THE COMPUTER VS. THE CAPTAIN

Will Increasing Automation Make Jets Less Safe?
By Gerald Traufetter

Computers on board aircraft have made flying safer, but when they encounter errors they can create turmoil. Engineers are pressing ahead with the automation of aircraft, but pilots warn that efforts to computerize jets are going too far and that diminished human control could create dangerous situations.

Ben Cave was starting to get bored. The Australian had been sitting in his seat for more than three hours, and he still had two hours left before the Qantas jet was scheduled to touch down in Perth.

The Airbus A330 was flying at a cruising altitude of 11,278 meters (37,000 feet). The calm of modern jet travel, accentuated by the monotonous drone of the engines, prevailed on board the aircraft. The flight attendants were clearing away the last of the lunch trays into their trolleys, some of the 303 passengers were waiting near the toilets, and others were passing the time with stretching exercises.


PHOTO GALLERY: HOW MUCH AUTOMATION IS TOO MUCH?
Click on a picture to launch the image gallery (8 Photos)

Ben Cave unfastened his seatbelt, stood up, opened the overhead luggage compartment and fished around for a magazine and a pen, hoping to make the remainder of the flight pass more quickly.

That was when the longest few minutes of his life began.

At 12:40 p.m. and 28 seconds, the autopilot in the cockpit suddenly disabled itself. While the unsuspecting Cave was digging around in the overhead luggage compartment, lights were flashing and alarms were going off in the cockpit. Error codes flashed onto the central monitor: AUTO FLT AP OFF, NAV IR1 FAULT. Then a metallic voice said, ominously: Stall! Stall! Stall! Danger: The aircraft is too slow. The airstream over the wings is about to decrease!

Then there was another warning sound and the words, in red, appeared on the screen: Overspeed! Overspeed! Overspeed! The aircraft is too fast!

For a few seconds, the captain and the co-pilot must have thought that they were merely dealing with the quirks of a flight computer. The engines were running normally, the aircraft was perfectly positioned in the airstream and the weather radar was not reporting any turbulence.

An Invisible Hand

"What's this thing doing now?" the irritated pilot usually says at such moments, and in most cases all it takes to fix the problem is to restart the computer, or simply wait until the computer resets itself.

But this time it seemed as if an invisible hand had taken control of the aircraft. A few moments later, at 12:42 and 27 seconds, it became clear that it was not going to be business as usual on board Flight QF 72. The nose of the aircraft was suddenly pitched sharply downward, 8.4 degrees over the horizon, headed toward the earth. The aircraft quickly picked up speed and the sound of air rushing by grew louder. The plane was in a nosedive.


FROM THE MAGAZINE
Find out how you can reprint this DER SPIEGEL article in your publication. "My head hit the cabin ceiling," says Cave, remembering his experience on that Oct. 7, 2008, en route from Singapore to Perth. All around him, passengers were suddenly flying into the air, their bodies smashing against the plastic ceiling, where they remained frozen in place. The forces that had suddenly been unleashed seemed capable of controlling the passengers' bodies like puppets on a string.

"For a few seconds, I thought it was all over," says Cave.

As in the cabin, there was a feeling of powerlessness, of being in the hands of fate, in the cockpit of the A330 with the tail number VH-QPA. Using all of his strength, the pilot pulled back the control stick, desperately trying to get the plane back onto a safe horizontal flight path. But for several long seconds, his efforts were completely ineffective.

As if guided by evil forces, the Airbus was plunging to its doom.

Just as unexpectedly as it had taken control of the aircraft, the computer relinquished that control and the nose of the A330 suddenly returned to normal. The passengers were thrown back into their seats or onto the floor at one-and-a-half times the force of gravity.

"There was utter chaos around me," says Cave. Only three minutes later, the plane went into another eerie, uncontrollable nosedive. At 12:49 p.m., the aircraft transmitted an emergency "Mayday" message, followed by a second one five minutes later.

"The pilots are real heroes," Cave said ecstatically after an emergency landing at a tiny military base on the west coast of Australia.

But if the pilots are heroes, they are tragic heroes at best.

A Plane Gone Amok

Instead of being able to pilot the plane, they were briefly transformed into helpless spectators. And it wouldn't have been long before they too became the victims of a plane gone amok, no longer stoppable by human intervention. If the nosedive had lasted a little longer, the plane might have reached a speed at which the pilots could no longer stop it without it breaking apart. The difference between life and death was a matter of seconds.

The incident on board Flight QF 72 resulted in 115 injuries, 12 of them serious, as well as two spinal injuries. The cabin ceiling was severely damaged in many places. "The oxygen mask was hanging down from the spot where I hit the ceiling," says Cave.

His wounds have long since healed, but the incident has left its mark on the pilots. There are 621 A330s in operation today, and one of them suddenly embarked on a bizarre life of its own.

What exactly happened on the circuit boards of aircraft computer system remains unclear. Defective readings apparently confused the flight computers, leading them to believe that the passenger jet was climbing steeply instead of cruising along a stable, horizontal path. This prompted the computers to push the nose down, without any pilot input, to protect the aircraft from the perceived danger of sideslipping. "We want to know, as quickly as possible, how exactly this could have happened," says a Lufthansa pilot who flies the same Airbus long-haul aircraft.

Julian Walsh, of the Australian Transport Safety Bureau (ATSB), openly articulates what the manufacturer and the airline would prefer to keep quiet about Qantas Flight 72: "Certainly there was a period of time where the aircraft performed on its own accord."

This arouses our primal fear of technology acting independently and assuming power. Just as HAL, the on-board computer in Stanley Kubrick's sci-fi classic "2001: A Space Odyssey," assumes control of the spaceship, the Qantas computers made arbitrary decisions.

The crash of another Airbus A330 on June 1, 2009, raises similar concerns. Air France flight AF 447 was at cruising altitude en route from Rio de Janeiro to Paris when it suddenly plunged into the Atlantic Ocean and killed all 228 people on board. It is possible that the real cause of the crash will never be known.

In that accident, the final signals that were transmitted by the doomed aircraft's computers via satellite also provide evidence of digital problems on board. Twenty-four matter-of-fact maintenance messages to headquarters in Paris indicate that the speed sensors reported defective data, and that the flight computers switched themselves off because they were incapable of processing the contradictory data.

A Flight Safety Debate Looms

What happened in that stormy night over the Atlantic? Were the pilots overwhelmed by crashing computer systems? Did the jumbled error messages cause them to make a fatal mistake? "Whatever the eventual findings, the crash already is prompting questions about how thoroughly aviators are trained to cope with widespread computer glitches midflight," writes the Wall Street Journal.

The British trade publication Flight International also anticipates a new debate over air safety and cites, in particular, the February crash of a Turkish Airlines Boeing in Amsterdam. During the landing approach, a malfunctioning altitude indicator reported that the plane was already two meters below the runway. The computer that controls the automatic thrust control system, believing that the aircraft was already on the ground, reduced engine power. The pilots ignored the change, perhaps because they had placed too much trust in the computer.

The Boeing 737 eventually crashed into a field near the runway, killing nine on board. "The issue of the human factors associated with operating highly automated aircraft is likely to move up the agenda once more," Flight International predicts.


NEWSLETTER
Sign up for Spiegel Online's daily newsletter and get the best of Der Spiegel's and Spiegel Online's international coverage in your In- Box everyday.

That agenda will probably be influenced by the final report on the near crash of a Lufthansa flight due out this autumn. In March 2008, the wing tip of an Airbus A320 scraped across the runway at Hamburg Airport in strong crosswinds. The dramatic images of the near crash quickly circled the world in the form of an amateur video that was eventually viewed millions of times on the Internet.

The pilots were initially described as heroes for having saved the plane. But then the tabloids sharply criticized the co-pilot for being inexperienced and inept.

"But now the situation turns out to be more complex," says Johann Reuss, the investigator with the German Federal Bureau of Aircraft Accidents Investigation (BFU) who was assigned to the case. He cannot comment further, because the final report has not been released yet.


Part 2: Digital Technology Has Improved Safety, But it Can Still Present a Threat


According to investigation results that have remained classified until now, the A320 apparently behaved in an unexpected way during the high-wind landing. The most likely explanation is that because one of the plane's tires had already briefly touched the ground, the flight computer switched from approach mode to ground mode. But when the computer is in ground mode, it does not permit the pilots to turn the ailerons as sharply as they would have done to handle the extreme crosswinds. The computer intervened by limiting the angle of the ailerons, causing the wing tip to suddenly scrape across the runway.

"This sort of behavior on the part of the aircraft wasn't described in any manual," says one pilot critically -- nor is it described today, because Airbus is remaining tight-lipped about the incident until the investigation is complete.

The landing could easily have ended in a disastrous accident. The computer was in control for almost three seconds. It was only through the determined intervention of the pilot, who pulled the plane back up into the air, that the aircraft, traveling at more than 200 kilometers per hour (124 mph), could be prevented at the last minute from crashing.

It is generally undisputed that digital technology on board has helped improve aviation safety. In the vast majority of cases, it helps prevent dangerous situations in the air before they become a problem.

But all of these incidents effectively show how digital equipment can also become a threat. The mysterious breakdowns have triggered a debate in aviation that both airlines and manufacturers would prefer to avoid. How much more high-tech equipment should engineers insert into the cockpit? Does more digital technology automatically result in improved safety? And how much power should flight computers be allowed to have before pilots become disastrously impotent?

The Computer Co-Pilot

Computers have a Janus-faced nature. On the one hand, they help prevent crashes, which is why no one questions their right to exist. Some experts would even like to see more computers in the cockpit. British aviation expert David Learmount, for example, believes that computers could replace one of the pilots in the cockpit one day. "Why do you need two if the computer system is the captain's copilot?" Learmount asks provocatively.

On the other hand, the computers themselves can turn into a safety problem. When the Australian accident investigators took a closer look at the details of the Qantas Flight 72 incident, they discovered that it was by no means an isolated case. Last December, just two months after the drama off the Australian coast, a similar problem occurred on board another Qantas A330. Airbus competitor Boeing is not immune to unexpected computer glitches, either. In 2005, a flight computer caused a Boeing 777 to climb 700 meters for no apparent reason. It happened twice during the flight and caused the jetliner to lose more than a third of its speed, so that it almost stalled.


PHOTO GALLERY: HOW MUCH AUTOMATION IS TOO MUCH?
Click on a picture to launch the image gallery (8 Photos)



"Incidents of this nature are a harbinger of what is to come," says Thomas Haueter, the director of aviation safety at the powerful US National Transportation Safety Board (NTSB), which investigates air accidents. He is alluding to the kinds of breakdowns in on-board computers that are difficult to predict. "Lots of people are very concerned that previously unknown problems could arise from the overabundance of computers and software." Haueter wants to make sure that pilots can never lose complete control over their aircraft.

There are about 2,000 computers operating in a modern Airbus A320 short-haul jetliner. They control the air-conditioning system, monitor the engines and check the toilets, but they also help fly the plane.

The days are long gone when a pilot fully understood his aircraft. "We have to make a huge effort so that we don't experience a decline in aviation safety," says Haueter. The manufacturers are well aware of the problems. "They know that automation is the way of the future, but they also know that computers have to be tested more effectively than they have been until now."

The authors of a report released by the US National Academy of Sciences (NAS) describe "several aircraft accidents" in which pilots confused various computer settings. "The software behaved the way it had been programmed to behave, but not the way the pilots expected." The US Federal Aviation Authority (FAA) agrees that the growing computerization of aircraft makes "validation and verification of software more challenging." Programs have become so complex that they can hardly be tested for all eventualities anymore.

"If you were to stack up the technical documentation for an airplane, it would create a mountain of paper three times as tall as the Eiffel Tower," says Marc Diouane, a senior vice president of the American software company PTC.

For a long time, the aviation industry could safely claim that flying had indeed become safer. Year after year, millions of tourists board planes to their vacation destination without hesitation. Even passengers who are afraid to fly now believe that the most dangerous part of flying is driving to the airport.

Statisticians have computed that this saying can be taken literally. The fact that many people switched from flying to driving after the attacks of Sept. 11, 2001 ultimately led to more deaths on the road than in the planes used in the attacks.

"An Unparalleled Success Story"

There is currently less than one accident with fatal consequences for every million takeoffs and landings. Around 1960, at the beginning of the jet age, this figure was still at 11. If aviation were as unsafe today as it was in the 1970s, an airplane would fall from the sky once a week.

Does this mean that all is well in the world of aviation, as we board our summer vacation flights this year? There is no doubt that today's airplanes are so reliable that we tend to forget that we are sitting in an aluminum tube equipped with a full tank of kerosene and traveling at just below the speed of sound. Engine failure, one of the main causes of plane crashes in the past, is a rarity today. The pressurized cabin, hydraulic system and landing gear have become much more reliable. Computers provide advance warning of the threat of ground impact or a collision with another plane. And the guide beams in the landing system direct planes down onto the runway as if they were traveling along a chain of pearls, even in heavy fog.

"When it comes to safety, aviation is an unparalleled success story," says Stefan Levedag, director of the German Aerospace Center (DLR) in Braunschweig in northern Germany. But that could be history now. There were more aviation deaths in the first half of 2009 than since 2002. After the Airbus crashes of Air France over the Atlantic and Yemenia Airways off the Comoros, the number of dead passengers, 499, was about 50 percent higher than the average for the last 10 years.

Judging by the latest accident statistics, which Flight International published last week, a historic turning point has been reached. While the crash rate decreased in every decade since the days of the Wright brothers, it appears to be stagnating for the first time between 2000 and 2010. "Is safety on the slide?" the magazine asked.

A new aviation safety debate has been raging for some time among experts. "How are we supposed to improve the high level of safety even further?" Levedag asks in exasperation. For better or for worse, this is precisely what the aviation industry is condemned to do, as the number of airplanes in the sky grows rapidly and, along with it, the risk of accidents. In a recent study, a European Union advisory panel calls for reducing the accident rate in aviation by an additional 80 percent between now and 2020.

How this goal is to be reached remains unclear. It has already become difficult to compensate for the rise in air traffic with an increase in safety. Some experts already see a trend reversal taking place. The number of minor incidents and near-accidents has risen, says the safety expert for a major airline. The rule of thumb is that for every crash or accident involving personal injury, there are hundreds of accidents involving property damage, as well as minor incidents. "And we have detected a rising trend at this lower level," says the insider.

Experts fear that the possibilities for further increasing safety through improved maintenance systems or state-of-the-art collision warning systems have been exhausted. In addition, new safety hazards are emerging, including a more crowded airspace, ruinous competition and, as a result, poor maintenance and training. Finally, the race to computerize aircraft also creates new risks arising from the complexities of the binary chatter of the thousands of computers on board an aircraft.


Part 3: How Much Control Should Remain with the Pilot?


This casts a new light on the question of the role man should play in this system in the future. Safety expert Learmount asks: "How much control should remain with the pilot, when should a computer intervene, and what should the interface between man and computer look like?"

The pilots themselves are calling for a discussion of how their profession sees itself. "We have to turn men and computers into a jointly operating unit," says Nikolaus Braun of the pilots' union Cockpit. More technology, he says, should by no means mean less human presence in the cockpit. On the contrary, pilots become even more necessary as system complexity grows. "Their training has to be improved, not reduced," says Fran Hoyas of the European Cockpit Association (ECA).

Reiner Kemmler, a flight psychologist with Lufthansa for many years, is convinced that technology confronts pilots with new challenges. "Visually speaking, they have reached the limits of what the human sensory perception system can handle," Kemmler warns.

Step by step, man has had to give up control over machines. The first flight computers were introduced in the military. It would be impossible to control today's fighter jets, given their unstable flight behavior, without the help of computers. The military systems later reappeared in the legendary supersonic jet, the Concorde.

Fly-By-Wire

Finally, Airbus, still a young aviation company at the time, revolutionized its fleet with an innovative, digital aircraft system that quickly came to be known in the industry as fly-by-wire, and it came with the promise of unprecedented safety. For this reason, writes aviation expert Learmount, it was afflicted from the start with a "psychological side-effect analogous to the talk of the unsinkability of the Titanic." When the A320 took off on its maiden flight in 1987, the unofficial Airbus advertising slogan had already been circulating in the industry for some time: The highest-paid passenger is sitting in the cockpit.

First and foremost, fly-by-wire means that the pilot's control commands are transmitted electronically to the hydraulic actuating cylinders of the tail assembly with the aid of cables ("wires") instead of through a mechanical rod system and cable controls. But there is also another key difference between the concept and conventional designs: There are always computers connected, as control systems, between the pilot and the tail assembly. These computers monitor all control pulses and correct them if necessary.


NEWSLETTER
Sign up for Spiegel Online's daily newsletter and get the best of Der Spiegel's and Spiegel Online's international coverage in your In- Box everyday.

"Novices erroneously think of the autopilot, which can be switched on and off," explains Gerhard Hüttig of the Flight Simulation Center in Berlin. The autopilot is also a factor, but it is only one of many, and it guides the airplane along a course pre-programmed by the pilot. But Airbus's flight computers do a lot more. They are automatically activated if the aircraft enters a dangerous angle, loses too much speed or threatens to complete a violent rolling motion. The Airbus engineers christened the software, which is designed to keep the aircraft within a green zone at all times, "Flight Envelope Protection." "The computers intervene," explains Hüttig, "no matter how hard the pilot pulls on the controls."

The flight professor provides a live demonstration of how this happens -- not in the air, but safely on the ground in downtown Berlin, where his center has installed a state-of-the-art flight simulator. Hüttig sits down in the front left seat of an A330 cockpit. "This corresponds almost exactly to the Air France plane that crashed in the Atlantic," says the scientist.

He leaves the takeoff from Munich Airport up to his inexperienced co-pilot. Then, for illustrative purposes, he turns to his own control device. It looks like a joystick, hardly bigger than that of a computer game. "This is the most visible part of the fly-by-wire technology," says Hüttig.

He pushes the control device, known as a sidestick, all the way to the right. It immediately becomes apparent that the computer is indeed along for the ride. The flight simulator's hydraulic legs buckle, creating the sensation of banking gently to the right. "In fact, the airplane ought to have turned so sharply to the right that it would overshoot and, in the extreme case, would roll over," Hüttig explains.

But that is precisely what the computer is there to prevent. In an instant it has calculated, based on the position of the airplane reported by sensors, by how much the plane can turn without creating a hazard.

In the real world of aviation, the equivalent of this maneuver would be another plane approaching from the left. "If the pilot panicked and steered too far to the right to avoid a collision, the computer would prevent him from making a flight error," the aircraft engineer explains.

Boeing installed a similar system into its 777 long-haul aircraft in the mid-1990s. The Boeing 787, the company's latest model, will contain even more of these automated flight systems, and today's Boeing 737s already have various automated components.

A Split in Digital Philosophies at Airbus and Boeing

But there is a difference between the American and European concepts. In the case of Airbus, the pilot is essentially prevented from disabling the flight computers. Unlike the autopilot, the flight computer can only disable itself, and only if its systems become so confused that it would otherwise malfunction.

In other words, the pilot in the Airbus flight deck is constantly digitally monitored and provided for. This new safety philosophy seemed irresistible at first. Nevertheless, its introduction was accompanied by a disaster. Three months after the initial delivery of the A320, an Airbus crashed, in front of live cameras, into a forest during an air show in Alsace in 1988. The image of a huge cloud of smoke rising above the treetops seemed like a bad omen, and some believed Airbus would never recover from this setback.

Was it merely a mishap, practically unavoidable whenever a new technology is introduced? Or did it expose a fundamental weakness in the new Airbus philosophy?

The experts argued passionately over the question. Some said that the computers and the pilot were not communicating properly in what was a complicated flight maneuver. Airbus still maintains that the pilot's behavior was not sufficiently disciplined.

Another accident occurred five years later, on a stormy day in Warsaw. In heavy wind and rain, a Lufthansa A320 slid off the end of the runway and broke apart. Two people died. The wind had suddenly turned, and perhaps the pilots should have aborted the landing. Instead, they carefully brought down the plane. Because of hydroplaning, the tires did not rotate on the wet runway. This confused the flight computer, which failed to recognize that the jet had already touched down. The system hesitated for nine seconds before the flight computer finally allowed the thrust reversers and brake flaps to engage -- nine long seconds in which the pilots were forced to look on helplessly as the jet rapidly approached the beaconing at the end of the runway.

At the time, Boeing more or less openly touted its own strategy, which gave the pilots more options to intervene. It cited the case of a Boeing 747 that two Chinese pilots had saved from an almost hopeless situation, in which the craft was exposed to four times the force of gravity. The Airbus computers wouldn't have allowed the pilots to perform such a radical maneuver.

Airbus fired back with its own examples. One was of a Boeing 757 that had crashed in Columbia, killing 159. The collision warning system had warned the crew of an impending collision. The pilot pulled up the plane, but it failed to clear the mountain ridge it was approaching, because he had forgotten to retract the brake flaps. An A320, Airbus said, would have done this automatically.

The PR battle has since been decided, according to the aircraft maker based in Toulouse, France, where a senior safety official says: "The accident statistics prove that we were right."

His claim is difficult to refute, because a meaningful comparison of accident figures between Boeing and Airbus models doesn't exist. However, the statistics also do not suggest that there is a clear advantage to the Airbus strategy. Aircraft made by both manufacturers crash, and whenever it comes time to investigate the causes of an accident, Airbus takes pains not to allow any questions to be raised about its fly-by-wire system. The company has played down the Qantas incident, saying that speculation is pointless before the ATSB releases its final report. This is even more applicable, says Airbus, to the case of the Air France A330 crash.

Boeing or Airbus? Among pilots, this has become almost a question of faith. "That's just as hard to decide as the question of whether Mercedes or BMW is better," says pilot representative Braun.

The controversy is kept going by accidents and incidents involving fly-by-wire computers. And again and again pilots, such those of the Lufthansa plane that almost crashed in a crosswind in Hamburg, run into new, nasty surprises that none of the engineers had predicted.

The engineers don't allow such unforeseen events to unnerve them, at least not visibly. "Redundancy" is the magic word with which aircraft developers attempt to placate pilots. So many computers are operating in parallel, they say, that problems in one computer do not spell disaster. Five flight computers are installed in an Airbus like the A330: three primary and two secondary flight computers. To provide the greatest possible security against a complete crash of the system, the software is written in different countries, by different companies and in different programming languages.

But even this much redundancy cannot provide 100-percent protection. Digital chaos erupted on board a South American airliner as it approached Chicago. Because of a broken spring, the main switch of one of the flight computers would not remain in the "On" position and began to rapidly switch the computer on and off. The resulting confusion disabled the other flight computers.

In 2005, the pilots of an Airbus plane en route from London to Budapest experienced something that, according to the engineers' logic, shouldn't even happen: the failure of all monitors except the one displaying the error messages. The system was so severely disabled that the pilots were unable to transmit a "Mayday" alert.


Part 4: The Glass Cockpit


Until they finally managed to reboot the failed system, the pilots had to rely on the emergency instruments, which have been located on the instrument panel since the early days of modern aviation, such as an artificial horizon and an altimeter based on barometric pressure.

In the latest generation of airplanes, the emergency messages also appear on a screen. Pilots refer to the modern-day cockpit, riddled as it is with monitors, as the "glass cockpit," unlike the cockpit of the past, which pilots affectionately called the "clock shop." If the Budapest flight had been part of the new generation of aircraft, would the monitor displaying the error messages have gone dark, as well?

In February 2005, the computer that monitored and controlled fuel levels on board an A340 failed en route from Hong Kong to London. One engine shut down and a second one stalled, but because the A340 has four engines, an emergency landing in Amsterdam went off without a hitch.

These mishaps raise the question of whether we will ever be able to rule out the possibility that an unrecognized error is lurking somewhere deep in the network of computer units, in the cacophony of programming languages and the interplay of zeroes and ones. For instance, when a Malaysia Airlines Boeing 777 went out of control four years ago, experts later discovered that a software update was incompatible with the preinstalled programs. "It would make me very worried about the future if we didn't get these kinds of problems under control," says NTSB expert Haueter, who is calling for new standards in the certification of automated systems on aircraft.

A Lack of Expertise

Peter Ladkin, an expert on software safety at the University of Bielefeld in north-central Germany, is working on a similar project. He is critical of the lack of expertise and what he says is incorrect methodology in the inspection and approval of new technology touted as "intelligent." "At the most, one failure per billion flying hours is guaranteed, and then the system goes haywire two times during a single flight, and again a few months later," he says, referring to the Qantas incidents.

Even system developers are increasingly stumped by the complexity of the computer networks they created. After an accident, it is often the case that only experts from the manufacturing company can reconstruct what kind of an error could have occurred in the computer -- a process that can sometimes take weeks. "The pilot, on the other hand, sometimes has only seconds to save his life and the lives of his passengers," says Ladkin, a pilot himself.


FROM THE MAGAZINE
Find out how you can reprint this DER SPIEGEL article in your publication. He also believes that it is highly problematic for the manufacturer of an airplane or a computer component to be entrusted with the investigation after an accident, because no one else can figure out the software. "This limits the perspective when searching for the cause," says Ladkin -- probably because no one wants to accept the blame.

Martyn Thomas, a British software safety consultant, agrees. "Computers have moved too far away from the people who are supposed to be operating them." What is needed, says Thomas, is a cockpit that is configured to allow a human being to intuitively take the right steps in an emergency.

The sidestick on the Airbus, for example, is controversial among pilots. It has fundamentally changed steering an airplane. In the past, the pilot's and co-pilot's control columns were connected to the same mechanical system. As a result, either of them could always feel what the other one was doing. This is not the case on Airbus's modern jetliners, in which the pilot's movements are ordinarily offset against those of the co-pilot. If both press the sidestick in the same direction, this increases the motion of the rudder. But if one pilot steers to the right and the other to the left, the two movements cancel each other out.

There is a button on the sidestick that allows one of the pilots to assume full control of the steering system. But the pilot faced with an emergency must remember to press the button. Besides, the switch takes a brief moment to go into effect.

Nevertheless, electronics have undoubtedly simplified the routine of flying. Gone are the days when pilots had to carefully guide an airplane into the right position, adjusting the thrust and using the rudders to steer against the wind. Passengers also benefit from the flying comfort that modern jets offer. The computer usually ensures that bumpiness during turbulence remains mild. In addition, digital technology has made aviation more efficient.

For example, landing is so automated that engineers have deliberately left it up to the pilots to extend the landing flaps and landing gear, even though the computers could handle this just as well. "This is purely to keep the pilots alert," explains aviation professor Hüttig.

"An Immense Workload"

Strong nerves, however, are all the more crucial when problems occur. Suddenly the two people in the cockpit are inundated with an abundance of control and warning messages that can hardly be processed. Granted, the system does arrange failures according to their urgency. For example, a faulty toilet flushing mechanism will appear at the bottom of the error menu. "In an extreme case, this requires pilots to understand the structure of a system that is hardly comprehensible," says Iberia pilot Hoyas. He cites the Air France Airbus crash as an example. "The error messages indicate an immense work load."

The operating manual does provide instructions on what to do in many cases of trouble. But how can someone repair a digital, multiple organ failure while under stress and flying through a storm at night? "And, in the end, the manufacturer says: 'Well, there were instructions for that,'" says Hoyas.

Another fatal problem, according to Hoyas, is that pilots increasingly lack the necessary training. "Some long-haul captains perform a handful of takeoffs and landings a month," says Hoyas. Once the computer is humming away, there is little left to do during the flight itself. The classic concept of flying, with a control column and thrust levers, is largely a thing of the past.

At the same time, young pilots are required to have less and less flying experience. The boom in discount airlines and the unbridled growth of aviation in Asia have led to training in the air being cut in half, from 300 to 150 hours.

And that number is expected to go down even farther. Under the new "Multi Crew Pilot License" system, pilot candidates will train in simulators more than in real life in the future. "Soon there will be co-pilots in the cockpit with only 70 hours of real flying experience," Hoyas says critically.

Faced with rising costs, airlines welcome the fact that the work of human personnel is gradually being delegated to computers in the cockpit. Even people at Airbus don't deny this. "Some companies justify reducing their training with the argument that they have purchased a modern aircraft with every conceivable form of safety technology," says an Airbus executive, although he denies the suggestion that Airbus uses this potential savings opportunity as a selling point.

The automation of aviation is moving relentlessly forward. Engineers are currently addressing what is perhaps the most dangerous phase of flight: the moment of touchdown, when people who are afraid of flying are already relaxing and, especially on charter flights, the passengers tend to break out in applause.

A new technology uses the exact position and topographic airport profile to measure whether the aircraft is gliding onto the runway correctly: not too high, not too low, not too soon, not too fast.

When the wheels have touched down, a second system controls the brake force, ensuring that the aircraft can turn off at the correct runway exit. Although the decision to abort a landing still rests with the pilot in the current configuration, "the system could already land the plane entirely on its own today," says Holger Duda of the DLR in Braunschweig.


Part 5: At What Point Do Pilots Become Redundant?


At what point, then, does the human being in the cockpit become completely redundant? Aerospace engineers have a lot of confidence in their abilities, as evidenced by the development of unmanned aircraft for the military. These so-called drones observe enemy territory, fire missiles at targets and will soon be used to bring in supplies. The "Global Hawk," for example, already has the range of a modern civilian short-haul aircraft.

After crossing the Atlantic, the windowless metal bird touched down at the Nordholz military airport near the North Sea town of Cuxhaven in Germany. The pilot was sitting at the joystick, but on a US Air Force base in California. "In 10 years, we will also have unmanned cargo aircraft in civil aviation," says Richard Deakin, a British manager at aircraft component producer Thales.

Engineers envision that aircraft would not be sent up into the air with no pilot at all. Instead, there would always be a person in the cockpit to keep passengers calm, like the conductor on a subway train. But is it really necessary to have two pilots in the cockpit? "Some airlines have already been asking manufacturers whether the one-man cockpit is doable," says Braun of the Cockpit pilots' union.

Based on the current logic of redundancy, one pilot would be as good as none. If he or she became incapacitated, the aircraft would have to be capable of landing entirely on its own. But what if remote control via a satellite becomes sufficiently reliable to safely land a plane in an emergency? Would the engineers feel confident enough to place the passengers in the hands of machines?

But there are also aircraft developers who favor technologies that would allow human beings to utilize their strengths during flight. "We need a reconciliation of man and machine," says DLR man Duda.

At the DLR's Institute of Flight Systems, engineers are developing an active sidestick that will allow both pilots to feel how the respective other pilot or the computer is controlling the plane at any given moment. The approach, dubbed "naturalistic flight deck," is also being investigated at Berlin Technical University's Aerospace Institute.

Advanced Imaging for the Future

At the institute, flight engineer Christian Berth and his team are experimenting with a display that projects the artificial horizon, altitude, position of the runway and the key flight data onto the cockpit window. Another option would be to completely replace the window with monitors and a wraparound projection. Berth wants to superimpose an infrared image of the approaching runway. "This would give the pilots perspective in the fog, enabling them to bring the aircraft down onto the runway using their own senses," says Berth. They would no longer have to stare down at the control panels, where the current landing system design merely provides the pilots with an abstract display of the plane's deviation from the optimal approach path.

A version of this imaging system is already installed in today's fighter jets and military transport aircraft. The airlines could also order the system, known as a head-up display, for civil passenger aircraft. "But many airlines shy away from the high cost," says a German pilot. "But the whole thing would be more intuitive, easier to understand quickly and easier to use automatically."


NEWSLETTER
Sign up for Spiegel Online's daily newsletter and get the best of Der Spiegel's and Spiegel Online's international coverage in your In- Box everyday.

The current automatic landing approach system, on the other hand, requires more concentration from pilots than manual landing. Although the pilot is simply sitting next to the computer and monitoring it as it does its work, this is actually more taxing than manual flying.

What was once a dream job is losing the glamour of days gone by. Instead of heroes of the air, pilots become controllers of electronic equipment. Ironically, the engineers fail to recognize a pilot's ability to prevent errors from occurring in the first place.

It is rare nowadays for a human pilot to be able to demonstrate his superiority, as was recently the case with Captain Chesley Sullenberger, who executed a masterful water landing of his Airbus A320 on New York's Hudson River.

But once the pilot has lost control of the computer, he becomes as helpless as an ordinary PC user whose computer has just crashed. After the sudden nosedive of the Qantas plane, the mystified pilots called their technical center several times on their satellite phone to ask the maintenance personnel to explain what was happening to their aircraft.

But the calls were as frustrating as a call to a typical computer hotline. The technicians in Sydney were also unable to make sense of the error messages that the plane's computer had radioed to the center. At one point the technicians advised the pilots to simply shut off the third flight computer. But this did not stop the error messages from scrolling down the monitors.

Instead, the pilots were left on their own to battle the confusion of beeps and warning messages that had become so numerous in the cockpit that the flight recorder could not even record them all.

The last warnings did not disappear until the aircraft had landed, at 1:50 p.m., and the power supply had been shut off.

Translated from the German by Christopher Sultan.