by Jeremy C.-H. Wang, Chief Operating Officer, Ribbit
When Lawrence Sperry invented the first autopilot in 1912, it was a gyroscopic stabilizer designed to hold heading and altitude. More than a century later, today’s autopilots and autothrottles are complex systems that can follow three-dimensional paths, manage power during takeoffs and go-arounds, and land airplanes. In the years ahead, automation—and, indeed, autonomy—will continue to enhance crew resource management, precision navigation and efficient performance, especially in long-duration flights. However, when these systems fail, are designed poorly or are operated incorrectly, the results can be disastrous. As autopilots continue to become more pervasive and capable, it’s helpful for pilots and manufacturers alike to consider the most common problems for automation-related accidents.
Wiener and Curry’s NASA reportFootnote 1 offers an excellent review of typical automation issues where the human pilot may function as or switch between being a passive monitor (supervising automated activities) and being an active controller (assuming manual control). Although authored in 1980, the report presents timeless guiding questions for automation development and operation.
Credit: Jeremy Wang
Canada's first autonomous fixed-wing airplane demonstrator, which completed the first hands-free gate-to-gate flight in Canada in 2023 while under contract to the Transport Canada Innovation Centre
Based on Ribbit’s experience developing highly automated and autonomous autopilot systems, a modified and expanded list of guiding questions is offered below for both builders and operators of modern aircraft. Manufacturers may use these questions to guide autopilot development, ergonomics analysis, flight deck design and certification. Operators and instructors may use these questions to assist the development of ab initio, line indoctrination and recurrent training programs. A contemporary review of automation-related aviation accidents is available from GawronFootnote 2.
Division and transition of control
- Failure detection: For which failures and under what conditions does the pilot detect failures more reliably as the passive monitor? As the active controller?
- Context switching: How long should/does it take for the pilot to “warm up” when they transition from passive monitor to active controller? How fast should/does the pilot “relax” after automation is turned on?
- Setting changes: Should/does the automated system inform the pilot after making a change, or only make changes after the pilot has approved? Should/does the automated system disclose the reason for the change?
- Override vs disengage: Is it safer for the pilot to assume active control by overriding the automation system while it’s still engaged, or by disengaging the automation system?
- Reliability: How do different levels of equipment reliability affect the pilot’s ability to detect, diagnose and treat failures? Is the perception of high reliability leading to complacency or low reliability helping to maintain vigilance?
Acquisition and retention of skills
- Deterioration: How quickly do manual skills deteriorate? What factors affect the rate of loss?
- Practice frequency: Can periodic practice prevent deterioration? If so, what frequency is required?
- Types of practice: Are there alternatives for practice with the actual system, such as simulators?
- Quality control: What quality control techniques or programs are needed to ensure skills are maintained?
- Overall capability: Does the automation system in question enhance the pilot’s overall capabilities, especially with complex tasks, by having some of the subtasks automated?
Monitoring
- Performance degradation: Does complex monitoring performance degrade with time on watch?
- Rare situations: What are the means for maintaining alertness for rare occurrences?
- State awareness: Is the pilot’s understanding of the automation system’s different states and behaviour in each state consistent with reality?
- Interpretability: What makes the automation system interpretable? How are the different possible malfunctions communicated or made noticeable?
Alerting and warning
- Design & gaps: What are the characteristics of an ideal alerting system? What is missing, and how are those gaps being filled?
- False alarms: What would be an unacceptable false alarm rate? What are the causes and effects of a high false alarm rate?
- Missed alarms: Why are alarms going unnoticed?
- Primary vs backup: When should/does the pilot rely on alerting and warning systems as primary versus backup devices?
- Alarm validity: When should/does the pilot choose to check the validity of an alarm?
- Preview: Should/doalarms accompany a preview of a corrective action or subsequent escalation if no action is taken?
- Complexity: Is the logic for alerting and warning systems too complex for the pilot to verify or trust all alarms that could be issued?
Psychosocial aspects of automation
- Perception: How does the automation system influence job satisfaction, prestige and self-esteem?
- Mitigations: What precautions and/or remedies should be taken to counter the negative effects?
- Job requirements: How does the use of the automation system affect pilot recruitment, hiring and selection processes?
- Training: How should training programs be designed to manage psychosocial effects?
Credit: Jeremy Wang
Canada's first autonomous fixed-wing airplane demonstrator, which completed the first hands-free gate-to-gate flight in Canada in 2023 while under contract to the Transport Canada Innovation Centre