Control of the Mission Versus Control of the System

by Matt "Pug" Boyne

Thursday, February 12, 2009

As flight deck technology gains greater sophistication, flight deck designers will continue to create additional information sources and control measures. It is an observation that aircraft accidents have a greater chance to occur when pilots cede control of the aircraft to automated systems rather than keeping control of the aircraft themselves. This may be referred to as a choice to use mission level automation (Rogers, Schutte & Latorella, 1996.) At this point pilots have moved from a controlling function to a monitoring one and if not properly engaged may lose situational awareness.

A classic example for lessons learned in this area is the American Airlines 757 crash on approach to Cali, Columbia in December of 1995 (Aeronautica Civil of the Republic of Columbia, 1996.) While rushing to prepare for a new approach to the airport the pilots loaded an incorrect navigational point into their flight management computer and then trusted that the autopilot system would bring them to the correct position. At this point they abrogated their control authority and moved to a monitoring position. Due to further distractions with navigational charts, both pilots allowed their monitoring duties to suffer as well. Unfortunately, due to confusion as to their location and the high terrain surrounding the airport, the flight management system directed the autopilot onto a path that resulted in collision with the mountains, loss of life and aircraft.

This example is used to describe the real risks to cockpit automation. As long as pilots retain control over the mission of the aircraft, they will maintain a higher level of situational awareness than when they move to a monitoring position. If the automated systems are used, they should be employed as a work load mitigator and not a placed in a decision making role. For tasks that are not mission critical, that may be thought of as aircraft or system specific, such as cabin temperature or fuel balancing, delegation to the automated system will not result into a significant safety hazard. Monitoring can be thought of in a time versus risk assessment. If sufficient time exists for human intervention before given a critical situation, delegation to automation will reduce workload, improve effectiveness and minimize fatigue.

This does not imply that pilots must at all time maintain physical control of the aircraft, as in manually flying. Rather the control must be in a dynamic sense. This means that the aircraft will not change profiles without pilot input, which may be through the flight controls manually or by engaging an autopilot mode control


Aeronautica Civil of the Republic of Columbia (1996). Aircraft accident report: Controlled flight into terrain, American Airlines Flight 965, Boeing 757-223, N651AA, near Cali, Columbia, December 20, 1995. Santafe de Bogota, D.C., Columbia: Author.

Rogers, W.H., Schutte, P.C. & Latorella, K.A. (1996). Fault management in aviation systems. In P. Parasuraman & M. Mouloua (Eds.), Automation and Human Performance: Theory and Applications. Mahwah, NJ: Lawrence Erlbaum Associates.

external image 767400-k60557.jpg