It's to be used only in the event that the pilot is incapacitated.

Because it's an emergency feature engaged by a passenger or automatically, it probably can't manage all complex situations. It may be just good weather emergency landing. Check fuel and wind, steer to nearest emergency airport and land. Best effort is better than no effort and dying.

> There is a mountain between the normal 3-degree glide-slope and the runway, an "offset approach"

I think it can land only to those airports that are it's database with landing approaches programmed it.

Cruise missiles have had similar technology for a long time.

From https://news.ycombinator.com/item?id=21409114

During those first few seconds after I hit the Autoland button, the system went through a series of complex calculations and decision-making processes to determine the nearest suitable runway based on runway length, width, and surface; fuel remaining; crosswind component; terrain; obstacles; and general weather information. The system requires an RNAV approach, but beyond that, the runway and weather criteria can be decided by the airframe manufacturer.

The system even forecasts its own weather if the nearest suitable runway is a significant distance away, long enough that the current ADS-B or SiriusXM weather may not be valid. It uses the latest weather trend information, for example, to determine if a thunderstorm might move into the runway environment where it intends to land. It will route the airplane around thunderstorms as well as terrain and obstacles, all of which it gets from its internal databases. If en route to a runway it determines, because of changing weather conditions, that another runway is closer or more suitable, it will change its destination. It can even estimate changing barometric conditions and adjust the altimeter—using algorithms. Garmin engineers say the calculated barometric readings are within 0.01 inches of mercury of actual ambient conditions.

> Cruise missiles have had similar technology for a long time.

I try to make my landings a little less eventful.

A "good" landing is one which people can walk away from and a "great" landing is one where you can use the cruise missile again so by definition, a cruise missile can complete neither a "good" nor a "great" landing by design.

"One unusual capability of the Snark missile was its ability to fly away from its launch point for up to 11 hours, and then return for a landing. If its warhead did not detach from its body, then the Snark could be flown repeatedly."

https://en.m.wikipedia.org/wiki/SM-62_Snark

Of course cold war shenanigans would prove me wrong.... I stand corrected

Well in theory it could fail in such a miraculous way that everything is intact and it just skidded across the dirt - so while that might be considered a "good" landing it would be considered a "bad" missile launch.

Then the SpaceX stage1 (or stage2, or however they call it) is a missile that only makes great landings. :D

there are plenty of loitering munitions that have great landings routinely.

I prefer to be subsonic before I let the mains touch down (atleast...)

> Cruise missiles have had similar technology for a long time.

Until GPS guidance came into use they were relatively crude terrain followers requiring a preloaded flight plan over a known terrain profile with sufficient bumpiness to protect against IMU drift. Nothing at all like this technology.

Cruise missiles don't "land" and they don't care about passenger safety :)

Almost airport with runways long enough to land G3000 equipped airplanes will have a published approach. What will be interesting though is how this system handles circle to land approaches.

My guess is it would choose a different approach or airport rather than circling if the winds are too unfavorable.

> Cruise missiles have had similar technology for a long time.

Yeah but an average human couldn't, and thankfully still cannot buy one. This is feature on a (and more to come) civilian aircraft, two very different things.

Would it be a lot simpler to have a remote pilot access the controls? Why go through all this ?

Establishing, maintaining, and handling the inevitable connection issues of the data connection necessary to remote pilot an aircraft is a lot more work than integrating a "best route" algorithm with existing autopilot features, automated radio communication, and calming cockpit UI.

I was assuming that this was a solved problem, given how prevalent drone warfare is now.

The military can easily afford other aircraft to serve as relays and satellite data connections that a general aviation pilot probably can't.

Even then, it's problematic: https://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incid...

Until StarLink has proper coverage.

Even then, would you really want to rely on that?

> Cruise missiles have had similar technology for a long time.

Cruise missiles aren't trying to survive the landing.

From https://www.piper.com/model/m600sls/

"The routing algorithm determines a path to the Final Approach Fix (FAF) of the chosen published approach that avoids terrain, obstacles, and significant weather."

That handles all of your contingencies except an engine failure. If you have an engine failure and a pilot who can't dead-stick a landing you're probably screwed. But you're still no worse off in that case than you would have been without autoland.

That is largely mitigated by the MUCH more reliable turboprop in the M600. They have problems much less frequently than piston engines. Not to say they don't happen, or that it isn't important that pilots train for engine out scenarios, it's crucial for pilot safety and an integral part of Aeronautical Decision Making, but this technology on a turboprop platform has the potential to dramatically reduce the likelihood of a fatal accident.

There even exists software for auto-planning a route for a dead stick landing: Xavion, by the author of x-plane.

I seem to remember reading like 4 or more years ago, that there was an experimental autoland system actually powered by that software, and could autoland in a dead stick situation.

EDIT: Found the experimental engine-out auto-land system based on the same technology as xavion: It is called the VP-400 by Vertical Power. I'm not sure if it ever became a purchasable product.

I think this a case for better GA trining. Expecting engine failure on takeoff, building the counterintuitive pitch-down reflex to avoid stall, and so on. Knowing your minimum maneuverable speed (and marking it on your air speed indicator). Expecting something to go wrong is the key mindset. A GA death happens roughly once a week for the reasons you outline. Emergency situations are not time to learn new skills, you need to have it down.

That's true, but, we also accept a certain risk as GA pilots being non-commercial. The risk we accept is translated into a larger GA industry that makes flying as a hobby "affordable" to mere mortals (read: wealthy non-millonaires and not career pilots.)

We can require more training for GA, but the training burden is already pretty high, and the GA industry is still shrinking last time I checked. Boosting safety requirements in the form of additional training for GA may save a few lives, but also those gains could be simply because there will be fewer hobby pilots.

The fact is that GA planes falling out of the sky just doesn't kill very many people. It obviously feels terrible to the families involved in a crash, but relative to automotive deaths, lung cancer, murders, etc, it is a tiny tiny blip in the numbers. Obviously being a GA pilot boosts your chance of dying in a small airplane crash, in the same way that learning to ride a motorcycle boosts your chance of dying in a motorcycle crash. The alternative of killing off recreational flying, is worse.

I’m not talking about making training harder - just changing the mindset of GA pilots. I wrote more in a reply below if you’re interested.

This system appears to be designed primarily for situations involving pilot incapacitation, not compensating for deficits in pilot skill.

All of that was covered, to the point of automatic reflex, during my Private Pilot training. I'm pretty sure it was standard, and not just my Instructor.

Private training varies, I have a friend that didn’t build that reflex properly until training for instrument cert. If you ask lots of private pilots - what’s more important: constant awareness of minimum maneuverable speed, or stall recovery - I expect most will answer stall recovery. Commercial pilots will answer the opposite. It’s a different mindset that’s been driven by commercial airlines. My point is GA training can be improved, and it’s not hard - just a change in mindset towards risk and preparedness.

I agree that that answer is strange. I would have assumed that everyone would answer that it's better to avoid the stall in the first place than have to deal with recovering from it. Clearly, I'm wrong!

I disagree with that. You might now be a pilot who has lost his experience in how to land an airplane and so will do a much worse job of it compounded by the emergency situation. Every landing is also training.

Yes, that true, but this autoland system is not intended for routine use. It's for emergencies only.

Ah, 'you' being 'the passenger and/or the incapacitated pilot' rather than the regular and healthy variety of pilot. Ok, now I understand your comment. Thank you for clarifying.

I've flown airplanes with solid GA plane autopilot that'll fly down to decision height, but you still have to put in flaps, gear, change throttle. To have an airplane do all that on its own is quite impressive, particularly to do a 'nearest' type input on a Garmin then to land it on the appropriate runway, still confuses me sometimes if its a new airport I've never been at.

I'd be interested to know if it declares an emergency, squawks 7700 and controllers are expected to give it a priority and right of way?

It sets 7700 and broadcasts what's happening, incapacitated pilot is an emergency so that's what it will tell everybody. If there's a controller on frequency it's up to that controller what to do about it, but there's no use arguing with a machine and the pilot is incapacitated, so my expectation is that a controller will keep other traffic out of the way, and if the autoland has picked somewhere with a local tower they'd call that tower and give it heads up it has got an incoming emergency, expect to close the incident runway while they clean up the aftermath.

Regardless, the machine will be broadcasting its intentions and again, there's no arguing with a machine other pilots will just have to accept that it's intending to land and stop on the runway putting it out of use until further notice.

Since the machine can't see lights, I assume it doesn't care whether they are functioning. So in the dark it's likely to land at some small airfield which is actually closed, slightly scary for the passengers to just come to a halt in darkness far from anywhere but arguably safer since nobody else is going to make the error of landing when the runway remains occupied.

> they'd call that tower and give it heads up it has got an incoming emergency

No need:

> [Autoland] would update and broadcast that message every 30 seconds—listening to make sure that it didn’t transmit over any other radio calls. Once near the Class D airspace of the tower, it would have changed one of the radios to the tower frequency and kept the other on the emergency frequency.

Then, once landed, it will brake, and then broadcast that the runway is inop due to airplane on the runway.

Quite amazing.

https://www.aopa.org/News-and-Media/All-News/2020/January/Pi...

Why? Airbus and Boeing and even smaller planes like bombedaire have had this capability. With ads-b requirements on all planes it puts GA aircraft in line with jets (ads-b requires transmitting internal information that autopilot also processes)

What I’m trying to say is that the auto land functionality is not a feat, it’s like self parking cars.. been around for 20 years just now cost efficient and safe enough for the masses to use. In a boeing 787, the pilot still needs to squawk 7777 and they should try comms, don’t know why a GA plane would be different..

Autoland, as used in a capable airliner, is much more limited than this. For an airliner, it's a procedure with lots of configuration and monitoring done by a pilot, in cooperation with air traffic control, which usually concludes with descent on a 3-degree or so path through touchdown and braking. Not to mention things like flaps and landing gear are still usually manually selected.

This is much more impressive, not the least of which because the system itself figures out the best place to land (taking into account operational constraints), how to get there (taking into account weather avoidance), and how to be at the right speed, altitude, configuration, etc. to perform the final approach to landing.

So to use your analogy, getting a bit closer to a self-driving car than just self parking!

> the pilot still needs to squawk 7777 and they should try comms, don’t know why a GA plane would be different..

The system being discussed is for when you no longer have a pilot.

Yes, this is not routine autopilot landing, this is "the pilot just had a massive heart attack and the only other people in the plane are a 12-year-old and an armless nun" landing.

The marketing material suggests that weather and runway conditions are taken into account when selecting a landing site. So I would assume the answer to all of those is that it won't pick that runway.

And if the aircraft is low on fuel or isn't making enough power to make that runway... Well, the usual happens - a forced landing, aka a crash landing.

I don't think this is meant to be used as a cop-out by the pilot. "My engine quit! You deal with this, computer!"

In the Vision Jet I believe low fuel / no suitable airport in range leads to automatic CAPS deployment by the autoland system

Thunderstorm: it can use weather broadcast over ADS-In UAT. Mentioned in the AVweb report.

Closure: certainly a problem.

Mountain: can use worldwide topographic information in its database to route around. See AVweb

Crosswind: mentions getting local weather.

Engine: Autland cannot help. But on the Cirrus you'd pull the CAPS cord and float down.

CAPS is not supposed to be used because you have an engine out under most circumstances - you are perfectly capable of dead-sticking a Cirrus onto a runway just like any other small GA plane. And it's not a gentle float, it's ~1700fpm or about 20mph, straight down. The airframe and seats absorb a chunk of it but compared to a 500-700fpm descent on an engine-out landing, pulling CAPS because your engine dies with any sufficient landing area in range (including open fields) will rightfully earn you quite a bit of ridicule.

Nope:

> > There are very few emergencies (in my opinion) in which parachute deployment would be the appropriate response unless there was an extremely unfortunate set of circumstances which led to the airplane being unable to fly or glide (like a wing snapping off)

> I've been a Cirrus instructor for 15 years. This attitude is completely wrong and is exactly what has led more people to be killed than needed to be, especially when Cirruses first came to the market and the chute was a new thing in production aircraft. We TEACH, intentionally, people to ask FIRST, "do I need to use the chute," and the answer is never "no." It's either, "Yes," or "not yet."

> There have been pilots - plenty of them - that had every opportunity to use the chute but kept gliding, or spinning, or whatever, and now they and their passengers are dead.

[...]

> Lose the engine - most of the time, pull the chute. Yes, even better than landing in a nice open field. The chute works. If I screw up the landing, or the field has ditches, furrows, irrigation, cows, power lines, fences, rocks, or who knows what else, I might just be screwed setting a plane down at 65-70kts. But not if I float down into it protected by my roll cage, high-g seats, air bags, etc.

[...]

* https://old.reddit.com/r/flying/comments/dp61qo#f5trzyz

The insurance companies apparently want pilots to pull the CAPS rather than try to dead stick it. That’s what I was told when I got checked out in the SR22 by the flight school. They drilled it into me. What happens when blah blah blah? Pull the CAPS. That was the answer to everything.

>The insurance companies apparently want pilots to pull the CAPS rather than try to dead stick it.

Well of course they do.

CAPS does a pretty good job putting an upper bound on the worst case result. They don't care if you screw your plane up because that's a known cost and you'll pay it back through premiums if you keep flying.

Dead sticking it has a very good chance of being no more expensive than a normal landing if you find a runway and not all that expensive if you find a good field or empty highway (i.e. a big towing bill) so of course most pilots would prefer to dead stick. But this comes with a small chance of you crashing into a daycare and maxing out your policy. The insurers do not want this.

Most decent pilots with good situational will be able to make the correct call between CAPs and dead sticking it. They're telling you to go CAPS all the time because they have to deal with idiot pilots too. It's the same reason every drivers ed program emphasizes brakes, brakes, brakes, despite the steering wheel being a far better way to avoid many problems. They don't trust you to make the call.

One of my friends is a Cirrus platinum instructor, including being type rated for the Vision Jet and even he had a CAPS pull as his first choice versus landing off airport. They call it dead sticking for a reason.

Was it his plane or a company plane? There's a big difference between taking on a little extra risk for your money vs someone else's money.

What's "a little extra risk"? A 5% chance you'll die? 1%? 0.1%? Compared to what? Those are actually very large risks when the cost is your life. When the survival rate of using CAPS is an order of magnitude (or more) safer? Use the chute. Not to mention how bad a decision it would be to dead stick if there are passengers on board.

> When the survival rate of using CAPS is an order of magnitude (or more) safer?

    [citation needed]

13:1 better survivability with CAPS deployed:

https://www.ncbi.nlm.nih.gov/pubmed/28539144

If I had something like Xavion to help with the approach I would probably choose the dead stick approach but really, how often have any of us ever really dead sticked it? I haven't. We pull the power to idle, but that's not the same as a propeller windmilling. That propeller is a huge brake and we aren't used to it. I for one prefer five nines of survival probability to something much smaller. What are the dead stick survival stats?

Anecdotal story:

I know of a skydive place that does or at least used to regularly (like once or twice a week) dead stick it in a C182 because they would fly with the bare minimum of fuel (when you're flying up and down all day even a little extra weight costs a lot of money).

CAPS sounds great over open water or desert, but not so great over a populated area.

At least a non-pilot co-passenger might want to try their luck gliding to open area and then pulling it.

A 20mph vertical impact into someone's roof really isn't the worst of outcomes.

Yeah, I don't think it would be any more catastrophic than a large tree crashing into the roof. It'll be messy and require extensive repairs, but you're not going to see a fireball and crater.

I'm not sure 20mph is correct. The POH says it's the equivalent of being dropped from 10 feet. It's not something I want to experience but it doesn't really sound that bad.

> The POH says it's the equivalent of being dropped from 10 feet.

A fall of 10 feet puts you at ~17 mph when you hit. 20mph is a good approximation.

Post-CAPS deployment descent is about 1700fpm which is 19.3-ish mph.

Ok. I was wrong.

I’m thinking more like power lines, or the chute catching a tall building, some industrial facilities may not be great either. Or moving traffic.

You’ll go wherever the wind pulls you. And might hit the side of something faster than 20mph before hitting the ground.

And hitting a crowd at 20mph.

Wrong. Check the Cirrus POH and exactly the opposite you said is true. In an engine out over the minimum altitude and under the pull speed, use the chute.

Chute pulls are almost 100% survivable. Landing in a field is a much lower percentage. Just hitting nearly invisible power lines can slice a plane in half. You also have a fire danger when landing off airport. And many dead engine landings result in landing short of the field.

You aren’t going to get ridicule from the Cirrus community for pulling the chute and even if you did, it’s less ridicule than crash landing into a field that looked suitable from 2000 feet up.

Yes. One of my friends died landing in a field with engine out.

It's almost impossible to tell what the situation is on the ground until it's too late--an unnoticed ditch can kill you.

Except ADS-B NEXRAD weather is generally 15-20 minutes behind the actual conditions. Using on board weather radar is much better .. many G3000 airplanes are using onboard weather radar rather than the outdated info from ADS-B.

M600 has onboard radar (it's the pod on the right wing).

For us non-pilots: what is CAPS?

Cirrus Airframe Parachute System - a whole aircraft emergency parachute

It's not a US/non-US thing, it's a Cirrus thing: a parachute.

* https://cirrusaircraft.com/totalsafety/

That's "us" not "US".

"Conditions are not suitable for autoland functionality. Please navigate to a location with a clear view of a runway and try again. Sorry for any inconvenience."

> During all phases of flight it communicates with passengers and appropriate air traffic control facilities regarding the new flight plan route and estimated time until landing.

Which would suggest that if you need to be vectored to a runway, the aircraft can negotiate that with ATC automatically (and perhaps ATC can advise which is the most appropriate diversion?) This in the situation where the pilot is incapacitated, but the aircraft isn't in an immediate risk of crashing (e.g. you're cruising, but there's bad weather immediately below you).

It should also be able to use stuff like D-ATIS to get airport conditions.

That seems optimistic though, perhaps it just announces its intentions and hopes ATC clears a path?

> Which would suggest that if you need to be vectored to a runway, the aircraft can negotiate that with ATC automatically (and perhaps ATC can advise which is the most appropriate diversion?)

I strongly suspect it just announces itself.

"N123FOO DECLARING EMERGENCY; PILOT INCAPACITATED, AUTOLAND ENGAGED; CLEAR RUNWAY 21L; 12 MILES OUT" sort of stuff.

Still makes me wonder: do you really need/want all that automation or would it make more sense to prepare for putting a remote pilot into the loop? Not for virtually holding the stick, but for looking at telemetry, communicating and doing all the high level decisions.

If you have a remote pilot then you need some sort of data connection as well; and if that link cuts out the plane needs to be able to continue on its own anyway.

It'd have to be as an additional safety measure. Connectivity is by no means guaranteed - you'd be relying on satellite comms in most cases. Maybe when SpaceX's Starlink comes online.

(It'd probably also be significantly more expensive, due to the need for a subscription.)

There are certainly incredible situations with happy endings where ATC has made suggestions or gotten someone with experience in a type on the radio.

But I could imagine a company contemplating building the remote-pilot-for-emergencies service might be scared off by potential liability. Families of pilots killed in GA accidents routinely sue aircraft and engine manufacturers even when the FAA determines the cause to be pilot error.

This is what some of the new "fully automated" semi-truck companies are doing.

Remote truckers in an office, similar to a UAV drone pilot.

Most trucks drive similarly. A Vision Jet is a far different airplane than a Pilatus. Automation is better because the computer is designed for that specific aircraft as opposed to having a bunch of on-call pilots that just so happen to be type rated for that specific plane. And if they aren’t type rated, they are more of a liability. It’s very expensive to get type ratings so that remote pilot concept just wouldn’t scale. A 787 pilot isn’t going to know the intricacies of a Kodiak and besides, what pilot is going to want to sit in a ready-room for a shift for days on end with nothing to do? An incapacitated pilot is so rare that automation is a high enough percentage that it’s a fine solution. There is already a pilot shortage — hiring type rated remote pilots to just sit and wait around isn’t going to be easy.

> ... what pilot is going to want to sit in a ready-room for a shift for days on end with nothing to do?

Possible scenario: if pilots are already sitting in a simulator for currency training / testing, it may be possible to have the sim be 'reset' to a live feed in an emergency.

You wouldn't have them hang around 'just in case', but rather use people who are already present for some other reason.

Another possibility: pilots are hours-limited for a given time period. If you have pilots that have hit that limit, some may be willing to spend time in a ready-room for a nominal bonus.

When a truck (or a train) can't see what to do on its own, it can brake to a full stop and remain motionless until a human intervenes. Cell network crashed? Mountain in the way of the transmitter? Somebody stepped on the cable? Whatever it is, most problems will be averted by just always braking to a halt and waiting.

This is not an option in a plane. If it was, this technology wouldn't be needed - if the pilot is incapacitated just brake to a halt and step out of the plane...

A plane entering an ad-hoc holding circle is much less of a risk to its peers than a ground vehicle coming to a stop on the open road.

That highly depends on where that circle is.

FYI all major airlines have a sat link to their planes with monitoring. While they don’t have a remote fly by wire link, they can load live data from a plane into a sim and have a pilot on the ground troubleshoot with the troubled craft

Curious if it xmits that on guard or tries to tune to ctaf and do it.

I'd imagine given the airport database that it's capable of calling the right frequency. Might do both.

I did some searching and found some demo videos. In this video, part of the announcement is audible: https://youtu.be/IcVuubU4BTU?t=90

Starting at 1:30, "NOVEMBER SIX HOTEL LIMA, POSSIBLE PILOT INCAPACITATION, SIXTEEN MILES WEST OF KILO CHARLIE LIMA--" at this point the voiceover talks over the announcement, and I have trouble making it out, but I'm pretty sure I hear a "...LANDING ON RUNWAY..." in there as well. For those of you that don't know pilot jargon, that's the plane's registration number (N6HL), the situation, location relative to the nearest airport (KCL-something), and what I'm pretty is a declaration of intent to land on a specified runway.

So, your guess is correct, what the system does is announce its status and intentions and let ATC clear the way.

Other comments have speculated about uncontrolled fields, but I think that's less likely to be an issue. Per the demo video, the auto-land feature requires a GPS approach with altitude guidance published. If a field can't afford a staffed tower, would it be able to afford to have a published GPS approach with altitude guidance? My intuition says no, but as I'm not a pilot, I could be wrong about that. On possible scenario I could see is that the tower isn't 24x7, and so the field is uncontrolled at night. Perhaps such a field would have a GPS approach published, and if the auto-land selected that field, it would be up to any pilots in the area to be aware of the announcement and get out of the way. AFAIK, having one of your radios monitoring the emergency band is considered best practice, so other pilots in the area should be able to hear the emergency announcement and react appropriately.

But at this point, I'm speculating as well. For all I know, the auto land only selects airports known to have a manned tower at the time of activation.

There's a frequency for uncontrolled fields the Common Traffic Advisory Frequency. You join the frequency and ordinarily it's silent OR you can hear other pilots who are already in the same area or on the ground, co-ordinating. You listen and build a mental image of anything happening, then as you get closer, even if nobody else spoke yet, you announce your intentions.

The accident plane will be constantly reminding people of its status on this frequency when there isn't a tower. Other pilots will be talking in response to each other but this system can't understand what they're saying. So it will just explain periodically what's going on. Something like:

"Springfield Traffic, November Six Zero Hotel Lima with Emergency Possible Pilot Incapacitation. Final Runway One Six. Full Stop. Runway Will Close After Emergency."

I can definitely imagine, especially when this technology is new, other pilots trying to ask questions

"Zero Hotel Lima, did you say runway will close? I was planning to land there after you. Do you know when it will re-open?"

The system can't understand their question and won't answer, but their training should teach them De Niro's line from Ronin. "When there is any doubt, there is no doubt". Something is wrong, they should divert and leave the emergency plane to do its thing.

The vast majority of reasonable places to land something small like these $2-3M planes will not have a tower at all, and for some of the rest the tower is only part time, but your emergency may not be, so it is usually going to be talking on CTAF and other pilots will just have to make new plans to work around the emergency.

Plenty of untowered fields with GPS approaches. Hayward, Palo Alto and Livermore are three that have closed towers at night — to be fair though, the GPS approach at Palo is prohibited at night, but Hayward’s is definitely available. Even untowered Sedona has an RNAV approach.

Yes it’ll squawk emergency transponder and broadcast on the radio.

In the case of the mountain, the avionics have a terrain database built in, so it can follow an LPV WAAS approach from a fix above the terrain.

I don't know if this can deal with the engine out, but in theory there isn't any reason it couldn't. There is an IPad app called "Xavion". With an engine out, Xavion will calculate an approach for you follow to a suitable airport, based on the aircraft's best glide speed + required runway length. Interestingly it doesn't use the published best glide speed and stopping distances, the app uses your flight history to figure out the aircraft's actual best glide and stopping distance.

Head and tailwinds are real

What kind tech stack/development processes do you think are needed for something like this?

At a very naive level, for example: typed language vs dynamic; formal verification of the code or not (or to what extent); what kind of QA? (can't even imagine how to test this "in production" given the amount of edge cases like the ones you describe; hw and sw redundancy; to name a few.

I have zero experience with airplane software but I find it fascinating considering how safe flying is.

> typed language vs dynamic

You are not approaching this from the correct angle. "dynamic" and "static" types is a red-herring for safety. Yes, when we are rushing some feature in our day jobs we can try to call functions with their wrong types. But these are not critical systems.

If you DO have a critical system, you are going to have to invest _massive_ engineering resources. You are going to exercise all code paths. If you get a "type" error, you haven't done your job correctly. Because this was a code path not exercised before, and that should not happen. The additional type checks at compile time are a drop in the bucket compared to all the testing you have to do.

That said, most such applications will be very traditional. C or C++, maybe ADA. Despite having types, the C family you give you a whole lot more failure scenarios. For instance, it's very easy to corrupt your entire process memory in C, that is something that not many "dynamic" languages will let you do. And yet people build mission critical systems with them.

That's not the only possible answer though. For an interesting autonomous system, please look into NASA's Deep Space 1, in particular the Remote Agent. Written in Lisp, it had spacecraft controls for a few days. It could self-diagnose and correct issues. For a long time, it was the most advanced piece of software to ever control a spacecraft. And Lisp is "dynamic" typed (but strongly typed)

Now, they do test in "production", but it's more like they have lots of staging environments. Some of them may be simulators, some of them may be replicas. At the end of the day, this is no different from any other software: it has inputs (airspeed, altitude, heading, roll, pitch, yaw, servo positions, charts, weather radar, etc) and outputs (controlling the servos, changing radio frequencies, etc). You can simulate some or all of them.

I'd imagine that it begins well before that with Requirements Management: probably more important than any other single thing since that drives the entire development process.

Anyway, I'm sure there used to be a blog for the Dreamliner test team, but I can't find it now, so here's this instead: https://www.wired.com/2010/03/a-look-inside-the-brains-of-bo...

And specifically for code, look here: https://ldra.com/aerospace-defence/standards/misra-cc/

and (JSF, not commercial) https://www.f35.com/about/life-cycle/software

The FAA has a lot to say about how software gets onto planes.

https://en.wikipedia.org/wiki/DO-178C

Interesting responses. Thanks!

Question: how close are we to totally self-flying planes? I feel like we could easily get there before we got self-driving cars, if we wanted to.

Would the costs for short hops be comparable to a commercial airplane ticket? Because it would be awesome to charter small flights from an app to jump to a nearby city.

We've had truly autonomous long-range flight since 1998 with the RQ-4A Global Hawk https://en.wikipedia.org/wiki/Northrop_Grumman_RQ-4_Global_H...

A couple highlights from the Records section:

> On 24 April 2001, a Global Hawk flew non-stop from Edwards AFB to RAAF Base Edinburgh in Australia, making history by being the first pilotless aircraft to cross the Pacific Ocean. The flight took 22 hours, and set a world record for absolute distance flown by a UAV, 13,219.86 kilometers (8,214.44 mi).[97]

> On 22 March 2008, a Global Hawk set the endurance record for full-scale, operational uncrewed aircraft UAVs by flying for 33.1 hours at altitudes up to 60,000 feet over Edwards AFB.[98]

Unlike Predator/Reaper/etc. drones, the Global Hawk is autonomous, there is no pilot sitting in a faux-cockpit stateside.

Do you know how these drones communicate with the ATC to state their intentions? Is there a flight plan made ahead and plan that they don't deviate from? I could not find any information online.

The operator is communicating via VHF with ATC. I’m not sure on exactly how the transmissions are handled (via aircraft, or remote radio station?) but the operator is in communication with ATC. If you can find a live ATC feed of Syracuse tower they’re frequently doing touch and go’s there.

One thing to keep in mind is that any type of auto-fly is dependent on a LOT of automation systems on the plane itself being functional. For example, instruments, sensors, autopilot, auto throttle.

To be considered safe, an auto-fly needs to be able to gracefully degrade as the subsystems in which it depends start to fail. Human pilots are trained to handle this by compensating for system failures in a variety of ways, including compensation (eg in a split flap scenario) and disabling (turning off a misbehaving autopilot). Ultimately, a human pilot can always turn off all the automation and fly the plane by looking out the window (or, in poor conditions, using gyro powered “steam” gauges).

In the case that the pilot is disabled, then auto-land is a great option, even though it’s reliant on so many subsystems. But for an always-on auto-fly, the requirement to gracefully degrade, and degrade, and degrade, and still operate at the level of a human pilot using the “Mark 1 eyeball” is a tough one which hasn’t yet been met (as far as I know).

There’s mention in this discussion of fully automated drones. But, those are basically expendable if there’s a serious system failure, since there are no souls on board.

Gyro powered steam gauges are all but gone from aviation. The GA fleet is even shedding them at a promising rate. MEMS based independent systems with backup power are solid state and far more reliable than a janky vacuum pump driven by the engine running a couple clockwork instruments.

Sorry to be a pedant but since it took me a second to get it at first: "all but gone" implies that they're definitely still here, I think something like "almost gone" or "almost out of use" would be the right phrasing.

all but is an expression meaning almost. See e.g. https://grammarist.com/usage/all-but/. It's one of the most confusing English expressions I've encountered.

'all but' is an idiomatic synonym for 'almost'.

https://idioms.thefreedictionary.com/all+but

I don't see how that's relevant. _They can and will still fail_

What happens then they do?

You have more than one independent system. A typical glass panel install will have a primary ADAHRS (air data attitude and heading reference system which contains a MEMS magnetometer, gyro, accelerator, pitot static pressure transducers, and processor) and a secondary ADAHRS both connected to the primary flight displays. Should one fail, you have a fallback for your PFD. As a backup, were you would normally have a vacuum gyro, you have a small glass panel (the garmin offering is the G5) which contains it's own built in ADAHRS and battery and will continue running even with the entire aircraft electrical system disabled.

Most of the GA fleet is still vacuum powered for backup.

Why do people keep parroting this? I know of exactly zero aircraft currently produced that are retaining the vacuum system and I've seen very few retrofits that retain the vacuum on the engine. The aircraft in operation with vacuum systems use them as primary systems but are moving away from it with each annual.

>Because it would be awesome to charter small flights from an app to jump to a nearby city.

I doubt the cost of a pilot's time alone is a big enough factor to meaningfully change the number of people with access to chartered flights.

The other costs (hours of plane time, fuel, ramp fee, parking fees, maintenance) probably dwarf pilot time as a percentage of total cost. And you're either pushing the absolute unreliability of aviation [0] to the customers who are now trapped in a different city, or they're paying even more to the app to have backup plans ready to roll.

[0] Commercial aviation deals at a scale that can absorb flights that don't keep their plan. You go to the counter, get rebooked, and angrily eat some shitty fast food. When something goes wrong on a private flight, you're pacing around on the tarmac at 1 am, 3 states away from home and have to be at work in the morning.

We have them now, just not passenger carrying. Military drones are autonomous.

They are remotley piloted. https://www.youtube.com/watch?v=_w5NGKt71k4

Engine failure on takeoff is tricky to deal with. See Sullenberger landing on the Hudson for example https://en.wikipedia.org/wiki/US_Airways_Flight_1549

Isn't that a situation where a machine would excel? One challenge is the abundance of decisions with only one non-deadly option, the other challenge is lack of time. The first challenge is solved by well-defined decision trees and mental checklists, but those make the second challenge harder. Computers don't need to balance between checklist thoroughness and decision latency, they can look at all the data they have in practically zero time.

Mandatory bad car analogy: a driver will often prefer a faster response over spending time to check the rear view mirror before slamming the brakes, a computer would never have reasons to do so, they can check without meaningful delay.

No this isn't a situation where a machine would excel because it can't handle unexpected failure modes for which is hasn't been programmed. Human pilots can often come up with a "good enough" solution based on understanding fundamental principles without having any prior experience. For example, the pilots on US Airways flight 1549 intentionally changed and disregarded parts of the checklist for handling a dual engine failure because it wasn't a perfect fit for the actual conditions at the time.

Yes I agree.. As long as the system can simulate the degraded plane, and is fast enough, it can brute force through a huge number of decision trees and scenarios in milliseconds to find the optimal. A human would do something similar but will prune the tree much more heavily than the computer as the human is slow. This is analogous to any chess engine, the difference is that the plane flight requires a much more difficult simulation scenario compared to a chess board. The system has to understand or at least measure what has degraded as well which might be difficult.

(I don't mean to make it sound as I think it's easy to solve, but the basic strategy to solving it is simple :)

The basic strategy is simple, but implementing it is not. I think a perfect real world example is Tesla's recent roll out of their summon feature. The basic strategy of having your autonomous car pull out of a parking spot and pick you up at the door is simple, but the actual implementation shows how difficult that actually is.

There's probably a wide range of unusual, one-off edge cases that almost never happen which would be impossible or difficult to find.

And maybe catching/handling them properly would involve more sensors, when people really just want a well-trained human who is able to improvise in the cockpit.

It would be difficult code a machine to find a good landing spot in extremely variable terrain. For instance, I saw a video of a plane safely crash-landing landing on a four-lane highway with traffic. It would be impractical to code something to handle that very rare situation.

I'm not a pilot, but the by far most dangerous time to have an engine problem is the period that starts the moment you have accelerated too much to safely stop the plane on the ground and that ends with having sufficient speed and altitude to glide back to an emergency landing. There surely are defined procedures for reaching the least deadly outcome for every phase within that period (basically a lookup table based on accumulated energy, with different input options, with either time or airspeed and altitude is proxies for accumulated energy). Being well trained just means applying those rules with minimum hesitation.

Even experience cannot be much of a factor on top of that, as very few pilots will ever experience a scenario like that outside the simulator. My layman's suspicion, honed in the MCAS debates, tells me that the only other thing experience and human "general intelligence and gut feeling" can add to the equation is educated guesswork regarding which data to distrust when things just don't add up consistently due to a malfunction.

Yup:

> V_1 is the critical engine failure recognition speed or takeoff decision speed. It is the speed above which the takeoff will continue even if an engine fails or another problem occurs, such as a blown tire.[9]

* https://en.wikipedia.org/wiki/V_speeds

The plane has to keep going until V_2 (or V_2_min).

>very few pilots will ever experience a scenario like that outside the simulator

One thing that no doubt helped with Sullenberger was he was a hobby glider pilot where that kind of situation comes up regularly if in a much less dangerous way as gliders are slow and light.

This is what companies like Lilium are aiming for [1], and they're aiming for passenger operations starting in 2025 on a "taxi" type basis, probably initially with a pilot on board, though from what I understand this is largely because they don't expect to get approval for autonomous operation from day one. Of course there's no guarantee they'll meet that target, but they're also just one of many companies working on this.

[1] https://lilium.com/newsroom-detail/taking-to-the-skies-fligh...

There's been discussions for years on whether or not the level of automation in modern aircraft causes pilot training to lapse due to misuse. Self-driving planes are much easier than self-driving cars because there is empty space on all sides of the plane pretty much at all times. Autopilot is already generally speaking "a thing", with the exception of takeoff and landing.

Bear in mind even in takeoff and landing scenarios, unlike a public roadway, the airplane has pretty exclusive use of the runway as well.

Pilots are very unlikely the primary cost of aircraft trips. Things like jet fuel are probably much more of the cost driver.

>I feel like we could easily get there before we got self-driving cars, if we wanted to.

The environment has shown quite clearly that we don't want to. We'd probably already have it if we did.

The safety design of aviation relies on having multiple highly competent people in the loop on every flight and exercising their judgement on dozens of things. And that's for the best-case scenario, they also have to be capable of choosing and executing fallback plans when part of the overall system (the plane, air traffic, radio navigation, flying conditions, ground conditions, etc...) degrades or enters an unexpected state.

The technology already exists, it's a much easier problem than self driving cars. Spacecraft can fly themselves to other planets and return. That is a massively more complex problem.

It's a problem of trust, and regulation, not a technical one.

No doubt this is real engineering. I'm sure they had to do a lot of software verification work.

I’d hope that autoland connects to Garmin HQ and then they can coordinate and also just call up the tower and tell them what’s going on. Managing airspace and radio communications is the tricky part imo

I'd presume the plane will also start to squawk 7700, shouldn't be an issue then.

Autoland will squawk the emergency code 7700 on the transponder, and announce itself on the emergency frequency 121.5 and the local CTAF (common traffic advisory frequency, IIRC, which coincides with tower frequency if the airport is towered).

Uncontrolled airspace is much more of a concern, since there is no tower HQ can call.

>but what happens when...

You handle those things manually by setting proper inputs to the normal non-emergency autopilot or flying without autopilot like you would in any other aircraft equipped with an autopilot that is capable of landing. I assume "one off" approaches are a non issue because they are using a database of supported airports with the necessary approach details since they change slowly and the list is short enough. That's traditionally how this kind of thing is handled.

This is not a replacement for a pilot and is not portrayed as such.

It will be insanely impressive if it actually performs well in those scenarios :)

Well the plane crashes i suppose

It's just shortest path traversal no?

Represent each airport as a node in a graph with all relevant data (distance, weather, etc.) ... Traverse the graph and find the shortest path.

https://en.wikipedia.org/wiki/Dijkstra%27s_algorithm

Easier said than done I'm sure ;)

Confused as to why this is being downvoted. If there's a better way to implement it, by all means, lets discuss that! It's an interesting tech challenge... why just downvote?

I agree with you!

The word "just" in their post may be prickly. Also, it's not really a graph search as stated, just a "choose the airport with the lowest weight". That, in theory, chooses the airport to land at, but not... the rest of it.

Yes, choosing a route would be essentially a graph search, with weather at intermediate nodes adding to edge weights, etc, but even after you've computed a target path, you're going to be continually refining that path (e.g. the thunderstorm moves in a way you didn't predict). And... flying the aircraft itself.

Autopilot in straight & level flight isn't too big of a deal. Autopilot tracking a path is doable (including ascent/decent). Auto-throttle is common on larger airliners but not in GA aircraft. Automatically configuring landing gear and flaps, as appropriate for weather conditions, is (afaik) not done automatically even in commercial airliners. And doing all of this, reliably, with the assumption that the pilot is incapacitated... that's friggin' cool!