What The Boeing Crashes Teach Us About The Limits Of Automation

As the Boeing fiasco shows, current state of automation is far from replacing humans out in the environment

An airplane is what control theory calls a coupled system. That means that a given input produces more than one result. For example, depressing the gas pedal in a car results in but a single outcome: an increase in speed. In an airplane, advancing the throttle during straight and level flight results in an increase in airspeed, but also in the angle of attack, meaning that the nose of the plane pitches up, which in turn increases lift and causes the airplane to gain altitude and subsequently lose airspeed. Therefore, if the pilot wishes simply to increase speed while maintaining straight and level flight, he must advance the throttle and simultaneously apply forward pressure to yoke in order to keep the pitch angle from increasing.This is the direct effect. There are secondary effects as well. Increased airspeed causes the aircraft to interact differently with the air mass around it and the pilot must be vigilant to enter corrective inputs with the the rudder and the ailerons (control surfaces on the wings that affect the roll angle in order to maintain straight and level flight.

In a car, a turn of the steering wheel will cause the car to turn. In an airplane, a rotation of the yoke or applying lateral pressure on the stick will roll the wings and cause the plane to turn, but it will also result in a loss of lift, causing the nose to pitch down and, since the aircraft is a free body in space, it will cause it to slip sideways. A simple turn maneuver then, requires several inputs, rotation of the yoke while applying upward pressure to maintain the pitch angle, advancing the throttle to guarantee sufficient power through the maneuver, and finally applying rudder to eliminate slip. All of these are only the direct inputs. Secondary inputs will be needed to correct for the change in how the aircraft interacts with the air mass around it while performing the turn maneuver. A skilled pilot, without realizing, almost automatically, is constantly solving in his head a set of coupled differential equations, a difficult task indeed.

That being said, these equations are known to us and can be programmed into a computer. Since modern commercial aircraft are all “fly by wire”, meaning that yoke, rudder, and throttle inputs do not go directly to the control surfaces and the engines, but rather to the computer, which in turn translates them into electrical signals to servo motors and fuel injectors, fully automated flight is possible. In this regime, an on-board computer, known by various acronyms, but here we will simply call it an autopilot, solves the flight equations given inputs from various sensors with the goal of maintaining a flight regime set by the pilot. In this flight regime, the pilot serves as a computer operator, entering navigational information based on the approved flight plan and the required altitude, rate of climb or descent, and airspeed for each phase of flight. The actual inputs to the control surfaces and the engines are calculated by the computer and it is the computer that sends the electrical signals needed to execute the necessary adjustments.

The Truth Hurts In Brazil

Problems arise when one of two things happen: there is failure(s) in the sensor input or any other part of the system, or the information provided by nominally functioning sensors fails to adequately describe the environment in which the airplane operates at a given moment. Commercial and military pilots, in fact any pilot who wishes to safely make it to his destination, perform meticulous preparation work before every flight. They study the weather on route in great detail and create in their mind a detailed map of conditions that can affect the systems in the aircraft, conditions such as temperature, atmospheric pressure, icing, humidity, visibility, winds at all flight levels, and more. During all flight phases pilots maintain an acute awareness of what has been happening before the present, what is happening at the present, and what is likely to happen next. Every decision they make to register a control input represents the sum total of their combined understanding of each unique flight at each unique moment.

No sensor array, no computer today, is capable of mimicking the decision making process of an experienced pilot. Autopilots have a temporally and spatially limited view of the flight conditions and their algorithms are only capable of dealing with this contemporaneous data and computing based on this data solutions that are generally correct, but not necessarily correct for this particular airplane in these particular conditions at this particular time.

Preliminary data suggests that Boeing 737 Max, desiring to “stretch” the venerable 737 platform, equipped the airframe with bigger, heavier engines. These engines changed the center of gravity of the airplane, pushing it aft, outside of allowable envelope for safe handling. To solve this problem, Boeing redesigned the engine pylons, advancing the engines further ahead of the wings. It also introduced a subroutine into the maneuvering control assist system (MCAS), a type of autopilot, that gained up the sensitivity to high pitch angles on take off and climb to avoid possible stalls. A stall is what happens when the angle between the wing and the airflow around it is increased beyond a certain limit, causing the flow to detach from the upper surface of the wing resulting catastrophic and immediate loss of lift. The software was designed to command the control surfaces that affect pitch to push the nose of the aircraft down, reducing the angle of attack and avoiding stall.

NASA administers a data base into which pilots can anonymously enter comments about the equipment they operate and anything else that in their view affects flight safety. It is distinct from the FAA (federal aviation administration) database, which is not anonymous. It now appears that when it came to the Boeing 737 Max platform, pilots complained about unnecessary and extreme pitch down commands issued by the MCAS system during the initial climb phase of the flight, causing them to disconnect the autopilot and manually restore a safe flight regime. This represents a failure of the MCAS system during one of the most critical and dangerous phases of flight, a phase that is characterized by low altitudes, high power settings, and high wing loads, meaning that pilots have almost no time to do anything before disaster strikes.

President Trump, in his comments about wanting a flying professional in the cockpit rather than an “Albert Einstein” or an “MIT computer scientist”, spoke in his typical shorthand, but nevertheless was right on the money. The on-board computer represents the sum total of our knowledge, it might as well have been a top MIT computer scientist or an “Einstein”. What it doesn’t have, however, is the experience of thousands of hours flying a large variety of aircraft through an nearly infinite variety of atmospheric conditions. This experience is more intuitive than analytical and thus nearly impossible to program.

Autopilots are very useful, but increasingly also very dangerous. They are dangerous because they allow airlines, especially the extremely cost-conscious discount ones to skip on flight training, in particular the very expensive non-simulator kind and hire less experienced pilots and co-pilots. These pilots, in turn, are intimidated by the state of the art, highly sophisticated and very expensive aircraft they are asked to “fly”. Such a pilot may hesitate to disconnect the automation and take over the plane, hesitate to assume the true duties of the “pilot in command”. In the full-power, full-load, low altitude take-off and initial climb-out phase, a split second hesitation means death.

Boeing Pulls Down Dow After Weekend Crash

NASA database contains complaints from pilots not only on the failure of the MCAS system in the new Boeing 737 Max platform, but even more egregiously on the failure by Boeing to provide full and adequate documentation of the system and come up with the training program necessary to train pilots in its use. I don’t know if this is the result of negligence and cost-cutting or hubris and arrogance. Perhaps Boeing has decided that pilots didn’t really need to know what the MCAS was doing and why, all they needed to do was set the climb rate and sit back. Both are rationales are bad. Both represent a tremendous liability for Boeing, a horrible error in judgment for which the company should and surely will pay dearly.

The Boeing 737 Max is a great platform. Its problems will be fixed and it will log countless hours of safe flying. But the tragic crashes of the two aircraft teach us something profound about the limits of automation, something that we should pay attention to. What these failures tell us is that the current state of computing provides adequate solutions for systems that operate in highly stable and predictable environments such as factory floors and checkout counters. Aircraft and long-haul trucks are examples of systems that do not operate in regimes that allow safe operation under a fully automated regime. This is because their interaction with a highly variable and unpredictable environment presents a nearly infinite set of variables that can only be processed by operators that are sufficiently trained and experienced to possess in their human brains an intuitive matrix, a constantly updated lookup table, one that they can rely on to come up with safe and effective solutions for each unique situation. Each solution is unique. None is the same as before. Each adds to the operator experience.

Remotely piloted airplanes called drones, are of course, another matter. They are flown by qualified pilots and carry no human beings. But when actual aircraft are concerned, we must resist the cost-cutting pressures to convert pilots from highly trained, experienced, and compensated professionals into data entry and customer service specialists with gold stripes. We must equally resist the hype, promoted by scaremongering politicians, as to the current state of the art of automation. There is not much in common between checking you out at Walmart, or spot welding your automobile in a climate-controlled factory floor and piloting an aircraft or welding two pieces of steel together on an oil rig in the middle of a blizzard. Our technology is very far away from autonomously and safely operating out in the environment and we’d better keep that in mind. Go to flight school, become a welder. Your job will be safe for your lifetime.