It likely isn't active because any event which causes loss of control of the aircraft will exceed the autopilots limits.
As for crashed military, state side decades ago I did a shoulder to extended arm walk in the wood. Overseas a sister squadron deployed some guys to recover what they could and destroy the rest; that was in a "not so hostile" country.
The autopilots flight envelope limits are somewhat artificial though. If you wanted to, you could design it to try and take over no-matter-what in the event of an ejection.
The biggest question I'd have is: What would you even want the auto-pilot to try and do after an ejection? Assuming it somehow gained full flight control, then what?
You might eject when in control of the vehicle if it couldn't land, or there was an engine fire say. You probably want the vehicle to ditch where it will do least harm.
In that case, "least harm" might mean "find the least accessible location and crash in whatever manner does the most damage to sensitive components", assuming "go to nearest allied country and crash-land" isn't an option.
This falls along the same lines to me as the "autonomous car morale quandary" questions that were really popular for a while. Both assume the situation is bad enough that the pilot has ejected/car can't avoid the accident but the airplane/car has the control authority left to actually make the choice.
Right, as the commenters in SO point out, any situation that's bad enough for the human pilot to eject is also almost certainly bad enough that the autopilot won't be able to do much.
Solved problem long ago. One would think pulling the ejection handle would also wipe anything sensitive in the cockpit. Programmed autopilot steer towards water should be okay after that.
I suspect it's fine. Two-seater planes fire the seats in sequence - if it's not frying the other passenger, it's highly unlikely to be melting the instruments.
"The autopilot doesn't change its operational parameters to account for ejection." would be an answer, meaning it takes no account of it and continues as before.
Saying "it's programmed to do nothing" is very different: meaning it would stop, meaning it would be taking notice of the ejection.
The real answer is more along the lines of 'if the pilot has ejected there's some serious issue with the plane and the autopilot has been disengaged in attempts to rectify the problem, either automatically in the case of a stall or spin or by the pilot giving inputs which would disengage the autopilot.' There's no instructions after that because the plane is assumed lost once the pilot ejects.
I'm annoyed that the top answer is basically saying "well that wouldn't happen". So what? The question wasn't about how likely a thing is, it's what happens should it occur.
It would be like if someone asked "what would happen if a C program tried to access uninitiated memory?" And the answer was "Good programmers would never do that".
This is why my favorite coffee table book is the “XKCD What If”. He only spends a few seconds on “why it probably wouldn’t happen”, then fully digs into what would happen if it did.
I think I have this book, it is wonderful. It talks about the nuclear explosion that would result of you tried to hiy a baseball traveling at the speed of light.
Yes, that's the first What-If in the book. If I remember correctly, the nuclear explosion is from the fusion of the atoms in the air molecules building up in front of baseball, before it even gets to the bat!
> Everything within roughly a mile of the park is leveled, and a firestorm engulfs the surrounding city. The baseball diamond is now a sizable crater, centered a few hundred feet behind the former location of the backstop.
> A careful reading of official Major League Baseball Rule 6.08(b) suggests that in this situation, the batter would be considered "hit by pitch", and would be eligible to advance to first base.
And that's a fine answer. "Nobody has a plan for that because it's so unlikely, so the outcome is kind of unknown", then maybe some examples that come close.
Ejecting presumably shoves the plane downward in recoil from the pilot shooting upward. The autopilot would notice that.
Also, the plane would be lighter after the ejection.
And perhaps—I'm just guessing—the cockpit window or ceiling might now be gone? In which case there'd suddenly be a lot of drag from air swirling down into the cockpit.
So no, I don't expect the autopilot would continue to do exactly what it was doing before. It'd have to do a bunch of corrections, and then it would return to what it was doing before :)
(Or those corrections might be enough to make it decide "the pilot" should take over. What happens when there's no pilot and no autopilot? I'm guessing that's down to the way avionics hardware reads out when nobody's touching it.)
The first two options are for acceleration and weight. The first one changes enough while the plane is flying to be measured in Gs. There's also air turbulence. You wouldn't want to rely on secondary things like that. The second one can change for a number of reasons in a military plane. If you can even measure it, considering the changing acceleration.
The cockpit can be broken or sensors may be malfunctioning as well, so "cockpit missing" is not a great signal.
Yeah, that is what I was thinking as well. The autopilot itself won't care, but the disturbance may (or may not) be enough to cause it to turn off. Whether it does or not may even be situation dependent.
Yeah, but we usually know what "undefined behaviour" actually means in practice. In programming languages, we can just go check what the particular compiler we're using spits out when you do something stupid.
It might not generalize to any other compiler—and that's the reason you don't try to build anything predicated on any particular assumption about the behavior—but you can still know it for a particular context.
And, in fact, often there are conventions in compiler-writing that mean that every compiler basically does the same thing in response to certain UB code. (Like optimizing away always-false branches, for example.)
So, by analogy: there are a limited number of autopilot AI programs in existence. Of those concrete implementations, is there anything they would be predicted to do in response to this event they're not coded for? What would it look like to them—what branch would they take without an explicit branch for "ejected"—and how would they react to being in that branch?
It's literally not something that gets programmed though. It's like asking "if Microsoft Word stops responding and I press the close button, is it programmed to auto-save my file?" It could not possibly get to that point where it could execute such instructions, so it makes no sense to program that behavior in.
My experience with aircraft autopilots is limited. I've used them in small planes (altitude hold, heading hold types). I have read about them on commercial and military jets, in order to simulate them for a flight simulator.
With that caveat, every autopilot system I've studied turns itself off if the plane is outside its flight regime. So for example, if you pull a plane straight up and do a tail stall and try to turn on the autopilot, the autopilot would refuse to engage as the plane isn't in a "flyable" regime.
What is more, the autopilots I've seen were explicitly programmed to be pilot activated, so even if the plane went from one regime where the autopilot kicked itself off automatically, back to one where the plane could be flown by the autopilot, the autopilot would not automatically re-engage.
If the pilot ejects because they cannot control the plane, neither can the autopilot so it won't be on. If the pilot put the plane on autopilot and then ejected, the ejection would most likely force the autopilot to disengage. If a pilot put a plane on autopilot, walked into the back of the plane and opened a door and parachuted out, the plane would continue flying on autopilot until it ran out of gas and then the autopilot would disengage and the plane would crash.
A bit OT, but over 20 years ago, I asked Chuck a n00b question on comp.robotics.misc with my flamesuit on and ready since that was often the tone of responses on some of those newsgroups. He carefully considered my dumb question and gave me a polite, reasoned response. If only the majority of Usenet was like that.
So, yeah. I think he means it :-) I was pleasantly surprised when I saw that username pop up here a few years ago.
And for several decades Soviet fighters have had a save-me button for when the pilot loses spatial-awareness. It returns the aircraft to wings-level flight in a gentle climb.
From memory it was introduced in the Sukhoi Su-7 in the late 1950s.
It would be a fair question to wonder what GCAS does when a pilotless plane is heading into the ground. I'm going to guess that the folks who built GCAS have a test to see if there is a pilot in the plane or not. And in the absence of a pilot just augur in, but that is just a guess.
I wonder if they'd consider that. It's basically a system to activate in an emergency, so adding a complex process of detecting a pilot with possible errors into the mix seems risky. "Pilot on the plane" is not a trivial thing to determine.
Well, I would guess that determining "Pilot on the plane" is pretty straight forward with an ejection seat. If I were designing it I would put a soldered in wire through the seat that completes the 'pilot seat is still in the plane' circuit. Pilot ejects, circuit opens because the seat yanks out the circuit when it leaves.
I don't think autopilot programs are anywhere close to that complex. All the ones I've seen had modes like "hold course and speed" or "follow a series of pre-programmed waypoints". Some military aircraft will have a radar guided terrain following mode as well. In the (highly unlikely) event that the autopilot is engaged when the pilot ejects, the autopilot is just going to continue following whatever mode it's set to.
Some are that complex. There are commercial systems that can essentially land a plane all by itself, called CAT IIIb. The pilot takes over after the plane is completely on the ground. In the future the planes will probably be able to taxi without the pilot too.
Me: That wouldn't happen because sharks live in the ocean and can't jump high enough or far enough to reach land.
Them: OK, but what if?
Me: ... It would get burned and die...
So yes, if a pilot ejects and the plane had auto-pilot on and the auto-pilot was programmed to try to land after a pilot ejection and the plane was still safe to fly, the plane would in fact attempt to land.
But the question is what is it actually programmed to do. The answer seems to be that is scenario is not contemplated. But it isn't a childish what if type of question.
The ejection seat is a rocket device. If it's connected to the avionics in any way, that is another potential point of failure. Maybe, if the cockpit canopy is jettisoned rather than fragmented at the moment the seat is fired, the switch/action of jettisoning the canopy is connected with avionics. Seems more likely but still improbable. But we need an expert...
A few decades ago an F86 pilot ejected from a flat spin. The resulting changing in CG leveled off the aircraft and when his wingman saw the plane flying level and straight again, he radioed "You better get back in that plane". It landed in flyable condition in a corn field, engine running.
The assumption inherent in the question is that there is some kind of autopilot mode or logic change based on whether ejection has occurred or not. It is pretty unlikely that such explicit logic exists.
Also, ejection only makes sense in the context of a manned military aircraft. For the question to make sense as posed, the implication is that the pilot had engaged the autopilot and then ejected while the autopilot had meaningful control authority over the aircraft. That's not a scenario the airworthiness certification authorities probably consider as critical. Manned aircraft require deliberate human action to engage the autopilot. What the flight control computers do in general (e.g., limit control inputs to keep aircraft within acceleration/maneuvering limits, automatically enter a stable attitude when stick forces are not present) is not considered the "autopilot".
You could ask the question, "If the pilot ejects, do flight control computers attempt to fly the aircraft in any particular way?" At least for U.S. aircraft, recent ejections (e.g. the Thunderbird ejection near the end of Obama's tenure), suggest the answer is "no". If an automated flight termination system is installed, when safety constraints are violated (e.g., heartbeat signal or veering outside of geographic limits) it usually takes action to put the aircraft into the ground as quickly as possible (e.g., cut power to actuators on an unstable aircraft). This is common with UAVs. I don't think this is the case with manned aircraft.
I thought with military craft, as soon as the ejector handle is pulled the onboard computers are wiped/destroyed before the seat even exits the aircraft.
Even moreso, I would expect that with most experimental or non-commodity military craft in actual combat situations (i.e. the kinds you really don't want the enemy analyzing or using against you), the plane would just explode as soon as you're a safe distance away.
I can answer a similar question in Formula 1 engine testing failure. It might be similar to the plane problem.
There are basically two options:
Hard shutdown (power off, full brakes) vs Soft shutdown (power off, doing nothing). Both have it's merits and usecase, and are selected by the SW automatically. HS could save lives but could be very expensive, as the engine could be broken by the strong forces.
SS could last a few minutes and destroy the engine also.
In the plane cases you don't have that many options there, though usually with 4 more degrees of freedom yodur options on a plane are much higher. I don't think that there are programmed sequences, but with military applications I would be not surprised to see both options implemented. Escape as far as possible vs hard vertical acceleration for maximal destruction.
I think it is programmed to control the plane. Not to autoland it, but to keep it flying. When JAS Gripen crashed in Stockholm after instability, the pilot ejected and the plane managed to improve its stability somewhat before crashing.
Re: Mig-23 incident - at the time of the incident it was a popular theory that this was Soviet's answer to Mathias Rust landing his Cessna on Red Square two years prior.
Once the pilot is ejected, the autopilot doesn't need to concern himself with human G limitations. That could be useful for drastic recovery maneuvers.
> I would want to build in a way for the plane to try and save itself if possible
In a combat situation, I would imagine you'd want to destroy the aircraft if you lost control of it, to prevent the enemy recovering: the working aircraft itself, the technology it contains, or any sensitive reconnaissance recorded on it.
As someone who has worked on the F/A-18 (actually CF-18) mission computer software, when the pilot ejects the mission computers start to erase the sensitive information that they contain.
However, you could ask a similar question with a modified premise: you'd want to build in a way to have control over the fate of the airplane.
Depending on the situation, the right thing might be to safely land it (if in friendly territory), destroy it as thoroughly as possible (if in hostile territory), or protect lives on the ground (if you don't think you can land it).
But whatever the goal may be, maybe the autopilot could do better than leaving it to chance.
EDIT: I forgot about a fourth possibility. If in hostile territory, maybe use the autopilot to turn the plane into a weapon. You're leaking fuel so fast there's no way you'll make it back to base, but maybe you still have enough fuel to pick up a lot of speed before slamming into a nearby enemy asset.
Take this from someone in an actual air force: (On lunch break atm by I am wearing a flight suit.)
(1) The chance that the 'autopilot' will even be on in an ejection scenario is very low. If something does go wrong, pilots will take control first, eject second. Disconnecting the autopilot will happen either deliberately or automatically as the pilot moves the stick.
(2) Aircraft with ejection seats are not Cessnas. The "autopilot" might not be on, but the fly by wire control system is never really off. That system will remain active and could potentially "fly" the plane some distance. Think of it like a car sliding on ice. The cruise control might be off, but the stability assist system isn't. The driver can jump out and the car still recover itself.
(3) The engine(s) will keep going. Ejection does not turn off anything. It's not like falling off a jetski where a kill switch is pulled. The throttle will be wherever the pilot left it.
There have been a handful of incidents where a pilot has ejected and the aircraft continued on without him/her. I've read about this with test pilots in spins. The aircraft is spinning and unrecoverable, so the pilot ejects. The aircraft then self-recovers through a combination of inherent aerodynamic changes (falling into thicker air) and/or efforts by the fly by wire system to maintain the commanded heading/pitch from a now-unmanned stick.
There is an adage amongst fighter pilots that they shall not punch out until they know where their aircraft will land. Hanging in a parachute as your aircraft recovers and continues strait into a school. If over land/people they will stay with it until VERY close to the ground.
Per military planes, I suspect they select the preferred behavior ahead of time based on the mission and estimated flight path. In some cases self-destruct may be the better option, in others, a controlled landing is better. You probably don't want to self-destruct over your own cities and thus build in logic to find a rural landing spot if it's a local or training mission.
83 comments
[ 3.1 ms ] story [ 156 ms ] threadAs for crashed military, state side decades ago I did a shoulder to extended arm walk in the wood. Overseas a sister squadron deployed some guys to recover what they could and destroy the rest; that was in a "not so hostile" country.
The biggest question I'd have is: What would you even want the auto-pilot to try and do after an ejection? Assuming it somehow gained full flight control, then what?
Not if it's a military aircraft with classified equipment over enemy territory.
There was a case of Iran interfering with and American UAV and then spoofing GPS to get it to land in Iranian territory.
https://aeroantique.com/products/bc-706a-detonator-impact-sw...
They didn't ask would it be likely in an ejection event, they asked what the programming parameters were.
AFAICT it's "continue as before", which is useful to guide the aircraft away to avoid excessive harm to people/property.
Clippy's flying the plane, folks.
https://upload.wikimedia.org/wikipedia/commons/9/9c/Ejection...
"The autopilot doesn't change its operational parameters to account for ejection." would be an answer, meaning it takes no account of it and continues as before.
Saying "it's programmed to do nothing" is very different: meaning it would stop, meaning it would be taking notice of the ejection.
It would be like if someone asked "what would happen if a C program tried to access uninitiated memory?" And the answer was "Good programmers would never do that".
> Everything within roughly a mile of the park is leveled, and a firestorm engulfs the surrounding city. The baseball diamond is now a sizable crater, centered a few hundred feet behind the former location of the backstop.
> A careful reading of official Major League Baseball Rule 6.08(b) suggests that in this situation, the batter would be considered "hit by pitch", and would be eligible to advance to first base.
Ejected vs. not-ejected is very likely not even an input variable to the autopilot. So the answer would be:
Autopilot will attempt to do exactly what it was doing before the pilot ejected.
Also, the plane would be lighter after the ejection.
And perhaps—I'm just guessing—the cockpit window or ceiling might now be gone? In which case there'd suddenly be a lot of drag from air swirling down into the cockpit.
So no, I don't expect the autopilot would continue to do exactly what it was doing before. It'd have to do a bunch of corrections, and then it would return to what it was doing before :)
(Or those corrections might be enough to make it decide "the pilot" should take over. What happens when there's no pilot and no autopilot? I'm guessing that's down to the way avionics hardware reads out when nobody's touching it.)
The cockpit can be broken or sensors may be malfunctioning as well, so "cockpit missing" is not a great signal.
It might not generalize to any other compiler—and that's the reason you don't try to build anything predicated on any particular assumption about the behavior—but you can still know it for a particular context.
And, in fact, often there are conventions in compiler-writing that mean that every compiler basically does the same thing in response to certain UB code. (Like optimizing away always-false branches, for example.)
So, by analogy: there are a limited number of autopilot AI programs in existence. Of those concrete implementations, is there anything they would be predicted to do in response to this event they're not coded for? What would it look like to them—what branch would they take without an explicit branch for "ejected"—and how would they react to being in that branch?
With that caveat, every autopilot system I've studied turns itself off if the plane is outside its flight regime. So for example, if you pull a plane straight up and do a tail stall and try to turn on the autopilot, the autopilot would refuse to engage as the plane isn't in a "flyable" regime.
What is more, the autopilots I've seen were explicitly programmed to be pilot activated, so even if the plane went from one regime where the autopilot kicked itself off automatically, back to one where the plane could be flown by the autopilot, the autopilot would not automatically re-engage.
If the pilot ejects because they cannot control the plane, neither can the autopilot so it won't be on. If the pilot put the plane on autopilot and then ejected, the ejection would most likely force the autopilot to disengage. If a pilot put a plane on autopilot, walked into the back of the plane and opened a door and parachuted out, the plane would continue flying on autopilot until it ran out of gas and then the autopilot would disengage and the plane would crash.
(by the way Chuck, your important section on your profile is really impressive, I've never seen anything like it but it makes total sense).
So, yeah. I think he means it :-) I was pleasantly surprised when I saw that username pop up here a few years ago.
Auto-GCAS Saves Unconscious F-16 Pilot: https://www.youtube.com/watch?v=WkZGL7RQBVw
From memory it was introduced in the Sukhoi Su-7 in the late 1950s.
https://www.wsj.com/articles/SB10001424052702304791204576402...
Liability as well.
It would be a fair question to wonder what GCAS does when a pilotless plane is heading into the ground. I'm going to guess that the folks who built GCAS have a test to see if there is a pilot in the plane or not. And in the absence of a pilot just augur in, but that is just a guess.
https://en.wikipedia.org/wiki/Autopilot#Autopilot_for_ILS_la...
https://en.wikipedia.org/wiki/Instrument_landing_system#ILS_...
Them: What if a shark jumped into a volcano?
Me: That wouldn't happen because sharks live in the ocean and can't jump high enough or far enough to reach land.
Them: OK, but what if?
Me: ... It would get burned and die...
So yes, if a pilot ejects and the plane had auto-pilot on and the auto-pilot was programmed to try to land after a pilot ejection and the plane was still safe to fly, the plane would in fact attempt to land.
https://en.wikipedia.org/wiki/Cornfield_Bomber
Also, ejection only makes sense in the context of a manned military aircraft. For the question to make sense as posed, the implication is that the pilot had engaged the autopilot and then ejected while the autopilot had meaningful control authority over the aircraft. That's not a scenario the airworthiness certification authorities probably consider as critical. Manned aircraft require deliberate human action to engage the autopilot. What the flight control computers do in general (e.g., limit control inputs to keep aircraft within acceleration/maneuvering limits, automatically enter a stable attitude when stick forces are not present) is not considered the "autopilot".
You could ask the question, "If the pilot ejects, do flight control computers attempt to fly the aircraft in any particular way?" At least for U.S. aircraft, recent ejections (e.g. the Thunderbird ejection near the end of Obama's tenure), suggest the answer is "no". If an automated flight termination system is installed, when safety constraints are violated (e.g., heartbeat signal or veering outside of geographic limits) it usually takes action to put the aircraft into the ground as quickly as possible (e.g., cut power to actuators on an unstable aircraft). This is common with UAVs. I don't think this is the case with manned aircraft.
Like scuttling a ship, but smaller.
http://www.ejectorseats.co.uk/ejection_from_a_harrier.htm
There are basically two options: Hard shutdown (power off, full brakes) vs Soft shutdown (power off, doing nothing). Both have it's merits and usecase, and are selected by the SW automatically. HS could save lives but could be very expensive, as the engine could be broken by the strong forces. SS could last a few minutes and destroy the engine also.
In the plane cases you don't have that many options there, though usually with 4 more degrees of freedom yodur options on a plane are much higher. I don't think that there are programmed sequences, but with military applications I would be not surprised to see both options implemented. Escape as far as possible vs hard vertical acceleration for maximal destruction.
https://en.wikipedia.org/wiki/1989_Belgian_MiG-23_crash
https://en.wikipedia.org/wiki/Mathias_Rust
> I would want to build in a way for the plane to try and save itself if possible
In a combat situation, I would imagine you'd want to destroy the aircraft if you lost control of it, to prevent the enemy recovering: the working aircraft itself, the technology it contains, or any sensitive reconnaissance recorded on it.
However, you could ask a similar question with a modified premise: you'd want to build in a way to have control over the fate of the airplane.
Depending on the situation, the right thing might be to safely land it (if in friendly territory), destroy it as thoroughly as possible (if in hostile territory), or protect lives on the ground (if you don't think you can land it).
But whatever the goal may be, maybe the autopilot could do better than leaving it to chance.
EDIT: I forgot about a fourth possibility. If in hostile territory, maybe use the autopilot to turn the plane into a weapon. You're leaking fuel so fast there's no way you'll make it back to base, but maybe you still have enough fuel to pick up a lot of speed before slamming into a nearby enemy asset.
(1) The chance that the 'autopilot' will even be on in an ejection scenario is very low. If something does go wrong, pilots will take control first, eject second. Disconnecting the autopilot will happen either deliberately or automatically as the pilot moves the stick.
(2) Aircraft with ejection seats are not Cessnas. The "autopilot" might not be on, but the fly by wire control system is never really off. That system will remain active and could potentially "fly" the plane some distance. Think of it like a car sliding on ice. The cruise control might be off, but the stability assist system isn't. The driver can jump out and the car still recover itself.
(3) The engine(s) will keep going. Ejection does not turn off anything. It's not like falling off a jetski where a kill switch is pulled. The throttle will be wherever the pilot left it.
There have been a handful of incidents where a pilot has ejected and the aircraft continued on without him/her. I've read about this with test pilots in spins. The aircraft is spinning and unrecoverable, so the pilot ejects. The aircraft then self-recovers through a combination of inherent aerodynamic changes (falling into thicker air) and/or efforts by the fly by wire system to maintain the commanded heading/pitch from a now-unmanned stick.
There is an adage amongst fighter pilots that they shall not punch out until they know where their aircraft will land. Hanging in a parachute as your aircraft recovers and continues strait into a school. If over land/people they will stay with it until VERY close to the ground.