Aviation’s Safeguard: Two Pilots Always on the Flight Deck
Part 6: Automation, Trust, and Security: Accept No Substitute
By Christopher Freeze, Senior Aviation Technical Writer
Editor’s note: Exposing the dangers of reduced-crew operations has been and will continue to be an ALPA priority. In this nine-part series, Air Line Pilot will educate, inform, and advocate support for maintaining the most vital aircraft safety feature: two experienced, well-trained, and well-rested professional pilots on the flight deck. Catch up with Part 1, Part 2, Part 3, and Part 4, and Part 5.
“As the global supply chain crisis has deepened, we’ve learned more and more about the true costs of delays and weak points in these processes. Any error can produce ripples that impact countless others, both locally and aboard. The same applies to aviation. No one likes delays, passengers and pilots alike, as our industry works diligently to shave minutes and seconds. But to add an unnecessary delay to routine flight deck procedures as would be introduced by the presence of a remote operator—when the standard of two well-trained, qualified, and rested pilots is proven to be best—is simply against the common good and common sense.”
—Capt. Joe DePete, ALPA President
Automation technology has advanced significantly over the decades. And while it serves as an important tool pilots employ to keep flying safe, ALPA strongly advocates that technology’s role in the commercial airline industry is to supplement safety—not to replace two experienced, well-trained, and well-rested professional pilots on the flight deck. Perhaps the biggest technological hurdle to safe reduced-crew and single-pilot operations is an advanced form of artificial intelligence called artificial general intelligence (AGI). Unlike existing or emerging forms of artificial intelligence that can handle specialized individual tasks, AGI, as envisioned, would effectively replicate human judgment across a broad spectrum of sensing, analytical, decision-making, and implementation functions.
Such a capability might someday safely replicate the redundancy on the flight deck that a second pilot provides. However, this technology is still a theoretical construct. The recent “FAA Aerospace Forecast” reports that true AGI is at least two decades away. And according to a 2014 NASA paper, short of being able to act, sense, and react like a human pilot, artificial intelligence will have to perform at least two key functions to enable single-pilot operations: interaction and task exchange with the human pilot (captain) and monitoring the health and cognition of the captain.
Interaction includes tasks such as the machine informing the captain what it’s doing, confirming important parameters such as altitude settings, and recalling information and instructions provided by air traffic control. Interaction is complicated by the fact that different tasks might be better suited to the captain than the machine—and vice versa—at any given time. The ability to reallocate tasks between the two, especially during off-nominal circumstances, is needed. If the captain becomes overloaded with tasks, they must be able to offload certain tasks to the automation with full confidence. If the machine must offload for similar reasons, it must be able to provide a reason and other situational awareness information ahead of time, which is well beyond the capability of current technology. A well-trained and experienced first officer who is able to see and understand the task saturation the captain may be facing has repeatedly been proven to be a vastly superior alternative.
In addition to whether the level of automation required for single-pilot operations is technologically feasible, concerns remain about relying on such technology. Increased dependency on automation in aviation may not be advisable, as a key requirement for its implementation is advanced automation that provides onboard support functions at a level well beyond what’s currently available in modern airliners. While it may be tempting to simply automate as many of the current pilot functions as possible, distancing the captain from the flight/mission could erode situational awareness and cognitive readiness.
Securing pilot trust is another obstacle. Robotic systems are prone to failures, which can undermine user trust in these systems, eroding their usefulness and benefits. Further factors such as obscured communications and an unequal degree of dependence between the human and the machine also impede trust further. While trust is necessary for humans to take advantage of autonomy, putting trust in unreliable autonomy, particularly in an aviation context, is dangerous.
Furthermore, a lack of trust and perceived safety could inhibit pilot acceptance of automated systems, which presents a barrier to their development.
Reduced-crew and single-pilot operations also introduce a cybersecurity issue due to the requirement that ground-based pilots be able to assume control of the aircraft in the case of pilot incapacitation or other emergency. Because hostile actors have attacked aircraft radio communications in the past, the possibility of exploiting weaknesses in communications links to disrupt or even commandeer airplanes in flight must be addressed. In order to prevent reduced-crew operations from opening up powerful new avenues of cyberattack on aircraft, countermeasures must be taken. An authentication mechanism to ensure trust of communications is needed to make certain that only authorized personnel or systems on the ground have access to aircraft systems. Similarly, a means for the pilot on the flight deck to deactivate the automation would be necessary—which is at odds with the need for automation and ground pilots to intervene in case of a partially incapacitated pilot. Another baseline capability to address cybersecurity threats would be to encrypt communications between the aircraft and ground, which raises issues of communications redundancy and latency.
Day and night, pilots safely transport passengers and cargo to their destinations, routinely performing the expected. They also safely manage the unexpected when situations arise. To honor those flight crews that have experienced unexpected and extraordinary events while piloting their aircraft, ALPA bestows upon them its Superior Airmanship Award.
In each article of this nine-part series, Air Line Pilot is highlighting an incident from the past in which flight crews—working as a team—used their knowledge, skills, and abilities to make the difference between a safe landing and the unthinkable alternative. These incidents truly highlight why two pilots are required on the flight deck.
On the evening of April 13, 2004, United Airlines Flight 854, B-767-300 service from Buenos Aires, Argentina, to Miami, Fla., was in cruise flight at FL310 over the jungles of southern Colombia. Capt. Brian Witcher and F/Os Donald Arlotta and Ross Windom were the flight crew that night.
Suddenly, the autopilot warning horn went off, the flight deck went bright with standby lighting, and the first officer’s panel went blank. Witcher took manual control of the airplane and called for a checklist to deal with the electrical failure.
The overhead electrical panel appeared normal, with no lights on except for the battery discharge light. In fact, the entire overhead panel was normal, with only the automatic speed brake and rudder ratio lights illuminated. The pilots pressed the light-test switch and confirmed that all the lights worked and none of the bulbs were burned out.
Windom arrived from the crew rest area. The three pilots discussed the situation and their options. Shortly afterward, Witcher’s instruments began to fail. The pilots immediately declared an emergency and asked air traffic control for a clearance to Bogotá. They tried to establish radio communications with United’s dispatch office, both through HF and satellite radios, without success.
The EICAS displays were full of cautions. The pilots soon realized that no checklist existed to cover the situation in which they found themselves. They knew they had a serious electrical problem, but the hydraulic motor generator (HMG) would kick in and keep the captain’s instruments powered—according to the manual.
When radios failed, Witcher reset the generator control circuit breakers. The pilots were surprised when the VHF radio, and Witcher’s instruments, came to life again and then promptly failed once more, still about 200 nautical miles from Bogotá.
The pilots squeezed 41 minutes from their 30-minute battery by turning off everything they could, including the outside lights, to conserve battery power for lowering the landing gear. Witcher reset the generator control circuit breaker three times before they landed safely, but with no clearance from the Bogotá tower because their radios still didn’t work. The pilots landed with less than two volts of battery power left.
The pilots didn’t learn until after the flight that a single bracket grounded both transformer rectifier units in the A/C electrical system. United’s Maintenance Department eventually found that corrosion had caused a short circuit of the grounding bracket and that the HMG didn’t come on line because it falsely sensed that the airplane had normal A/C power.