Automation Surprise: When Aircraft Do Exactly What Pilots Command But Still Catch Them Off Guard

A survey of 145 airline pilots conducted by Joris Field, a researcher at the National Aerospace Library, found that each pilot experiences an average of two mode confusion events per year. Vertical Navigation (VNAV) was identified as the greatest source of these incidents, with approaches and landings representing the most dangerous phase of flight.

The U.S. Federal Aviation Administration addressed the issue in its 2013 report 'Operational Use of Flight Path Management Systems,' which found that automation-related surprise was a factor in 23% of accidents and 45% of safety incidents reviewed. Manual flight errors remained the leading cause of accidents at 60%, but automation-linked errors were cited in 27% of accidents involving incorrect computer mode selection and 60% of safety incidents involving flight management computer use. Dr. Thomas Schnell, a University of Iowa researcher working with NASA on the issue, compared the problem to a car's cruise control being mistakenly believed off, "now make it 10 times as complicated." Three primary causes have been identified: mode confusion, where pilots do not know which automation mode is active; unexpected mode changes, where the system switches logic without warning; and hidden system logic, where complex algorithms governing flight behavior are not visible or clear to the crew.

On July 24, 2011, a Thai Airways Boeing 777-300 flying from Bangkok to Melbourne descended lower than expected during its approach. Air traffic controllers noticed the deviation and instructed the crew to go around, and the pilots took approximately one minute to respond before initiating the climb. The Australian Transport Safety Bureau investigated and concluded the pilot-in-command had likely experienced automation surprise following an unexpected autopilot pitch change during a non-standard approach. In a separate case, the 2013 crash of Asiana Airlines Flight 214, a Boeing 777 that struck the seawall short of the runway at San Francisco International Airport, was linked in part to automation surprise, including the crew's mistaken expectation that the autothrottle would maintain safe airspeed.

The FAA's advisory circular AC 120-71B instructs pilots to "stay in the loop by mentally flying the aircraft" even when autopilot is engaged, anticipating each maneuver before the system executes it and continuously monitoring instrumentation. Pilots are also advised to verify the Flight Mode Annunciator with every change made on the autopilot mode control panel.

Boeing and Airbus have taken different design philosophies that add further complexity. Airbus employs digital envelope protection, preventing pilots from exceeding structural or aerodynamic limits, while Boeing preserves pilot override authority in all circumstances. The two manufacturers also differ in control hardware, with Airbus using an outboard sidestick with passive feedback and Boeing retaining a floor-mounted control column with active feedback.

The pattern described here is not a hardware failure but a human-machine interface gap: systems execute their programmed logic correctly while the crew's mental model of that logic falls out of sync. The FAA's own figures, 23% of accidents and 45% of safety incidents tied to automation-related surprise, show this is treated as a distinct risk category rather than a subset of ordinary system malfunction, even as manual flight errors remain the larger single cause of accidents at 60%.

Flight deck design already reflects two competing answers to the same problem. Airbus's envelope protection limits what the aircraft will do regardless of pilot input, while Boeing's approach keeps the pilot as final authority and relies more heavily on training and monitoring discipline to catch mode confusion before it becomes consequential.

As aircraft such as the Airbus A350 push automation further, experts cited here expect autopilot errors to become less frequent but more disorienting when they do occur, since crews get fewer chances to build the mental models that catch mode changes early. Whether training curricula and cockpit alerting evolve to keep pace with that complexity is the open question the next generation of automation-surprise incidents will answer.