null null

AUTOMATION
a Precursor to Disaster
© 2012
By: Capt Myron Papadakis J.D.
Times have changed dramatically over the last few generations. Forty
years ago we had pilots that could fly and autopilots that were new and
untrustworthy. Today we have automation that can out perform human
capabilities and pilots that can not fly.
Those are fighting words to the inventors of the next generation glass
cockpits who have convinced the desk bound certification offices at the FAA
that their new products are user friendly, reliable, redundant high quality
display systems that provide more information to flight crews in an integrated
manner, better than ever before. They also suggest, with good training the
system is easy to use and reliable. The autopilots themselves when integrated
with these display systems all provide programmed flight possibilities from 400
feet after Take off, throughout the entire flight planned program –all the way
to Touchdown and roll out at destination.
Most systems have two or three auto flight (autopilot) systems, at least
two mode control panels one in front of each pilot. Usually at least two
separate auto throttle systems , at least two computers, Two computer entry
pads called with many pages and multiple integrated ways to display flight
progress data on a variety of Glass display panels that pilots may select.
The late 1960 standard six display instruments have been integrated and
removed from the NG equipped aircraft as antiquated and of second rate
capability for transferring actionable - useful knowledge to a pilot in quantity,
quality and reliability.
The antique auto flight systems pre 1960 provided little more than
directional control, altitude control and almost never speed control with auto
throttles.
By the 1960s airliners had the ability to capture and fly ILS approaches with the
Captain controlling speed by controlling speed (throttles manually. Autopilots
were always turned off at decision heights and the aircraft landed manually.
With Jumbo jets, came auto throttles that now allowed speed control.
Next radar altimeters and auto flight systems were coupled with auto throttles
and Flare and retard modes were added and integrated and now flights were
allowed to touch down and rollout to 80 knots when
1. Certified systems were used and all systems were working
1
2. When certified runways at specified airports were protecting low
minimum operations.
3. That specific lighting arrays were turned on.
4. That the Captain and crew had been trained to the auto land system.
The autopilots of the time transitioned from clumsy, jerky handles and dials to
a series of push to engage switches and the aircraft then annunciated which
mode was operating on and captured an appropriate signal. Tactile feedback
was becoming progressively less a part of flying the jet transports of the late
1970s. The pilots were becoming systems monitors instead of integrated system
controllers.
Either the auto flight system was flying the aircraft and the pilot was
monitoring or the pilot was flying and the auto flight system was essentially
off.
In this period, some wise engineer provided a display system that
integrated information and superimposed Flight Director information on the ADI
display. The flight directors of the time were typically Collins V bar or the
Sperry Cross hairs.
If raw data were selected this could be displayed without selecting
Flight directors and the pilot saw his position displayed relative to desired
flight path and made corrections to regain desired position and remain on said
flight path. The pilot was forever making corrections and the distance between
aircraft positions and desired flight path was a constant series of corrections
initiated by the pilot. Raw data flying was enhanced by diligent continual
concentration and skill and experience.
The VBAR or Cross Hair flight display worked identically with what an
Auto flight system would do if it were engaged and manipulating the controls of
the aircraft.
In short the antique displays showed exactly the position of the aircraft
relative to desired flight track centerline and it was up to the pilot using skill,
judgment and experience to return to and establish and maintain the desired
flight path. This took unending continued diligence and effort on the pilot
flying. It required constant diligence of the non flying pilot to monitor the
other. In short, raw data flying required awakened constant diligence.
With a Flight director the pilot flying now followed flight director
commands by keeping the nose of the aircraft either on the intersection of the
horizontal and vertical crossed hair on the display. The V bar required the pilot
to fly the triangular shaped aircraft and insert the nose into a V bar flight
director display. . As long as the pilot maintained position on the cross hairs or
2
within the V bar the aircraft would return to and maintain appropriate flight
path.
Raw data showed aircraft position and desired flight track. It was up to
the pilot to decide how to best regain and maintain flight paths. In Flight
director the pilot only need follow the director and flight path would be
regained and maintained exactly the same way as the auto pilot would do it if
autopilot was on and operating.
By the late 1970s and early 1980s auto flight was being stressed and raw
data flying minimized. Automation was being stressed and flying was not. All
the training Manuals suggested that autopilots of the time could fly the aircraft
better than a living human could. It was not only true it became a self fulfilling
prophecy as autopilots improved and as autopilot usage increased so too did
raw data hand flying diminish. Insidiously an airline pilot was being trained and
expected to become an auto flight monitor, not a pilot
Worse, It was not simply the airlines where this was happening. The
military was leading the way in new and battle field display systems and glass
cockpits. The systems were said to be and indeed proved themselves
exceptionally reliable. Systems failures were hardly ever recorded. Instead
what was happening were an ever increasing accidents and incidents where
pilots failed to use or monitor reliable and working auto flight systems. Pilots
also were becoming complacent in their monitoring tasks and so human errors
in monitoring or using automatic flight equipment was becoming noticed with
emphasis by FAA and Manufacturer to point out that their systems worked
perfectly. They showed that it was the pilots who were failing to use and
monitor perfectly operating equipment. And to a point the manufactures were
in bed with the regulatory certifying agency. No one was willing to suggest that
the advance in art was caused by working and reliable automation
The first clues that automation was bad were recognized in the training failure
rates of International pilots undergoing recurrent training. These pilots simply
could no longer fly. When first detected it was thought that the senior
international pilots were losing their edge because of the stress of overnight
flights, diurnal cycle upset and old age setting in. No one suggested it was the
reliance on the new automation that was killing flying capabilities.
All an observant investigator needed to do is analyze what an
International airline captain does and you will see why he can not fly. A pilot
trip Dallas to Frankfurt takes 10 hours. The Captain is allowed to fly 80 hours a
month. That is four round trips to Germany. It is usual for the first officer and
Captain to alternate legs of a rotation. So the Captain actually flies 4 Take offs
and landings a month. He has a month vacation, assume one sick out and one
trip drop for training. That means he has a total of 42 take offs and landings a
3
year. In hand held flight time he has hand flown about 44 hours a year. To stay
really proficient the studies show that a pilot should fly.
The auto flight reliant pilot has become a computer monitor. The
international pilot had become a victim of this progress. They were failing re
current check rides regularly. 25,000 hour pilots were forgetting how to fly.
That was true everywhere but far worse in the long leg flight regime.
This was very quietly understood in airline hiring practices at the time
military pilots were preferred as they had received extensive and intense
training and fixed wing pilots were preferred over helicopter aviators. It was
recognized that certain flight experiences were more intense and airline
applicable than others. It was also understood that these new hires would be
trained starting in either engineers or co pilots seats.
What was happening was now far different. The latest pilots from the
military were more computer and auto flight oriented and the senior pilots
were WWII flyby hand aviators
What clues did the airlines have that there was a developing auto flight
problem. The first correction was handled very quietly. It was the need to
retrain pilots flying International more regularly and longer than the pilots
flying the short haul domestic trips. Why? This was simply automation was
making the pilots forget how to fly.
Worse reliable auto flight enhances pilot complacency. It should be a
corollary to Murphy ’s Law that as auto flight reliability increases so to does
pilot monitoring complacency. We read about pilot/auto pilot complacency
regularly. It is everywhere. It is a predictable human trait.
An airliner over the North Atlantic was 100 miles off his assigned and
programmed. This was discovered when it had a near miss with another airliner
correctly flying his assigned route. To say the obvious a pilot must not have
been alert for at least 15 minutes to track that far off course (probably a lot
longer)
KAL 007 was shot down by the Russians because it had tracked 200 miles
off course and flew into Russian Secret area. The Russians said the night
intrusion was thought to be a spy plane. The KAL plane had failed through
misapplication of automation to establish on the programmed flight path. For
eight hours complacency prevailed as the aircraft got further and further off
course
Recently an Airbus overflew an airport by 140 miles while the pilots
complacently ignored perfectly working and reliable auto flight equipment.
4
Much about the new reliable designs enhances both safety potential and pilot
complacency. As an example take Boeings Cockpit Design philosophy that
suggests a cockpit that is quiet and dark is safe. That is because as a matter of
design Boeing has created WARNING, CAUTION and ALERT devices to be
attention grabbers. Thus when some required item is not safe the system will
set off attention grabbers “whistles bells and flashing red or amber lights”.
This design has saved many pilots from critical mistakes. On the downside is it
possible that some pilots have come to rely on the warning system and thereby
been complacent on checklist performance.
Back to auto flight and pilots who can not fly.
In the year 2010 most pilots going in to the Next Generation era are
autopilot qualified and reliant. Now pilots are trained to turn auto flight
systems climbing through 400 feet And to leave them on and monitor there
operation to or through landing. While this is a generally true statement it is
especially true in marginal weather. It is a reversal of philosophy in place 50
years ago. It was stated by a Captain who was the best pilot/aviator I have ever
had the honor to know. He said:
“Pappy quit relying on the autopilot ---Fly the damn airplane .Fly it
by hand every chance you get. Try to be better than the autopilot. You
can’t but try.”
“In your simulator training ask the instructor to let you hand fly an
ungraded zero-zero approach RVR 300 and throw in a 29 kt cross
wind with one engine out. See if you can do it. You know the autopilot
can ---Practice that because someday your “F ----ing auto flight
system will fail. Hand fly and always try to out perform the system. Do
that ,train that because on some dark and rainy low fuel night your
God Damned autopilot will fail and it will be up to you!!”
Years later, as Captain I watched during an 800 foot overcast 4 miles
visibility wind 10-knot approach to fields in level terrain when my co pilot
started a ILS approach. For reasons not understood at the marker his auto pilot
decided to click off. I watched with bemused interest as he floundered trying
to re establish the auto flight system. He was totally engrossed in pushing
buttons and flipping switches. He was going low and drifting off course to the
right. I let it continue as his frustration mounted.
Finally, we broke out and I said “Look up and Fly and Land the GD
airplane” That night he learned that auto flight was all well and good when it
works…And that is most of the time.
5
If I were a passenger I would hope my pilot could fly, I would hope he
could understand and monitor systems and, I would hope the autopilot would
work
Therefore, what has happened to pilots in cockpits throughout the
world. Technology and the design geeks and nerds of Microsoft Gameboy
fame have invaded the cockpit . And just as in Cell phones to GPS to
Internet to twitter and texting the improvisation has outpaced the
ability of Viet Nam era pilots to comprehend.
The children of technology speak and live in a far different world than
the grandparents, and the grandparents, by seniority are Captains. The
young act and react far differently than the left seated Neanderthals.
Worse even than that, is the youngsters believe in and trust automation.
The old guys do not and are reluctant to learn.
The FAA is willing to certify just about anything the manufacturer wants
to sell. Then come the aviation psychologists to tell us what human
mistakes should have been predicted or recognized earlier. They put in
their hindsight couched in psycho babble verbiage and eventually correct
a situation that should not have occurred if proper planning and
standardization had been incrementally applied during automation phase
in
Ask any old timer whether the automation of CV880, L1011, MD11, B757,
B777 or any NG resembles an older version. Then through in a few of the
Airbus aircraft for a fun and games look at automation. Make the entire
situation worse by having an airliner have its pilots transition back and
forth between new and older versions of seven or eight aircraft and you
have disaster waiting in the wings
I believe I am correct as saying that in my flying career with a single
airline we owned CV-880 L-18 (c130) B727, DC-9 shorties, DC9-50, Md-80
series, DC-9 stretch, Rented B747, B767 200 and 300 ers, B767ng-400,
B757, B737, 200, 300 and 800, and the B777. Each with differing auto
flight systems, the 737-800ng, B777, 757,767 and 767 -400ng all had
varying degrees of very modern automation.
The fact is that it was change that creates the problems to begin with
A group of academic piled “higher and deeper” were commissioned by
the government grant to tell the FAA what precisely was wrong with
automation and what needed to be done to correct it. A 1996 to 2000
study at least defined a portion of the problem. Among many items the
study found automation created some of the following problems
6
Before reading these lists I suggest to the reader two generalities that
apply to the statements
1) If you would question an older group of airline pilots you would find they are
not trusting of automation, nor are they trusting of anything. Instead they are
distrusting, confused and fatigued by every automatic function they are not
familiar with and satisfied by proven past performances. They would just as
soon shit can the automation and fly a real airplane. That was what Neal
Armstrong did when he landed the eagle on the moon. That was what Lovell did
to make a mid course adjustment.
2) Ask the young guy whether he trusts automation and you get an emphatic
yes. In fact they have been trained to rely on automation so much, they do
because they were trained to. Worse they have to rely on automation because
they were not trained to fly. So the young are trusting and reliant up on
automation. They are especially at home with it because they are
uncomfortable doing what aviators used to do…Fly.
After a number of accidents and potentially catastrophic incidents the GURUS
decided to take another look and here is an example of what they determined
as possible with reliance upon automation
1. Pilots may become complacent because they are overconfident in
and uncritical of automation, and fail to exercise appropriate
vigilance, sometimes to the extent of abdicating responsibility to
it. This can lead to unsafe conditions.
It is possible that reliance on automated warning systems lead to
checklist omissions in the sense that pilots believed that mistakes
would be picked up by sensors …I know that the G quiet dark
Cockpit philosophy was taught to mean that quiet and dark
equated to safe. In several TAKE of TOWS failures one might
conclude that complacency was rampant because they believed
the system would alert them of mistake NWA 255 Delta 1141, and
Spanair 2555
2. The behavior of automation devices -- what they are doing now
and what they will do in the future based upon pilot input or other
factors -- may not be apparent to pilots, possibly resulting in
reduced pilot awareness of automation behavior and goals.
The pilots of KAL 007 selected a navigation switch that armed and
should have captured a predetermined flight plan route. When
the switch was armed the aircraft was beyond intercept capability
and the auto flight system continued tracking on heading hold. A
fateful pilot error and no rechecking the automations solution.
7
3. It may be difficult to detect, diagnose, and evaluate the
consequences of automation failures (errors and malfunctions),
especially when behavior seems 'reasonable', possibly resulting in
faulty or prolonged decision making.
The Old L 1011 did not include an aural or other attention
grabbing warning when an autopilot would quit operating in a
mode asked of it. An Eastern airline flight crew got involved with
a landing gear problem while auto flight shut down. A perfectly
flyable aircraft descended and settled into a Florida swamp with
fatal results.
4. Automation may change modes without pilot commands to do so,
possibly producing surprising behavior
Recently an auto flight system of a new Turkish Air 737-800NG on
instrument approach to Amsterdam had an auto flight problem so
thoroughly confuse the pilots that the aircraft control was lost in
a stall too close to ground for a successful recovery. A automatic
mode while attempting a approach with ILS tuned improperly
shifted from Approach to the Landing Flare - Retard mode
because of some still undetermined failure in an altimetry system
and a software program allowing such change without an alert or
comparator warning to a second radar altimeter. The aircraft
slowed and eventually stalled while the experience pilots were
unable correctly analyze this shift in automation mode.
Automation mode control panel design is very far from standard,
and the differences can confuse and even kill.
5. Pilots may not be able to tell what mode or state the automation is
in, how it is configured, what it is doing, and how it will behave.
This may lead to reduced situation awareness and errors.
See Turkish Air 737-800NG write up above. There were three
pilots in the cockpit and the approach was hurried because the Air
Traffic control vectored the aircraft in close so the glide slope
was to be captured from above. This created a far from stable
approach to begin with. Worse there was an observer check
airmen in the jump seat. The late start hurried the landing
checks and the supposedly better instrumentation displays of the
glass NG cockpits did not annunciate a radar altimetry error
between left and right altimeters
8
6. Pilots may inadvertently select the wrong automation mode or fail
to engage the selected mode, possibly causing the automation to
behave in ways different than intended or expected.
See the shoot down of KAL 007 above, started more than a 1,000
miles earlier when the pilot selected and armed a correct
autopilot mode moving from heading select to Navigation mode at
a geographical point where the navigation mode could never
capture the planned routing. Thus the flight continued in the
earlier heading select mode and drifted 200 miles off course.
7. Reliance on automation may reduce pilots' awareness of the
present and projected state of the aircraft and its environment,
possibly resulting in incorrect decisions and actions.
NWA over flight Most recently a flight crew attention was
diverted from flying to cockpit discussions of company related
topics. So complete had become the reliance on auto flight they
allowed themselves to be taken completely out of the loop. The
autopilot reached the end of its route segment and shifted to
heading mode. The aircraft over flew its destination by 150 miles
before the errors was noticed.
COMPANY policy: At the airline I flew for it was company
standard policy SOP on international over water all nighters to
have a designated flight attendant knock on door and over snacks
or beverages every ½ hour. Often they would remain in the
cockpit and start conversations. This was because the auto flight
system was so good that the company wanted flight attendants to
regularly check to see the pilots were awake and doing flying
jobs. You knew they were doing company bidding if they asked
where are we? Or how do you know where we are way out here.
That forcing an explanation and flight attendant induced
situational awareness
8. Pilots may use automation in situations where it should not be used.
A DEADLY TRAP
Too often this old pilot has watched a young pilot on automatic
approach become totally engrossed in trying to reprogram an auto
flight system that for any number of reasons has decided to fail or
otherwise disconnect it self. The youngsters’ attention is riveted
to switches and push to arm buttons as he frantically pushes
buttons in a ever more frustrating game. Situational awareness as
9
to aircraft and geographical position in a rapidly changing 4
dimensional world is lost a t a very critical time. The aircraft on
approach is typically flying forward one football field every
second and descending about 15 feet every second. On every go
around at least 50 to 150 feet is lost from recognition to changing
vectors from down to up …And that is just momentum.
Recognition time may be longer especially if situational awareness
is diverted to other jobs like reinstating a auto flight system that
has dropped off the line…The answer should be; fly the aircraft
first. The autopilot dropped off the line for a reason ranging from
temperamental to critical. The time to analyze it is in a non
critical time. Fly and land the aircraft safely or go around hold
and analyze the situation.
AN OLD TIMERS View Point
When the weather is good practice hand flying. Do this so you will
remember how to fly. When you have the opportunity to handfly
do it. When you hand fly practice to fly perfectly and precisely.
Hone those skills. HAND Fly an ILS or the newer GPS approaches
so you can closely perform to automation standards. Sometime in
your 30,000 flight hour flying career Murphy will test you and
deprive you of auto flight and then you will learn whether you are
a pilot or an aviator. Never allow your epitaph to say “Here lies a
pilot who relied on automation. Do this because auto flight
systems all were built by an engineer named MURPHY. Remember
Murphy will not get hurt falling out of his office chair walking over
to the coffee locker.
11. Displays (including aural warnings and other auditory displays),
display formats, and display elements may not be designed for detect
ability, discriminability, and interpretability. This may cause important
information to be missed or misinterpreted.
The HELIOS case is an example. A pilot takes off and climbs in a
737 aircraft. He fails to pressurize the aircraft and at 10,000 feet
a warning horn goes off identical to the TAKE OFF WARNING horn
that signals FLAPS or speed brakes in improper flight status. The
crew mistakes this and sends a crewmember to the rear of the
aircraft to see if spoilers or flaps are really in wrong position. The
aircraft continues to climb and Oxygen deprivation deprives the
crew of sensible analysis. There were only two correct solutions –
Dive to lower altitude and pressurize. Unable to return to Cyprus,
land safely and fly again another day. Instead a good autopilot
flew incapacitated and dying crew and passengers to Athens
where the aircraft crashed. Here an identical horn was used for
two purposes.
10
Other examples would be to look at the myriad of Take off
Warning Alerts on Airliners.
The Boeing 757, 767, 777, series have a siren and a red warning
light combined with a configuration light. Early DC-9s had a Take
off Warning horn, Boeing 707 and 727 had a horn as did early 737,
later 737 are more like the 757. The MD-80 had a ladies recorded.
The MD11 had a green safe take off light as well as unsafe
warnings. Truth is you have more standardization in street signs
world wide than aircraft cockpits.
A Comparative Analysis of Flight decks With Varying Levels of Automation
Federal Aviation Administration Grant 93-G-039, Final Report, 8 June 2000
Ken Funk,& Beth Lyall Prepared for the FAA Chief Scientific and Technical
Advisor for Human Factors,AAR-100, Technical Monitors:, John Zalenchak, Tom
McCloy
This chapter started with a contentious presumption that the
recently hired airline pilots do not know how to hand fly and that they
trust automation. The first portion of the statement is quite provable by
any standard,
Automation has improved in the last fifty years and pilots have
become used to the machines working almost flawlessly almost all of the
time. It has become some airlines policy to suggest that pilots utilize the
full automation every opportunity they have. Starting at somewhere
about 4oo feet above the ground and ending somewhere near approach
minimums.
This suggests the pilot flies the airplane during after take off
clean up and after passing the approach fix just before touchdown.
Pilots have become wonderful monitors of equipment. Taken to
absurdity, in a two hour flight it suggests a pilot manipulates the
controls fifteen minutes and monitors and pushes buttons and throws
switches the other hour and 45 minutes. An international pilot flies
fifteen minutes and monitors 8 hours.
Smart bombs do a great job as they replace aviators as the
ultimate delivery system. Pilots learn to remain miles away. Golly the
predator guys fly and armchair with a pong screen and buttons in Las
Vegas and a drone delivers the goods. The very best and very highly
disciplined and qualified pilots in the USAF got assignments to U-2s, YF 12s, sr -71 Blackbird ands F-17 Stealth. But all of these aircraft flew so
high and so far into regimes that pilots could not manipulate controls
and fly them so most parts of their flights are conducted on autopilot.
11
When these “The Best Stuff”, superbly trained pilots left the
service and went into airline flying they actually had to hone hand flying
skills because so much of their flight time had been auto flight.
Today’s youngsters are brought up on auto flight, and they ,when
so flying have a far greater time available to monitor and do other things
associated with cockpit duties. The airplane flies itself. The Quiet -Dark
cockpit provides warnings cautions and alerts through high tech
attention grabbers. Pilots rely on that. They can become complacent
and they do lose hand flying skills.
Heads on a swivel are no longer needed in the 600 mph world as
TCAS is a very good indicator of traffic that has a collision potential.
(Except for VFR aircraft in the lower altitudes and airport
environments.)
A special problem exists with all the computers. They, very often
throughout flight, require reprogramming and de-selection of certain pre
programmed segments updated with new requirements. The descent and
landing segments are, more often than not, a very high work load time
frame. This time frame begins at cruise altitude about 100 miles from
airport of landing.
During the descent stage the pilots are forced into separated
duties while descending. It is a time where pilots tune special radio and
receive the landing airports computer generated weather and runway
conditions called GETTING ATIS. There after one pilot manipulates a
computer or manually writes down data for landing including the ATIS
weather, Aircraft weight, Flap and landing speeds required.
If a runway is assigned the pilot not flying searches out runway
data and inserts and displays same on computer. Pilots get out and
alternately review their instrument approach plates for a particular
runway.
Then time is taken to do an official, briefing of the approach out
loud so the CVR can understand one is completing protocol. The briefing
includes Identifying the approach plate by number and date. Then a
discussion is held where decision heights are established and entered on
data. Landing speeds are bugged. Various descent altitudes are discussed
as displayed on approach plate and marker altitude and distance from
airport are discussed. Then Go around procedures are discussed. All
required inserts are put into the computer or pulled from the computers
memory and displayed (this depends on the equipment. Somewhere in
this sequence Flaps speeds are computed or retrieved and displayed
from Computer memory. Also based on airport altitude and current
12
airport reported temperature the correct go around power setting is
determined by a pilot manually or by retrieving and displaying such data
from the computer.
At 18,000 feet descending there is a small challenge and reply
descent checklist. After the retrieval of of and insertion of landing data
,and insertion of radio inputs for an ILS approach the
Next there is a larger aircraft specific, Challenge and reply
Approach checklist which requires both pilots attention. Throughout the
entire process the aircraft is slowing from 500 kts/h to about 250 kts/hr
and descending from 35,000 to approach altitude as assigned by the air
traffic controller.
Now the pilot flying is concentrating on manipulating controls in
accordance with the Air Traffic Approach control directions. Typically on
this descent there will be a radio transfer from air Route Traffic to
Approach control. This typically occurs when the aircraft is about 40
miles from airport and descending through 10,000 feet. This is when the
aircraft must be slowed to 250 kts or less.
There after as the pilot descends and maneuvers to get into the
proper approach path the aircraft will be being flown in one of several
modes .They are
1. HEADING MODE …This mode determines the direction of flight a small
knob then turns the aircraft to a dial in and display direction
2. AIR SPEED MODE – slows or accelerates aircraft to maintain an exact
airspeed selected on another knob to dial in a display speed
3. VERTICAL SPEED MODE may be a selected mode and the pilot dials in
the number of feet per minute, up or down the aircraft will climb or
descend at.(called climb rate or descent rate )
4. ALTITUDE MODE select mode you dial in the next altitude and when
aircraft gets to that altitude it will transition and hold the altitude
until the next is selected.
5. NAVIGATION MODE/vertical – While in this mode the aircraft will
follow the pre programmed flight path over the ground. In new
models in aircraft with auto throttles engaged the aircraft will also
change altitudes to climb to or descend to altitudes programmed
along the flight path.
6. APPROACH MODE is armed approaching the selected instrument
approach and it captures and flies the approach patch including glide
slopes to touchdown.
7. LANDING MODE. At about 50 feet AGL for a 747 by radar altimeter,
and 27 feet for small 737 aircraft the aircraft shifts to landing mode.
13
This in turn slowly Flares the aircraft for a touchdown and it retards
power to idle by touchdown
8. ROLLOUT The aircraft says aligned to runway centerline left or right
by 4 feet during landing roll. The autopilot should be off as the
airplane slows to 80 kts (plus or minus)
9. GO AROUND –TOGA mode. If this function is selected the aircraft will
pitch nose up and add Go around power automatically. If the aircraft
was in approach mode it will follow the programmed missed
approach flight path.
As the pilot approaches the marker beacon typically located 6 miles
from runway touchdown zone. The aircraft should be in final configuration at
the Marker and at appropriate altitude-Usually 2,000 feet above ground. The
Landing checklists should be complete and now the non flying pilot closely
monitors approach with call outs. These call outs are approved by FAA and the
individual airlines choice. Typically and sequentially they are:
“Localizer Captured “
“Glide slope Captured”
Over Marker Beacon, Altitude checked,
Cleared to land checklist complete sir”
1,000 FT above,
On Course, On Glide slope –No Flags
200 above minimums - No flags
100 above minimums –No flags
Decision Height –
Or
Pilot flying says –Insight- Landing
Pilot says – Not in sight TOGA Missed approach.
It is strange in that after an hour or longer of shear boredom where auto
flight does it all the descent phase becomes hectic. This is made far more
complex descending into a large airport in a busy airport like Chicago, Atlanta,
or Los Angeles. Then traffic becomes a serious problem and Approach Control,
Tower, Ground control are all overworked. This is no place for an amateur.
ACCIDENTS
14
John Hall, Former head of the NTSB said it all. In Paraphrase “There is no
investigation too complex to not blame it on the pilot.”
It is true that for every auto flight situation there is supposed to be a
human monitor and a human programmer. Thus, every accident where an auto
pilot is concerned there may well be some human error. The error may be a
computer input error, a failure to monitor error, or a failure to react to auto
flight failure modes.
Here you may have a shared error, Human and design induced. With
computers and aircraft you have problems that are unique. Is the aircraft user
friendly such that a moderately trained individual can understand and learn
how to fly the machine through all expected regimes of flight Is the
automation and computer user friendly such that a moderately trained
individual can understand and learn how to utilize the machine through all
expected regimes of automated flight
A similar question is posed is are the aircraft and computerized
automation standardized throughout differing fleets of aircraft. Here the
answer is a resounding No. At last count there were over B727, B737, B 707,
L1011, B747, B767, B757, B777, DC-8, DC-9, DC-10, MD-11, B717, C-5, C-17,
there are about 5,500 Airbus varieties flying. The models are 300, 310, 319,
320, 330, 340, 350, and 380. Throw in the Russian airliners and the Commuter
RJ varieties and the number of different auto flight systems is staggering
In major airlines the switching from one aircraft to another possess
learning problems and a learning curve. Human factors gurus suggest in very
stressful situations pilots may react in a manner consistent with the aircraft the
pilot has the most hours within. I had 17 years in every seat in a Boeing 727 (3
seats) and 22 years later I still know from memory all the landing flap numbers
and most emergency procedures.
LATENT FAILURES
The thing that kills pilots and passengers most frequently is latent
failures of equipments and Latent failures of pilots. A latent failure is a failure
that goes un noticed until it is too late to recover from the failures.
As an example airline Pilots recover from approaches to stalls very
frequently and without much problems. Pilots have a more exciting and
difficult situation recovering an airliner from a deep actual stall. That is why
the designers created impending stall warning devices.
There have been 19 airline Take Off accidents since 1958 where the
airplane was miss configured for flight. In 17 of those cases the Take off
15
Warning Horn system failed to operate, and both the miss configuration and the
latent failure of TOWs went unnoticed.
The famous, Infamous Lockheed L1011 descent into a swamp west of
Miami occurred because an autopilot failed while all the crew were wrongfully
trying to fix a landing gear indicator failure. The jumbo jet crashed in the
swamp with a large loss of life.
Three changes resulted from that accident.
1) In L-1011 when landing gear indicator did not show safe green gear
down lights the first thing to do was to remove the green light cover and
replace the bulbs. Test the lights
2) The second change was in every airliner if an autopilot failed a loud
and distinctive siren would blare Called a WAILER and a red master light
would illuminate.
3) a Memo was distributed to remind pilots working a problem ,that one
pilot should be designated to fly while the others worked a problem.
ACCIDENT INVESTIGATIONS AND AUTOMATION
The most simple of investigation techniques now becomes complex with
the advent of micro miniature computers that control massive objects.
Automation is every where in many forms and failure modes undreamed of a
few years ago are no commonplace. In the home your old on off, hot/ cold
thermostat has become a programmable green device.
There are more communication capabilities molded into in a hand held
cell phone than imaginable. The automation computers on the Apollo moon
lander were surpassed by the very first computer sold at TOYS R US in 1980.
Today a computer system as much capability could be molded into a cell phone
size object.
The old accident investigator is left as far behind as the Captain is
compared to his texting co pilot. The data of whether or not something
occurred with automation is not usually found by the traditional Tin Kicker
looking for witness marks in remnant metal. Answers are found in laboratories
where data is retrieved
THE CVR should be expanded to replay the entire last flight. This would
include a new recorder that was on digital and would be stored within a black
box. Unlike the 30 minute rewind CVR this would uncover the entire flight.
Some method to automatically start and stop /erase the preceding flight should
16
be incorporated. The entire last segment would be preserved and used only for
accident reconstruction.
The CVR is very helpful to determine what switches were thrown, what
the crew was doing and what was being said. It is reported that the NWA crew
spoke about company problems as they overflew Minneapolis by 150 miles.
Some believe they were asleep. Either way that was a complacent act at best.
The Digital Flight Data recorders are the best single source to know what
was transpiring at any second within an aircraft flight path. These Data
recorders record literally month’s worth of data. Very often Line replaceable
items record in flash memories the status of the equipment but also they may
record various failure modes over the life history if the part.
Software changes need be investigated as on Alaska Army National Guard
Kingair crashed because the data being utilized was outdated.
The Black Boxes usually painted International Emergency Fluorescent
ORANGE are sturdy to more GS than granite can stand and heat resistant to
steel melting points. The boxes usually survive.
The problem is far greater than that. The non volatile chips within the
individual computers are not protected like the Black Boxes. So finding
information from these remnants usually takes Company representatives
helping the Investigator find and identify chips that store data.
This picture shows a Airlines boxes have been opened and computer data
boards retrieved and identified. The next step was to find the Chips with
individual data stored in memory. One protocol is to remove a chip and place it
on a new identical board and see what readings can be retrieved. Another
protocol on apparently undamaged systems is to attempt to utilize the Line
replaceable unit as is and retrieve data there from. No one knows the best
retrieval methodology than the designer/ manufacturer of the part. When they
are parties to an investigation and work for the NTSB the results are usually
obtainable FOIA from the full accident investigation file.
For an investigator automation and software used in flight present a new
challenge. The existence of so many data storage chips presents a new source
of forensic evidence; do not overlook this mine field of data. Think of the
stored data on computer chips as diamonds in a field to be retrieved, cleaned
and admired for the clarity they can bring to an investigation process.
17

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project