Two men in a helicopter with one holding an ipad.
Lt Col Eric Wilks and Lt Col Marvin Ashbaker, pilots with the 465th Air Refueling Squadron, Tinker Air Force Base, OK, conduct pre-flight checks aboard the Air Force Reserve Command’s first KC-135 to be upgraded with Block 45. Block 45 provides a digital display of engine controls, an updated autopilot, a new altimeter and software upgrades, ensuring that the KC-135 can perform well into the future as the workhorse of the air refueling fleet. USAF photo by TSgt Lauren Gleason
A man in blue gloves is holding something
NTSB investigators and a member of the recovery team retrieving the flight data recorder of Atlas Air Flight 3591, a Boeing 767-300 cargo jet that crashed in the muddy marshland of Trinity Bay, Feb. 23, 2019, about 30 miles from Houston’s George Bush Intercontinental Airport. NTSB photo
Two people in lab coats and gloves working on a cooler.
NTSB engineers Sean Payne (left) and Joe Gregor, removing the cockpit voice recorder from a cooler used to transport it from the Feb. 23, 2019 accident scene of the cargo jet that crashed in Trinity Bay in Anahuac, TX. NTSB photo taken by Keith Holloway

The Potential Pitfalls of Automation

By MR. STEVE PANGER, HQ AMC FLIGHT SAFETY

Back in the day, I flew aircraft that had minimal automation. Pilots flew aircraft manually during many phases of flight. Autopilots were great but used sparingly outside the high-altitude cruise portion of flights. Today’s flying environment calls for significantly more use of automation. Although this can ease a pilot’s workload, it can also lead to situations in which it degrades or malfunctions, and the pilot is reluctant or unable to recover an aircraft from a hazardous condition manually.

The following unfortunate mishap illustrates that some pilots may be too reliant on automation and unwilling or unable to revert to manually flying an aircraft when events start spiraling out of control.

On February 23, 2019, a cargo company’s Boeing 767 was destroyed after it rapidly descended from an altitude of about 6,000 feet Mean Sea Level and crashed about 41 miles from Houston, Texas. The captain, first officer (FO), and a nonrevenue pilot riding in the jumpseat died. The mishap flight’s departure, en route cruise, and initial descent were uneventful. As the flight descended toward the airport, the flight crew extended the speed brakes, lowered the slats, and began setting up the flight management computer for the approach. The FO was the pilot flying, the captain was the pilot monitoring, and the autopilot and autothrottle were engaged and remained engaged for the remainder of the flight.

The analysis determined the aircraft encountered light turbulence, and the airplane’s go-around mode was activated. This location and phase of flight were inconsistent with any scenario in which a pilot would intentionally select go-around mode.

Neither pilot made a go-around callout to indicate intentional activation.
Within seconds of go-around mode activation, manual elevator control inputs overrode the autopilot and eventually forced the airplane into a steep dive from which the crew did not recover. Only 32 seconds elapsed between the go-around mode activation and the airplane’s ground impact.
Why did this happen? It is possible that the pilots were too dependent on automation. Automation dependency is a pilot’s reliance on aircraft automated systems to the point at which it can lead to a sense of complacency. Pilots may become fully confident in their ability to control the plane only when using such systems’ full functionality.

Automation dependency can definitely affect incidents when automation starts to malfunction. Pilots may be reluctant to voluntarily reduce the extent to which they use full automation capability to deal with any situation—routine or abnormal. If the full automation capability is degraded or no longer available, pilots may tend to partially retain the use of automated systems rather than revert to manual aircraft control. It usually stems from a combination of inadequate knowledge of the automated systems themselves unless all are employed. If pilots do not fully understand the aircraft’s automation, it can trigger a degree of task saturation for both pilots and lead to a loss of situational awareness.

Entirely relying on automation can obviously erode basic flying skills. When faced with a situation in which the automation degrades to the point at which the aircraft enters an undesirable state, can pilots reliably disconnect the systems and revert to hand flying?

A related issue with automation is the need for updating flight information. The need to program flight computers and manage them in flight can lead to heads down inside the cockpit rather than looking outside. It can happen during all phases of flight but is especially hazardous when operating in a busy airfield environment. This can contribute to a loss of situational awareness and, ultimately, an undesired aircraft state if not arrested quickly.

In the previously mentioned mishap, the National Transportation Safety Board (NTSB) determined that this accident’s probable cause was the inappropriate response to the inadvertent activation of the go-around mode by the first officer as the pilot flying. It led to his spatial disorientation and nose-down control inputs that placed the airplane in a steep descent from which the crew did not recover. Contributing to the accident was the captain’s failure to monitor the airplane’s flight path adequately and assume positive control of the aircraft to intervene effectively.

We are all familiar with the two mishaps involving the 737 MAX aircraft, which involved the aircraft entering an undesirable aircraft state, loss of aircraft control, and a considerable loss of lives. It appears the mishaps were the result of a critical software system called the Maneuvering Characteristic Augmentation System (MCAS) malfunction. The MCAS was designed to activate under certain conditions automatically. It would automatically disengage when pilots overrode the system with manual trim. Did the pilots attempt to disconnect any of the automation and try to recover the aircraft manually? Although it seems that this automation malfunction contributed to these mishaps, the NTSB is still investigating and has not yet released its findings.

Automation errors can occur in almost any phase of flight and should never be totally relied upon without continuous verification and monitoring. Both pilots need to ensure that at least one of them will always fly the aircraft, especially if the other is downloading information in the computer. Automation can be a wonderful thing, but it also can bite you in the end if you become complacent and lose situational awareness. Fly (and monitor) safely!