The course ends where the modern career is flown: behind automation. With some 70 percent of aviation accidents attributed to human error, the drive to automate is understandable and irreversible, and the guiding principle is worth stating before any list of pros and cons: automation exists to assist rather than replace the pilot, leaving the higher-level decisions human, and the pilot must at all times remain in control of the automation and aware of what it is doing. A few terms first: automation proper is an embedded, autonomous, predetermined sequence over which the pilot normally has no control and which cannot be deactivated (cabin pressurization and cabin temperature control); protection automation triggers as a safety limit is passed and cannot be disengaged (the stick shaker, flap load relief, some alarms); a support system displays processed, instantly usable information (EICAS, the flight director); and a glass cockpit is a design of computer-generated displays, at minimum a PFD and an ND, not merely screens redrawing standard instruments.
Two philosophies: Boeing and Airbus
The syllabus compares the two basic concepts of automation by manufacturer. In the Boeing concept the pilot remains the last operator: the automation advises, protects and warns, but the pilot's input ultimately commands the aircraft. In the Airbus concept the automated systems can correct erroneous pilot action: within the normal control law, envelope protections will refuse or rein in an input that would take the aircraft beyond its limits. Neither philosophy changes the guiding principle above; they differ in where the last word sits when human and machine disagree at the edge of the envelope.
The advantages
The canonical list: crew input is decreased, reducing the chances of human error; technical reliability, with two or even three computers giving dramatic redundancy; cost savings and increased productivity; smaller cockpits, since the choice of modes cut the display space needed; reduced crew workload, freeing time for decision making; smoother and more accurate control than a human achieves; a greater choice of options for displaying information; and increased safety. The workload item carries two honest caveats: physical workload certainly falls, but mental workload may rise with an inexperienced pilot or a wary attitude toward the automation, and there is evidence that automation tends to force pilots from normal low workload suddenly to unexpectedly extreme workload when the system fails.
What the machine cannot do
The fundamental restrictions of autoflight systems are two: a lack of creativity in unknown situations, and a lack of personal motivation with regard to safety. The computer has no stake in the outcome and no imagination beyond its programming, which sets up the syllabus's strengths comparison: the pilot brings creativity, decision-making, prioritisation of tasks and a safety attitude; the autopilot brings precision and reliability. Oxford's aphorism compresses it: computers do the things pilots already know how to do well much better than pilots, but they do not know how to do the things a pilot would like to do well (the territory of the decision-making lesson).
The ironies of automation
The syllabus names three ironies of automation. First, designers' errors due to wrong interpretation of the data: the automation faithfully executes its designer's misunderstanding. Second, the tasks that are too complex to automate are left to the pilot: the machine keeps the easy work and hands back exactly the hard cases. Third, the pilot's manual and cognitive skills decay while the automation does the flying, so the human reserved for the hard cases arrives at them out of practice. Oxford states the resulting bind plainly: pilots are asked to oversee an automated system, which humans do poorly, and to take over in abnormal conditions, which they may then not be very good at either. The syllabus names one countermeasure directly: regular training flights, keeping the skills alive that the line no longer exercises.
The disadvantages in daily work
The disadvantage list is long and each item earns its place. Boredom leading to a loss of situational awareness: the automated flight deck and extended-range operations grew up together, so a cruise with little to do can run beyond twelve hours, producing the underload this module has already mapped, plus hypovigilance and a loss of handling skills; a bored crew may even be tempted to experiment (one crew, probing how the auto-throttle behaved, disabled the engine management to the point that an engine shed fan blades through the fuselage, and a passenger was lost through the hole). Greater delays between the crew's performance and its ultimate effect: an incorrect waypoint entry may not become apparent for hours, the classic case being the Air New Zealand DC-10 flown into Mount Erebus on a waypoint entered incorrectly by ground personnel. Confusion is a third: designers, in a marketing race, pile more information onto one screen than competitors, and volume itself confuses; the tailored status display, meanwhile, can leave the pilot unaware of information that an unusual problem suddenly needs.
Mode error deserves its own paragraph: with so many available modes, the pilot can believe the aircraft is programmed for one function while it performs another. In 1979 a DC-10 climbed with the autopilot in vertical-speed hold when airspeed hold was intended; the speed decayed into stall buffet, the buffet was read as vibration in the number 3 engine, that healthy engine was shut down, and the aircraft stalled, rolled to its right and lost 11,000 feet before recovery. The defences are stated on both sides of the interface: pilots must make the mode representation a central part of the scan, and designers must display mode information prominently and centrally. Alongside it sit the quieter costs: ease of use erodes basic instrument-flying skills (young pilots with no depth on basic aircraft especially), an older pilot's mistrust can multiply checking workload, the systems are too complex to be understood as thoroughly as older ones were (the commonest modern flight-deck expressions are reported to be 'What's it doing now?' and 'I've never seen that before'), a pilot out of the loop is not mentally prepared when a failure suddenly hands the aircraft back (failures are rarer, but less predictable, quicker and more intense), and a poor-quality sensor signal is not normally revealed to the crew as poor.
Automation also reaches crew communication, and the syllabus lists what can be lost: awareness of input errors, of the flight modes, of failure detection, of failure comprehension, of the status of the aircraft and of the aircraft's position. The mechanics behind the loss: each pilot has individual access to an expanding database and to commands, which is dangerous without a concerted effort to inform the other pilot of intentions and actions; the co-pilot moves less, so body language thins out; information is abbreviated into so many acronyms that rare ones get ignored or confused with familiar ones; and digital reports are so detailed that reading them can consume the time prompt action needed. Finally, changing plans is hard: data entry is lengthy and error-prone, and pilots get drawn into time-consuming reprogramming (with the attendant loss of situational awareness) in exactly the situations, a runway change on final or a revised hold, where manual override of the flight path would have been the best way to ensure safety.
Automation complacency
Automation complacency is an over-reliance on automation, and its classic symptom is passive monitoring: the tendency to leave it to the computer to sort out, in the blind belief that the automation monitors the flight path and finds solutions better than the crew could. The main weaknesses in the monitoring of automatic systems are the two already met: hypovigilance during flight, and loss of flying skills. Continued, active and deliberate monitoring is an absolute necessity, and the infallibility fantasy needs naming: an unstallable aircraft is no comfort at low level and low airspeed with no energy left to fly away, because automation does not absolve the pilot from complying with the basic requirements of safe flight. (This is the complacency attitude of the personality lesson wearing its automation uniform: the settled assumption that checking is unnecessary, aimed at the machine.)
The error vocabulary the syllabus wants: passive monitoring (above), blinkered concentration (becoming so involved in a single readout that situational awareness is lost, when 99 percent of alarming readouts can be cross-checked against other instruments), confusion (the sheer volume of information on one screen), and mode awareness, the discipline whose absence is the mode error of the previous section: knowing at all times which modes are engaged and armed, with the mode annunciations inside the scan.
Call-outs against silent drift
The counter to ineffective monitoring is to make the automation's state spoken. Call-outs force the modes out of the annunciator and into the shared crew model: stating the mode with the intention ('descending to 5,000 feet in flight level change'), and, where company procedure prescribes it, reading the flight mode annunciator changes aloud, in some airlines as a shared process (the flying pilot makes the change, the monitoring pilot calls the active mode, the flying pilot calls the armed modes). The mechanism is the one the communication lesson taught: announcements of modes are the only guarantee that all crew share the same model of the situation, and a call-out obliges the caller to actually read the annunciation rather than glance past it. CAP 737 adds the honest hedge: there is no undisputed best practice around such call-outs, and schemes need monitoring for long-term side effects, but whether or not the annunciations are called out, monitoring them is essential.
Overcoming the drawbacks
The drawbacks the syllabus asks to be overcome are loss of manual flying capabilities, additional workload through programming, the risk of slips during programming, and hypovigilance during cruise, and the adaptation principles answer them point by point: fly the aircraft; take your time (nothing has changed, you are still flying the aircraft, merely via a computer); do not get so involved in reports or data entry that situational awareness slips; fly with an experienced pilot until confident; beware boredom and hypovigilance, staying in the loop; input data only when there is plenty of time, stopping every fifteen seconds or so to look around; double-check every data entry and have the other crew member check it again independently (the defence against programming slips); keep the rest of the crew current on what you are doing; double-check any displayed information you do not understand, because it could be wrong; and take every opportunity for extra simulator training, the regular-training countermeasure to skill decay. Oxford's summary keeps the tool in its place: automation is far from a panacea, and its effectiveness depends on the user.