When Flight Computers Crash - 3 Cautionary Tales | William Thomas Online | William Thomas

When Flight Computers Crash - 3 Cautionary Tales

    From sex to sashimi, we are rushing to turn every human endeavour over to robotic control. Intelligent machines are already sentencing lawbreakers, performing brain surgeries, controlling our vital water and energy grids, and writing many of the stories appearing in the Associated Press, Washington Post, Reuters and Los Angeles Times.

    As you read this, robotic systems are flying 10,000 airliners carrying 1.2 million passengers through this world's wounded skies, while their knob-turning pilots attempt to manage complex interactive systems no human – including their designers – fully comprehends.

    What could possibly go wrong?


Robot co-pilot flies & lands Boeing 737 -aviationcv.com

Robot co-pilot flies & lands Boeing 737 -aviationcv.com 




 Cautionary Tales


by William Thomas


Okay, so you’re almost bored swanning through Earth’s upper atmosphere at a high fraction of Mach. Except for the part of you that keeps protesting, “This is not natural.”

The main thing about flying a plane is not to stall more than a few inches above the runway. An airplane stalls when the wings are inclined so steeply, they lose lift and can no longer keep it airborne. This hasn’t changed since the Wright Brothers. 

When I was 16, I used to practice stalls in a rented Cessna by chopping power and pulling the nose up. With the stall warning horn blaring and the little two-seater suddenly tilting sharply towards the ground, I pushed the throttle forward and held the nose hard down, leveling off when flying speed was regained. Falling out of the sky is no biggie when there’s altitude to spare.

Presumably, the pilots up in the pointy end desire to live as much as you do. They’re doing an excellent job so far – turns are smooth and gentle, each thrust application uncannily precise. Here’s the captain now

“Howdy, folks. Roger Ramjet here. I’m the guy in front supposedly driving this thing. It is true that only my superhuman flying skills stand between you and fiery death. But fear not. I got this.”



In fact, both pilots are on a working holiday. Flirting with the flight attendants, yarning about their weekends, twisting a knob, updating the airplane's logbook, turning a dial, reporting in, gazing at the cloud deck far below.

The airplane has the airplane. Yes, that’s right. This thin-skinned conveyance hurtling through even thinner air near the hairy edge of its performance envelope is flying itself. Specially trained hominids still guide 350-ton airliners through the takeoff roll, before turning over control to the autopilot around 50 to 100 feet. And they usually hand-fly the last 200-feet of their final approach, after the aircraft has configured itself to land.

But that’s about it.

The remarkable news is that huge commercial jetliners are nearly sentient, with multiple redundant computers keeping the airplane within safe limits, while micro-responding to electronic navigation aids and control-surface feedbacks without human intervention. Airlines insist that algorithms do the aviating, because robots fly more smoothly and exactly than mere humans, saving expensive fuel, and wear-and-tear on engines and airframes.

The troubling news is that button-pushing airline pilots are losing basic flying skills that will be urgently needed when aircraft systems fail and befuddled flight-computers suffer paralysis. 

Or worse.


*   *   *

ANZ A320

Afternoon, November 28, 2008

After leasing one of their Airbus A320s to a German airline, Air New Zealand pilots and representatives are conducting a flight test prior to accepting the handback. The final exercise will drastically slow the jet to check its automatic stall protection, which should respond by nosing the airplane down, powering up both turbines and accelerating to full flying speed.

Instead of carrying out the stall test at the recommended 14,000 feet, the crew decides to conduct it at 4,000 feet on their return to the airport. No minimum airspeed to commence manual recovery is established. And no one onboard imagines that rinsing off the plane for delivery has introduced water into two angle-of-attack sensors needed to prevent an incipient stall. At higher altitudes during their test flight, those trapped water droplets have frozen.

The Pilot Flying retards the throttles and nudges back on his side-stick to tilt the nose up. Like a video game at home, there is no feedback, no “feel”, no sensation of control surface response. You just move it to make the digital displays read what you want. 

As their flying speed degrades, everyone in the cockpit is waiting… waiting… waiting for the automated stall protections to trigger.

Air France Airbus 330


Night, June 1, 2009

2229 GMT (7:29 PM local) Air France Flight 447 departs Rio de Janeiro for Paris. As the Airbus A330 “heavy” heads out over the Atlantic, 216 passengers and 12 crew are looking forward to the City of Lights they will never reach.

(The following timeline indicates total elapsed hours, minutes, seconds since takeoff.)

0148 Flying beyond ground radar coverage, co-pilot Pierre-Cédric Bonin picks up the first storm on the plane’s weather radar, some 200 miles ahead. Captain Marc Dubois is not impressed. He is reading a magazine and wants to talk about tax havens.

0151 The captain expresses concern that if they don’t climb about flight level three-six (36,000 feet), “we might be in trouble” with the weather. He adds, “It’s going to be turbulent when I go for my rest."

Bonin observes that reaching three-seven is “going to be a bit tight.” He’s already mentioned that they would have to wait for nearly an hour to burn off enough fuel to climb higher.

Roberts (ro-bare) returns from his rest. Did he sleep? Not really, he tells Dubois (doo-bwa).

0156 They are closing fast on the notoriously rough equatorial weather. So another 15-minutes flying should see them elbow their way through the storm cell bullies that typically crowd the ocean-spanning Intertropical Convergence Zone. 

“Should” is not a flying term. 

Bonin keeps asking when they are going to climb above the storm. But Captain Dubois demurs. With their present load of fuel and passengers, if they climb much higher they will be flying into the “coffin corner” where high-speed and low-speed stalling speeds edge together. Dubois elects to take his scheduled break, leaving the “airline baby” – Bonin, with 3,000 flying hours – to “monitor” the robot plane. 

“I didn't sleep enough last night. One hour, it's not enough,” Captain Dubois protests. He has spent the previous night and following “rest day” in Rio with his girlfriend, currently seated in the passenger cabin aft. 

0200:08 “Well then, I’m out of here.” The captain has decided that the storm they’re about to enter is not so bad after all. Like any weary executive, he disappears into the tiny flight-rest compartment behind the cockpit. 

Airbus initially wanted to call the pilots of its new automatic airliners, “flight managers”. It’s an accurate description. And a dangerous assumption adopted by too many “managers” who let the flight management computers do all the work.

Everything’s fine. The airplane is contentedly flying itself, making .82 Mach way out in the middle of nowhere at 35,000 feet. The radios pop and crackle. Robert returns from his nap. He changes radar settings and sees that they are heading straight into intensive thunderstorm activity.  

Bonin dials back the speed, selecting .80 Mach. “Putain la vache. Putain!” he curses the outside air temperature. Though well below freezing, it's warmer than expected, preventing them from climbing to a higher altitude.

The temperatures and moisture they’re flying through are also ideal for icing up the pitot tubes. Located under the nose, those three redundant air-pressure probes are feeding altitude and airspeed data to the airplane’s identical flight computers.

The pitots' propensity to icing up on A330’s is well-known. Such incidents over the last year have sharply increased in frequency. Instead of grounding the fleet until a fix can be arranged, Air France has moved to replace the problem probes with an improved design as they become available. The first shipment has just arrived in Paris, awaiting installation when Flight 447 arrives.

0210:04 Ice crystals can be heard hissing against the windscreen. Robert is looking at a massive thunderstorm painted by the radar as an angry red blob dead ahead. He says, “You want to go a little to the left?” (Hint-hint.)

Excusez-moi?” Bonin is startled by the notion.

The ever-diffident Robert suggests his colleague might “eventually go a bit to the left.” Instead of continuing head-on into extremely violent turbulence, precipitation and wind shear.

Why not? Bonin clicks the autopilot knob 20 degrees left. The blob moves aside as the big jet turns onto the new heading.

0210:05 Over the next minute, the Airbus automatically issues 14 system failure messages to Air France operations showing inconsistencies between all three airspeed indicators. As a result of ice buildup inside the pitot tubes, the speed readouts are telling conflicting and improbable tales. 

As William Langewiesche relates, neither pilot has time to notice these anomalies before the autothrottles and autopilot respond to the loss of credible airspeed data by dropping offline. A soft C-chord chime warns that the flight computers have given up trying to fly without reliable inputs and someone else ought to consider hand-flying the airplane. 

It is not an emergency. The Airbus continues flying normally through light to moderate turbulence. All is snug inside the blue LED-washed cockpit. Everything outside is black.

 Boeing's MCAS at work in Ethiopia

Early Morning, October 29, 2018

Flight JT610 takes off at 0620 local time from Jakarta, bound for the Indonesian island of Bangka with 169 humans onboard. Three minutes and 22 miles after takeoff, the pilots request and receive clearance to return to the airport.

They do not declare an emergency. But climbing through 4,000 feet, their recalcitrant Boeing 737 “Max 8” jet wants to dive toward the sea. Every time the captain pulls the nose up, an automatic anti-stall system called MCAS (m-cass) pushes it back down.  

Because two bigger engines mounted further forward on the wings can destabilize their new jet, Boeing has inserted additional lines of code into Max 8 flight computers. The Maneuvering Characteristics Augmentation System pushes the nose down if it senses the plane nearing a stall.

On older 737’s, the autopilot can be disconnected by pulling on the yoke. But not the MCAS.

The pilots in charge of flight JT610 have never heard of MCAS. “They have no idea Boeing has introduced something new,” a 737 captain and former fighter pilot for the Swedish air force will later comment.


*   *   *


“Airplanes are like computer games nowadays,” observes aviation analyst, Colleen Keller, reiterating a dangerous misperception. Computer games do not soar above unyielding countryside and densely populated cities at 530 knots.

While making flying much safer, highly automated glass cockpits have turned pilots into knob-clickers, while their basic flying skills erode. When computers are confused by faulty inputs, the resulting cascade of error messages scrolling down the central flat-panel display – each sounding its own continuous alarm – can swamp human brains.

“Crews sometimes struggle to deal with the complexities of the automated systems,” admits James Healy-Pratt, Head of Aviation at Stewarts Law. They are not trained to cope with improbable computer glitches “by manually flying the aircraft.”

“There is simply no arguing with the success of the automation,” argues William Langewiesche. Thanks to fourth generation automated airliners, “plummeting” fatal accident rates have prompted some air crash investigators at the National Transportation Safety Board to retire early.

“Automation has made it more and more unlikely that ordinary airline pilots will ever have to face a raw crisis in flight,” the veteran pilot, author and aviation expert continues, “but also more and more unlikely that they will be able to cope with such a crisis if one arises.”


“When trouble suddenly springs up and the computer decides that it can no longer cope,” chimes in Jeff Wise, a contributing editor for Popular Mechanics and author of Extreme Fear: The Science of Your Mind in Danger, “the humans might find themselves with a very incomplete notion of what's going on.”

What is the primary threat? Which instruments are still reliable? Which can no longer be trusted?

“Unfortunately,” Wise whispers, “the vast majority of pilots will have little experience in finding the answers.”



An engineer named Earl Wiener famously penned four laws of aircraft automation:

1. Every device creates its own opportunity for human error.

2. Exotic devices create exotic problems.

3. Digital devices tune out small errors while creating opportunities for large errors.

4. Some problems have no solution.


Nadine Sarter -U. Michigan


Industrial engineer Nadine Sarter has written extensively about the “automation surprises” that occur when pilots are unaware their rebellious airplane has switched into cranky-autonomous mode.                                 

In olden times, when this navy reservist entered the cockpit of a rattletrap Flying Boxcar somewhere over the Nevada desert to find the navigation radio tuned to a jazz station, I knew enough to loudly inquire, “Are we lost?”

“Of course,” answered the marine in the left seat, uttering the required response without looking up from the Playboy centerfold he was admiring.

These days, according to Langewiesche, the expected cockpit question is: ‘What’s it doing now’?”

Sarter went on to observe that the many complex subcomponents in modern aircraft can interact in unexpected ways that pilots cannot immediately recognize. In conversation with five engineers, Sarter learned that even the men who built the plane could not agree how it worked. As for the pilots… “Well, Good luck.”

Airline pilots think they understand their clever machine, only to find the airplane defying their control inputs. Happily, the ensuing steep learning curve rarely leads to accidents.

But as Boeing’s Delmar Fadden explains, “Once you put pilots on automation, their manual abilities degrade and their flight-path awareness is dulled: flying becomes a monitoring task, an abstraction on a screen, a mind-numbing wait for the next hotel.”



Nadine Sarter calls this pernicious process, “de-skilling”.  As Langewiesche relates, Captain Dubois had logged 346 flight hours over the previous six months. But he’d manually flown “for at most only about four hours” during the past year.

Bonin had about the same amount of “stick time”; Robert less. “For all three of them, most of their experience had consisted of sitting in a cockpit seat and watching the machine work.”

Even worse, advanced flight computers are “covering” for mediocre pilots. “As a result, the mental makeup of airline pilots has changed,” Langewiesch remarks. “On this there is nearly universal agreement – at Boeing and Airbus, and among accident investigators, regulators, flight-operations managers, instructors, and academics. A different crowd is flying now, and… the knowledge base has become very thin."

Which means…

“We are locked into a spiral in which poor human performance begets automation, which worsens human performance, which begets increasing automation.”


*   *   *



Back onboard the Air New Zealand jet, deceived by the frozen angle of attack (AoA) indicators, the flight computer is blithely ignoring the approaching stall. 

“Don’t sink! Don’t sink!” the airplane shouts. 

The slowing A320 yaws left and right, swinging the nose from side-to-side. The pilot-in-command powers up and pushes the side-stick forward. The nose tilts down. 

Then it starts back up. 

What is happening? The pilots don’t realize that the automatic horizontal stabilizer on the tail is trying to “save” the falling airplane by pitching full up. 

This is the worst possible response.

The jet tilts up at an impossible angle, then fully stalls, mushing bottom-first towards the Mediterranian Sea. There is not enough altitude to recover. No one survives the crash off Perpignan, France.

AoA #1 sensor from wreckage -BEA

AoA #1 sensor from wreckage -BEA                                               


0210:03 Both First Officers are startled when the autopilot-disengaged alert sounds a cavalry ch