If a pilot ejects, what is the autopilot programmed to do?
aviation.stackexchange.com
aviation.stackexchange.com
It would be like if someone asked "what would happen if a C program tried to access uninitiated memory?" And the answer was "Good programmers would never do that".
> Everything within roughly a mile of the park is leveled, and a firestorm engulfs the surrounding city. The baseball diamond is now a sizable crater, centered a few hundred feet behind the former location of the backstop.
> A careful reading of official Major League Baseball Rule 6.08(b) suggests that in this situation, the batter would be considered "hit by pitch", and would be eligible to advance to first base.
Ejected vs. not-ejected is very likely not even an input variable to the autopilot. So the answer would be:
Autopilot will attempt to do exactly what it was doing before the pilot ejected.
Also, the plane would be lighter after the ejection.
And perhaps—I'm just guessing—the cockpit window or ceiling might now be gone? In which case there'd suddenly be a lot of drag from air swirling down into the cockpit.
So no, I don't expect the autopilot would continue to do exactly what it was doing before. It'd have to do a bunch of corrections, and then it would return to what it was doing before :)
(Or those corrections might be enough to make it decide "the pilot" should take over. What happens when there's no pilot and no autopilot? I'm guessing that's down to the way avionics hardware reads out when nobody's touching it.)
The cockpit can be broken or sensors may be malfunctioning as well, so "cockpit missing" is not a great signal.
It might not generalize to any other compiler—and that's the reason you don't try to build anything predicated on any particular assumption about the behavior—but you can still know it for a particular context.
And, in fact, often there are conventions in compiler-writing that mean that every compiler basically does the same thing in response to certain UB code. (Like optimizing away always-false branches, for example.)
So, by analogy: there are a limited number of autopilot AI programs in existence. Of those concrete implementations, is there anything they would be predicted to do in response to this event they're not coded for? What would it look like to them—what branch would they take without an explicit branch for "ejected"—and how would they react to being in that branch?
With that caveat, every autopilot system I've studied turns itself off if the plane is outside its flight regime. So for example, if you pull a plane straight up and do a tail stall and try to turn on the autopilot, the autopilot would refuse to engage as the plane isn't in a "flyable" regime.
What is more, the autopilots I've seen were explicitly programmed to be pilot activated, so even if the plane went from one regime where the autopilot kicked itself off automatically, back to one where the plane could be flown by the autopilot, the autopilot would not automatically re-engage.
If the pilot ejects because they cannot control the plane, neither can the autopilot so it won't be on. If the pilot put the plane on autopilot and then ejected, the ejection would most likely force the autopilot to disengage. If a pilot put a plane on autopilot, walked into the back of the plane and opened a door and parachuted out, the plane would continue flying on autopilot until it ran out of gas and then the autopilot would disengage and the plane would crash.
(by the way Chuck, your important section on your profile is really impressive, I've never seen anything like it but it makes total sense).
So, yeah. I think he means it :-) I was pleasantly surprised when I saw that username pop up here a few years ago.
Auto-GCAS Saves Unconscious F-16 Pilot: https://www.youtube.com/watch?v=WkZGL7RQBVw
From memory it was introduced in the Sukhoi Su-7 in the late 1950s.
https://www.wsj.com/articles/SB10001424052702304791204576402...
Liability as well.
It would be a fair question to wonder what GCAS does when a pilotless plane is heading into the ground. I'm going to guess that the folks who built GCAS have a test to see if there is a pilot in the plane or not. And in the absence of a pilot just augur in, but that is just a guess.
https://en.wikipedia.org/wiki/Autopilot#Autopilot_for_ILS_la...
https://en.wikipedia.org/wiki/Instrument_landing_system#ILS_...
Them: What if a shark jumped into a volcano?
Me: That wouldn't happen because sharks live in the ocean and can't jump high enough or far enough to reach land.
Them: OK, but what if?
Me: ... It would get burned and die...
So yes, if a pilot ejects and the plane had auto-pilot on and the auto-pilot was programmed to try to land after a pilot ejection and the plane was still safe to fly, the plane would in fact attempt to land.
Also, ejection only makes sense in the context of a manned military aircraft. For the question to make sense as posed, the implication is that the pilot had engaged the autopilot and then ejected while the autopilot had meaningful control authority over the aircraft. That's not a scenario the airworthiness certification authorities probably consider as critical. Manned aircraft require deliberate human action to engage the autopilot. What the flight control computers do in general (e.g., limit control inputs to keep aircraft within acceleration/maneuvering limits, automatically enter a stable attitude when stick forces are not present) is not considered the "autopilot".
You could ask the question, "If the pilot ejects, do flight control computers attempt to fly the aircraft in any particular way?" At least for U.S. aircraft, recent ejections (e.g. the Thunderbird ejection near the end of Obama's tenure), suggest the answer is "no". If an automated flight termination system is installed, when safety constraints are violated (e.g., heartbeat signal or veering outside of geographic limits) it usually takes action to put the aircraft into the ground as quickly as possible (e.g., cut power to actuators on an unstable aircraft). This is common with UAVs. I don't think this is the case with manned aircraft.
(1) The chance that the 'autopilot' will even be on in an ejection scenario is very low. If something does go wrong, pilots will take control first, eject second. Disconnecting the autopilot will happen either deliberately or automatically as the pilot moves the stick.
(2) Aircraft with ejection seats are not Cessnas. The "autopilot" might not be on, but the fly by wire control system is never really off. That system will remain active and could potentially "fly" the plane some distance. Think of it like a car sliding on ice. The cruise control might be off, but the stability assist system isn't. The driver can jump out and the car still recover itself.
(3) The engine(s) will keep going. Ejection does not turn off anything. It's not like falling off a jetski where a kill switch is pulled. The throttle will be wherever the pilot left it.
There have been a handful of incidents where a pilot has ejected and the aircraft continued on without him/her. I've read about this with test pilots in spins. The aircraft is spinning and unrecoverable, so the pilot ejects. The aircraft then self-recovers through a combination of inherent aerodynamic changes (falling into thicker air) and/or efforts by the fly by wire system to maintain the commanded heading/pitch from a now-unmanned stick.
There is an adage amongst fighter pilots that they shall not punch out until they know where their aircraft will land. Hanging in a parachute as your aircraft recovers and continues strait into a school. If over land/people they will stay with it until VERY close to the ground.
Like scuttling a ship, but smaller.
There are basically two options: Hard shutdown (power off, full brakes) vs Soft shutdown (power off, doing nothing). Both have it's merits and usecase, and are selected by the SW automatically. HS could save lives but could be very expensive, as the engine could be broken by the strong forces. SS could last a few minutes and destroy the engine also.
In the plane cases you don't have that many options there, though usually with 4 more degrees of freedom yodur options on a plane are much higher. I don't think that there are programmed sequences, but with military applications I would be not surprised to see both options implemented. Escape as far as possible vs hard vertical acceleration for maximal destruction.
https://upload.wikimedia.org/wikipedia/commons/9/9c/Ejection...
> I would want to build in a way for the plane to try and save itself if possible
In a combat situation, I would imagine you'd want to destroy the aircraft if you lost control of it, to prevent the enemy recovering: the working aircraft itself, the technology it contains, or any sensitive reconnaissance recorded on it.
However, you could ask a similar question with a modified premise: you'd want to build in a way to have control over the fate of the airplane.
Depending on the situation, the right thing might be to safely land it (if in friendly territory), destroy it as thoroughly as possible (if in hostile territory), or protect lives on the ground (if you don't think you can land it).
But whatever the goal may be, maybe the autopilot could do better than leaving it to chance.
EDIT: I forgot about a fourth possibility. If in hostile territory, maybe use the autopilot to turn the plane into a weapon. You're leaking fuel so fast there's no way you'll make it back to base, but maybe you still have enough fuel to pick up a lot of speed before slamming into a nearby enemy asset.
"The autopilot doesn't change its operational parameters to account for ejection." would be an answer, meaning it takes no account of it and continues as before.
Saying "it's programmed to do nothing" is very different: meaning it would stop, meaning it would be taking notice of the ejection.
As for crashed military, state side decades ago I did a shoulder to extended arm walk in the wood. Overseas a sister squadron deployed some guys to recover what they could and destroy the rest; that was in a "not so hostile" country.
The biggest question I'd have is: What would you even want the auto-pilot to try and do after an ejection? Assuming it somehow gained full flight control, then what?
Not if it's a military aircraft with classified equipment over enemy territory.
There was a case of Iran interfering with and American UAV and then spoofing GPS to get it to land in Iranian territory.
https://aeroantique.com/products/bc-706a-detonator-impact-sw...
They didn't ask would it be likely in an ejection event, they asked what the programming parameters were.
AFAICT it's "continue as before", which is useful to guide the aircraft away to avoid excessive harm to people/property.
Clippy's flying the plane, folks.