[Peetwo]

Trouble to the MAX for Boeing - 

Via the NYT: https://www.nytimes.com/2019/02/03/world...ilots.html

Behind the Lion Air Crash, a Trail of Decisions Kept Pilots in the Dark

Boeing’s 737 Max is the latest version of a plane that first went into service half a century ago.CreditCreditMatt Mcknight/Reuters

By James Glanz, Julie Creswell, Thomas Kaplan and Zach Wichter
Feb. 3, 2019



In the brutally competitive jetliner business, the announcement in late 2010 that Airbus would introduce a more fuel-efficient version of its best-selling A320 amounted to a frontal assault on its archrival Boeing’s workhorse 737.

Boeing scrambled to counterpunch. Within months, it came up with a plan for an upgrade of its own, the 737 Max, featuring engines that would yield similar fuel savings. And in the years that followed, Boeing pushed not just to design and build the new plane, but to persuade its airline customers and, crucially, the Federal Aviation Administration, that the new model would fly safely and handle enough like the existing model that 737 pilots would not have to undergo costly retraining.
Boeing’s strategy set off a cascading series of engineering, business and regulatory decisions that years later would leave the company facing difficult questions about the crash in October of a Lion Air 737 Max off Indonesia.

The causes of the crash, which killed 189 people, are still under investigation. Indonesian authorities are studying the cockpit voice recorder for insights into how the pilots handled the emergency, and are examining Lion Air’s long history of maintenance problems.

But the tragedy has become a focus of intense interest and debate in aviation circles because of another factor: the determination by Boeing and the F.A.A. that pilots did not need to be informed about a change introduced to the 737’s flight control system for the Max, some software coding intended to automatically offset the risk that the size and location of the new engines could lead the aircraft to stall under certain conditions.

That judgment by Boeing and its regulator was at least in part a result of the company’s drive to minimize the costs of pilot retraining. And it appears to have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash: faulty data erroneously indicating that the plane was flying at a dangerous angle, leading the flight control system to repeatedly push the plane’s nose down.

Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max more than seven years ago, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides.

Those decisions ultimately prompted the company, regulators and airlines to conclude that training or briefing pilots on the change to the flight control system was unnecessary for carrying out well-established emergency procedures.

The story of the change to that system, and how it came to play a central role in the Lion Air crash, shows how safety on modern jetliners is shaped by a complex combination of factors, including fierce industry competition, technological advances and pilot training. It illustrates how, in the rare instances when things go awry, the interplay of those factors can create unintended and potentially fatal consequences.

The crash has raised questions about whether Boeing played down or overlooked, largely for cost and competitive reasons, the potential dangers of keeping pilots uninformed about changes to a critical element of the plane’s software.

And it has put a new focus on whether the F.A.A. has been aggressive enough in monitoring Boeing in an era when technology has made airliners both remarkably reliable and increasingly complicated. European regulators initially disagreed with the F.A.A.’s judgment about the need for additional training but ultimately went along, a pilot familiar with the certification process said, while regulators in Brazil broke with the F.A.A. and required that pilots be made familiar with the change.

Boeing has taken the position that the pilots of the Lion Air flight should have known how to handle the emergency despite not knowing about the modification. The company has maintained that properly following established emergency procedures — essentially, a checklist — long familiar to pilots from its earlier 737s should have allowed the crew to handle a malfunction of the so-called maneuvering characteristics augmentation system, known as M.C.A.S., whether they knew it was on the plane or not.

Boeing said that various systems on both the Max and its previous generation 737 can push the nose down. “Regardless of cause,” the company said, the flight crew should go through the checklist, “which is contained in existing procedures.”

The company said that in developing training materials for the 737 Max, it followed long-established practices. “The process ensures flight crews have all the information to safely operate the airplane,” Boeing said, “and for maintenance and fleet chiefs to understand how to ensure the airplanes are serviceable.”

But in the aftermath of the crash, Boeing plans to release a software upgrade for the 737 Max, according to a person briefed on the matter, though it is not clear how the upgrade will affect M.C.A.S. Boeing said that it “continues to evaluate the need for software or other changes as we learn more from the ongoing investigation.”

The F.A.A. declined to comment about the crash but acknowledged that its own role was being examined.

“The F.A.A.’s review of the 737 Max’s certification is a part of an ongoing investigation with the N.T.S.B. and Indonesian civil aviation authorities,” the agency said in a statement, referring to the National Transportation Safety Board. “We cannot provide details of that review until the investigation is complete.”

Boeing’s position has left many pilots angry and concerned.

“Any time a new system is introduced into an airplane, we are the people responsible for that airplane,” said Jon Weaks, the president of the Southwest Airlines Pilots Association.


A 737 simulator being used by Lion Air aviation students. The Federal Aviation Administration decided that 737 pilots would not have to undergo additional simulator training to fly the new Boeing 737 Max.CreditWilly Kurniawan/Reuters

Referring to the addition of M.C.A.S., Mr. Weaks added, “We felt and we feel that we needed to know about that, and there’s just no other way to say it.”

John Barton, a 737 captain who spoke on the condition that the airline he flies for not be identified, said the blame started with Boeing and the F.A.A. but extended to airlines and pilot unions.

“Many pilots feel the training was inadequate, and therefore it appears to me that Boeing, the F.A.A., the airline training centers and possibly the unions themselves are culpable for the incident that happened,” he said.

Saving Airlines Time and Money

In designing the 737 Max, Boeing was selling airlines on the aircraft’s fuel savings, operating cost reductions and other improvements. But at the same time, it was trying to avoid wholesale aerodynamic and handling changes that would spur the F.A.A. to determine that existing 737 pilots would need substantial new and time-consuming training.

Internally, a primary requirement for the Max was that no design change could cause the F.A.A. to conclude that airline pilots must be trained on the system differences between the then-current version of the plane, the 737 NG, and the Max using simulators, said Rick Ludtke, a flight crew operations engineering analyst who was involved in devising some of the other new safety features on the 737 Max.  

By limiting the differences between the models, Boeing would save airlines time and money by not putting their 737 pilots in simulators for hours to train on the new aircraft, making a switch to the Max more appealing.

“Part of what we wanted to accomplish was seamless training and introduction for our customers, so we purposely designed the airplane to behave in the same way,” Dennis A. Muilenburg, Boeing’s chief executive, said on CNBC in December in response to a question about whether the company wanted to hold down training costs. “So even though it’s a different airplane design, the control laws that fly the airplane are designed to make the airplane behave the same way in the hands of the pilot.”

But Boeing’s engineers had a problem. Because the new engines for the Max were larger than those on the older version, they needed to be mounted higher and farther forward on the wings to provide adequate ground clearance.

Early analysis revealed that the bigger engines, mounted differently than on the previous version of the 737, would have a destabilizing effect on the airplane, especially at lower speeds during high-banked, tight-turn maneuvers, Mr. Ludtke said.



A Boeing employee examines wiring on a 737 Max at the company’s plant in Renton, Wash.CreditDavid Ryder/Bloomberg

The concern was that an increased risk of the nose being pushed up at low airspeeds could cause the plane to get closer to the angle at which it stalls, or loses lift, Mr. Ludtke said.

After weighing many possibilities, Mr. Ludtke said, Boeing decided to add a new program — what engineers described as essentially some lines of code — to the aircraft’s existing flight control system to counter the destabilizing pitching forces from the new engines.

That program was M.C.A.S.

M.C.A.S., according to an engineer familiar with the matter, was written into the so-called control law, the umbrella operating system that, among other things, keeps the plane in “trim,” or ensures that the nose is at the proper angle for the plane’s speed and trajectory. In effect, the system would automatically push the nose down if it sensed that the plane’s angle was creating the risk of a stall.

Both M.C.A.S. and the so-called speed trim system — the automatic stabilizer controls used on the 737 NG and earlier versions — operate primarily via the horizontal section of the 737’s tail fin, which consists of a relatively narrow “elevator” in the back and a larger surface called a stabilizer in the front. In manual flight, pilots move the nose up and down by pulling or pushing on a control column, also called a yoke, to pivot the elevator one way or the other.

Ordinarily, the stabilizers accomplish a more subtle task, making sure that the up or down forces on the tail keep the plane balanced around its center of gravity. Either pilot can control the stabilizers electrically using switches at the top of the yoke.
M.C.A.S. was written to use the stabilizers in a different way.

The modified system’s first task was to automatically offset the stall risk created by the change in the size and location of the engines.

“M.C.A.S. was necessary then for the airplane to be certified by the F.A.A. to have met all of the regulatory design requirements for stability and control,” Mr. Ludtke said.

In addition to addressing safety, M.C.A.S. also let the plane handle much like its predecessors from a pilot’s perspective. In assessing whether existing 737 pilots would need to spend hours training on simulators to fly the Max, the F.A.A. would take into account how similarly the two versions handled.

Boeing said that the modification “improves aircraft handling characteristics” and decreases “pitch-up tendency” only in unusual circumstances. “It does not control the airplane in normal flight,” the company said.



The 737 Max was Boeing’s response to a more fuel-efficient version of its archrival Airbus’s A320 jetliner.CreditMatt Mcknight/Reuters

The F.A.A. would also determine what kind of training would be required for pilots on specific design changes to the Max compared with the previous version. Some changes would require training short of simulator time, such as computer-based instruction.

“I would think this is one of those systems that the pilots should know it’s onboard and when it’s activated,” said Chuck Horning, the department chairman for aviation maintenance science at Embry-Riddle Aeronautical University.

That was not the choice that Boeing — or regulators — would make.

The F.A.A. Sides With Boeing

Ultimately, the F.A.A. determined that there were not enough differences between the 737 Max and the prior iteration to require pilots to go through simulator training.

While the agency did require pilots to be given less onerous training or information on a variety of other changes between the two versions of the plane, M.C.A.S. was not among those items either.

The bottom line was that there was no regulatory requirement for Boeing or its airline customers to flag the changes in the flight control system for its pilots — and Boeing contended that there was no need, since, in the company’s view, the established emergency procedures would cover any problem regardless of whether it stemmed from the original system or the modification.

At least as far as pilots knew, M.C.A.S. did not exist, even though it would play a key role in controlling the plane under certain circumstances.

Boeing did not hide the modified system. It was documented in maintenance manuals for the plane, and airlines were informed about it during detailed briefings on differences between the Max and earlier versions of the 737.

But the F.A.A.’s determination that the system did not have to be flagged for pilots gave pause to some other regulators.

Across the Atlantic, the European Aviation Safety Agency, the European Union’s equivalent of the F.A.A., had qualms, according to a pilot familiar with the European regulator’s certification process.


The larger, more fuel-efficient engines Boeing wanted for the 737 Max led to a change in the flight control system that was never highlighted for pilots.CreditDavid Ryder/Bloomberg

At first, the agency was inclined to rule that M.C.A.S. needed to be included in the flight operations manual for the Max, which in turn would have required that pilots be made aware of the new system through a classroom or computer course, the pilot said. But ultimately, he said, the agency did not consider the issue important enough to hold its ground, and eventually it went along with Boeing and the F.A.A.

When Brazilian regulators published their required training for pilots, they singled out M.C.A.S. as one of the changes that needed to be flagged.

The F.A.A. said that “other countries base their standards on conditions specific and unique to each nation.”

Among the many unanswered questions raised by the crash is the degree to which Boeing and the F.A.A. considered what would happen in the event that M.C.A.S. — or the sensors that fed the system information about the plane — were to malfunction.

In the Lion Air crash, one of the primary theories is that the system was receiving faulty data about the angle of the plane from what is known as an angle of attack sensor, vanelike devices on either side of the fuselage that measure how much the plane’s nose is pointing up or down. Preliminary findings from the investigation suggested that the sensor on the pilot’s side of the plane was generating erroneous data.

In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight.

That decision kept the system simpler, but also left it vulnerable to a single malfunctioning sensor, or data improperly transferred from it — as appeared to occur on the day of the crash.

There is no evidence that Boeing did flight-testing of M.C.A.S. with erroneous sensor data, and it is not clear whether the F.A.A. did so. European regulators flight-tested the new version of the plane with normal sensor data feeding into M.C.A.S. but not with bad data, the pilot familiar with the European certification process said.

The stabilizers on older models could have moved in unpredictable and dangerous ways as well, because of factors like electrical shorts, bad sensor data or computer problems. Boeing reasoned, according to people the company has briefed, as well as a bulletin it sent airlines after the crash, that the emergency procedure for malfunctioning speed trim and other stabilizer problems on the earlier 737s would work on the Max for problems related to M.C.A.S., too.


Lion Air Flight 610, a Boeing 737 Max, crashed into the Java Sea off Indonesia on Oct. 29, killing all 189 people on board.CreditUlet Ifansasti/Getty Images

The centerpiece of that procedure is to switch off two “stabilizer trim cutout” switches on the central console of the cockpit, and then flip open the handles on wheels near the knees of the captain and first officer. By cranking those wheels, the pilots can adjust the stabilizers manually in an effort to keep the plane from pitching up or down.

The Role of Pilots

At the heart of the debate is whether the pilots would have responded differently if they knew the plane’s nose was being forced down specifically by M.C.A.S.

Information from the flight data recorder shows that the plane’s nose was pitched down more than two dozen times during the brief flight, resisting efforts by the pilots to keep it flying level. If M.C.A.S. was receiving faulty data indicating that the plane was pitched upward at an angle that risked a stall — and the preliminary results of the investigation suggest that it was — the system would have automatically pushed the nose down to avert the stall.

The standard checklist for dealing with that sort of emergency on the previous version of the 737 focuses on flipping the stabilizer trim cutout switches and using the manual wheels to adjust the stabilizers.

Boeing has asserted the pilots on the next-to-last flight of the same Lion Air aircraft that crashed encountered a similar, if less severe, nose-down problem. They addressed it by flipping off the stabilizer cutout switches, in keeping with the emergency checklist. Still, Indonesian investigators found, the pilots broke from the checklist by flipping the switches back on again before turning them off for the rest of the flight. That flight, with different pilots from the flight that crashed, landed safely.

Older 737s had another way of addressing certain problems with the stabilizers: Pulling back on the yoke, or control column, one of which sits immediately in front of both the captain and the first officer, would cut off electronic control of the stabilizers, allowing the pilots to control them manually.

That feature was disabled on the Max when M.C.A.S. was activated — another change that pilots were unlikely to have been aware of. After the crash, Boeing told airlines that when M.C.A.S. is activated, as it appeared to have been on the Lion Air flight, pulling back on the control column will not stop so-called stabilizer runaway.

The preliminary results of the investigation, based on information from the flight data recorder, suggested that the pilots of the doomed flight tried a number of ways to pull the nose back up as it lurched down more than two dozen times. That included activating switches on the control yoke that control the angle of the stabilizers on the plane’s tail — and when that failed to stop the problem, pulling back on the yoke.

There is no indication that they tried to flip the stabilizer cutout switches, as the emergency checklist suggests they should have. Findings from the cockpit voice recorder could establish in more detail what culpability, if any, rests with the Lion Air pilots.

Boeing’s position that following the established emergency checklist should have been sufficient understates the complexity of responding to a crisis in real time, pilots said.

Referring to Boeing’s focus on the need for pilots to flip the stabilizer cutout switches, Dennis Tajer, the spokesman for the American Airlines pilots union and a 737 pilot, said, “They are absolutely correct: Turning those two switches off will stop that aggressive action against you.”

Still, Mr. Tajer added, a pilot needs to know what systems are aboard so that they become “a part of your fiber as you fly the aircraft.”

The pilot of the plane’s next-to-last flight, in his entry into an electronic log, noted a variety of problems he had encountered, and speculated that the plane’s speed trim system — the stabilizer functions used on the 737 NG and earlier versions — was not operating correctly. But no one involved in that next-to-last flight of the doomed plane flagged M.C.A.S. or seems to have recognized that it might have been the root of that flight’s problems.

“It really tells you what professional pilots, having flown this very aircraft for the past 10 years, are feeling,” said Bjorn Fehrm, an aeronautical engineer and former fighter pilot for the Swedish air force, referring to the previous generation 737. “They have no idea Boeing has introduced something new.”

Next, via the LA Times: https://www.latimes.com/business/la-fi-l...story.html

Lion Air crash shows cockpit computers are no substitute for pilot skills


By RALPH VARTABEDIAN and SAMANTHA MASUNAGA FEB 04, 2019 | 11:25 AM



A member of the Indonesian National Commission of Transportation Safety shows the cockpit voice recorder recovered from a Lion Air jet that crashed off Indonesia in 2018. (Aditya Irawan/EPA-EFE/REX)

When an altitude sensor failed on a Turkish Airlines Boeing 737 flight to Amsterdam in 2009, the jetliner’s computerized flight controls erroneously cut the engine thrust. The pilots didn’t understand what happened in time to prevent a crash.

The accident had striking similarities to the recent Lion Air tragedy in Indonesia, which took the lives of 189 people. A failed sensor led flight computers to put the 737 MAX jetliner into a series of dives, based on the erroneous calculation that it was losing lift and about to stall. The crew didn’t diagnose the problem, which could have been remedied with the flip of a switch, and the plane fell into the Java Sea. The investigation into the crash is ongoing.

Aviation experts say automated systems have made planes safer than ever and are a major reason why crash rates have declined all over the world. The push to automate — which also reduces airlines’ training costs — is only growing stronger. Boeing has a research project in the works to develop a fully automated jetliner. A company spokesman said last month that testing was ongoing.

But automated flight systems are also implicated in a series of incidents in which they made the wrong decisions and pilots did not fully understand the complex software that adjusts flight controls constantly during automated takeoffs, landings and high-altitude cruising.

“A lot of the optimization that the computer is doing is not made clear to the pilot,” said Douglas Moss, an instructor at USC’s Viterbi Aviation Safety and Security Program. He is a former United Airlines captain and before that, an Air Force test pilot, as well as an attorney. “The pilot is sitting there for 10 or 15 seconds trying to figure out why the computer is pitching up the nose or adjusting the throttle. I can think of thousands of times when the autopilot or flight management system would do something that caught me by surprise. Almost always, it is the right thing to do, but it is the pilot who is responsible for the safety of the flight.”

The two accidents also highlight the potential risks of basing automated flight control decisions on readings by only two sensors — which can create uncertainty when one fails.

Boeing and Airbus, the dominant international manufacturers of large jetliners, declined to provide detailed information about how many sensors their aircraft models have for various critical measurements, such as altitude, airspeed and angle of attack, citing the ongoing Lion Air investigation.

But Federal Aviation Administration documents reviewed by The Times, along with interviews of union officials and aviation experts, point out that some, though not all, aircraft have three sensors for critical readings, allowing a computerized voting system to eliminate a discrepant sensor.

Aviation experts say the pilots’ authority, certainly outside of the U.S. and Western Europe, is being gradually encroached on by automated control systems that offer air carriers lower training costs and crew expenses in an increasingly competitive international industry. It has led to a decline in basic manual flying skills, the ability to use the stick, rudder and throttle to keep a plane at the correct speed, pitch and altitude, a wide range of safety experts say.

“Pilots are not being told or taught everything they need to know about their airplanes,” said Chesley Sullenberger, the renowned pilot who made an emergency landing on the Hudson River a decade ago that saved every person on board.

“It is not easier or cheaper or requires less training to fly an automated airplane. It frequently requires more, because you have to have a deep understanding of how a system works, including the dark corners, the counterintuitive things it might do in certain circumstances. Many foreign carriers are trying to take people with zero flying experience, put them in simulators and quickly put them in the right seat of a jetliner. They don’t have the experience, knowledge, skills and confidence to be the absolute master of the aircraft start to finish.”



Capt. Chesley "Sully" Sullenberger, who safely ditched US Airways Flight 1549 in the Hudson River in January 2009. “It is not easier or cheaper or requires less training to fly an automated airplane," he says. "It frequently requires more." (Todd Sumlin/MCT)

Dennis Tajer, an American Airlines captain and spokesman for the Allied Pilots Assn., agrees automated systems should result in more pilot training, not less.

“It makes the aircraft a bit more complicated, so understanding that, being able to utilize it and making it a part of your safety standard is critical,” he said. When a piece of equipment fails, it’s incumbent on the pilot to keep control of the plane, he said, adding, “stick and rudder skills save lives.”

The U.S. airline industry agrees, and Boeing doesn’t dispute the value of pilots.

Company executives have questioned where global airlines are going to get all the pilots needed to fly the planes that are on order and expected over coming decades.

As air travel increases rapidly around the world, many foreign carriers are coming to depend on automated controls to help flight crews that do not routinely have the deep experience, military background and intensive training that is common among major U.S. and Western European airlines. American experts are growing increasingly concerned that such crews are reluctant to fly aircraft manually and lack the skills necessary to intervene when computers make the wrong decisions.

Those concerns were at the forefront in the crash of an Asiana Airlines Boeing 777 at San Francisco in July 2013, which killed three and injured 187. The crew had inadvertently disengaged the auto throttle, which is akin to cruise control on an automobile, as it made its final approach. The airspeed and altitude varied widely over the prescribed glide slope and the plane’s landing gear and tail hit the concrete sea wall at the far edge of the runway. Federal investigators blamed the accident on improper speed and altitude control, noting that Asiana Airlines emphasizes the use of cockpit automation. As a result of similar policies, many crews from nations around the world have limited hands-on manual flying skills.

In the Turkish Airlines and Lion Air accidents, the pilots should have been able to manually fly the planes out of harm’s way, experts say.

In the Turkish Airlines flight, one of the aircraft’s two radar altimeters reported that the plane was eight feet below the ground, leading the computer to think it was about to land and triggering an automatic reduction in the throttle. In fact, the aircraft was at about 2,000 feet and the crew was trying to reduce airspeed on the approach. But the crew did not realize the power settings had been cut to idle until it was too late, and the plane crashed a mile short of the runway. Nine people were killed.

In the Lion Air accident, one of the plane’s two angle-of-attack sensors, which measure the angle at which the wings are moving through the air, failed on takeoff from Jakarta. The aircraft’s autopilot disregarded the good sensor and followed readings of the discrepant left side, or captain’s sensor. As a result, it triggered software meant to offset the aircraft’s tendency for the nose to pitch up.

Such a nose-high attitude can reduce lift and potentially stall the jetliner. But in this case, the software — the maneuvering characteristics augmentation system, or MCAS — was responding to wrong data and putting the plane into a dive. It is similar to what is known as a “runaway trim,” which can be caused by as many as five problems. Some experts say the crew should have known how to flip off the MCAS and manually fly the plane, which is what another crew had done the day before in the same plane. Instead, the captain repeatedly attempted to pull up the nose and never correctly diagnosed the problem.



An Asiana Airlines Boeing 777 lies burned near the runway after it crash-landed at San Francisco International Airport in 2013. (Ezra Shaw / Getty Images)

“Automation complacency is a huge issue,” said Andrew Skow, founder of Tiger Century Aircraft, which develops cockpit safety systems, and a former Northrop Grumman chief engineer and flight test director. “If an automation system has control and is right most of the time, you become complacent.”

Skow said automation systems often fail to consider unintended effects, which occurred in the Turkish Airlines and Lion Air accidents. He also faults Boeing’s design of the MCAS, saying it trimmed the nose down at too fast a rate, because it was designed to be engaged at a lower speed. At 250 knots, it was generating violent nose-down movements that the crew could not counteract.

Boeing declined to comment on the matter, citing the pending investigation.

A third angle-of-attack sensor may have allowed the flight computers to determine which sensor was giving a bad reading, Skow said, a view shared by other experts.

Tajer, the pilots union spokesman, said airline flight manuals indicate Boeing planes have two AOA sensors, while Airbus models have three. Could three sensors have made a difference in the Lion Air accident?

“I think Boeing is very much asking itself that question,” said Steve Wallace, the former director of the FAA’s office of accident investigation and now an aviation safety consultant.

But Wallace and others don’t make the case that three sensors would have necessarily changed the outcome. William Tuccio, a former aerospace engineer at the National Transportation Safety Board, said engineers rely on what’s called failure mode and effects criticality analysis as one way to assess risk probabilities and determine the proper amount of protections.. Additional sensors may be unnecessary and could be a waste of money or an increase in complexity, he said: “If you’re going to answer a single question about reliability or engineering resilience, just asking how many AOA sensors is an incomplete question.”

Wallace pointed out that no jetliner has crashed while on an automated landing, though there have been accidents because of the crew’s incomplete understanding of the automation. “Fundamentally, automation is a huge plus for aviation safety,” he said. “You still need to know the basics of stick and rudder flying.”

And then there is the cost versus benefit. “How many backups to your backups do you need?” said Michael Barr, the former director of the USC safety program. “Nobody wants to talk about cost.”

No one in aviation expects automation to slow down, though there are sharp disagreements among experts about how far it should go.

As far as a fully automated aircraft, Sullenberger, who retired as a commercial pilot in 2010, is skeptical that it will happen for a long time and doubts he would fly in one. “Unless it is actually capable of learning in the moment and improvising, unless it could be essentially human, I don’t see how you ever have the same level of confidence.”

Robert Ditchey, a safety consultant, expert witness and former airline executive, says the day there is no pilot in the cockpit is when he will stop flying. “We have the ability to autonomously land a spacecraft on Mars, but do we want to put people on board? I don’t think so.”

But Wallace is a big fan of automation and where it is headed. “I drive my Tesla with autopilot on all the time. It keeps a safe distance.”

MTF...P2