Are cockpits controlled by pilots or software?
When an altitude sensor failed on a Turkish Airlines Boeing 737 flight to Amsterdam in 2009, the jetliner’s computerized flight controls erroneously cut the engine thrust. The pilots didn’t understand what happened in time to prevent a crash.
The accident had striking similarities to the recent Lion Air tragedy in Indonesia, which took the lives of 189 people. A failed sensor led flight computers to put the 737 MAX jetliner into a series of dives, based on the erroneous calculation that it was losing lift and about to stall. The crew didn’t diagnose the problem, which could have been remedied with the flip of a switch, and the plane fell into the Java Sea. The investigation into the crash is ongoing.
Aviation experts say automated systems have made planes safer than ever and are a major reason why crash rates have declined all over the world. The push to automate • which also reduces airlines’ training costs • is only growing stronger. Boeing has a research project in the works to develop a fully automated jetliner. A company spokesman said last month that testing was ongoing.
But automated flight systems are also implicated in a series of incidents in which they made the wrong decisions and pilots did not fully understand the complex software that adjusts flight controls constantly during automated takeoffs, landings and high-altitude cruising.
“A lot of the optimization that the computer is doing is not made clear to the pilot,” said Douglas Moss, an instructor at USC’s Viterbi Aviation Safety and Security Program. He is a former United Airlines captain and before that, an Air Force test pilot, as well as an attorney. “The pilot is sitting there for 10 or 15 seconds trying to figure out why the computer is pitching up the nose or adjusting the throttle. I can think of thousands of times when the autopilot or flight management system would do something that caught me by surprise. Almost always, it is the right thing to do, but it is the pilot who is responsible for the safety of the flight.”
The two accidents also highlight the potential risks of basing automated flight control decisions on readings by only two sensors • which can create uncertainty when one fails.
Boeing and Airbus, the dominant international manufacturers of large jetliners, declined to provide detailed information about how many sensors their aircraft models have for various critical measurements, such as altitude, airspeed and angle of attack, citing the ongoing Lion Air investigation.
But Federal Aviation Administration documents reviewed by The Times, along with interviews of union officials and aviation experts, point out that some, though not all, aircraft have three sensors for critical readings, allowing a computerized voting system to eliminate a discrepant sensor.
Aviation experts say the pilots’ authority, certainly outside of the U.S. and Western Europe, is being gradually encroached on by automated control systems that offer air carriers lower training costs and crew expenses in an increasingly competitive international industry. It has led to a decline in basic manual flying skills, the ability to use the stick, rudder and throttle to keep a plane at the correct speed, pitch and altitude, a wide range of safety experts say.
“Pilots are not being told or taught everything they need to know about their airplanes,” said Chesley Sullenberger, the renowned pilot who made an emergency landing on the Hudson River a decade ago that saved every person on board.
“It is not easier or cheaper or requires less training to fly an automated airplane. It frequently requires more, because you have to have a deep understanding of how a system works, including the dark corners, the counterintuitive things it might do in certain circumstances. Many foreign carriers are trying to take people with zero flying experience, put them in simulators and quickly put them in the right seat of a jetliner. They don’t have the experience, knowledge, skills and confidence to be the absolute master of the aircraft start to finish.”
Dennis Tajer, an American Airlines captain and spokesman for the Allied Pilots Assn., agrees automated systems should result in more pilot training, not less.
“It makes the aircraft a bit more complicated, so understanding that, being able to utilize it and making it a part of your safety standard is critical,” he said. When a piece of equipment fails, it’s incumbent on the pilot to keep control of the plane, he said, adding, “stick and rudder skills save lives.”
The U.S. airline industry agrees, and Boeing doesn’t dispute the value of pilots.
Company executives have questioned where global airlines are going to get all the pilots needed to fly the planes that are on order and expected over coming decades.
As air travel increases rapidly around the world, many foreign carriers are coming to depend on automated controls to help flight crews that do not routinely have the deep experience, military background and intensive training that is common among major U.S. and Western European airlines. American experts are growing increasingly concerned that such crews are reluctant to fly aircraft manually and lack the skills necessary to intervene when computers make the wrong decisions.
Those concerns were at the forefront in the crash of an Asiana Airlines Boeing 777 at San Francisco in July 2013, which killed three and injured 187. The crew had inadvertently disengaged the auto throttle, which is akin to cruise control on an automobile, as it made its final approach. The airspeed and altitude varied widely over the prescribed glide slope and the plane’s landing gear and tail hit the concrete sea wall at the far edge of the runway. Federal investigators blamed the accident on improper speed and altitude control, noting that Asiana Airlines emphasizes the use of cockpit automation. As a result of similar policies, many crews from nations around the world have limited hands-on manual flying skills.
In the Turkish Airlines and Lion Air accidents, the pilots should have been able to manually fly the planes out of harm’s way, experts say.
In the Turkish Airlines flight, one of the aircraft’s two radar altimeters reported that the plane was eight feet below the ground, leading the computer to think it was about to land and triggering an automatic reduction in the throttle. In fact, the aircraft was at about 2,000 feet and the crew was trying to reduce airspeed on the approach. But the crew did not realize the power settings had been cut to idle until it was too late, and the plane crashed a mile short of the runway. Nine people were killed.
In the Lion Air accident, one of the plane’s two angle-of-attack sensors, which measure the angle at which the wings are moving through the air, failed on takeoff from Jakarta. The aircraft’s autopilot disregarded the good sensor and followed readings of the discrepant left side, or captain’s sensor. As a result, it triggered software meant to offset the aircraft’s tendency for the nose to pitch up.
Such a nose-high attitude can reduce lift and potentially stall the jetliner. But in this case, the software • the maneuvering characteristics augmentation system, or MCAS • was responding to wrong data and putting the plane into a dive. It is similar to what is known as a “runaway trim,” which can be caused by as many as five problems. Some experts say the crew should have known how to flip off the MCAS and manually fly the plane, which is what another crew had done the day before in the same plane. Instead, the captain repeatedly attempted to pull up the nose and never correctly diagnosed the problem.
"Automation complacency is a huge issue,” said Andrew Skow, founder of Tiger Century Aircraft, which develops cockpit safety systems, and a former Northrop Grumman chief engineer and flight test director. “If an automation system has control and is right most of the time, you become complacent.”
Skow said automation systems often fail to consider unintended effects, which occurred in the Turkish Airlines and Lion Air accidents. He also faults Boeing’s design of the MCAS, saying it trimmed the nose down at too fast a rate, because it was designed to be engaged at a lower speed. At 250 knots, it was generating violent nosedown movements that the crew could not counteract.
Boeing declined to comment on the matter, citing the pending investigation.