19
$\begingroup$

After having read the disturbing

https://en.wikipedia.org/wiki/1999_South_Dakota_Learjet_crash

I'm left with the question as to why the computer allows for the autopilot to be disengaged when there is no pilot input.

Why doesn't it engage the stick shaker and alarm as normal, but maintain control until pilot input is received, or require the pilot to manually disengage the autopilot?

I'm not a pilot, so I'm sure there is good reasoning behind this. However, from my own naive perspective this is why it seems foolish to automatically disengage the autopilot:

This is what happened after the autopilot was disengaged:

"The target is descending and he is doing multiple aileron rolls, looks like he's out of control...in a severe descent, request an emergency descent to follow target."

Imagine that the crew did regain consciousness, they would find themselves in a disorienting situation, with an aircraft possibly damaged from aerodynamic stress when approaching mach 1 in an uncontrolled nose dive. This, compared to the autopilot simply maintaining attitude as best it can.

Until finally, this: "the aircraft hitting the ground at a nearly supersonic speed and an extreme angle."

The alternative being, with no pilot input that the aircraft would have maintained a somewhat stable attitude, deploys its landing gear, flaps, and prayed for the best -- that there just happens to be a fairly smooth piece of land, with no major obstacles in the way?

Now, I'm aware that all six on board were dead before the plane crashed. That doesn't mean there are no situations where a controlled crash landing is not preferable to an uncontrolled crash.

I'm not an avionics software engineer, so forgive me if I don't appreciate the complexity of the task -- but as a software engineer and someone with an IT education it seems to me almost trivial to extend the functionality for the aircraft to accommodate for this scenario with a mostly hard-coded procedure---yes, blindly landing at whatever is there and hoping (and with the system being extended with visual processing, perhaps, in the future). While I'm not even going to sketch a full proposal for such an extension here, it is part of my motivation for asking this question in the first place, so I'm simply mentioning it as that.

I can also mention, although I'm sure anyone qualified to answer this question will know about this case (and know it far better than I do), the Cornfield Bomber https://en.wikipedia.org/wiki/Cornfield_Bomber so if this is possible without any help from the computer, surely it would be possible with help, even from a computer that only has basic instruments (altitude, attitude, etc.) and no vision, yet simply attempts it "blindly" as far as visual processing is concerned.

Please keep in mind that I'm under no illusion that the plane will land without a scratch. This is a game of statistics, such as all safety procedures, and it seems (naively, I'm sure) that this might increase the chances of survival by some (probably slim) margin.

My own attempt at an answer:

I can only imagine that the reason such functionality doesn't exist, is because it is so rarely useful and considered too much of a curiosity. However, other crashes that also appear to be highly unlikely in general, have seen changes enforced in the aviation industry. So this isn't really a good answer.

The only other thing I can think of, is the omnipresent fear of AI. The idea to implement some AI, that could potentially, when given full authority of the plane, glide it into a building unintentionally, is just unthinkable for obvious reasons. While I sympathize with this view, I don't see why this is more likely than it happening with a plane flying without such a simple AI---both the AI and the completely uncontrolled plane would be flying just as blindly, both at risk of hurting innocent bystanders. The only difference is that the AI assisted plane flying autonomously (despite mostly blindfolded) does have a marginally higher chance of allowing for some survivors.

Improve this question
$\endgroup$
4
  • 2
    $\begingroup$ Note that part of what happened on N47BA is that the crew apparently didn't put on supplemental oxygen immediately, but were likely trying to figure out a difficult-to-comprehend checklist item in an already-stressful situation. Had the first item on the checklist been "oxygen masks - don", or either pilot had just thought "we're losing pressure, don't futz with the checklist yet, just don that oxygen mask now!", it's likely that the outcome would have been very different, and my understanding is that in response to that accident, such a checklist change was made more or less across the board. $\endgroup$
    – user
    Jul 12, 2019 at 17:43
  • 1
    $\begingroup$ Essentially autopilots are much, much simpler than one would think. They're not even vaguely like "a self-driving car". $\endgroup$
    – Fattie
    Jul 14, 2019 at 17:28
  • $\begingroup$ @Fattie Yes, but this is the question: Why are they this simple? Keep in mind that I'm suggesting why it doesn't continue to maintain control (and land blindly, which is better than crashing). It already is able to maintain control, isn't it? I'm not suggesting a major software overhaul (although I'd very much like to see one). I'm merely suggesting why the already simple functionality isn't only marginally extended. $\endgroup$
    – AlphaCentauri
    Jul 15, 2019 at 12:21
  • $\begingroup$ hi Alph - hmm, purely FWIW I would not see that as simple. You know the (mechanical) auto-tiller on sailboats which solo sailors use. Strikes me it's more like that. Closer to a mechanical thermostat than a "self-driving car" as we now pretty much think of them. $\endgroup$
    – Fattie
    Jul 15, 2019 at 12:34

5 Answers 5

Reset to default
23
$\begingroup$

The "autopilot" is a fairly basic control system. Usually it is composed of just a few components (logically speaking) like a wing-leveler, heading mode, and altitude mode. The autopilot can control the aircraft usually through servo's connected to the control cables or through the hydraulics. External systems can feed into this to do things like follow a descent path, follow GPS/VOR routes, etc. The autopilot itself is basic.

The autopilot is designed to fly an aircraft that does not otherwise have any other issues. The autopilot is not designed to fly outside of normal operating circumstances. This means that when some kind of abnormality is detected (usually through the autopilot hitting its programmed limits) it will automatically disconnect.

In the Learjet case you cited, the autopilot continued to maintain altitude after the engines failed, but because maintaining altitude without engines means your speed will decrease, the autopilot disconnected before the aircraft stalled rather than fighting the pilot through a stall. It assumes that it is safer to automatically hand-off than require the pilot who is now trying to stabilize the aircraft to also have to worry about disconnecting the autopilot.

Most autopilots give some kind of warning that they've disconnected. This can be things like a chime, voice alert, stick shaker, etc. It's the autopilots way of saying "I've reached the limits of what I can control, you need to take over now". Otherwise it could potentially make a situation much worse.

The cornfield bomber was not on autopilot when it crashed. It just regained stability as a result of the ejection and remained on a fairly level (but descending) path until it bellied into a field (and continued to run/move for quite some time).

Improve this answer
$\endgroup$
6
  • 3
    $\begingroup$ You beat me to it. +1 for the "Otherwise it could potentially make a situation much worse." $\endgroup$
    – Quentin H
    Jul 11, 2019 at 15:51
  • $\begingroup$ How can it make a situation much worse when there is no pilot input? Isn't an aircraft that has some control by the autopilot more safe than one that has no control at all? If it is a matter of fear of the autopilot making sudden, unwanted movements in the case of sensor failures, etc then wouldn't this trivially be solved by having a time delay from a programmed desire to disengage, before (in the event of no input at all) the autopilot re-engages and attempts to maintain some sort of control? I understand that some autopilots have little to no software involved, but surely capabilities vary? $\endgroup$
    – AlphaCentauri
    Jul 12, 2019 at 11:27
  • $\begingroup$ @AlphaCentauri Let's say you have heading and altitude mode engaged and you lose your left engine. The right one is only at 50% throttle so it can't maintain altitude. As your airspeed bleeds off, you will start to yaw to the left. Now you are uncoordinated approaching a stall... what happens next? As you enter the spin, now you have the autopilot applying rudder for you, which you don't want. Hurry up, disengage the autopilot, feather the left prop, ailerons neutral, elevator down, rudder against the turn. Do you remember where the button is to disengage (it isn't always on the control wheel) $\endgroup$
    – Ron Beyer
    Jul 12, 2019 at 12:09
  • $\begingroup$ With my idea, and in my scenario (no pilot input)? The autopilot disengages immediately, waits some reasonable time (say 10 seconds) for pilot input, then re-engages if there is no pilot input. After re-engaging, is will attempt to use whatever authority it has over the plane to keep it level, even if this involves bringing the nose down. Without my system, the autopilot would disengage and never come back. With no pilot input, the plane would probably do rolls like in the 1999 Learjet case and eventually (almost certainly) crash a lot harder than during a somewhat controlled crash. $\endgroup$
    – AlphaCentauri
    Jul 12, 2019 at 12:12
  • 4
    $\begingroup$ Aircraft are naturally stable, they should return to a level flight (within an envelope) if they are left with no inputs (hands off). This is why just "letting go" is sometimes better than trying to fight it. For example I believe the C-152 will happily exit a spin if you just "hands-off". The learjet you are talking about wasn't doing rolls in level flight, it was pointed almost straight down at the time... $\endgroup$
    – Ron Beyer
    Jul 12, 2019 at 12:13
8
$\begingroup$

Other answers already stated that autopilots are essentially very simple things. Especially for someone with an IT background.

In some autopilots, there are modes for such events. For example, some G1000/G3000 on light jets are equipped with Emergency Descent Mode (EDM). What does it do?

  • Automatically activates when cabin pressure is lost above a certain altitude (~30000 ft).
  • Sets Altitude Hold for 15000 ft. This is a compromise altitude where air is breathable but no obstacles are expected.
  • Changes course to 90° to the left so as not to descent through an airway.

Simple, and very far from AI. Furthermore, it gets worse by the fact that on many aircraft, and most light aircraft, there is no autothrottle, or if there is, it is often decoupled from the autopilot. So, if the pilot is unconscious and cannot reduce thrust (and ideally deploy speedbrakes), this 'emergency descent' turns into a smooth cruise descent at the maximum allowed airspeed, some 300-1000 fpm, if any at all.

Once again, this is rather a tool to reduce workload, rather than a 'pilot'.

Why so? This is a separate philosophical question. But generally, while a human pilot is ultimately responsible in the cockpit, the pilots (and aviation in general) prefer known deterministic solutions rather than unpredictable 'intelligence'. Many incidents already stem from pilots' confusion about what the aircraft is doing; adding 'smarts' here can add to that. But may improve in some cases. There is just no obvious answer like 'just throw more computing power at it'. Just think of the 737MAX/MCAS ordeal.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ Note that Emergency Descent Mode was developed in direct response to the South Dakota Learjet crash cited and has far lower complexity (and thus risk) than the OP's proposed solution. $\endgroup$
    – StephenS
    Jul 12, 2019 at 15:11
7
$\begingroup$

The autopilot is designed to do exactly what it's told, until it can no longer safely do so. At that point the situation is beyond what the autopilot is designed for, so it hands control back to the pilots. Even modern autopilots aren't designed to do much descision-making on their own, let alone a Learjet designed in the 1970's.

Adding some sort of functionality to "fly the plane down" in such a situation would add complexity to the system for very little benefit. This sort of situation is fairly rare. And most of the world is water, with much of the rest being not very flat. It's extremely unlikely that for all that effort such a system would be able to make any survivable landings.

And even if it could make a survivable landing, we're talking about crew and passengers that could have been passed out for hours, and might not surive that anyway. Perhaps there's some value in a sort of "dead-man's switch" that would automatically bring the plane down if the pilots fail to respond, but this has most of the same issues above.

There's also the issue of adding yet more automated features to the flight controls. How do we handle situations where this malfunctions, and starts unexpectedly descending the plane for no apparent reason? That sort of thing would be especially unpopular right now.

Some fighter jets do have a system called Auto-GCAS that is designed to stop an unconscious pilot from flying into the ground, but that's a much more simple problem to solve than getting on the ground safely.

Improve this answer
$\endgroup$
1
4
$\begingroup$

The general philosophy is that autopilot is a tool, not an extra pilot, and as such, it disengages when anything goes seriously wrong. Inertial sensor failure? Engine loss? Unusual attitude? Hand control back to the pilots with a nice warning sound. This option isn't taken lightly, especially in high-workload situations like landing, but it's the general solution to rare conditions.

Yes, it may seem from a software perspective like a small feature to add robustness here and there's certainly room for innovation, but the cost and liability to develop for rare and even dangerous situations is generally not worth the rare benefit it provides. For example, here the autopilot disengaged because the plane went below stall speed or vmin. The standard solution to a stall is to descend and increase throttles to build up speed again, but automated stall recovery has complications like traffic and terrain avoidance, and thrust-management integration. Automated stall recovery is especially tricky when you have no fuel as in this incident, or back in 1999 when enhanced TAWS and TCAS II was fairly new and before GCAS.

Additionally, preventative solutions now exist that make the cost-benefit analysis here even more lopsided. First, it should be noted that in general, planes are stable and flying without pilot or autopilot input causes the plane to fly more or less straight and level, although that did little good here. Automated pitch-based low-speed protection or AoA protection are standard on some aircraft like Dassault jets. Airbus and other companies have developed a rapid/emergency descent feature to handle incapacitated pilots due to depressurization. Fighter jets are developing an auto-GCAS as fooot has mentioned that's already saved the lives of some incapacitated pilots.

Improve this answer
$\endgroup$
4
  • $\begingroup$ I think the general design philosophy is that if the auto pilot were to merely politely indicate that a human pilot should take control, that may lead to situations where a human thinks the autopilot is flying the plane when in reality nothing is controlling it. That having been said, it might be useful to have a "human emergency" switch to indicate to the control system that even though there should always be a human in position to take over at a moment's notice, reality has intervened. Rules may forbid the use of such a switch in non-emergency situations, but if, e.g., ... $\endgroup$
    – supercat
    Jul 11, 2019 at 17:51
  • $\begingroup$ ...an aircraft has two pilots on board and no other personnel, and one of the pilots goes into unexpected cardiac arrest during what's expected to be straight and level flight on an IFR-cleared path, I would think having one pilot try to rescue the other after triggering an automated "human emergency" distress call and setting instruments to fly the plane, would be better than simply letting the incapacitated pilot die. $\endgroup$
    – supercat
    Jul 11, 2019 at 17:55
  • $\begingroup$ @supercat The current generation of autopilot will already accommodate that scenario in normal flight , however if there is both an airplane and pilot emergency , from a triage perspective the non-incapacitated pilot should probably continue to fly the plane. $\endgroup$
    – crasic
    Jul 11, 2019 at 18:11
  • $\begingroup$ @crasic: A pilot who is expecting or handling an airplane emergency should obviously remain at the controls, but if dealing with a "[possibly human] contents of airplane" emergency during seemingly-normal flight has caused the pilot to leave the controls, the risk calculus of whether unexpected turbulence should cause an autopilot to hand controls to the pilot who isn't there, or attempt to fly the plane as well as it can until the pilot gets back, would seem to favor the latter even though, with a pilot present, it would favor the former. $\endgroup$
    – supercat
    Jul 11, 2019 at 18:18
4
$\begingroup$

The cruise autopilot behaves this way by design. From this answer: design parameters for aircraft system safety.

enter image description here

For airborne systems, a very thorough analysis is made on failure probability and on failure modes.

  • A safe failure mode is: the system stops functioning completely. An unsafe failure mode: an unintended output, such as a hard-over fail of a hydraulic actuator with a stuck servo valve.
  • Also, you want the system to only carry out its intended function. It is hard though to predict everything that can ever happen, and both for safety and cost reasons the system is simply completely disengaged and the pilots notified.

The cruise autopilot has relatively low reliability requirements because the pilots take over when the system fails. At cruise, there is sufficient buffer in altitude and reaction time for a response to autopilot failure, so the A/P is designed to be Fail Passive: it simply disconnects upon any detected anomaly, while notifying the pilots. "Your job now."

Notice that the autopilot functioning during landing, the CAT III auto land capability, has much more stringent safety requirements: functional failure less than once every million hours instead of once every 1000 hours for the cruise autopilot. This is because during landing the ground is very nearby, speed is very low, and there is no time for safely transferring control to the flight crew. So the auto land system is designed to be Fail Active: three redundant channels perform exactly the same job, upon failure of one of these the other two disengage the failed channel and continue automatic landing.

With the cruise autopilot, no redundant channels are required because there is a flight crew :)

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ I love the diagram type. I've never seen it before, but it's a nice way to conceptualize reliability. $\endgroup$
    – monocell
    Jul 12, 2019 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .