< Return to Video

What's It Doing Now? (33c3)

  • 0:12 - 0:13
    [Music]
  • 0:13 - 0:17
    MC: so have you ever called IT only to be
    told
  • 0:17 - 0:19
    have you tried turning it off and on again?
  • 0:23 - 0:28
    Today we will be talking about
    pilots usually pilots are called to pilot
  • 0:28 - 0:35
    in command and we expect a pilot to be
    just that in command but today's pilots
  • 0:35 - 0:40
    are turning more and more into computer
    operators and have less and less actual
  • 0:40 - 0:48
    hands-on flying ability so now imagine you
    are the pilot flying a gigantic computer
  • 0:48 - 0:55
    in 30,000 feet height with 200 souls
    behind you only to be told by IT have you
  • 0:55 - 1:03
    tried turning it off and on again so I
    would like to welcome Bernd Sieker. who is
  • 1:03 - 1:08
    a systems engineer and an aviation
    accident analyst he specialized in reverse
  • 1:08 - 1:13
    engineering and he's developing formal
    methods to development of safety critical
  • 1:13 - 1:19
    systems and he will enlighten us about
    problems in aviation automation because
  • 1:19 - 1:25
    apparently every pilot has uttered the
    words what's it doing now
  • 1:25 - 1:33
    [Applause]
    BS: yes thank you thank you very much yes
  • 1:33 - 1:38
    but first I'd like to learn a bit about
    the audience so how many of you here in
  • 1:38 - 1:46
    the hall today are pilots Oh quite a few
    so commercial pilots? far fewer. ATP
  • 1:46 - 1:54
    anyone? yeah there's one I heard one but I
    can't see. okay so some of you will know
  • 1:54 - 2:02
    about some of the stuff I hope there's a
    bit new stuff for everyone let's get right
  • 2:02 - 2:09
    into it what the announcer said was a bit
    of nice folklore it's not completely true
  • 2:09 - 2:15
    but there's a little bit truth to it what
    I'm going to talk about is automation in
  • 2:15 - 2:19
    the aircraft and the idea is often as he
    said that it's just a computer and the
  • 2:19 - 2:23
    pilot doesn't have to do anything that's
    one saying that in modern airplanes there
  • 2:23 - 2:30
    will only be one pilot and a dog and the
    pilot is there to watch what the the
  • 2:30 - 2:33
    pilots there to feed the dog and the dog
    is there to bite the pilot if he touches
  • 2:33 - 2:42
    anything so that's not quite yet how it is
    I talk a very little bit about the
  • 2:42 - 2:49
    analysis method that we use to analyze
    accidents not only in aviation but mostly
  • 2:49 - 2:53
    and then I'll tell you a short tale of two
    throttles or two thrust levers as they are
  • 2:53 - 2:59
    sometimes called and also talk about human
    pilots how they cope with failures or
  • 2:59 - 3:04
    don't as the case may be and I haven't
    seen a lot of other talks here about self-
  • 3:04 - 3:08
    driving cars although they are now
    becoming a very big thing so I'll touch
  • 3:08 - 3:14
    that briefly and have a tentative
    conclusion. I can't see very fine to the
  • 3:14 - 3:23
    future so I'm not sure if I'm right about
    that. So what is automation in airplanes?
  • 3:23 - 3:27
    the most obvious thing is that automated
    flight controls on every airliner and on
  • 3:27 - 3:33
    many small airplanes these days. there
    used to be a requirement for a simple
  • 3:33 - 3:37
    autopilot even on small private single-
    engine airplanes if you want to fly under
  • 3:37 - 3:43
    instrument flight rules. That has been
    relaxed somewhat now but many small planes
  • 3:43 - 3:49
    still have them. so there are three levels
    of fat controls there the first one is
  • 3:49 - 3:55
    manual flight where the pilot moves flight
    controls and the airplane does what it's
  • 3:55 - 3:58
    told then there's the simple
    autopilot where the pilot just
  • 3:58 - 4:04
    sets airspeed altitude climb rate stuff
    like that and there are managed modes now
  • 4:04 - 4:08
    where there's a more sophisticated
    computer which has knowledge about the
  • 4:08 - 4:13
    whole flight with waypoints and altitudes
    and there are other automated systems not
  • 4:13 - 4:19
    only the flight controls spoilers on the
    ground have to extend to help slowing down
  • 4:19 - 4:25
    the aircraft the high-lift devices are
    automated radios maybe Auto-tuning there's
  • 4:25 - 4:30
    the computer that controls the engines
    full authority digital engine control.
  • 4:30 - 4:34
    There are things like cabin pressurization
    and many other small subsystems are
  • 4:34 - 4:42
    automated as they are in cars these days.
    So what is automation not? It's not yet
  • 4:42 - 4:49
    except for very few specialized drones a
    self flying aircraft the pilot in command
  • 4:49 - 4:53
    still is in command at all times you can
    turn off the automation you can have to
  • 4:53 - 4:58
    fly the aircraft at any time if you wants
    to and barring any serious errors which
  • 4:58 - 5:05
    are extremely rare in commercial aircraft
    the airplane does what it's told. the
  • 5:05 - 5:10
    pilots the the autopilot really doesn't
    have any decision capabilities except at
  • 5:10 - 5:15
    the very lowest level deciding on a bank
    angle to make the right turn and things
  • 5:15 - 5:22
    like that it is also not a panacea for any
    errors that the pilot can make now you can
  • 5:22 - 5:26
    still fly a highly computerized modern
    aircraft into the side of the mountain if
  • 5:26 - 5:32
    you want to. so some military aircraft
    actually have systems that will prevent
  • 5:32 - 5:36
    you from flying into a mountain if they're
    active or if you have passed out but
  • 5:36 - 5:41
    airliners don't at the time and of course
    the pilot in command still bears the
  • 5:41 - 5:47
    ultimate responsibility for the safe
    conduct of the flight. so as I said
  • 5:47 - 5:50
    briefly manual flying is just stick and
    rudder you move the stick and you move
  • 5:50 - 5:56
    your rudder pedals and the airplane moves
    the control surfaces mechanically on small
  • 5:56 - 6:01
    airplanes hydrolically assisted or even
    computer-assisted on some airliners on
  • 6:01 - 6:06
    most modern airliners called fly-by-wire
    you may have heard about that then the
  • 6:06 - 6:11
    simple autopilot modes where you
    directly select the heading and the
  • 6:11 - 6:15
    airplane flies in that heading and managed
    modes as I said before where you have a
  • 6:15 - 6:22
    sophisticated flight management system
    which then in turn sets headings and climb
  • 6:22 - 6:27
    rates and things like that on the
    autopilot proper. they are not super
  • 6:27 - 6:34
    reliable they can be thrown off by many
    things and mostly they they turn off when
  • 6:34 - 6:39
    there's any small error in any of the
    small subsystems, any of the various input
  • 6:39 - 6:44
    values that you get air speed altitude
    engine power anything if any of those have
  • 6:44 - 6:50
    invalid readings it'll turn off and the
    pilots have to assume command in that
  • 6:50 - 6:57
    case. they cannot handle basically
    anything unexpected most air sensors are
  • 6:57 - 7:02
    there then threefold so if only one of
    them disagrees the other two are usually
  • 7:02 - 7:08
    taken as valid but if they all three
    disagree then the system just says I don't
  • 7:08 - 7:14
    know what's true anymore what speed is and
    all the automatics drop out and most of
  • 7:14 - 7:17
    the computer assisted manual flying also
    is turned off in that case.
  • 7:20 - 7:22
    so this is very briefly the method
  • 7:22 - 7:25
    that we have developed at
    the University of Bielefeld
  • 7:25 - 7:31
    and the professor lepkin for analyzing
    accidents called why because analysis it
  • 7:31 - 7:36
    uses a formal notion of causality called
    the counterfactual test and then you can
  • 7:36 - 7:43
    make a very nice graph for accidents
    they're usually bigger than that but it's
  • 7:43 - 7:47
    more or less objective criterion for
    causality and then different people with
  • 7:47 - 7:52
    some experience in the domain make why
    because graphs of an accident they usually
  • 7:52 - 7:53
    are very similar to each other
  • 7:57 - 8:00
    so there's a lot of automation
    on modern airplanes
  • 8:01 - 8:09
    and it's quite hard to get it right and
    one of the reasons is that unlike for many
  • 8:09 - 8:15
    situations in cars and rail vehicles there
    is no default safe state, you can't just
  • 8:15 - 8:20
    turn everything off and stop by the
    roadside so we always have to decide the
  • 8:20 - 8:27
    engineers always have to plan for many
    eventualities what can happen in the air
  • 8:27 - 8:33
    and decide what given a certain set of
    circumstances is the safest state for the
  • 8:33 - 8:38
    airplane to be in and that is not always
    unambiguous and it's a very hard decision
  • 8:38 - 8:42
    tomake and sometimes
    they get it wrong and
  • 8:42 - 8:49
    sometimes you just get into that situation
    where in most cases the set of values the
  • 8:49 - 8:56
    set of measured values that the system
    gets when most circumstance is one set of
  • 8:56 - 9:00
    decisions is the correct one and you get
    into that situation where the computers
  • 9:00 - 9:05
    get the same inputs and that decision is
    the wrong one and that may still lead to
  • 9:05 - 9:15
    an accident. those are very few and very
    rare but these these things can happen. so
  • 9:15 - 9:19
    a few of the decisions that the engineers
    have to take when designing the automation
  • 9:19 - 9:25
    in airplanes is what to do if things fail
    if certain individual things fail if a
  • 9:25 - 9:33
    combination of things fail little motors
    little engines sensors fail some actuators
  • 9:33 - 9:38
    fail a hydraulic system fails anything
    like that what you do in that case with
  • 9:38 - 9:45
    the remaining systems and what to tell the
    pilots? well naively you might assume the
  • 9:45 - 9:49
    pilot wants to know about everything that
    is broken every little valve every little
  • 9:49 - 9:56
    system that is broken on the airplane but
    if a lot goes wrong at the same time then
  • 9:56 - 10:01
    the decision has to be taken which of
    these things that have gone wrong are the
  • 10:01 - 10:07
    most important for the flight crew to know
    and that's not trivial at all and it can
  • 10:07 - 10:15
    very easily lead to to sensory saturation
    of the pilots so they don't know what is
  • 10:15 - 10:20
    what anymore because from all sides alarms
    are blaring there are lots and lots of
  • 10:20 - 10:28
    displays that they have to watch and so
    certain error messages are suppressed in
  • 10:28 - 10:33
    certain states of flight certain stages of
    the flight so as not to overwhelm the
  • 10:33 - 10:38
    pilot. and some things that may be
    essential to have on the ground some
  • 10:38 - 10:44
    functions for example the wing spoilers
    those are the big the big flaps on the top
  • 10:44 - 10:49
    of the wings that come up after touchdown
    are important to have on landing to dump
  • 10:49 - 10:55
    the lift so the airplane doesn't jump up
    again. because it is a touchdown still at
  • 10:55 - 10:58
    the speed at which it could fly at least
    for airliners, for small airplanes it's a
  • 10:58 - 11:03
    bit different but airliners are safely
    above the very lowest
  • 11:03 - 11:07
    speed they can go when they touchdown so
    they need to have some means to make sure
  • 11:07 - 11:12
    they don't jump up again they still do
    sometimes but not very often but the
  • 11:12 - 11:16
    spoilers destroy most of the lift so
    deploying them in the air close to the
  • 11:16 - 11:24
    ground is extremely dangerous so the
    computer has to be absolutely certain so
  • 11:24 - 11:29
    to speak to know that the aircraft is on
    the ground when it gives the command to
  • 11:29 - 11:35
    deploy the ground spoilers if it does that
    a few seconds too early when the airplane
  • 11:35 - 11:41
    is still a hundred meters up above the
    ground that will likely be a fatal accident.
  • 11:48 - 11:52
    so in most at least in most jet
    airliners not in all propeller-driven but
  • 11:52 - 11:57
    in all almost all jet airliners there's an
    automatic thrust management so the
  • 11:57 - 12:01
    computer does not only control where the
    nose of the airplane points but also how
  • 12:01 - 12:07
    much power the engines produce and there
    are two different one might call them
  • 12:07 - 12:12
    philosophies between the two major air
    framers and Boeing and most others to use
  • 12:12 - 12:19
    back driven throttles so the computer sets
    the thrust and moves the thrust levers to
  • 12:19 - 12:26
    match the commanded thrust position and
    Airbus has a different system where the
  • 12:26 - 12:29
    thrust levers remain in one position
    throughout the entire flight basically
  • 12:29 - 12:36
    after take off when thrust is reduced
    for the main climb and cruise and descend
  • 12:36 - 12:42
    and everything they remain in one position
    and the computer tells the engines
  • 12:42 - 12:47
    directly which thrust to produce. and
    there are there's an argument which one of
  • 12:47 - 12:53
    the systems is better but I'll show you
    accidents three accidents in which the
  • 12:53 - 13:01
    thrust system the throttle system played a
    role. so the first one has a little video
  • 13:04 - 13:07
    you will see I think there are two
    different camera perspectives you will see
  • 13:07 - 13:13
    two airplanes landing of the same class
    they are small airliners two hundred
  • 13:13 - 13:19
    people something like that 150 to 200 now
    landing and the first one is a normal landing
  • 13:23 - 13:25
    so it's already pretty slow takes
    its time
  • 13:29 - 13:31
    and the next one is the accident flight.
  • 13:32 - 13:35
    it's on the same day it's only
    minutes apart so on the same Airport
  • 13:37 - 13:41
    and you can see that one is slowed down
    and the one other one is still going very fast
  • 13:46 - 13:47
    so there's the first one
  • 13:51 - 13:52
    and that's the second one
  • 13:52 - 13:59
    and as you can imagine that didn't end well
  • 13:59 - 14:03
    it was one of the worst aviation
    accidents maybe still
  • 14:03 - 14:07
    the worst today in Brazil where 200 people
    died
  • 14:08 - 14:12
    and as you can see this is a
  • 14:12 - 14:17
    transcript of of the flight data recorder
    the digital flight data recorder and the
  • 14:17 - 14:24
    first two lines are the interesting ones
    that says TLA that is thrust lever angle
  • 14:24 - 14:27
    and normally what happens on landing just
    before touchdown the pilot pulls both
  • 14:27 - 14:33
    thrust wheels to idle now the engine
    thrust goes down to to idle and then it
  • 14:33 - 14:38
    touches down engages reverse thrust
    spoilers brakes everything to slow down
  • 14:38 - 14:43
    and what happened in this case is that the
    pilot only moved one of the thrust to idle
  • 14:43 - 14:48
    and left the other there put the one
    thrust lever in reverse but not the other
  • 14:48 - 14:54
    and that led to the computer getting
    conflicting information about whether the
  • 14:54 - 14:59
    pilots actually wanted to land or not so
    it didn't deploy the automatic wheel
  • 14:59 - 15:07
    brakes it didn't deploy the spoilers and
    reverse thrust only on one engine so that
  • 15:07 - 15:15
    went pretty badly and some people said
    well with tactile feedback from a thrust
  • 15:15 - 15:19
    levers if the pilots have been used to
    that they would have noticed earlier and
  • 15:19 - 15:24
    we can't really be sure because the pilots
    also died in the accident but there were
  • 15:24 - 15:29
    some people who made a case that moving
    thrust levers would have been a lot better
  • 15:29 - 15:30
    in this case
  • 15:31 - 15:33
    so is that always better?
  • 15:36 - 15:38
    here's another throttle related accident
  • 15:40 - 15:47
    in this time it was a Boeing Boeing 737 at
    Amsterdam Schiphol Airport there was a
  • 15:47 - 15:51
    small technical malfunction would call
    which caused the computers to think the
  • 15:51 - 15:55
    airplane was actually eight feet
    underground that was the reading that it
  • 15:55 - 16:02
    gave due to work through the way it works
    and so said oh I'm below 30 feet I have to
  • 16:02 - 16:06
    reduce the thrust to idle and that's what
    it did although it was still a couple
  • 16:06 - 16:11
    hundred feet high and the pilots didn't
    notice early enough and let the
  • 16:11 - 16:18
    speed decay and the wing stalled and
    crashed the airplane crashed and the nine
  • 16:18 - 16:23
    people died it was moderately only a
    moderately hard crash so most people
  • 16:23 - 16:29
    survived actually though it was still a
    problem and the way the auto in auto
  • 16:29 - 16:35
    throttle system works in this case if the
    thrust levers had been static this
  • 16:35 - 16:39
    wouldn't have happened because the pilots
    were pushed the thrust levers above a
  • 16:39 - 16:45
    certain detent and it wouldn't have
    reduced thrust automatically again so it's
  • 16:45 - 16:52
    very hard to say which system in total is
    better you can count the accidents maybe
  • 16:52 - 16:58
    in which it played a roll but there are so
    few they're just really less than a
  • 16:58 - 17:02
    handful in each case so they're not
    statistically significant so you can't
  • 17:02 - 17:07
    really say by statistics alone which
    system is better than the other they both
  • 17:07 - 17:13
    have their own problems and this is one of
    the decisions as engineers that you really
  • 17:13 - 17:20
    can't make a decisive argument for so one
    manufacturer chooses one and the other
  • 17:20 - 17:25
    chooses the other and there's another one
    is asiana flight 214 at San Francisco many
  • 17:25 - 17:32
    of you may remember that. only three
    people were killed in this one because it
  • 17:32 - 17:38
    really burned out only after the crash
    after everyone had evacuated and so the
  • 17:38 - 17:42
    auto throttles didn't work as expected in
    this case the pilots thought oh the auto
  • 17:42 - 17:46
    throttles will hold the speed we don't
    have to worry about that as far as I
  • 17:46 - 17:52
    remember there were five pilots in the
    cockpit and when finally someone noticed
  • 17:52 - 17:57
    and pushed the throttles forward it was
    already too late the engines take that
  • 17:57 - 18:01
    time to spool up the legal requirement is
    that they may take up to eight seconds to
  • 18:01 - 18:08
    spool up from idle to the necessary power
    to go around and there wasn't enough time
  • 18:08 - 18:12
    for that because after the engines have
    spooled up the airplane also still has to
  • 18:12 - 18:17
    accelerate to get back to flying speed
    again so in this case again the wings
  • 18:17 - 18:24
    stalled the airplane crashed just short of
    the runway and three people died. and the
  • 18:24 - 18:28
    third case was even one when nothing was
    wrong with the airplane except you could
  • 18:28 - 18:34
    argue it was a design flaw but it was
    working as designed people who were going
  • 18:34 - 18:39
    to fly the aircraft learned how the system
    worked learned everything about it
  • 18:39 - 18:47
    hopefully and so more training may perhaps
    be the answer that is one thing system
  • 18:47 - 18:55
    knowledge, two. crew resource management
    has been a big thing in previous decades
  • 18:55 - 19:01
    that the pilot command in command is not a
    dictator on the airplane he has to listen
  • 19:01 - 19:07
    to the others to the other pilot even though
    he has ultimate authority in decision.
  • 19:12 - 19:17
    so do pilots always screw up if
    the automation fails? no luckily not if
  • 19:17 - 19:22
    other systems fail in this case not the
    automation really but there are two
  • 19:22 - 19:26
    cases which I would briefly mentioned
    Chesley Sullenberger everybody knows about
  • 19:26 - 19:33
    him the movie has just been out the
    ditching in the Hudson superb pilot great
  • 19:33 - 19:39
    decision making to find the biggest flat
    surface in the area to pull it down and
  • 19:39 - 19:48
    Peter Burkhill he'll many other so who
    knew about Peter Burkhill? A few. he was
  • 19:48 - 19:53
    the one saved about as many people as
    Sullenberger when on approach to london
  • 19:53 - 20:00
    heathrow both engines lost thrust most of
    the thrust anyway and he managed to put it
  • 20:00 - 20:04
    down within the airport but short of the
    runway it was a crash landing the airplane
  • 20:04 - 20:09
    was destroyed but nobody died so it was a
    pretty good outcome.
  • 20:14 - 20:17
    so airplanes are one thing,
    another thing are cars
  • 20:19 - 20:26
    and anyone here has a
    self-driving car? Or at least a
  • 20:26 - 20:34
    lane assist or something? Not many so not
    many people don't trust these newfangled
  • 20:34 - 20:42
    systems I guess. one of the big
    differences is that pilots who are going
  • 20:42 - 20:47
    to fly highly automated aircraft have to
    take a long training course beyond their
  • 20:47 - 20:54
    pilot's license to learn the specifics of
    operating this specific aircraft and
  • 20:54 - 21:02
    maintenance is very highly controlled and
    regulated so that's another thing. and the
  • 21:02 - 21:06
    things for cars in general if something's
    wrong with the engine you can just pull
  • 21:06 - 21:13
    over to the right and stop in most cases
    and cars cannot just take off and take
  • 21:13 - 21:18
    evasive action in the third dimension and
  • 21:18 - 21:22
    there are lots and lots of obstacles
    on the ground there are trees
  • 21:22 - 21:30
    cars people houses everything whereas
    the air is mostly empty not entirely
  • 21:30 - 21:38
    air-to-air collisions happen midair collisions do
    happen but they are very very few. in the
  • 21:38 - 21:46
    automatic systems in the self-driving cars
    or the autonomous cars that we have today
  • 21:46 - 21:53
    require constant monitoring and if the
    systems work too well then drivers may
  • 21:53 - 21:58
    actually forget about it and think they
    are perfect and let their attention
  • 21:58 - 22:07
    wander. pilots sometimes are prone to do
    that as well but the thing is that in
  • 22:07 - 22:14
    Cruise in cruise flight if the automatics
    drop out the pilots have on the order of
  • 22:14 - 22:20
    minutes to react really at least several
    seconds whereas on a road car if the
  • 22:20 - 22:26
    automatics drop out and you're in a curve
    you have fractions of a second to save the
  • 22:26 - 22:29
    car with the current state of the
    technology.
  • 22:36 - 22:41
    some of you probably have heard about the trolley
    problem or trolley-ology as it's sometimes called.
  • 22:45 - 22:49
    it basically boils down to that a
    fully autonomous car a highly
  • 22:49 - 22:56
    automated car may eventually have to make
    the decision between killing the occupants
  • 22:56 - 23:04
    and killing people on the road. and I
    think that is fundamentally an unsolvable
  • 23:04 - 23:11
    ethical problem that we cannot just leave
    to the engineers or the car manufacturers
  • 23:11 - 23:16
    to decide that maybe the occupants are
    always more important than people on the
  • 23:16 - 23:21
    road? what if there's only one person in
    the car and there's a crowd on the road
  • 23:21 - 23:25
    and you have to decide between steering on
    the car into to the tree and killing the
  • 23:25 - 23:33
    sole occupant or killing several people
    that are in front of the car these are
  • 23:33 - 23:43
    situations that may actually happen. so I
    really can't see what the right answer is
  • 23:43 - 23:49
    to that if there is one and maybe there
    isn't one. some engineers have actually
  • 23:49 - 23:54
    suggested that making a random decision in
    that case is the answer. I'm not too sure
  • 23:54 - 24:02
    about that either but whatever the
    decision the software takes at that moment
  • 24:03 - 24:11
    then people will die and they will take
    the blame either way and we don't know yet
  • 24:11 - 24:13
    how that's going to turn out in front of
    the courts.
  • 24:18 - 24:20
    so automation is hard to get
  • 24:20 - 24:25
    right and in some cases self-driving cars
    it may be impossible to get it absolutely
  • 24:25 - 24:33
    right. which stage is the safest for the
    systems to be in and at what time who
  • 24:33 - 24:41
    knows it's very very hard to get it right
    even in limited systems such as airplanes
  • 24:41 - 24:47
    and what to display to the operators and
    when in many cases it would help the
  • 24:47 - 24:55
    pilots a lot when the automation drops out
    to know intimate details of how the system
  • 24:55 - 25:01
    works internally. airbus has some logic
    diagrams in their pilots handbook but they
  • 25:01 - 25:06
    are labeled 'for info' which means they
    are not required for any exams it's just
  • 25:06 - 25:12
    interesting to know but in case of the
    logic for extension of the ground spoilers
  • 25:12 - 25:16
    it's quite helpful to know which
    conditions exactly have to be satisfied
  • 25:16 - 25:17
    for the ground spoilers to deploy.
  • 25:21 - 25:24
    but some of these problems I think cannot
  • 25:24 - 25:31
    be left to engineers and scientists alone
    and we need psychologists and maybe
  • 25:31 - 25:38
    sociologists other people who know about
    the psyche of people who know about how
  • 25:38 - 25:45
    people think how people react how people
    process information to make good
  • 25:45 - 25:52
    engineering design decisions to build
    safer systems. and as I said some of the
  • 25:52 - 26:00
    fundamental ethical problems may turn out
    to remain unsolvable.
  • 26:00 - 26:03
    thank you I think we have a little bit of
    time for questions
  • 26:03 - 26:12
    [Applause]
  • 26:12 - 26:15
    MC: yes we actually do we have some time
  • 26:15 - 26:19
    for questions and we're gonna start with
    the internet if there are any questions no
  • 26:19 - 26:21
    there are not then it's microphone number
    three
  • 26:21 - 26:27
    Q: yes you mentioned the ethical problem
    of the decision making the trolley problem
  • 26:27 - 26:33
    so whenever this comes up regarding
    automated driving systems whether it be
  • 26:33 - 26:40
    flight control or car driving I always get
    a little bit mad when philosophers come up
  • 26:40 - 26:45
    with that the there is one decisive
    decision you can make and that is the
  • 26:45 - 26:51
    whole thing should act predictably
    especially in road traffic the uttermost
  • 26:51 - 26:58
    importance is that all participants behave
    predictably swerving out of lane is the
  • 26:58 - 27:02
    most dangerous thing you can do
    H: And what's your question?
  • 27:02 - 27:08
    Q: and if you have to make
    this decision people say you
  • 27:08 - 27:13
    have to make a decision then I say no
    there is a definitive safe state that is
  • 27:13 - 27:21
    drive with enough distance to the guy in
    front of you don't tailgate don't speed up
  • 27:21 - 27:24
    because if you're a regular driver
    MC: no no please ask your question
  • 27:24 - 27:31
    Q: okay question is why are people always
    saying it's ethically not decisive
  • 27:31 - 27:35
    decidable?
    BS: it isn't because if if just keeping
  • 27:35 - 27:39
    enough distance we solve all problems that
    would be that would be fine but cars are
  • 27:39 - 27:45
    not the only participants in traffic there
    are people right and they can just jump in
  • 27:45 - 27:51
    front of a car. that is not predictable,
    yeah you can you can require people to
  • 27:51 - 27:55
    behave predictable but good luck with
    that.
  • 27:55 - 28:02
    Q: I would like to counter that
    [Applause]
  • 28:02 - 28:07
    MC: okay I'm sorry there's not much room
    for discussion right now but microphone
  • 28:07 - 28:15
    number two please ask a concise question
    Q: okay let me try so you said about
  • 28:15 - 28:20
    automation in airplanes that whenever
    there is a small malfunction the autopilot
  • 28:20 - 28:25
    will disconnect and expect the pilots to
    fix the situation right so it is my-
  • 28:25 - 28:28
    BS: yeah it's not not the smallest problem
    but some yeah
  • 28:28 - 28:32
    Q: okay so but it is my understanding that
    the pilots are still expected to follow
  • 28:32 - 28:39
    procedures and not make any random gut
    decisions in most cases. my question is do
  • 28:39 - 28:45
    you have statistics when the standard
    procedures were actually not applicable in
  • 28:45 - 28:49
    how many cases and in how many of these
    cases did the pilots actually managed to
  • 28:49 - 28:54
    save the flight?
    BS: no I'm not aware of any statistics and
  • 28:54 - 29:00
    one of the problems with that is that in
    general the data recorder is only read
  • 29:00 - 29:04
    when there was an accident and it is
    strictly off-limits in all other
  • 29:04 - 29:10
    circumstances some airplanes have a quick
    access data recorder which they can
  • 29:10 - 29:16
    routinely read but only anonymized so and
    I don't think the airplanes published
  • 29:16 - 29:21
    statistics about that
    MC: okay last question microphone number
  • 29:21 - 29:25
    four please
    Q: yeah I'm just I just want to bring this
  • 29:25 - 29:32
    back to this sort of the IT security part
    where what I find very good about about
  • 29:32 - 29:38
    the way accidents are handled in in
    aviation is that the report is completely
  • 29:38 - 29:41
    public so if you want to read you know the
    Challenger cut this show if you can you
  • 29:41 - 29:45
    can actually read all the technical
    details and all that all the stuff that
  • 29:45 - 29:54
    happened and and all that information is
    there and the question is is why is this
  • 29:54 - 29:58
    not happening in the IT sector where
    clearly millions of people are being
  • 29:58 - 30:06
    affected and somehow you haven't reached
    this stage where the the the data and the
  • 30:06 - 30:11
    analysis of the data is public so we can
    all learn from it and get better as it has
  • 30:11 - 30:15
    been you know the way
    BS: I think the short answer is excuse me
  • 30:15 - 30:17
    Q: no it's good
    BS: I think the short answer is because
  • 30:17 - 30:24
    there is no legal requirement and if there
    weren't for accident reports to be
  • 30:24 - 30:27
    distributed then many airlines wouldn't do
    it .
  • 30:27 - 30:31
    Q: but why? It's very clear [???]
    BS: it's because it's embarrassing if you
  • 30:31 - 30:34
    have an accident it's basically the thing
    I think
  • 30:34 - 30:37
    MC: ok very last question microphone
    number one please
  • 30:37 - 30:43
    Q: hey so one of the reasons we have
    automation in aircraft in the first place
  • 30:43 - 30:47
    is to reduce pilot workload where too high
    pilot workload is a major cause of
  • 30:47 - 30:53
    accidents it seems like one of the issues
    we're talking about here is that in a
  • 30:53 - 30:57
    situation where something's gone wrong the
    presence of that automation are needed to
  • 30:57 - 31:01
    understand it means you've got a higher
    pilot workload in that situation the
  • 31:01 - 31:07
    question what is it doing now what's the
    industry sort of approach to that effect
  • 31:07 - 31:13
    and what do you think about that?
    BS: I think the traditional approach is to
  • 31:13 - 31:18
    just pile on more automation so then if
    that fails the pilot has an even higher
  • 31:18 - 31:26
    workload but the current thing is that
    manufacturers and the airlines go back
  • 31:26 - 31:33
    very very slowly to letting the pilot hand
    fly more often and for a long time the the
  • 31:33 - 31:39
    mantra was use automation whenever
    possible the highest level of automation
  • 31:39 - 31:43
    that is appropriate for the situation so
    only the takeoff and touchdown were flown
  • 31:43 - 31:51
    by hand and now it is very often use the
    appropriate level of automation and that
  • 31:51 - 31:56
    means if there's not very high workload
    and not a lot of traffic then hand fly the
  • 31:56 - 32:06
    approach for example. so to to keep in
    good practice and right to maintain
  • 32:06 - 32:10
    proficiency for all situations hopefully.
  • 32:14 - 32:17
    MC: thank you and please give a warm hand
    of applause for Bernd Sieker.
  • 32:17 - 32:22
    [Applause]
  • 32:22 - 32:27
    [Music]
  • 32:27 - 32:46
    subtitles created by c3subtitles.de
    in the year 2018. Join, and help us!
Title:
What's It Doing Now? (33c3)
Description:

more » « less
Video Language:
English
Duration:
32:46

English subtitles

Revisions