> What does it mean for an autopilot to fail, in this case? We're not talking about an automatic guidance system, like in fixed-wing aircraft.

Actually, that is exactly what we're talking about. Why would you doubt it? You not only need to keep the helicopter oriented, you need to keep it in the same place, i.e. you need it to follow a zero-velocity trajectory. Why would you think that this is any different from a regular autopilot?

An automatic guidance system in a fixed-wing aircraft is given a route with waypoints, and autonomously navigates between them. It needs to know things about horizons, Great Circles, collision-avoiding altitude change plans, least-time routing, reachability of nearby airports given available fuel weight, etc. There's no real way to implement this with anything less than a CPU with a full (realtime) OS and a software stack on it, full of complex pre-baked databases, with multiple inter-related components from different vendors in the mix. It's frail. Of course it needs a backup.

The kind of system I'm talking about here, on the other hand, is essentially a physical model of the three available controls and how they interact to move the aircraft (and thus predict how the aircraft will be moved); combined with actuator-sensors, accelerometers, and gyroscopes to read off how the aircraft is being affected by those controls (and thus correct the prediction)—enabling you to translate linear movement of a flight-stick to linear movement of the helicopter. It's a dynamic torque model feeding a control system, with a user-supplied reference point. You can make an ASIC that does that and put it through fuzz-testing for literally every potential input combination it'll ever receive.

Yes, said ASIC might physically fail (even after you've done an extensive burn-in test)—but, given the tolerances we have in making ruggedized solid-state electronics these days, vs. the tolerances we have in making mechanical systems, it'd be the least likely part in the control chain to fail.

It is obvious you have never actually flown a real plane, and you have no familiarity with actual aircraft avionics. There are so many errors in what you said above that I don't have the time to correct them all.

It is true that state-of-the-art navigation systems operate the way you described. But airplanes have been flying for over 100 years, and there have been autopilots for nearly all of them (the earliest autopilot dates back to 1912). The vast majority of airplanes flying today do not have state-of-the-art systems.

You are just picking random descriptions of autopilot systems.

Helicopters can also have advanced and full integrated routing systems that will complete an entire trip from A to B, just as fixed-wings can have a simplistic input-to-output linked autopilot that just aims to keep the plane level and with the same heading.

So yes, an advanced system is more complicated than a simple system, but both systems can fail. And since that is inevitable, it's usually better to have a complex system with redundancy that will tolerate failure, than a simple system with no backup that will lead to catastrophe.

it is not the electronic chips that cause an autopilot to fail (in most cases). the primary failure mode is 'something else', meaning a failure in the mechanical equipment connected to the environment.

Not having a backup doesn’t not mean that no failure is possible, that is a very odd thing to say.

Automatic transmissions fail all the time, and then the car stops moving. Ok for cars but serious problem for flight so these aircraft have multiple automatic and manual redundancies.

Helicopter autopilots are indeed full guidance systems like fixed wing aircraft, but they can hold the craft in hover position because it's just another flying position possible for helicopters, but it is still actively flying.

I misspoke. What I meant is, the ASIC controlling the automatic transmission—the thing that makes it "an automatic transmission"—doesn't fail. It's just a simple bit of solid-state electronics. It'll probably outlive the car.

Other parts of the automatic transmission system fail, sure, but those parts are the same parts that are in a manual transmission. (Because, after all, in modern cars, a manual transmission's control system still ends up as signals sent to an electronic gearbox.)

So, like I said—in modern cars, where you've just got an electronic gearbox anyway, there's no sense in having both the ASIC issuing control-commands to the electronic gearbox, and a backup manual stick for issuing the same commands. If there's any fault in the system, it's far, far more likely to come from the stick's mechanism breaking down and issuing spurious commands, than from the ASIC breaking down and issuing spurious commands. And more likely than either is the gearbox getting messed up because it's sitting in a hot, dirty engine compartment.

"the ASIC controlling the automatic transmission—the thing that makes it "an automatic transmission"—doesn't fail"

In 2018, it is possible to have a car with an ECU that is 30 years old, and I happen to have one. Solder joints can go bad over time, and repairing the control unit is a thing that people do on cars like mine. If I was looking forwards regarding some other bit of electronics, I would probably worry about capacitors too.

All electronics can fail, and those failures can be unpredictable. A bad batch of capacitors can pop during the slightest surge of current. Age can also contribute. Car ECUs used to be built to be as simple as possible (which also cuts down on manufacturing costs) - this had the nice side effect of making them extremely reliable. And if they fail, it's an inconvenience, but rarely life-or-death.

Autopilot systems, however, are only as good as the people who program them. A helicopter, as mentioned elsewhere, is dynamically unstable and requires so many tiny inputs to maintain steady flight, let alone hovering. Just like in Teslas that 'nope' out of their Autopilot systems back to the driver milliseconds before a crash, a pilot has precious little time to retake control should the electronics fail.

Car ECU keeping your car moving in one dimension (forwards) - fairly safe to let a computer take over, minimal danger if it fails.

Autonomous technology keeping your car moving in two dimensions (forwards AND steering) - very complex, very little time to retake control in a failure scenario, very dangerous.

Autopilot keeping your helicopter moving in three dimensions - I think you get the idea by now :)

The distinction you're talking about is analog vs digital, as in mechanical linkages vs fly-by-wire, but it's a distinction with much difference as most systems are a mixture of both these days.

Either way, failure is not unique and can happen in either domain. There are plenty of examples of electronics failing and again it is strange to say that they don't. Silicon chips might not move but they are physical products that can overheat or short-circuit or just break.

Aircraft are much more critical than cars and the reason they have multiple completely redundant systems is precisely because things do fail all the time.

> ...the reason they have multiple completely redundant systems is precisely because things do fail all the time.

To be sure, it's not because they fail all the time, but to probabilistically address the risk that if Murphy does come knocking, consequences won't be immediately catastrophic.

We're talking about different spectrums. I'm saying that "things" in general fail all the time, not always on a single plane or flight.

Different spectrums, indeed.

I only meant to clarify that aircraft redundant systems exist because failure mode consequences would be catastrophic with unacceptably high probability otherwise; not simply because things in general fail all the time, as was asserted.

It's a subtle yet significant difference that other readers in passing may not recognize.

>Because, after all, in modern cars, a manual transmission's control system still ends up as signals sent to an electronic gearbox.

No, they don’t (so long as you are talking about stick-shift and not paddle shift).

The solid state electronics absolutely can and do fail. There's a reason why modern large aircraft typically have three redundant ADIRUs...

> There's a reason why modern large aircraft typically have three redundant ADIRUs...

That has more to do with aggregate risk management predominantly driven by predicted MTBF, failure mode analysis, and safety criticality levels.

> automatic transmission doesn't fail

Um, what kind of car do you drive?

And all those transmission repair shops are doing... what, exactly?

The transmission does fail. It doesn’t have a backup because the consequences of the failure don’t justify the cost of the backup.