An FAA Special Airworthiness Information Bulletin issued on September 24 (SAIB AIR-20-15) perfectly captures the conundrum that faces pilots flying modern aircraft. Automation can easily dupe a pilot into letting the airplane decide which way to go instead of the pilot ensuring that the airplane is doing what the pilot believed was specified.
The SAIB summarizes a problem with the avionics in the Boeing 787, where the autopilot flight director system (AFDS) fails to capture the localizer when the airplane intercepts the beam at angles greater than 40 degrees. Pilots are taught to verify the selected mode on the flight mode annunciator (FMA), after pushing the button on the flight guidance panel to select that mode. And in this case, the FMA showed exactly what the pilot expected—LOC—but the AFDS elected not to capture the localizer but continued beyond the beam at a 20- to 30-degree angle while also capturing and initiating a descent on the glideslope.
Obviously, this is a safety risk, with the airplane descending on a heading different than the localizer, and this prompted FAA to issue the SAIB. Boeing was aware of this because it had already released Flight Crew Operations Manual Bulletin TBC-106 on Dec. 18, 2019, and Boeing was working with the avionics supplier on a fix.
Automation is helpful when it works properly and does exactly what the pilot expects, but subtle breakdowns like the one mentioned in the SAIB can be hard to detect. And the more automation is added to aircraft, the more pilots need to be vigilant to spot such problems. The Flight Safety Foundation sums this up succinctly, in a briefing note titled “Automated Cockpit Guidelines,” which “discusses how to improve training for interfacing with automation.”
Here is what the briefing note recommends:
“When performing an action on the flight guidance control panel or the FMS central display unit—or control/display unit (CDU)—to give a command to the automated flight system (AFS), the pilot has an expectation of the aircraft reaction and, therefore, must have in mind the following questions: what do I want the aircraft to fly now? What do I want the aircraft to fly next? These imply answering the following questions: which mode did I engage and which target did I set for the aircraft to fly now? Is the aircraft following the intended vertical and horizontal flight path and targets? Which mode did I arm and which target did I preset for the aircraft to fly next?"
In an article published by Air Facts Journal, “On Automation and Airmanship,” pilot Steve Green shares some of his strategies in a lengthy but compelling summation of the automation problem. His article begins: “I have been known, on occasion, to talk to the autopilot. ‘Why on earth are you closing the throttles now?’ or ‘What? Who told you to fly at 210 knots?’ It’s possible that this could be a little unnerving to an unsuspecting first officer, but there are occasions when it is necessary to question the autopilot’s intentions or even its situational awareness. Sometimes I have to intervene: ‘No, no, let’s not do it that way...here, let’s try this mode...’ And every so often, ‘Oh for goodness’ sake, stop making this harder than it is...’ a comment usually associated with disconnecting the thing.”
In Green’s view, there are two schools of thought when it comes to automation. In its most basic form, he sees designers stuck in a closed-loop environment. In his view, their thinking doesn’t go beyond seeing “the operating environment only as a socio-mechanical construct, such as the National Airspace System...” and that it’s only necessary to design automation that reacts to “set parameters.” Or to train a pilot to fly within those set parameters, what he calls “the cybernetic view of technology.”
But Green argues this just results in creating “a systems operator who is unprepared to debate on terms of equality with the mountain, the sea, and the wind, or, for that matter, with the central processing unit of the flight control computer. The foresight is pre-programmed, trapped within the closed control loops, and limited to a narrow set of anticipated threats, or specific risks. This is antithetical to airmanship, because those parameters will eventually fall out of equality with the vast tribunal of a tempestuous sky.”
Green goes on to explain, “The fundamental flaw in attempts to adapt the cybernetic view of technology to the problems of flight lies in the belief that we have expanded our knowledge to a point at which we have absolute, predictable, and repeatable control within a tempestuous sky. We don’t, and likely never will. An analog world will simply swat away a digital mindset.
“In the end, we can only preserve mastery of the aircraft if we understand airmanship as the management of uncertainty, not simply the management of systems. We must know how the airplane is constructed to achieve the design capabilities, and match this with a strategy for how we want the airplane to be flown to utilize those capabilities, and then insist that the autoflight systems fly our plan. When those systems don’t fly our plan, we need to step in and do some of that pilot stuff. The automation can never be allowed to become the master of the airplane, obvious or otherwise; in no case can it be allowed to place the successful outcome of any maneuver in any doubt whatsoever.”
AIN posed questions about automation design and philosophy to avionics manufacturers, and the following are some of their thoughts.
Garmin
Garmin engineers have been working on avionics automation since the company was founded, and most recently Garmin achieved an industry first, certification of its Autoland, a general aviation emergency automatic landing system. The first certification was in the Piper M600, and this was followed by the Daher TBM 940 and Cirrus Vision Jet G2. “We think we’ll have over 100 flying in the field by the end of the year,” said Phil Straub, Garmin executive v-p and managing director of aviation.
“Automation is sort of a continuum of what we’ve been doing for a long time,” he explained. “Autoland follows that path, it’s a big leap. The Autoland software is the heart and core of what we do and we had to design those systems [brake controls, engine controls, passenger displays, etc.] to help make it do that.”
Another way of looking at automation is the term coined by the General Aviation Manufacturers Association (GAMA): simplified vehicle operations. The concept is to design automation that doesn’t add to the pilot’s burden but frees up resources that the pilot can apply to solving problems and flying the aircraft. An example is a caution and advisory system (CAS)-linked checklist. When a CAS message pops up, the system automatically pulls up the abnormal checklist and related synoptic diagram, so the pilot doesn’t have to paw through a printed checklist or try to figure out which system to look at. “That’s the type of automation we like,” Straub said. “It keeps the pilot in the loop and removes pilot actions, but we don’t have the pilot saying, ‘what is it doing?’”
For Garmin, some of its best ideas come from the people who work for the company and are also pilots, something that Garmin incentivizes by helping pay for flying lessons and regular training. A Garmin engineer and pilot, for example, came up with the idea for Electronic Stability & Protection (ESP), which is now standard on a variety of aircraft types. ESP uses autopilot servos when the autopilot is off to “nudge” the controls when pitch and bank attitudes reach certain limits. Further developments enabled envelope protection features such as automatically lowering the nose to prevent a stall (underspeed protection) and overspeed protection, which raises the nose to prevent excess speed. And of course, ESP became a building block for Autoland.
Straub hinted at other products that might derive from building blocks like SafeTaxi, which was introduced more than a decade ago. At the time, Garmin had to develop its own georeferenced airport taxi diagrams as they weren’t available otherwise. SafeTaxi not only helps with situational awareness, he said, but could also lead to automatic taxi routing that takes into account clearance limits and airport hotspots.
These products are not full automation, Straub said. “I call it putting safety nets around the aircraft and crew.”
This philosophy extends to Garmin’s avionics in larger aircraft, such as the G3000 and G5000 touchscreen-controlled flight decks in many Cessna Citation models and the Learjet 70/75 and aftermarket upgrades like the King Air G1000 and Citation G3000 and G5000 mods. Straub flies a King Air 350 and CitationJet and during training, he said, “the busiest thing you do is that missed-approach procedure, especially single-engine. There is a whole lot happening 200 feet off the deck, in a half-mile visibility.”
Typically autopilots were designed to switch off after the pilot pushed the go-around button, so the pilot had to remember to switch it back on during a complex process of adding power, pitching up, resetting flaps, retracting the landing gear, and reselecting the nav mode. “We didn’t like that,” he said, and the Garmin design keeps the autopilot coupled during the go-around and automatically sequences the nav as needed for the missed approach.
If the airplane has autothrottles, even better, as it’s easier for the pilot to manage a go-around and avoid getting too slow or too fast with the power being set automatically. Now autothrottles are moving into smaller airplanes, with Garmin systems in the TBM 940, M600, and Vision Jet, and an IS&S system in the King Air. “Every airplane ought to have autothrottles,” he said, and this is becoming more possible because Garmin’s system simply attaches to the throttle cable instead of adding complex mechanisms in the throttle quadrant. Of course, Garmin’s autothrottle in larger airplanes like the Citation Longitude is a quadrant-type system.
But, he explained, “we’ve shown what we can do with conventional actuation. And they should belong in piston airplanes. [Without an autothrottle], during a go-around, if you do nothing, it buys you time and you won’t stall. But if you have an autothrottle, the airplane does exactly what it needs to do.”
Further on the automation front, Garmin worked closely with Embraer on incorporating the Brazilian manufacturer’s Runway Overrun Awareness and Alerting System (ROAAS) in the new Phenom 300E. Garmin has developed its own ROAAS library, but in this case Embraer engineers designed the system for the 300E. “We try to be flexible and accommodating with customers,” Straub said. “Embraer has a huge depth of talent, and they had the desire to do their own ROAAS.”
One of the critical questions that comes up in automation discussions is how all these tools and capabilities affect pilot training. One might assume that if the integrated avionics and flight control systems are easier to operate that training times might decrease, but that hasn’t been the case. The opposite seems to be true, in that pilots who become more dependent on automation need more training in airmanship. “This is something we all have to grapple with and how to manage that,” he said. It remains important for pilots to understand the aircraft’s systems and what the automation is doing at all times and to be able to keep flying the airplane no matter what goes wrong.
Straub said that Garmin is working on new developments related to the automation theme, but while “we love talking about the stuff we’re working on, there are things we can’t talk about. There are certain things computers do really well,” he said, “and there are some unique opportunities. We’re going to see more with connectivity, not a new satcom system, but what type of information can move back and forth.”
He explained the connectivity angle in relation to the Autoland system, which is designed to land the airplane safely at a suitable nearby airport after the pilot becomes incapacitated. But this means the airplane could land at an airport in a relatively remote area. “If you look at the country, it’s not all that populated in some places. If you think about Autoland, it prioritizes time. But what if we have better connectivity, and what if at the other end we can communicate with the airplane? We know it was a massive heart attack, so we may not want to get down in Garden City [Kansas], how about we go on to Wichita [where there are bigger hospitals]. If you have connectivity you can have an exchange about what’s going on and have a person on the ground override the original destination. And then have support services on hand when the airplane arrives. Saving lives is what we’re after.”
Collins Aerospace
“The goal of automation is a good question because we’re going to have to think of automation in the context of how it truly takes tasks off the crew and not just automating those tasks,” said Charles Wade, director of marketing for business and regional avionics at Collins Aerospace. “The traditional thought is to take a task and automate it. Behind the scene, we’ve got to be careful. Are you truly taking a task away or moving a task and end up increasing the pilot workload and he has one more thing to watch? The goal has to be to truly reduce the number of tasks on the flight deck.”
Regulators will drive these explorations and with different outcomes depending on the country where developments take place, Wade explained. For example, in Canada, business jets can’t be flown by a single pilot even if certified for one-pilot operations in the U.S. “When we look at this broadly, the complexities of the international flavor of this topic and what we’re going to do in the U.S., there is lots of runway in front of us to sort this out.”
The pressure to keep adding automation to passenger-carrying aircraft isn’t just for the sake of doing so but also stemming from the development of autonomous aerial vehicles (AAVs) such as electric aircraft. “We’re watching some of the technology and problem solving going on with the AAV segment," he explained, "so there’s a natural thought to say, ‘How come I can’t do that?’” But there is also the question of how soon full automation will happen with passengers onboard. “That’s where the game changes,” he added, with considerations about liability, insurance, and return on investment.”
For the nearer term, where pilots are still in the flight deck, solving the problem of reducing the tasks that pilots have to perform will be challenging. “We can’t isolate the avionics from the rest of the airplane,” he said. “We have to take a holistic look,” which means how all the aircraft’s systems and the pilot interfaces interact and how that is managed.
“The value propositions are going to be incremental in nature,” Wade explained. “I don’t know of anybody who is going to take this head-on and revolutionize the flight deck now, given the state of the economy.” A lot of work needs to be done on regulations, too. “There is going to have to be new technology and new ways of managing that flight deck that have not been certified before. In the context of market activity around this, when we talk about reduced-crew operations or simplified-vehicle operations, we’ve gone beyond autolanding, which Collins has done for years for Boeing and the commercial market. This is trying to take that next step and now revisit the philosophical aspect of that airplane and how it needs to be managed.”
Driving much of this exploration is keen interest in the AAV market and the eVTOL and electric-, electric-hybrid-, and hydrogen-powered aircraft that visionary designers are developing. “This has impacted the OEMs and their curiosity about what can be done,” he said. For Collins, he added, “The initial plays are around anything we can do to make that airplane safer. [Current airline aircraft] are safe, their record is through the roof. But we’re going to continue pulling on that thread because we can always do better.”
On the training front, Wade agrees that over the years much more capability and functionality have been added to avionics. “When we started in this industry, avionics were built on vacuum tubes. We’ve watched it evolve over time and bring awesome technology to market. But over time we’ve just kept adding, and we’re reaching the point of saturation within that flight deck. There are more things in front of these pilots than they’ve ever had before. One [way] we have to tackle is that simplification; how to truly reduce pilot workload. To integrate another piece won’t help.”
The solution isn’t just the avionics design, he explained, but working in partnership with other entities such as the FAA to integrate the aircraft into the National Airspace System. “We’re reliant on the airspace management toolset to streamline communications, route updates, and weather updates, which is what we’re trying to do with CPDLC and other technologies. We see a lot of opportunities to leverage those technologies, and not by adding another layer but simplifying."
As an example of how this could help pilots, Wade pointed out that now when pilots fly from one flight information region or ATC center to another, they have to switch frequencies. “When we’re on a cell phone, we don’t have to do that,” he said. “Why are we forcing the pilot to dial the new frequency?”
There are many avenues of exploration for new technologies that will make pilots’ jobs easier and improve safety. “There’s nothing we’re doing that’s outside the imagination of industry right now,” Wade said. “Collins is working through and thinking through this future much like everybody else. We’re trying to put our own unique value proposition around it and work through that.”
The airspace management aspect is a major factor that will affect the application of these technologies, especially as it relates to reducing or eliminating pilot positions in the aircraft. “We can create what we want,” he said, “but the long pole is going to be around airspace management. Is ATC ready to manage multiple aircraft without a pilot in it?” And he added, “I haven’t seen anything from the regulatory [side] that’s driving specifications or regulations on what a reduced crew or single-pilot aircraft would look like.”
There are more subtle issues that designers will have to address, too. Unpressurized AAVs generally will fly at low altitudes and for short-range trips and won’t need airport infrastructure. But for longer flights, even with an electric-powered airplane, all the requirements apply, from needing a terminal or FBO to taxiing to the runway for takeoff and transition into the National Airspace System.
“That transition from what they’re doing now and to the next level has lots of complexities they’re not dealing with today,” Wade said. “There are key technologies they’re going to require. We’re going to see that part of the industry monitored and helping with safety and control laws and flight management type technology. That's the layer of complexity you have to deal with.”
Collins Aerospace, he said, “is actively evaluating the value propositions and how to bring the right technologies to market. There are only a handful of companies that supply this technology. Something as complex as what we’re doing, there aren’t a lot of players. There are a lot of niche players, but not anybody that can bring it together [like we can].”
Honeywell Aerospace
The focus for aircraft automation hasn’t changed, explained Mike Ingram, v-p and general manager of avionics at Honeywell Aerospace. What automation does is improve the ride for passengers and lower pilot workload, all with the goal of adding to the overall level of safety. With properly designed automation, the pilot has less to think about and can focus on working with air traffic controllers, next steps in flight planning, and flying the aircraft.
Although there has been plenty of talk about and even tests of aircraft that can fly without a pilot, “The move from dual to single pilot in very expensive business jets will be a longer development,” he said. “It won’t happen right away.” There is an effort, however, to do just that in the airline world, although that has been delayed by the coronavirus pandemic.
“There still is a push with airlines to reduce the number of pilots, especially for the time between takeoff and landing.” To facilitate that, Boeing and Airbus are working with suppliers like Honeywell on systems to monitor pilots’ drowsiness level or detect incapacitation but still allow ground personnel to communicate with the crew.
Ingram expects to see further developments like Garmin’s Autoland system, especially for owner-flown, one-pilot airplanes. “Garmin set the precedent,” he said, “and that’s something airplanes in that class all will need to have.”
Honeywell developed the automatic descent mode for business jets equipped with its Epic avionics suites, an early example of automation that helps incapacitated pilots. The capabilities of automation will continue to move downmarket to smaller jets, Ingram added, and indeed many of them already offer envelope protection features such as Garmin’s ESP that help pilots avoid unusual attitudes or coupled go-around capability, which greatly eases the flying burden in a stressful and busy environment close to the ground. “We’ll see more of that,” he said, “especially during landing and takeoff phases.”
In larger jets, flight testing successfully showed that an Airbus A350 could take off by itself, guided by cameras viewing the runway instead of using GPS or other electronic sensors. Honeywell’s IntuVue RDR-84K electronically steered radar can provide similar accuracy in IFR conditions, Ingram said. “As the sensors become better, whether visual, radar, or lidar, they enable more automation because the airplane can sense more accurately the environment. As sensors improve and processors improve, we’re able to add more automation levels.”
Honeywell pioneered the development of autolanding in airliners, and Ingram sees opportunities to take “expensive technology and bring it into the lower end of the business aviation space. CAT IIIb is basically zero-zero conditions, and we’ve been landing without pilot intervention for a long time.”
The ultimate automation implementation is a pilotless aircraft, and fly-by-wire flight controls are a key building block for that capability, although creative designers like Reliable Robotics have flight tested unmanned conventional airplanes using servos attached to control cables.
“There are many benefits to fly-by-wire,” Ingram said, “not only from a safety and weight perspective, especially on larger aircraft, but fly-by-wire can react much faster than a cable-pulley-autopilot flight control system.” This includes mitigating some of the effects of turbulence because the electronic controls can react much quicker than a pilot and help dampen out the turbulence.
“Fly-by-wire controlling all actuation and motor control can significantly help you get that aircraft under control and understand the aerodynamics of that aircraft,” he said. “There is a huge interest from OEMs; they can do the computations in the computer rather than mechanically in the aircraft.”
Now aircraft design has reached the point where a manufacturer can ask Honeywell to integrate a fly-by-wire control system with all the necessary control laws and a triple-redundant hardware package. And the final control input can either be a pilot in the airplane actuating a sidestick or yoke or a pilot on the ground controlling the airplane remotely or even full autonomy. The cost of fly-by-wire, while still much more expensive than mechanical controls, is improving for smaller aircraft, especially as companies like Honeywell develop compact fly-by-wire controls for the AAV market. “The magic will be to get to really low cost and weight,” Ingram said.
Auto manufacturers, especially Tesla, are already well along in developing sophisticated near-autonomous controls. “Certain cars have full autopilot mode,” he said, “and you can turn it on if you’re not interested in driving.” In an airplane application, this “gives the pilot more choice if there is an emergency, the ability to not have to worry about the airplane and deal with the emergency.” It could also help if the system allowed for an automatic non-emergency landing, say, if an ill passenger needed assistance, the pilot could let the airplane land itself while taking care of the passenger. “That would be a big help,” he said.
The next step is to incorporate artificial intelligence in the automation. “We see this trend towards how can we incorporate artificial intelligence and machine learning into avionics and controlling the aircraft,” he said. “There is a lot of research going on there. The silver nugget will be when a company or organization is able to certify artificial intelligence in a realistic use-case scenario. There are some developers [working on it], but how to certify it? How do we create a deterministic output and prove to certification authorities that it’s doing what we said it would do. Those are the trends now.
“[Autopilots] have been around for over 100 years,” Ingram said. Lawrence Sperry publicly demonstrated early autopilot controls in 1914, and Honeywell ended up acquiring Sperry years later. “We’ve had 100 years to develop automation on aircraft,” he concluded, “but now we’re taking it to the next level of autonomy, that is going to be the next step.”