The Computer vs. the Captain Will Increasing Automation Make Jets Less Safe?
Part 3: How Much Control Should Remain with the Pilot?
This casts a new light on the question of the role man should play in this system in the future. Safety expert Learmount asks: "How much control should remain with the pilot, when should a computer intervene, and what should the interface between man and computer look like?"
The pilots themselves are calling for a discussion of how their profession sees itself. "We have to turn men and computers into a jointly operating unit," says Nikolaus Braun of the pilots' union Cockpit. More technology, he says, should by no means mean less human presence in the cockpit. On the contrary, pilots become even more necessary as system complexity grows. "Their training has to be improved, not reduced," says Fran Hoyas of the European Cockpit Association (ECA).
Reiner Kemmler, a flight psychologist with Lufthansa for many years, is convinced that technology confronts pilots with new challenges. "Visually speaking, they have reached the limits of what the human sensory perception system can handle," Kemmler warns.
Step by step, man has had to give up control over machines. The first flight computers were introduced in the military. It would be impossible to control today's fighter jets, given their unstable flight behavior, without the help of computers. The military systems later reappeared in the legendary supersonic jet, the Concorde.
Finally, Airbus, still a young aviation company at the time, revolutionized its fleet with an innovative, digital aircraft system that quickly came to be known in the industry as fly-by-wire, and it came with the promise of unprecedented safety. For this reason, writes aviation expert Learmount, it was afflicted from the start with a "psychological side-effect analogous to the talk of the unsinkability of the Titanic." When the A320 took off on its maiden flight in 1987, the unofficial Airbus advertising slogan had already been circulating in the industry for some time: The highest-paid passenger is sitting in the cockpit.
First and foremost, fly-by-wire means that the pilot's control commands are transmitted electronically to the hydraulic actuating cylinders of the tail assembly with the aid of cables ("wires") instead of through a mechanical rod system and cable controls. But there is also another key difference between the concept and conventional designs: There are always computers connected, as control systems, between the pilot and the tail assembly. These computers monitor all control pulses and correct them if necessary.
"Novices erroneously think of the autopilot, which can be switched on and off," explains Gerhard Hüttig of the Flight Simulation Center in Berlin. The autopilot is also a factor, but it is only one of many, and it guides the airplane along a course pre-programmed by the pilot. But Airbus's flight computers do a lot more. They are automatically activated if the aircraft enters a dangerous angle, loses too much speed or threatens to complete a violent rolling motion. The Airbus engineers christened the software, which is designed to keep the aircraft within a green zone at all times, "Flight Envelope Protection." "The computers intervene," explains Hüttig, "no matter how hard the pilot pulls on the controls."
The flight professor provides a live demonstration of how this happens -- not in the air, but safely on the ground in downtown Berlin, where his center has installed a state-of-the-art flight simulator. Hüttig sits down in the front left seat of an A330 cockpit. "This corresponds almost exactly to the Air France plane that crashed in the Atlantic," says the scientist.
He leaves the takeoff from Munich Airport up to his inexperienced co-pilot. Then, for illustrative purposes, he turns to his own control device. It looks like a joystick, hardly bigger than that of a computer game. "This is the most visible part of the fly-by-wire technology," says Hüttig.
He pushes the control device, known as a sidestick, all the way to the right. It immediately becomes apparent that the computer is indeed along for the ride. The flight simulator's hydraulic legs buckle, creating the sensation of banking gently to the right. "In fact, the airplane ought to have turned so sharply to the right that it would overshoot and, in the extreme case, would roll over," Hüttig explains.
But that is precisely what the computer is there to prevent. In an instant it has calculated, based on the position of the airplane reported by sensors, by how much the plane can turn without creating a hazard.
In the real world of aviation, the equivalent of this maneuver would be another plane approaching from the left. "If the pilot panicked and steered too far to the right to avoid a collision, the computer would prevent him from making a flight error," the aircraft engineer explains.
Boeing installed a similar system into its 777 long-haul aircraft in the mid-1990s. The Boeing 787, the company's latest model, will contain even more of these automated flight systems, and today's Boeing 737s already have various automated components.
A Split in Digital Philosophies at Airbus and Boeing
But there is a difference between the American and European concepts. In the case of Airbus, the pilot is essentially prevented from disabling the flight computers. Unlike the autopilot, the flight computer can only disable itself, and only if its systems become so confused that it would otherwise malfunction.
In other words, the pilot in the Airbus flight deck is constantly digitally monitored and provided for. This new safety philosophy seemed irresistible at first. Nevertheless, its introduction was accompanied by a disaster. Three months after the initial delivery of the A320, an Airbus crashed, in front of live cameras, into a forest during an air show in Alsace in 1988. The image of a huge cloud of smoke rising above the treetops seemed like a bad omen, and some believed Airbus would never recover from this setback.
Was it merely a mishap, practically unavoidable whenever a new technology is introduced? Or did it expose a fundamental weakness in the new Airbus philosophy?
The experts argued passionately over the question. Some said that the computers and the pilot were not communicating properly in what was a complicated flight maneuver. Airbus still maintains that the pilot's behavior was not sufficiently disciplined.
Another accident occurred five years later, on a stormy day in Warsaw. In heavy wind and rain, a Lufthansa A320 slid off the end of the runway and broke apart. Two people died. The wind had suddenly turned, and perhaps the pilots should have aborted the landing. Instead, they carefully brought down the plane. Because of hydroplaning, the tires did not rotate on the wet runway. This confused the flight computer, which failed to recognize that the jet had already touched down. The system hesitated for nine seconds before the flight computer finally allowed the thrust reversers and brake flaps to engage -- nine long seconds in which the pilots were forced to look on helplessly as the jet rapidly approached the beaconing at the end of the runway.
At the time, Boeing more or less openly touted its own strategy, which gave the pilots more options to intervene. It cited the case of a Boeing 747 that two Chinese pilots had saved from an almost hopeless situation, in which the craft was exposed to four times the force of gravity. The Airbus computers wouldn't have allowed the pilots to perform such a radical maneuver.
Airbus fired back with its own examples. One was of a Boeing 757 that had crashed in Columbia, killing 159. The collision warning system had warned the crew of an impending collision. The pilot pulled up the plane, but it failed to clear the mountain ridge it was approaching, because he had forgotten to retract the brake flaps. An A320, Airbus said, would have done this automatically.
The PR battle has since been decided, according to the aircraft maker based in Toulouse, France, where a senior safety official says: "The accident statistics prove that we were right."
His claim is difficult to refute, because a meaningful comparison of accident figures between Boeing and Airbus models doesn't exist. However, the statistics also do not suggest that there is a clear advantage to the Airbus strategy. Aircraft made by both manufacturers crash, and whenever it comes time to investigate the causes of an accident, Airbus takes pains not to allow any questions to be raised about its fly-by-wire system. The company has played down the Qantas incident, saying that speculation is pointless before the ATSB releases its final report. This is even more applicable, says Airbus, to the case of the Air France A330 crash.
Boeing or Airbus? Among pilots, this has become almost a question of faith. "That's just as hard to decide as the question of whether Mercedes or BMW is better," says pilot representative Braun.
The controversy is kept going by accidents and incidents involving fly-by-wire computers. And again and again pilots, such those of the Lufthansa plane that almost crashed in a crosswind in Hamburg, run into new, nasty surprises that none of the engineers had predicted.
The engineers don't allow such unforeseen events to unnerve them, at least not visibly. "Redundancy" is the magic word with which aircraft developers attempt to placate pilots. So many computers are operating in parallel, they say, that problems in one computer do not spell disaster. Five flight computers are installed in an Airbus like the A330: three primary and two secondary flight computers. To provide the greatest possible security against a complete crash of the system, the software is written in different countries, by different companies and in different programming languages.
But even this much redundancy cannot provide 100-percent protection. Digital chaos erupted on board a South American airliner as it approached Chicago. Because of a broken spring, the main switch of one of the flight computers would not remain in the "On" position and began to rapidly switch the computer on and off. The resulting confusion disabled the other flight computers.
In 2005, the pilots of an Airbus plane en route from London to Budapest experienced something that, according to the engineers' logic, shouldn't even happen: the failure of all monitors except the one displaying the error messages. The system was so severely disabled that the pilots were unable to transmit a "Mayday" alert.
- Part 1: Will Increasing Automation Make Jets Less Safe?
- Part 2: Digital Technology Has Improved Safety, But it Can Still Present a Threat
- Part 3: How Much Control Should Remain with the Pilot?
- Part 4: The Glass Cockpit
- Part 5: At What Point Do Pilots Become Redundant?