … individual.
Until we fix the (thinking) lens we look through, every solution no matter how advanced will just speed up our drift."

Automation or Human; or Automation and Human and all other interactions in complex operations.

https://cimg1.ibsrv.net/gimg/pprune....b7b6a016a.jpeg
'Systems Thinking' usually avoids the word 'problem' as this implies a solution, which in many cases there is no single identifiable intervention.
At best, safety (risk) management can use small safe-to-fail experimental interventions, but these must accommodate as many views as possible; i.e. avoid looking for consensus, there are none.

Automation may not be the answer, but it is an additional contribution in safety.

Spot on.

To me these types of thread always seems to boil down to a single phrase: "we accept dying, but only on our own terms so there is nothing else to blame but ourselves (or the other)".

Raw data flying is a solution to my identification as a pilot. You can train as much as you want, my humanity will have a role the day "it will matter" and becomes an unpredictable factor, and there will always be limitations related to my humanity and my backgrounds. You take away a simple thing as "sight", and I'm lost. Smoke, bad weather,... I need help or I'll die. That is not acceptable.

My job as a human should be different, if there is a flying problem, I am not the best solution.

Bernard Ziegler, a former Vice-President of Airbus Industrie, made the following observations and requirements from his experience as a test pilot and distinguished engineer:

“The machine that we will be handling will become increasingly automated. We must therefore learn to work as a team with automation; a machine is not a leader in the strategic sense of the term, but as a remarkable operator.

Humans will never be perfect operators, even if they indisputably have the capabilities to be leaders; strategy is in the pilot’s domain, but not necessarily tactics.
The pilot must understand why the automaton does something, and the necessary details of how; it must be possible for the pilot to immediately replace the automaton, but only if he has the capability and can do better. Whenever humans take control, 'the robot' (concept) must be eliminated.
The pilot must be able to trust automation; and acknowledge that it is not human nature to fly.

It follows that a thinking process is required to situate oneself, and in the end, as humiliating as it may be, the only way to insure safety is to use protective barriers” (Ziegler, 1996).

I really have enjoyed this thread! Thanks for all the input.

It sounds like Airbus may have sumed it up... Automation can optimize the operation, but regardless of what comes in the future, humans have to be in the loop in an emergency.

The newest YouTube by mentor pilot addresses the human trying to figure out how things work...

A pair of pilots broke the alpha floor on two occasions, and at least to some degree, they were trying to understand how the alpha floor was working.

Good news is there were no negative outcomes, but a fully automated system wouldn't need to experiment to understand how it works :-)

Can someone please tell Peter ( Mentour Pilot) that using Flex does not save more fuel than using TOGA for take off. :}

I think you are all close. It won't be the automation currently in use, it is more lilely to be a highly advance AI robotic humanoid which replaces the First Officer completely, fully integrated with the aircraft systems and every other AI First officer in service, it never leaves the flight deck. The Captain whilst a pilot will serve more as a systems technician and capable of flying and landing in the normal way if required. The AI will know you, remember the last conversation you had with an AI on the previous flight on a different aircraft, like they are all one and the same.
Once they are developed and its performance is flawless, then I think we will see single (human) piloted airliners and pilots will only fly simulators.

I highly disagree. 'Humanoid' implies some kind of human-shape robot a la Clarke? Having robots pushing buttons and operating controls is the height of inefficiency and introduces all kinds of alignment issues, not to mention needlessly handicapping the automation (only has two hands).

Attempting to throw personality/AI into safety-critical equipment is just stupid; you now have to work out whether you can have a suicidal robot.

Indeed but it is nevertheless very important to understand that Airbus FBW and Boeing (737) autopilots are not equal in capability, robustness, or in reaction to hydraulics failures for example. The Boeing 737 is not as well integrated or as capable and it has to be more closely watched.

Perhaps, but the Airbus FBW is not over automated, (with the possible exception of auto TCAS). The contributing factor in the aforementioned disasters was insufficient pilot training.

The original autopilots only held altitude and heading because that's all the technology of the time could provide. It was to assist the pilots on long sectors with aircraft that had very manual systems, e.g. fuel transfer, pressurisation, which needed a lot more pilot attention.

More and more automation is not the answer and having more and more layers of automation and ground pilots, and relying on extra radio links......it's all nonsense and ridiculous. It's also a lot more to go wrong and to be hacked or suffer software issues.

The tried and extensively tested Airbus FBW automation is a very good level to have - giving the pilots useful assistance but without taking away the actual flying.


The elephant in the room is pilot training. There is pressure to reduce pilot training and testing - because it costs money - and for example what used to be a 2 week course of talk and chalk in the classroom to learn the aircraft systems, is now a computer CBT course, where candidates can just learn the answers, rather than how the systems actually work. Many items in the Sim exams are tick boxes which if scraped through will receive a tick, when in the past more practice and training would have been provided.

All these accidents were caused by errors or omissions in pilot training. Some time back, I had to have a hiatus from Airbus and do a Boeing B737 type rating. During that type rating training in the Sim, we never did a pitch trim runaway. So the first time I would experience a pitch trim runaway would be in the actual aircraft during an actual sector. In theory I would know what to do, but such a vital drill should have been experienced and practised before flying the real thing.

Every time this comes up I suggest that pilots should be mandated to fully manually fly three approaches in every 6 month period. We used to have to do this with auto-lands, and log them, so the arrangement exists and could be adapted and extended to include manual flying.

This might not sound like much manual flying, but it would be a start, and it is not easy to fit such things into todays intensive flying patterns and rosters.

Uplinker..
Your entire post is totally correct right now..

But the reason I said avoid A and b wars is because we're not talking about Airbus in Boeing offerings... We're talking about something in the future that is entirely different...

Obviously either of those companies would likely go this direction in the long term (If they still exist), but the point of this thread is someday, somehow, it's likely that total automation will be more efficient, safer and far better ROI.

Of course we don't have any of that today.. so you're right, more training makes sense now, not arguing about that.. talking about what comes next.

IMHO it's a buck each way. You can teach something to tens of thousands of pilots, probably on a recurring basis, and know that it's not going to stick with a reasonable percentage of them.
Or you can teach it to the computer once and test the f*** out of it.

Almost every accident *could* have been prevented by *either* better crew training *or* better equipment design/software. We point the finger at crew training currently because the assumption is that crew should recognise the issue and deal with it, and therefore if the crew don't recognise it or don't deal with it, it's a crew problem.

We could equally reverse that - why isn't the aircraft recognising it's mis-trimmed, and instead relying on the pilot to do that?

Expect that assumption to change - engines are already virtually black boxes where crew have pretty limited visibility or control over them, because the internals are well engineered enough with adequate redundancy that the engine is (for the most part) either 'OK', 'warning', or 'dead'. Sure, you get oil quantity and turbine temps - but there's been posts from the engine people on here that the FADECs are doing a lot of predictive maths on individual sensor/actuator performances and predicting chances of failure to send a general red/yellow/green indication of engine health.


Certainly a reasonable suggestion, especially in less complex airspace while airliners do still have pilots on board.
It's not incompatible with improving the automation on new aircraft.

Zionstrat2 : I am sure that some think or want that to happen, but more automation is not the answer.

Why is more automation thought to be necessary ? because pilot training is being cut and reduced. So pilots are less well trained and less tested, so more sub-par pilots are now on the line, and accidents are happening - accidents from which lessons were learned years ago, and which therefore should not be happening now. In addition, rosters are becoming ridiculous; leading to pilot overload.

And, why is all this happening ? To save money. You can now fly to Spain for tens of pounds when it used to cost hundreds of pounds. That is not sustainable, and cuts are being made in pilot training and engineering support.

More automation might cover this up, and might apparently allow single pilot operation - which would save money. But can you imagine the problems that more automation would bring - pilots would be less practiced in flying, and with only one pilot, a very serious situation would arise if the software developed a glitch or a programming error that software writers had not foreseen on a bad day where a particular set of circumstances occurred together.

And as for having a network of pilots on the ground ready to step in and land a stricken automatic plane - that would bring so many extra unsafe factors - radio links, data links, all of which can be corrupted, suffer interference, or even jammed. And if the stricken plane had suffered an electrical problem how would all the extra automatics work ?



We once flew back from Faro, in an A320, and in the cruise abeam Madrid, all hell suddenly broke loose. The master caution chime was going off literally every second - ding....ding.....ding...etc. The overhead panel was flashing like a Christmas tree and PF's auto-pilot dropped out along with their PFD and ND. So PF gave me control. Along with the constant master caution chimes, the ECAM screen kept displaying a system page but only for less than a second, so we could not see what the problem was. As well as this chaos, we could hear a bang.......bang.........bang from engine 1, which sounded like engine stalls.

The upper ECAM screen displayed an electronic checklist which pointed towards an electrical problem. I was PF now and flying fully manually, so I asked PM to perform the ECAM. I was thinking that if we could not resolve this, then Madrid was just down there, and Lisbon was just over there etc.

But the checklist was coming and going as well. Every time the ECAM told PM to press a switch, by the time he had raised his arm to press the switch, the ECAM changed again, so he kept getting conflicting orders.

I was flying manually with no auto-thrust, but as PM struggled, I could just make out something in amber on the lower left part of the system screen that the ECAM was bringing up - for less than a second each time. I knew that the amber caption was in the area of GEN 1 on the electrical page, and I suspected that we had an intermittent generator, whose output was normal.....absent......normal......absent, and that was causing all the chaos and ECAM confusion.

I suggested to PM that we turn off GEN 1 which would leave us with only GEN 2, (but GEN 2 can power the whole aircraft with galley shedding) and then at least the constant changing would stop and we would be able to sort out the problem. PM was wary, "are you sure?" "Yes, I am absolutely sure". He suggested starting the APU first, then turned off GEN 1 and peace returned. We were still flying, on GEN 2. We used the APU GEN to replace GEN 1 and were then able to continue home, rather than making an emergency landing.

Can you imagine that sort of problem happening with a single pilot in a very automatic aircraft ? Can you imagine the chaos and the difficulty of ground pilots trying to sort that out - the radio links providing the data might have been adversely affected as well.

For something as complex and safety-critical as passenger air travel, you need at least two fully trained and fully rested pilots on board.

~ ~ ~

GEN 1 was sent away for testing and was confirmed to be faulty: it had a bad electrical joint on the generator output.

The "bang.......bang.......bang" we heard from the engine was the generator loading and unloading the engine accessory gearbox and the N2 high pressure spool, as the generator went from full output to zero output.
.