Tag Archives: pilot-proof

A Canadian Multi-Crew Licence?

Posted on by

document.write(" serif">Canada's Flight Training Reputation

Trying to keep Canadian flight training competitive is a laudable goal. We have a well-deserved reputation for competence, earned the hard way by flying in our terrible weather around our huge unpopulated country with plenty of pressure to get there (sooner or later) because it's often the only way to get there.

Much training business has come to our shores because of this reputation. The way to keep it coming is to maintain and bolster our good reputation in these trying times.

Loss of Control Accidents

In the last decade the character of airline tragedies has changed completely. Modern aircraft are so reliable that engine and system failures are rare. Aircraft and crew are designed and trained to deal with these failures if they occur. What we are seeing instead are crew failures.

These have come to be called loss of control accidents. The well-known examples are AF447, Colgan Air at Buffalo, and now Asiana 214 at San Francisco. There are many more, including, most recently, Southwest at LaGuardia. These accidents were all caused by crew action (or inaction).

(That includes, by the way, AF447 and Colgan, in which icing played a peripheral role. Flying into known icing is something for which the crew is responsible.)

These accidents all have something in common: pilot incompetence.

I know that sounds harsh, but it must be said. It is an accurate statement. The pilots in these cases may have known their airplane fairly well. They may have memorized their company's operating manual and their Standard Operating Procedures. But in all cases they did not understand some of the basics of flying an airplane. Colgan and AF447 fell into the ground or sea with the wing stalled, not flying, because the pilots pulled back on the control column and held the back pressure despite warnings and stick shakers. The Asiana crew pulled back to stretch their glide, even though they were far gone on the back side of the drag curve, within a few knots of the stall.

What is missing in these cases is basic flying training. The causes are legion and still being debated, but the fix is simple. In order to get a license, especially a license to fly a large airplane with many paying passengers aboard, a pilot must demonstrate the ability to take off, fly, and land an airplane while keeping it within its safe envelope. He must, in other words, demonstrate competence.

Commercial Reasoning

Canada's proposed Multi-Crew Licence has this as its rationale: Canadian flight training operators providing commercial training to foreign candidates are unable to compete with foreign operators and risk losing a segment of their industry (my emphasis).

Under various names, the Multi-Crew Licence has had a role in most loss of control accidents.

On the face of it this license seems reasonable. There is always a Captain who has a real license to supervise the others with lesser licenses. But on closer inspection what we are really saying is that a pilot who cannot legally take a friend for a ride can occupy a cockpit seat while the captain is back in First Class (AF447, and the Korean Air flight shot down over the Kamchatka Peninsula). We speak of Crew Concept and Crew Resource Management, but if the only pilot who understands the basics is not on the flight deck, these concepts are moot.

Commercial pressures have brought us, step by innocent-seeming step, to where we are today. Each step seems reasonable, at least at the time. We now routinely fly two-engine airplanes on twelve hour overwater legs. Back in the 1970's that was unthinkable and illegal. In those days airplanes didn't land themselves. Now they can, under the right conditions, and some operations manuals even specify autolands as the normal procedure. Pilots who comply are soon incompetent, unable to land the airplane by hand. But in San Francisco last month the glidepath transmitters were shut down on both runway 28's. Indeed, they had been off since June 1. Manual landings were the only way at KSFO.

The Multi-Crew Licence seems like a logical next step in response to today's commercial pressures. In reality, it is the next step toward complete incompetence on all flight decks.

Public Assumptions

Airlines have done an excellent job marketing a service that whisks you to another continent at half the speed the sun moves. Even with today's oil prices, ticket prices are (in today's dollars) a fraction of what they were in the 1960's. This is the new normal. Flights are uneventful. Pilots are bus drivers. Airplanes land themselves, don't they?

An airplane crashes at San Francisco. There must have been something wrong with the engines. Or perhaps the autothrust? A nosegear collapses on landing at LaGuardia? Obviously a mechanical malfunction.

Marketing has succeeded in making aviation seem safe. But even though airplanes have changed since the 1930's, flying is still a dangerous adventure. The safe arrival of even today's incredible airplanes still depends on the good judgment of pilots.

We don't want to think about that, because pilots are people and can make mistakes. But we'll have to start thinking about it, and acknowledging it, or the crashes will continue.

Feeders, Discount Airlines, and the Elimination of Apprenticeship

Flying is an apprenticeship trade. Like any job worth doing, it takes dedication and a lifetime of learning. I have 45 years and 19,000 hours of experience and I am just beginning to understand how little I know. But I have survived so far and I am very serious about continuing to survive. Dying by your own hand at the controls of an airplane is an absolute no-no for a pilot.

I was lucky. I have had (and still have) many fine teachers. When I was a young airline pilot most captains still took their teaching responsibilities seriously. Today's young pilot is not assured of the same. Pressure on unions and pilot salaries is being applied by business methods: spawning and dividing feeders and discount airlines foremost among them. The goal is to lower costs, but the (perhaps unintentional) byproduct is the interruption of the contact between old and young pilots and the teaching and learning that allows. (I believe that lowering wages also directly reduces respect for the job and the job satisfaction of the worker, but that is an argument for another time.) The FAA's response to the Colgan Air crash was to raise the experience requirement for First Officers to 1500 hours, even though it was the captain who was flying and who stalled the airplane and even though the airline had given insufficient training to both pilots on icing and how their aircraft handles ice. I have always understood that pilots are paid to be responsible. I am bemused by today's response to accidents, where band-aids are liberally applied to wounds which obviously require surgery.

Conclusion

Introducing a Multi-Crew Licence in Canada would be just another band-aid papering over the serious issues facing aviation today. Don't do it!

Losing Competence Part V: Asiana 214 and the Loss of Control Accidents

Posted on by

document.write(" serif">Automation and Hubris

Bernard Ziegler designed the Airbus to be pilot-proof. He is a good pilot, and he noticed that many pilots are less skilled than himself. In the interest of safety, he designed an airplane that could not be stalled. But it has been known for thousands of years that hubris is followed by nemesis, that Pride goeth before destruction, and an haughty spirit before a fall. (Proverbs, 16:18)

Hubris is arrogance before the gods. The goddess Nemesis alone can see the fine line between doing the best work you can and believing that your work is somehow superior. Cross the line and she is ruthless, finding your fatal flaw and using it to bring you down.

AF 447 was the fall of the hero. Pilot carelessness led the airplane into a line of thunderstorms. Supercooled water drops overwhelmed the pitot heaters, temporarily removing all three sources of airspeed information. The autopilot dropped off. The flight control computers switched from Normal to Alternate Law. The airplane can be stalled in Alternate Law.

Human or robot, there is always a fatal flaw.

How can we work with imperfection?

Don't Bow Down

Mankind, when confronted with the complicated or the divine, tends to bow down in worship. This can be hazardous in aviation.

The new automation – glass cockpit, fly by wire, IRS and GPS – together bring a change at least as momentous as going from props to jets in the 1960's. The aircraft is now such a capable pilot on her own that she almost seems real. We called the Airbus Fifi. Rather than bowing down, we found it was much better to treat her like a person. Dare to know her and maintain a relationship.

In her early days, frustrated pilots would exclaim, “What the #$%* is it doing now?” On a go-around at KLGA the map display would disappear, the airplane sailing off the edge of the world because it had passed the last waypoint in the flight plan. Or on a miss from a visual approach at KMIA the power would suddenly go to idle. Finger trouble with the Autothrust. She was trying to maintain go-around speed.

But the answers are right in front of you on the FMA. (Flight Mode Annunciator, at the top of the Primary Flight Display) We began speaking for her, calling out any change in the FMA, so we all knew what she was doing, or thought she was doing.

And yes, most of the time she was a damn good pilot. Just as we are. Exactly the same, including the occasional lapse. Which is why there is more than one pilot aboard. And which is why the human pilot should never bow down and never step aside. Know her (the automation, Fifi, the airplane) as well as you can. Always monitor her as you would a human pilot and call out anything unusual. And if she's not doing what she is supposed to, take over. For those interested in pursuing the subject, there is an excellent video, Children of Magenta, of a lecture by an American Airlines training captain. The take-away is the same: if she's not doing what you want, take over and fly by hand. You don't have time to figure out what you did wrong with the automation.

Crew Concept – and Not Just Humans

Moving from props to jets, pilots were introduced to many new concepts: mach tuck, dutch roll, deep stall, etc. Perhaps the most important were the long, shallow drag curve and the slow spool-up time of the engines.

Moving into the fly-by-wire era, we have to accept that the airplane (her automation) is part of the crew. Philosophically, it is perhaps a stretch, but in the real world of the cockpit it is a game changer and a life saver. As soon as you accept that the airplane is part of the crew – not a superior or inferior, but an equal – everything starts to make sense. She sounds the cricket as the autopilot drops off. In Alternate Law she says Stall, Stall as the panicked pilot pulls back on the sidestick.

But if you're on approach below 1000 feet (critical phase of flight) and the descent rate is 1300 feet per minute and the airspeed is below Vapp then someone isn't doing what needs to be done. (Without a glideslope the airplane will not understand that something is wrong.) The software doesn't care if the airplane crashes. She is a good pilot but she has absolutely no self-preservation instinct, no will to live. Human pilots have, or they have no place on the flight deck.

The French in Denial

Posted on by

It could happen to anyone. This time it happened to be a French airplane with French pilots flying for a French airline.

For two years the “black boxes” (the voice recorder and the DFDR) lay in peace on the floor of the Atlantic Ocean, 13, 000 feet below the waves. For two years there was conjecture, speculation, and (some quite fine) attempts at reconstruction. Then the black boxes surfaced, along with other hard evidence, including the jackscrew from the Trimmable Horizontal Stabilizer.

For months as the Bureau d'Enquêtes et d'Analyses slowly released information, we (and the BEA) put together the tragic and terrifying story. But the story stopped abruptly, the last chapter removed or never written.

Now a French aviation writer, Jean-Pierre Otelli, has published that last chapter independently of Air France, Airbus Industrie, and The BEA. The story ends as we knew it would – badly and sadly – but now we have more grisly detail and less room for denial.

The Bureau d'Enquêtes et d'Analyses is incensed. In a press release on October 13, 2011, (look under News in the sidebar) they claim that the transcription released by Otelli “mentions personal conversations between the crew members that have no bearing on the event, which shows a lack of respect for the memory of the late crew members” (my emphasis). The same day the London Telegraph published an account of the final minutes. The account seems to have been shortened since October 13, and I have been unable to find the original. Those who are interested may add the following after “According to an official report released earlier this year, the last words were from Captain Dubois who said: 'Ten degrees pitch.'”:

But in his new book Mr Otelli asks who will be held responsible 'for this mess'. 'Is it a training problem, fatigue, lack of sleep, or is it due to the fact the pilots are confident that an Airbus can make up for all errors?,' he writes. France's air accident investigation unit, the BEA, reacted angrily to the publication of the book, with a spokesman saying printing the conversation showed a 'lack of respect to the memory of the crew who died'. Air France has denied that its pilots were incompetent, but has since improved training, concentrating on how to fly a plane manually when there is a stall. Both Air France and Airbus are facing manslaughter charges, with a judicial investigation led by Paris judges already under way. A judge has already ordered Air France to pay some £120,000 in compensation to the families of each victim, but this is just a provisional figure which is likely to multiply many times over. THE FINAL MOMENTS Marc Dubois (captain): 'Get your wings horizontal.' David Robert (pilot): 'Level your wings. 'Pierre-Cedric Bonin (pilot): 'That's what I'm trying to do... What the... how is it we are going down like this?'Robert: 'See what you can do with the commands up there, the primaries and so on…Climb climb, climb, climb. 'Bonin: 'But I have been pulling back on the stick all the way for a while. 'Dubois: 'No,no, no, don't climb. 'Robert: 'Ok give me control, give me control.'Dubois: 'Watch out you are pulling up. 'Robert: 'Am I?'Bonin: 'Well you should, we are at 4,000.'As they approach the water, the on-board computer is heard to announce: 'Sink rate. Pull up, pull up, pull up. 'To which Captain Dubois reacts with the words: 'Go on: pull.'Bonin: 'We're pulling, pulling, pulling, pulling.'The crew never discuss the possibility that they are about to crash, instead concentrating on trying to right the plane throughout the final four minutes. Dubois: 'Ten degrees pitch. 'Robert: 'Go back up!…Go back up!…Go back up!… Go back up! 'Bonin: 'But I’ve been going down at maximum level for a while.'Dubois: 'No, No, No!… Don’t go up !… No, No! 'Bonin: 'Go down, then!'Robert: 'Damn it! We’re going to crash. It can’t be true!'Bonin: 'But what’s happening?!'The recording stops.

What we know, briefly, is this: Air France 447 ventured into a line of thunderstorms along the InterTropical Convergence Zone. Four other flights diverted around the storms. In the zone the flight encountered unusually warm temperatures and supercooled water droplets – enough to briefly overwhelm the heaters in all three pitot tubes, denying airspeed information to the Flight Control Computers for long enough to cause them to kick off the autopilot and to degrade the flight controls from Normal Law to Roll Direct/Pitch Alternate Law. Despite the fact that by the book they were too heavy to climb, the pilot flying (First Officer David Robert) zoomed up from 35,000 feet to almost 38,000 feet, dissipating the aircraft's energy and exposing it to coffin corner, where Mach buffet meets stalling speed. With brief lapses he held back pressure on the sidestick for the remainder of the flight.

First the airplane stalled (quit flying because the Angle of Attack was too great). Then, because of the steady back pressure on the sidestick, the autotrim wound the Trimmable Horizontal Stabilizer (more powerful than the elevators) to full nose up. (The THS jackscrew was found in this full nose up condition). By now the aircraft was in a deep stall, falling almost straight down in a near-level attitude.

There is plenty of room for argument about why it happened this way. Many (including David Learmount at Flight Global and myself) have started that discussion. It must continue, because we must know not only why F/O Robert stalled the aircraft, but much more importantly why he didn't know he had stalled it, why he had a totally inaccurate picture of what was happening, and why there was a complete absence of situational awareness on that Flight Deck.

It may look as if I am placing blame solely on F/O Robert. Absolutely not. That would be much too easy. I and others have already written many pages (see AF447 on my blog) trying to piece together all the factors at work in this accident. We will write many more.

As in all accidents, there is a chain of events and decisions which gradually (at first!) reduce maneuvering room. The first of these was Captain Dubois' decision to take crew rest approaching the ITCZ.

But before that came Air France's decision to carry less fuel than the spirit of the regulations requires, by filing the Flight Plan as Rio to Bordeaux, alternate Paris. Even earlier, the brilliant (I am not being ironic or facetious, I admire the man) Bernard Ziegler designed the Airbus to be “pilot-proof” and impossible to stall. However he (or his designers) also left the autotrim functional in Pitch Alternate Law, an oversight I believe should be corrected ASAP. Finally, (and earliest of all) you and I and everyone else who has traveled since Airline Deregulation in 1978 believes or wants to believe in cheap seats.

It could happen to anyone.

Sadly, it has all been foreseen. Recently I read an article which bluntly calls out the forces that led to this accident. It is called The Training Paradox, and was written by pilot, engineer, and lawyer Mark. H. Goodrich. Some of the accidents and incidents he describes stood my hair on end. Unfortunately I cannot provide a link to it. I read it in Position Report, November 2011, Volume VIII Number 3. (This is the magazine of the Retired Airline Pilots of Canada).

The very experienced and knowledgeable Mr. Goodrich shows how the forces of deregulation have derailed traditional career paths and interrupted the passing along of knowledge. As a result, the craft, the trade, the profession if you will of flying is dying a slow death. Neither are regulatory bodies or airline management immune from this decay.

This time it was the French. It is not surprising they are in denial. But it could happen to anyone, and it will.

 

AF 447: Let’s Talk About Why – 2: Virtual Reality

Posted on by

How many times have you heard Airbus pilots say, “It's not an airplane, it's a video game.”?

In this blog I will explore the fact and fiction in this statement. My objective is not to praise a great airplane or run down a flawed one, but rather to find how to live with a perfectly good one.

For almost a decade I flew the A320 (and the A319 and A321) as Captain and Training Captain. I came to see her not as a video game but as a person with whom I had to deal. I came to appreciate her many sterling qualities and also her weaknesses. Both informed our work together.

Fundamentals

First, she is an airplane like any other. If you accelerate her to Vr and raise the nose, does she not fly? If you provoke her into an Angle of Attack above 16°, does she not stall? Do not the laws of aerodynamics still hold?

These fundamental things will always apply as we work through her many wonders: Fly-by-Wire, Envelope Protection, and Flight Guidance systems. These wonders are what software people call a “front end” to her conventional aircraft qualities. But the wonders can be a powerful distraction as well as a boon.

Another pilot comment heard (more frequently in the first decade of operation, roughly the 1990's) is “What the #*%# is it doing now?”. The question was being asked because the pilots didn't know where to look for the answer, and also because an airplane maneuvering on her own was a novelty. When things happen that we don't understand, we human beings tend to see them as acts of God. We substitute reverence for understanding. A320 software – partly because it is so good, most of the time – has been an object of such reverence.

But just as we are not perfect, neither is this marvellous software. As the history of the airplane in service demonstrates, it is only as good as its interface with the pilots.

The Crashes

The first three crashes – Mulhouse, Bangalore, and Strasbourg – are illustrative. In the first two the engines were at idle and the crew were unaware that the power was being commanded to idle by the Auto-thrust. This information is clearly presented at the left end of the Flight Mode Annunciator or FMA, which appears in a band across the top of the Primary Flight Display, or PFD. The Auto-thrust Mode is what the Auto-thrust thinks it is doing. The only acceptable modes for approach are Speed and Off. At Mulhouse and Bangalore the Auto-thrust Mode was reading Idle.

What was not clearly understood at the time of these crashes was how to change the Auto-thrust mode from Idle to Speed, which is to turn off both Flight Directors. Further, the annunciation of the Flight Director modes on the FMA was not as communicative as it is today. At Bangalore one pilot turned off his Flight Director and the other did not. As a result the Auto-thrust mode remained in Idle. Today in that situation the FMA would show 1FD- , meaning that FD 1 is operating on the left side and that FD2, on the right side, is off. (With both FD’s on the FMA would show 1FD2). Both pilots can see what is going on. This improvement was implemented after analysis of these crashes.

The Strasbourg crash resulted in another improvement in the airplane-pilot interface. The flight was performing a non-precision approach which specified a Flight Path Angle. The crew selected -3.3 into the Flight Control Unit but failed to switch it to Track/Flight Path Angle mode. The FCU remained in Heading/Vertical Speed mode and interpreted the command as -3300 feet per minute. (There is a big difference between the two. At normal approach speeds a Flight Path Angle of -3.3 would be 800-900 fpm.) The presentation has since been changed in two important ways: first, to change the HDG/VS mode on the FCU to show 3300 while leaving the TRK/FPA mode as 3.3. Second, the commanded rates are now repeated on the Flight Mode Annunciator.

In these accidents the crew were not aware of what the software was doing. In the following example, the loss of an A330 in flight test at Toulouse in 1994, the crew were not aware of a crucial software limitation.

In most autopilots there is an altitude capture mode. In Airbus aircraft this is known as ALT*, or “Alt Star.” The computer uses the selected altitude and the vertical speed to calculate how far ahead to begin the capture maneuver, which is an asymptotic curve. Higher vertical speeds require that the maneuver be begun earlier if “G” forces are to remain within limits. Crucially, because the software calculates the curve based vertical speed, it de facto assumes that the thrust available at the start of the capture maneuver will remain available. Thus the loss of an engine while in ALT* is a first-rate emergency requiring flight crew intervention within a few seconds.

Man/Machine Communication

I present these examples not as an exhaustive course on Airbus software, but as an illustration of how extra intelligence brings with it extra complication. First, the communication between man and machine is of paramount importance. The interface cannot be too well-designed and the pilot cannot take too much care in maintaining effective two-way communication. This is why at my airline any change in the FMA was verbalized by the Pilot Flying, in effect giving voice to the machine and keeping the three pilots (two human, one cybernetic) on the same page.

Second, each time a task is assigned to automation the process must remain transparent to the pilot. He must understand in general terms what the computers are doing, and even more importantly what they are not doing. Should the automation for any reason drop the task it must be immediately obvious to the pilot and he must have steps rehearsed which let him take control and do the task himself.

Engine failure in ALT* is a good example. With today's improved FCU interface the pilot can push the Vertical Speed knob, which simultaneously selects V/S as the vertical mode and sets the target V/S to zero. In less than a second he has intervened, taken control, and given himself time.

If altitude cannot be maintained on the remaining engine(s) he can twist the knob to set a modest descent. Then the drill calls for getting a clearance to a lower altitude, turning off the Auto-thrust and setting Maximum Continuous Thrust on the good engine(s), selecting the cleared altitude and Pulling the Altitude knob to select Open Descent. Speed and thrust can then be adjusted to suit the situation.

The above procedure is not difficult, is easily performed in the time available before losing control, and requires no particular skill. What it does require of the pilot is that he view the airplane (and her wonders of automation) as an equal: a skilled pilot who nevertheless can have a bad day, make a mistake, or be simply unavailable.

Anthropomorphism

I know I am not alone in assigning a personality to the Airbus. I have said elsewhere that I came to regard her as a friend, or more than a friend. I (ahem) even loved her. Perhaps I still do and that why I am writing this.

Wait, though. I know full well she is aluminum, carbon fibre, and Intel and Motorola Assembler. I also know she is a damn good pilot and that she can be trusted like a close friend. But – and this is the important part – she is my equal. I can fly too, but I sometimes make mistakes, have a bad day, or fail to communicate effectively. Ditto my software friend. I can be blinded by pride. Ditto my software friend. She is French and she has pride in her DNA.

In the Simulator we practice Pilot Incapacitation, recognizing that to err is human. What we have a harder time with is Automation Incapacitation. This is perhaps a symptom of our reverence for something that is beyond our understanding, for our unrecognized assumption that technology is perfect, or at least better than we are. This unrecognized and unwarranted assumption can be fatal.

It is much better to appreciate her as an equal and deal with her as a whole person, warts and all.

Feedback and Feel

Let's dig a step further. I believe what pilots are talking about, when they say Airbus aircraft are video games, is the lack of feedback and feel in the controls. The throttles, for example, do not move when the Auto-thrust is active. The pilot sees only Speed on the FMA and the engine indications on the ECAM. To take control smoothly (for example to do a manual approach) he must pull the thrust levers back until the little green donuts match the current thrust, and click the off button on the lever. The FMA says Off and he's on his own. But the approach is still a bit of a parlor trick because there is no feel in the sidestick. When a conventional aircraft gets slow increasing back pressure is necessary to keep the nose from dropping. Not so in an Airbus. Instead, the Autotrim will move the stabilizer nose-up to maintain 1G flight. The pilot's eye has to dart to the airspeed indicator to get what he might have sensed in the stick or control column. All of this contributes to the “video game” feel.

Perhaps a direct Angle of Attack readout in a Heads Up Display would compensate for the lack of feel. But this is ignoring an essential fact: the Airbus is a conventional airframe, with positive aerodynamic longitudinal stability. It is not like some fighter aircraft with neutral or negative longitudinal stability, where the aircraft is uncontrollable without fly-by-wire. The stability is there, but it is shielded from the pilot.

It must be pointed out that the Airbus is a beautiful airplane and a joy to fly and that it has hundreds of wonderful design features I would not like to see disappear. Just one example is “the hook” (the display on the airspeed tape of Vls (lowest selectable speed)) and its relationship to “the bug” (Vapp, or final approach speed). The bug speed is calculated by the FMCG (Flight Management and Guidance Computer) based on the Gross Weight (or Zero Fuel Weight) entered by the pilots. The hook is calculated from first principles by comparing Angle of Attack with dynamic pressure (airspeed). In a normal approach these are 0.5 cm (1/4 inch) apart. This is one of those comfort crosschecks for pilots. If the bug and the hook are too close together, the weight entered in the FMCD is likely wrong, and the calculated Vapp is too slow.

But even here an intelligence has been interposed between the pilot and his aircraft. Why not also display the Angle of Attack directly, and always fly the approach at the same angle of attack regardless of weight? (See my blog AF 447 – Let's Talk about Why – 1: Angle of Attack). It is this interposition of intelligence that contributes to what I see as the problem: the illusion of Virtual Reality.

Virtual Reality

Flying an airplane, any airplane, is a very real job. The airplane can be a bear or sweet to fly, it can be automated or not, it can “land itself.” But the bottom line of the captain's job does not change, and that is to be the arbiter of last resort: the man or woman who imagines, constructs, and sees the picture that determines the outcome. It is his or her job to maintain that picture. In the trade we call it situational awareness. If something goes wrong and that picture is wrong people die. And if the captain believes the glass display before him is superior to his own mental image, then he will be more likely to abdicate his responsibility to maintain situational awareness.

Today's glass cockpit is seductive. A wealth of information sits before the pilot: some of it is raw data; often it has been extensively processed into a colourful and sometimes beautiful picture. Like a video game, this is virtual reality. Software is doing the imagining for the pilot.

It can be argued that the picture in the pilot's head is also virtual reality, merely a representation of the external world. But this argument does not acknowledge the survival instinct that guides the pilot's doubt and questioning, his constant checking for consistency, his testing of the obvious.

Airbus aircraft are beautiful and a joy to fly. But they are not perfect. Like all of us, they have a fatal flaw. The Ancient Greeks knew this hamartia as an essential component of human character. Bernard Ziegler, the brilliant designer of the Airbus software, has been quoted as saying he wanted to make the airplane pilot-proof. Consequentially, as I have shown, there are areas where the pilots have been shielded from useful, even essential, information. The Airbus pilot must work hard to ensure he is not entirely removed from the loop.

Reality for an airline passenger is not virtual. This game cannot be started over. The next time you hear someone say, this airplane lands itself, will you be comforted? Or will you be hoping that the pilots are not just along for the ride?