Modern Avionics

June 19, 2026 20 min read Aviation & Aerospace

aviationavionicsflight-systemsautopilotsafety-criticalsoftware

Contents

If you climbed into a 1975 Boeing 727 and then into a 2026 Airbus A350, you would not recognize the two as the same trade. The 727 cockpit had three crew, around a hundred round instruments, and roughly the same scan philosophy as a P-51 Mustang. The A350 has two pilots, six large LCDs, two sidesticks, and a deep stack of software between the pilot’s hands and the control surfaces. Almost everything visible has changed. What is interesting is how little of the actual job has changed underneath. A pilot in 2026 still spends most of the flight monitoring instruments and managing energy, the way pilots have since the 1930s. The difference is that the instruments are virtual, the energy management is largely delegated to a flight management computer, and the hard part of the job has shifted from “fly the airplane” to “supervise a machine that flies the airplane, and notice quickly when it gets something wrong.” This post walks what a glass cockpit actually replaced, what the FMS does, how autopilots and autoland chains are built, why flight computers are triplicated, and the honest gap between manual and automated flight as it stands today.

What “glass cockpit” actually replaced

The phrase “glass cockpit” has almost lost meaning. A steam-gauge cockpit from the 1970s used one electromechanical instrument per parameter: a tumbling-gyro attitude indicator, a three-pointer barometric altimeter, an airspeed indicator with a Mach needle, a vertical speed indicator, a slaved heading indicator, and dedicated radio nav (VOR/ILS CDIs, ADF needles, DME readouts). A flight engineer’s panel added dual-pointer gauges for N1, N2, EGT, fuel flow, oil pressure and temperature, hydraulic pressures, and electrical bus voltages. A long-haul 707 or DC-10 had several hundred analog gauges and warning lights, and the crew’s scan was a trained reflex.

The transition was gradual. The Boeing 757 and 767 (1982) were the first widely deployed transports to replace primary flight instruments with CRTs - Boeing’s EFIS, built by Honeywell, Collins, and Sperry. The Airbus A310 followed quickly. The 747-400 in 1989 eliminated the flight engineer entirely, putting all systems pages onto displays the pilots could call up. The Airbus A320 (1988) mainstreamed the LCD PFD alongside fly-by-wire and sidesticks. By the time the 777 entered service in 1995, the six-display flat-panel layout was established. Later refinements (787, A350, Garmin G3000/G5000, Collins Pro Line Fusion, Honeywell Primus Epic) are evolutions of the same template.

Generation	Era	Display tech	Examples
Steam gauge	pre-1980	Electromechanical analog	Boeing 707, 727, DC-9, early 747
Early EFIS	1982-1995	CRT, partial replacement	Boeing 757/767, Airbus A310, MD-11
First-gen glass	1988-2000	CRT or early LCD, full panel	Boeing 747-400, 777, Airbus A320, A330
Modern integrated	2005-present	Large LCD, software-defined	Boeing 787, 777X, Airbus A350, A220, Embraer E2
Touchscreen integrated	2013-present	Multi-touch LCD, integrated avionics	Garmin G3000/G5000, Pro Line Fusion, Primus Epic 2.0

The point was not aesthetics or panel space, though both helped. An LCD shows different things in the same space depending on phase of flight, so a navigation display serves as planview map at cruise and ILS course deviation on approach. New data sources became visible that did not exist in the analog era: EGPWS terrain shading, TCAS traffic, weather radar overlays, datalink uplinks, electronic approach charts. And the human-machine interface could be redesigned so the right information appears at the right time, in a form a tired pilot at 0300 local can actually read.

The standard glass-cockpit panel in 2026

The layout of any modern transport-category cockpit is recognizable: six displays, three in front of each pilot and a centre stack, with minor variations between Airbus (ECAM) and Boeing (EICAS) and the business jet integrators.

+--------------------+  +--------------------+  +--------------------+
|     CAPT PFD       |  |   UPPER EICAS/     |  |     F/O PFD        |
|                    |  |        ECAM        |  |                    |
|  Primary Flight    |  | (engines, FMA,     |  |  Primary Flight    |
|  Display:          |  |  master warn list) |  |  Display:          |
|                    |  |                    |  |                    |
|  attitude          |  |                    |  |  attitude          |
|  airspeed          |  |                    |  |  airspeed          |
|  altitude          |  |                    |  |  altitude          |
|  heading           |  |                    |  |  heading           |
|  VSI               |  |                    |  |  VSI               |
|  flight director   |  |                    |  |  flight director   |
+--------------------+  +--------------------+  +--------------------+
+--------------------+  +--------------------+  +--------------------+
|     CAPT ND        |  |  LOWER ECAM/MFD    |  |     F/O ND         |
|                    |  |                    |  |                    |
|  Navigation        |  |  Systems pages:    |  |  Navigation        |
|  Display (moving   |  |  HYD, ELEC, FUEL,  |  |  Display           |
|  map, weather,     |  |  ENG, FLT CTL,     |  |                    |
|  terrain, TCAS,    |  |  BLEED, COND,      |  |                    |
|  approach plates)  |  |  status, checklist |  |                    |
+--------------------+  +--------------------+  +--------------------+

   sidestick                                       sidestick
   (Airbus)                                        (Airbus)
   or yoke                                         or yoke
   (Boeing)                                        (Boeing)

         MCDU            MCDU             MCDU
         (FMS interface, route, perf, fuel calculations)

The Primary Flight Display is the most important single piece of glass in the cockpit. It shows attitude as a large artificial horizon, airspeed on a left vertical tape with bugs for target speed and flap/gear limits, altitude on a right tape with a vertical speed indicator beside it, and heading or track on a compass arc across the bottom. Overlaid on the horizon are the flight director bars showing what pitch and roll the autopilot would command, and across the top sits the Flight Mode Annunciator (FMA): three or four lines of text naming exactly which autopilot and autothrottle modes are armed and active. The FMA is so important that pilot training spends enormous time on “what does the FMA say right now”, because every mode-confusion accident in modern jets has had a pilot mismanaging a mode they did not know was engaged.

The Navigation Display is a moving map. The pilot selects North-up planview for cruise, track-up arc for navigation, or a raw VOR/ILS rose for approach. Overlays include weather radar, predictive windshear, TCAS or ADS-B traffic, EGPWS terrain shading, the FMS lateral path, waypoints, top-of-descent and top-of-climb markers, and on the newest aircraft the approach chart itself.

EICAS (Boeing’s Engine Indication and Crew Alerting System) and ECAM (Airbus’s Electronic Centralised Aircraft Monitor) handle engine instruments and systems alerting. Engine N1, N2, EGT, and fuel flow sit across the top of one display. On a failure, the system automatically calls up the relevant systems page and lists the required actions. Airbus’s ECAM presents the abnormal checklist as a sequenced action list the crew acknowledges item by item; Boeing’s EICAS is more conservative and points the crew at a separate Quick Reference Handbook or Electronic Flight Bag.

The Flight Management System

The Flight Management System turns “Heathrow to Changi” into a continuous stream of commands to the autopilot, throttles, and navigation displays. The pilot interface is the Multifunction Control and Display Unit (MCDU on Airbus, CDU on Boeing), an alphanumeric display with a physical keyboard on the centre pedestal.

Before pushback the pilots load the route: origin and destination, cruise altitude and Mach, takeoff and landing weights, departure runway and SID, airways and waypoints, arrival STAR and approach, and the alternate. The FMS pulls coordinates, navaid frequencies, and runway data from a navigation database updated every 28 days on the Jeppesen/LIDO AIRAC cycle.

Once loaded, the FMS computes two things continuously. The lateral path is straightforward: great-circle segments between waypoints with smooth curved transitions. The vertical profile is harder. The FMS knows the performance model (climb rate vs altitude, fuel burn vs altitude and Mach, idle descent rate) and the arrival constraints (“cross X at or below FL120 at 250 knots”). From this it computes the top-of-descent point at which to retard to idle and begin a continuous descent that, at predicted winds, arrives at the first constraint with the right energy. Get it wrong and the aircraft arrives too high (uncomfortable dive) or too low (fuel-wasting low-altitude thrust). A good FMS, like a good PID controller, updates predictions continuously.

The FMS also tracks fuel burn, arrival times, predicted winds, and the cost index that biases between fuel and time. Once armed, it commands the autopilot through LNAV and VNAV modes, and the autopilot follows.

Autopilot mode hierarchy

Autopilots have been around since Sperry in 1912, but a modern autopilot is not a single thing. It is a stack of modes, each a different control law, and the pilot’s job is to know which modes are active right now and what they will do next.

Mode class	Function	Where the targets come from
Basic	Pitch hold, roll hold, wings level	Last commanded by pilot
Holds	Altitude hold, heading hold, IAS or Mach hold, vertical speed hold	Mode Control Panel knobs
Selected	Heading select, altitude select, vertical speed select, FLCH (level change)	Pilot-set targets on MCP/FCU
Managed (Airbus) / FMS (Boeing)	LNAV, VNAV, profile descent	FMS route and performance
Approach	LOC and G/S capture, VOR/LOC, RNP approach tracking	ILS or RNP receiver, FMS
Autoland	Full Cat IIIb autoland: LAND, FLARE, ROLLOUT	ILS + radio altimeter
Go-around	TO/GA mode, pitch up to climb profile	Pre-set go-around procedure

The Mode Control Panel (Boeing) or Flight Control Unit (Airbus) runs across the top of the glareshield with knobs for selected speed, heading, altitude, and vertical speed. Pilots use it to give the autopilot direct targets when they want to override the FMS plan, typically because ATC just issued a new instruction.

The crucial subtlety is the Flight Mode Annunciator. A typical FMA reads “SPEED THR / NAV ALT / CMD”: autothrottle in speed mode, lateral mode NAV (following the FMS route), vertical mode ALT (holding the selected altitude), autopilot engaged. When a mode changes (altitude captured, glideslope intercepted, top of descent reached) the text changes, often with a box around it for several seconds to draw the eye. Every automation-surprise simulator scenario comes back to a pilot not noticing an FMA change.

The autoland chain

Autoland is well-established and routine in fog. Most airline pilots fly a Cat IIIb autoland a few times a year in revenue ops and more in the simulator. The chain that makes it work is intricate.

The classical approach uses the Instrument Landing System: two ground transmitters send a localizer beam (lateral) and a glideslope beam (vertical, typically 3 degrees), and the aircraft’s ILS receivers compute deviations. The autopilot tracks them down. ILS minima are categorised:

Cat I: decision height 200 feet, runway visual range 550 metres. Hand-flown or autopilot, single autopilot acceptable.
Cat II: decision height 100 feet, RVR 300 metres. Dual autopilot, autoland or hand-flown with HUD; fail-passive system acceptable.
Cat IIIa: decision height below 100 feet, RVR 200 metres. Autoland mandatory or HUD. Fail-passive acceptable.
Cat IIIb: decision height below 50 feet (often zero), RVR 50 to 175 metres. Autoland mandatory. Fail-operational required.
Cat IIIc: decision height zero, RVR zero. Defined but not approved for revenue ops anywhere; taxi guidance not available.

The fail-passive vs fail-operational distinction is the backbone of autoland. A fail-passive system, on a single channel failure, disengages cleanly without leaving the aircraft mistrimmed and hands it back to the pilots, who must immediately go around because they will not see the runway. A fail-operational system has enough redundancy (typically three independent autopilot channels and three ILS receivers) to continue the approach and landing through a single failure. Cat IIIb minima are predicated on fail-operational, because at a decision height of zero and RVR of 75 metres the pilots will not see the runway in time to take over.

       +-----------------------+
       |   ILS localizer +     |
       |   glideslope (ground) |
       +-----------+-----------+
                   |
                   | radio
                   v
       +-----------------------+
       |  3x MMR / ILS recvrs  |   (multi-mode receivers,
       |  on the aircraft      |    one per autopilot channel)
       +-----------+-----------+
                   |
                   v
       +-----------------------+
       |  3x autopilot channels|
       |  AP1, AP2, AP3        |
       |  cross-checking each  |
       |  other every 50-100ms |
       +-----------+-----------+
                   |
        any 2 of 3 agree -> command
                   |
                   v
       +-----------------------+
       |  Flight control       |
       |  computers (FCC/FCPC) |
       +-----------+-----------+
                   |
                   v
       +-----------------------+
       |  Actuators (elevator, |
       |  ailerons, rudder,    |
       |  spoilers, throttles) |
       +-----------+-----------+
                   |
       below 50 ft radio alt:
                   v
            FLARE mode active
                   |
       on touchdown:
                   v
            ROLLOUT mode (rudder
            steers to centreline,
            autobrakes apply,
            autospoilers deploy)
                   |
       pilot disengages on taxi speed

Below decision altitude the autopilot follows the glideslope to about 50 feet radio altitude, then transitions to FLARE: it pitches up gently to slow the descent, holds the localizer with rudder, and reduces thrust to idle. After touchdown ROLLOUT mode steers along the centreline with nosewheel steering and rudder while autobrakes decelerate. The pilots monitor throughout, ready to intervene, but the aircraft truly does land itself.

ILS is increasingly complemented by RNP (Required Navigation Performance) approaches using GPS augmented by SBAS (WAAS in the US, EGNOS in Europe) or GBAS (a localised differential station near the airport). RNP approaches let aircraft fly curved finals into terrain-constrained airports, with vertical guidance computed from the FMS rather than received from a ground transmitter. Accuracy comes from differential corrections and tight integrity monitoring; the underlying mechanics are covered in how GPS computes your position. GBAS Landing System approaches now reach Cat I at certified airports, with Cat II in progress.

Flight computer redundancy

Behind the displays sits a stack of computers. On a fly-by-wire airliner every command - sidestick, autopilot, autothrottle - is a digital signal interpreted by flight control computers that drive the surfaces. Because those computers are flight-critical, they are redundant in interesting ways.

The Boeing 777 and 787 use three Primary Flight Computers, each running the same software on three dissimilar hardware platforms (in the original 777, an AMD 29050, a Motorola 68040, and an Intel 80486, since refreshed). The idea is dissimilar redundancy: a bug or radiation-induced fault that hits one processor family will not hit the other two. The three computers vote: if all agree the command is issued; if one disagrees the majority wins and the dissenter is marked suspect; if all three disagree the system degrades to a backup mode and alerts the pilots.

Airbus took a different approach. The A320 family uses two ELACs (Elevator and Aileron Computers) and three SECs (Spoiler and Elevator Computers), each running software written by two independent teams in two different languages (Ada and Assembler/C) on different processors. Each box computes the control laws twice, in independent software, and a hardware monitor checks agreement before issuing the command. If they disagree the box self-disables. The A330, A340, A350, and A380 follow the same pattern under different names (FCPC, FCSC, PRIM, SEC).

Both philosophies aim at avoiding common-mode failures - a single bug or flaw taking out every redundant copy at once. The cost is roughly twice the software development effort. The benefit is that aircraft fly hundreds of millions of hours without a flight control computer ever causing an accident.

Bus architecture matters too. ARINC 429 was the workhorse one-way serial bus from the late 1970s through the 2000s. ARINC 664 (also called AFDX, Avionics Full-Duplex Switched Ethernet) is the modern standard on the A380, A350, 787, and most new business jets - deterministic switched Ethernet with bandwidth guarantees and redundant paths. It is the avionics cousin of the deterministic automotive networks discussed in the CAN bus and modern vehicle electronics, though much higher bandwidth and more rigorously certified.

Fly-by-wire philosophies

Fly-by-wire replaces mechanical cables and pulleys with electrical signals interpreted by computers. Once the computers are in the loop, the system designer chooses what they do with pilot input.

Airbus’s philosophy is hard envelope protection. The A320 control laws (called Normal Law in their healthy state) treat the sidestick as a load-factor demand in pitch and a roll-rate demand in roll. The flight computer integrates the demand subject to hard limits: angle of attack, bank, pitch attitude, and load factor, with no override. Pull the sidestick fully aft and the aircraft holds maximum allowable AoA without stalling. The argument is maximum performance with no risk of overcontrol.

Boeing’s philosophy on the 777 and 787 is soft envelope protection. The computer provides cues and resistance as limits approach, but the pilot can override. Pulling hard against the stick shaker will eventually exceed the AoA limit. The argument is that the pilot must remain ultimate authority for edge cases where the computer’s model does not match reality.

The most visible artefact is the controls themselves. Airbus uses two sidesticks, outboard, not mechanically cross-linked: if one pilot makes an input the other’s stick does not move. This saves weight and clears space for a fold-down table. If both pilots input simultaneously the system sums them algebraically and a “dual input” callout warns - a factor in Air France 447, where the pilots were unaware of each other’s stick. Boeing keeps the traditional yoke, mechanically linked between positions, so each pilot feels what the other is doing. The yoke takes more space but cross-cockpit awareness is better.

DO-178C: how this software gets certified

Software in flight computers, FMSs, displays, and autopilots is certified under RTCA DO-178C (ED-12C in Europe), published in 2011 and adopted by the FAA, EASA, Transport Canada, and most other authorities. DO-178C defines five Design Assurance Levels based on consequence of failure.

DAL	Failure consequence	Examples	Test/verification objectives
A	Catastrophic (loss of aircraft)	Flight control laws, autoland	71 objectives, MC/DC coverage required
B	Hazardous (serious injury, large workload increase)	Autopilot, primary flight display	69 objectives, decision coverage required
C	Major (discomfort, moderate workload increase)	FMS, navigation database engine	62 objectives, statement coverage required
D	Minor (slight workload increase)	Cabin systems, IFE control logic	26 objectives
E	No safety effect	Cabin lighting scenes, galley control	No DO-178C objectives required

Level A software (flight controls, autoland) must demonstrate Modified Condition/Decision Coverage: every Boolean condition in every decision must be shown to independently affect the outcome, exercised by tests derived from requirements. Every line of code traces to a requirement, every requirement to a higher-level requirement, every test to a specific requirement. The toolchain (compilers, linkers, code generators) must itself be qualified. Verification effort for Level A typically runs 5-10 times development. The per-line cost reaches hundreds of dollars - not because the lines are hard to write but because every line is exhaustively tested, reviewed, and documented.

This is why avionics software lags consumer software by a decade. The 787 entered service in 2011 with software largely in Ada, certified to DO-178B starting in the early 2000s. Modern programs mix Ada, MISRA C, and increasingly model-based development with SCADE or Simulink generating certified code. A major system can take 18-36 months to certify, so new aircraft are designed around the toolchain you can certify, not the one you would prefer.

What pilots actually do

So what do pilots actually do in 2026? Less hand-flying than ever, more system management than ever, and the same final responsibility for safe outcomes as in 1960.

A typical sector: pilots arrive an hour before departure, load the flight plan via the MCDU, cross-check fuel and performance, brief the departure including engine-out contingencies, and run setup flows. Takeoff is hand-flown - the pilot flying advances thrust (or selects an autothrottle setting on Airbus), holds centreline with rudder, rotates, retracts gear, and follows the flight director. The autopilot engages between 500 and 1500 feet above ground. From there to short final the autopilot flies; the pilots manage the FMS for ATC route changes, monitor systems, and intervene if anything anomalous occurs.

On approach the pilots brief the arrival, set up the FMS, configure flaps and gear at the right speeds, and monitor the autopilot intercepting the ILS or RNP path. In good weather they typically disengage between 1000 and 200 feet and hand-fly the landing - both for skill maintenance and because humans are usually smoother on the flare than fail-passive autoland. In low visibility the autopilot stays in for autoland and the pilots monitor FMA, localizer and glideslope deviations, and radio altimeter callouts.

Taxi remains entirely manual. There is no autotaxi in revenue service in 2026. Pilots steer with the tiller and rudder pedals, follow taxiway signs visually, and shut down engines at the gate. Considerable effort is going into runway and taxiway incursion alerting using onboard databases, ADS-B traffic, and synthetic vision, but autotaxi itself remains in research.

The 737 MAX MCAS accidents of 2018-2019 cast a long shadow. MCAS was a single AoA vane feeding a single control law that could trim against the pilots without clear annunciation. When the sensor failed, the system added a control input the pilots did not understand and could not easily diagnose. The accidents reframed the industry around three principles: pilots must always be told what automation is doing, automation must not surprise pilots, and a single-sensor input driving a flight-critical output is unacceptable. The fixes - dual AoA inputs, explicit MCAS inhibit on AoA disagree, clearer alerting, and revised training - reflect a hard lesson the industry already knew but had to relearn.

Garmin AutoLand and the general aviation gap

One of the most interesting developments of the late 2010s and 2020s is Garmin AutoLand, certified on the Piper M600 and Cirrus Vision Jet in 2020 and now widely available on small turboprops and very light jets. Unlike airline autoland (a bad-weather tool), Garmin AutoLand is a pilot-incapacitation system. If the single pilot becomes incapacitated, a passenger (or the autopilot itself, on detecting incapacitation) presses a red button. The system diverts to the nearest suitable airport based on runway, weather, and fuel, communicates via synthesized voice on the radio, descends, configures the aircraft, lands, brakes, and shuts down the engine. The passengers only have to keep seatbelts on.

This is a different category from airline autoland, which reduces minima on a known approach with two qualified pilots monitoring. AutoLand replaces the pilot entirely for an emergency that should never happen but occasionally does. It depends on a suitable airport in range with adequate weather and on airframe systems remaining functional. It is not single-pilot airliner technology, but it is the first production automation that can handle a complete flight phase unaided.

Single-pilot operation of airliner-class aircraft (eMCO, extended Minimum Crew Operations) remains regulatorily non-viable in mid-2026 despite industry interest. The reasons are not primarily technical: the FAA and EASA have not approved a single-pilot certification basis for transport-category aircraft, unions have substantial concerns, and incident-data analysis keeps surfacing scenarios where two pilots cross-checking prevented an accident. The current direction is more capable automation under a two-pilot crew. The propulsion side has been similarly conservative; the dynamics of how a jet engine actually works have not fundamentally changed in 30 years even as the cockpit around it has.

Verdict

Modern avionics is forty years of incremental engineering toward a coherent target: make aircraft easier to fly safely, give pilots better information at lower workload, and degrade gracefully. The glass cockpit, FMS, multi-channel autopilot, redundant flight computers, fly-by-wire with envelope protection, DO-178C software, and autoland are pieces of the same story. They have delivered the safest decade of commercial aviation in history.

They have not removed the pilot. Automation handles the part of the job most amenable to it - holding altitude, following a programmed path, tracking an ILS or RNP approach - and the pilots handle the rest: taxi, takeoff, hand-flown approaches in good weather, ATC negotiation, non-normal procedures, and the unexpected. The framing of pilots as “just supervising computers” misses how much of the job is deciding when to override or disengage. MCAS made clear that pilots catching automation errors is itself part of the safety case.

The next decade will likely bring GBAS displacing more ILS, synthetic vision standard, predictive systems monitoring, routine incursion alerting, and perhaps eMCO for cargo overnight legs. What it will not bring is sudden replacement of the human pilot. The safety architecture is layered defence, and the human remains one of the layers.