Detecting and Correcting Anomalous Autoflight Performance
Human Factors in Aircraft Automation - issue #2
SECOND REPORT from the Human Factors Committee, Automation Subcommittee, Air Transport Association
prevPilots have reported a significant number of situations in which the aircraft deviated from the pilot's intended actions following selection of an autopilot mode. They may occur for a variety of reasons falling into two general categories — (1) inadvertent selection of a mode or input of data by the pilot, and (2) deliberate selection of a mode expecting different performance than the mode is designed to provide. The former have been referred to as input errors, and the latter as automation surprises or mode errors. In either case, the pilots must detect and correct the path of the aircraft, but the latter case reflects a deeper problem — the pilot does not understand the logic by which the mode functions in the reported situation. As a result, carriers must position their pilots to ensure that mode and data errors are quickly corrected and must position themselves to ensure that "anomalous functions" are documented in manuals and communicated in training.
Supporting Evidence
Each member carrier represented on the subcommittee has reported events where pilots encountered autoflight performance they did not expect, but on review found these to be characteristic of the underlying software or hardware design. For example:
- Pilots of MD80 aircraft and its variants have reported altitude deviations following entry of a speed restriction into the Flight Guidance Control Panel. Typically, the aircraft was operating in Perf Cruise mode when ATC restricted speed. The PF dialed in the speed or mach setting, then engaged Speed Select. The autopilot then complied with the speed, but began a spontaneous climb or descent. These events result from the design assumptions of the autoflight system software. Exiting Perf Cruise, the autopilot needs both speed and altitude/vertical speed targets. The pilot has provided the speed target. The altitude target is obtained by examining the aircraft’s current vertical speed. Because Perf modes allow 150 ft. of altitude variance to minimize pitch/power changes, the aircraft is often in a shallow climb or descent. In these events, the altitude/vertical speed mode has defaulted to vertical speed. The pilots expected it to default to altitude hold, as the aircraft had previously been at cruise. The obtained mode was annunciated on the FMA, but undetected by the pilots for some period of time. Training pilots to dial in the desired speed/mach, but selecting altitude hold on the FGCP (MCP) is addressing the particular problem.
- On F100 and A300 aircraft with the autopilot engaged in certain flight envelopes, pilot elevator input forces are sensed as unwanted inputs and are trimmed out by the autopilot. No force disconnects are implemented, and autopilot trim in the opposite direction of input is not inhibited as on some Boeing aircraft, for example. This has resulted in events that were perceived or described by pilots as runaway trim. For example, the pilot of an F100 aircraft did not disengage the autopilot when initiating a visual approach, but believed he had. Stab trim then moved to both full nose-up and full nose-down positions in response to elevator inputs and configuration changes. The autopilot was attempting to maintain the last target selected on the MCP, which was altitude hold. This sequence ended when torque forces applied to the manual trim wheel by the PNF were sensed as a fault, disengaging the autopilot. Importantly, the pilots believed the autopilot to have been disengaged throughout the maneuver. A similar event resulted in an A300 accident at Nagoya, Japan, when the FO/PF engaged TOGA mode, but attempted to stay on the glide slope with forward elevator pressure. Nearly full nose-up trim was obtained as the autopilot sought go-around pitch. The aircraft eventually pitched into stall attitude when the autopilot was disengaged, go-around thrust applied, and flaps retracted. In both of these events, the pilots expected action counter to the underlying software design, though the modes engaged were annunciated on the FMA. The A300 has been modified since the accident so that high control column force will disconnect the autopilot.
- FMS arrivals and approaches may be flown with lateral and vertical navigation engaged, and the lowest altitude restriction on the profile set in the altitude window. The VNAV mode honors all intermediate restrictions. On the B757/767, member carriers have reported events in which the aircraft was falling behind (above) VNAV path and the pilot selected FLCH or VS to expedite the descent. Altitude protection is forfeited for the intermediate restrictions by this action. This is a serious error if the pilots are not monitoring the performance of the aircraft at the intermediate restriction. Unsatisfied with the performance of VNAV, the pilot has selected a mode that meets the descent goals, but removes altitude protection, and does not recognize that tradeoff in real time.
- Other examples can be described for virtually every model of FGS, FMS, or GFMS-equipped aircraft.
Events of this type represent underlying misunderstandings of the functioning of particular modes by the pilot, a lack of strategy for confirming modes engaged or annunciated, or unusual or counter-intuitive entries into a mode or envelope. Alternatively, they may be viewed as inaccurate design assumptions of how a pilot would use or encounter a mode, or how an ATC clearance would affect mode selection. Countermeasures are necessary at three levels:
- Pilot strategy – pilots must deliberately scan the FMA to determine whether autopilot and autothrottles are engaged and in what modes. In a previous subcommittee paper, "Towards a Model Training Program," the subcommittee discussed this as analogous to the schedule bidding process. A mode selection is a bid, which must be compared with its annunciated award. Then aircraft performance must be continuously scanned for reassignments — deviations from selected and annunciated targets. These actions would catch and correct an overwhelming majority of mode errors reported to member carriers. The subcommittee found that each carrier has emphasized in training the need to confirm results of autoflight selections to prevent mode surprises and confusion. However, autoflight systems can also change modes autonomously, often with only FMA indications (flashing the mode a number of times, for example). So, ongoing monitoring is required, not simply selection and confirmation. A number of data sources identify situations where pilots failed to monitor or control the actions of an autoflight system in a timely manner. This may reflect both an inappropriate level of trust in the autopilot during critical flight modes such as altitude level-off and a tendency to "fly the aircraft through" a flight guidance or flight management system. These events often reflect a failure to continue scanning the performance of the aircraft following selection and confirmation of an autoflight mode. The subcommittee noted that policy and procedural guidance on this issue remain limited.
- Airline reporting – where seemingly anomalous autoflight performance can be traced to a design assumption or software, it must be documented to pilots in operating manuals and reviewed in training. Many of these events reflect a mode functionality expectation by the pilot that is not valid. If these can be documented and/or highlighted in training, they may be overcome by changing the expectation. This requires capturing the events though a reporting program. This is an argument for pursuing Partnership Programs and deliberately reviewing the reports for mode errors. Additional sources might include service difficulty reports reviewed by Maintenance management.
- Manufacturer reporting – where large numbers of similar events are found to be associated with a particular design assumption or software implementation, software updates and changes are warranted. Each manufacturer has implemented such changes through software upgrades. They can accomplish such corrective actions only to the extent they are made aware of events by their airline customers. Reliable feedback processes must be established or existing processes strengthened to assure this type of action.
Policy Guidance for Pilot Action
The subcommittee recommends that member carriers review their procedures and training to assess the extent to which they promote a pilot strategy of autoflight use that confirms the annunciation of selected modes and continues scanning for anomalous performance. The subcommittee offers the following prototypical statement for publication in policy manuals:
Pilots must confirm the results of autoflight selections to prevent mode or course surprises and confusion. A selection on the Mode Control or Flight Guidance panel must be checked against its result on the Flight Mode Annunciator. An input into the FMS/GFMS-CDU must be checked against its resulting course displayed on the Nav Display, and the pilot making the input must confirm the resulting course with the other pilot prior to executing the change when feasible. And in all cases, both pilots must continue their scan to ensure the autopilot performs as directed and anticipated.
Additional Recommended Actions
The subcommittee recommends that member carriers establish or review existing pilot reporting systems to ensure they can identify and respond to events resulting from mode errors. We also recommend that member carriers review their process of reporting such events to manufacturers to ensure that ongoing software revision efforts are geared to problems encountered in line operations, and to their fellow carriers to ensure lessons learned by one carrier's pilots are communicated to others.
This article is included in Gulfstream Contract Pilot Services' resource library strictly for your convenience. The information in this article is provided without guarantee or warranty, and is subject to change without notice. The information is the opinion of the writer, and may not reflect the opinion(s) of Gulfstream Contract Pilot Services or it's associates. The information should not be relied upon as advice to help you with your specific issue. We recommend that you discuss the specific facts of your situation with a qualified professional before making any personal or business decisions.
