The aviation industry has had a long- standing relationship with computer science. Developments in avionics, computer-aided design and flight management software, are just a couple examples of how computer science has permeated throughout all aspects of the industry. Today, with more passengers choosing to fly than ever before, demand for connectivity has also never been stronger. Many aircraft manufacturers share this same desire for greater connectivity, as maintenance can be streamlined. The result is that as computer science and other novel technologies becomes more integrated in aviation, the accompanying cyber security risks have become more numerous with bigger consequences. This paper will describe the role technology has played in the aviation industry, specifically focusing on the risks associated with pilot-aircraft interactions in the face of increased and even total automation. For years, pilots sat atop the commercial aircraft totem pole. Commercial transport aircraft were controlled by a three- person flight crew.
There was a captain, who’s primary responsibility was to safely operate the aircraft. The second pilot was called the first officer. The first officer’s is responsible for the safety of the aircraft and aircraft occupants in the event the captain is incapacitated. Lastly, there was a flight engineer, who was responsible for monitoring and operating the complex aircraft systems. The flight crew would interact with the aircraft using a system of analog electro-mechanical or purely mechanical designs, necessitating that each instrument has its own space. What resulted was often a complex layout of gauges and dials, which described the state of each aircraft system. The Federal Aviation Administration (FAA) made the three-person flight crew a requirement for aircraft designers and operators. However, as new technological shifts such the movement from piston to turbine aircraft, aircraft manufacturers in conjunction with airlines began looking at ways to reduce the number of people in the cockpit.
When Boeing initiated the original 737 aircraft design, the FAA had just published Federal Aviation Regulations (FAR) Part 25 for certification of new transport aircraft, which required a rational analysis and demonstration of crew workload. During the analysis, pilot unions made it a point to publicize the fact that a third flight crew member would improve the ability to detect other aircraft, reducing the possibility of mid-air collisions. This of course, garnered much public support however, a more in-depth analysis of three-person flight crews revealed a very different prospective. “Indeed the crews on airplanes flown with three pilots did see more aircraft. Interestingly, the 2- person crews saw significantly more aircraft than the two pilots on the 3-person airplanes. But because the 3rd pilot sits much further aft and lower than the pilots sitting at the two forward pilot’s stations, the target aircraft that the 3rd person can see are in a position where collision is highly unlikely. In this situation, if the two forward pilots relax their outside watch, the opportunity for an undetected collision event actually increases.” [1] In addition, Boeing researchers found that that the psychological workload associated with more complex communication methods was higher in three-person flight crews.
127 our experts are availableright now
“This rich field of study provided strong evidence of much more team complexity in 3- person groups as compared with 2-person groups. Issues related to coalition formation, distraction, and the need for more extensive verbal coordination in 3-person crews were shown to have the roots in normal human behavior that starts with childhood and continues, with far greater sophistication, through adulthood. From the viewpoint of the psychologists the best crew size was the absolute minimum number of people it took to complete the work.” [1] It was not until the development of new technologies such as the integrated circuit (IC) and cathode-ray tube (CRT) display that two- crew member flight decks became the standard. Micro-processors could monitor complex aircraft systems faster and more reliably due to the ease by-which redundancy could be achieved. CRT displays were used to improve situational awareness, as critical information such as aircraft attitude, airspeed, engine state could be presented in a less-cluttered, intuitive manner.
If a failure were to occur, the microprocessor would identify the error, possibly provide some correction input, and then alert the pilots through the CRT display. Whereas formerly, pilots would have to monitor each system through the designated gauge or dial and identify the anomaly themselves. Since the introduction of the integrated circuit into commercial transport aviation, automation innovations, especially in the flight management system (FMS), became evident. On March 2nd 1984, Airbus, one of the two main commercial aircraft manufacturers alongside Boeing, launched the A320. The A320 was a pioneer in automation and computerized flight. It was the first major commercial aircraft to employ fly-by-wire (FBW) technology, which essentially meant the pilot’s control inputs were not directly linked to the control surfaces of the aircraft, rather, the inputs were first sent to a computer, which then modified and relayed the signal to the control surfaces. FBW was revolutionary because it enabled the use of a flight envelope protection (FEP) system.
The FEP acts as a safety net, preventing pilot inputs from pushing the aircraft beyond its limits. Essentially, a computer reads the pilot control input, decides whether the input will put the aircraft in danger, and if so, alters the control surfaces such that the aircraft moves in the manner the pilot expects, but without exceeding the flight boundaries. Boeing’s philosophy on FBW slightly differs from Airbus, in that the pilot will always be in command of the aircraft. The Boeing FBW system might impose soft limits or warnings, but if the pilot were to choose to exit the ideal flight envelope, he or she would be able to do so. [2] Today, virtually every airliner employs some type of FBW control system. Unfortunately, the complex flight control laws and increased automation found in commercial aviation has not fully eliminated catastrophic accidents. On July 1st 2009, an Air France Airbus A330-200 from Rio de Janeiro to Paris crashed into the Atlantic ocean killing everybody onboard. The A330-200 was a state-of-the-art aircraft, including Airbus’ most sophisticated software and level of automation. As a consequence of flying through a storm in the intertropical convergence zone, one of the aircraft’s pitot tubes froze over.
The pitot tube measures air pressure, which is then used to determine most importantly airspeed. When the tube froze over, the computers aboard the aircraft changed the control law from normal to alternate 2 mode, which meant that the autopilot and autothrottle disengaged. When the autopilot and the autothrottle disengaged, the pilots were thrust into a high-stress situation, where they had little clue as to what went wrong. Unfortunately, the most junior pilot took control of the aircraft and inexplicably pitched the nose of the aircraft up, ultimately leading to an unrecoverable aerodynamic stall. The results of the Air France flight 447 crash sent shock waves throughout the aviation community. Investigators concluded that the cause of the crash was due to the faulty pitot tube and pilot error. While pilot error was seen as the main reason for the crash given the aircraft could have continued to fly had it not been placed in an aerodynamic stall by the pilot, the complex automation capabilities of the aircraft undoubtedly contributed to the incident. Wil Hyle of the New York Times perhaps said it best, “And when, in the middle of the night, in the middle of the ocean, flight 447 seemed to disappear from the sky, it was tempting to deliver a tidy narrative about the hubris of building a self-flying airplane, Icarus falling from the sky.” [3]
In environments where both man and machine share control over a vehicle, the situational awareness issue appears to become exacerbated as automated complexity increases. In the case of Air France flight 447, the pilots who were in the middle of the rather mundane cruise phase of flight were suddenly subjected to a flight deck with blaring alarms and flashing lights, indicating that the self-flying capabilities had disengaged. The sudden and “ungraceful” manner by which the automation handed control back over to the human pilots was a significant cause of the crash. In addition, the rampant automation of almost all phases of flight has caused many pilots to lose some of their “hand-flying skill.” The human-automation “hand-off” problem will exist as long as both the human and automation have control over the actions of the vehicle. In the case of aviation, the introduction of automation has greatly reduced the number of accidents, yet, the “hand-off” and situational awareness problems still exist.
Unfortunately, a recent Boeing 737-8 MAX accident serves as an example of such. On October 28th 2018, a Lion Air flight 610, a Boeing 737-8 MAX aircraft crashed into the Java Sea right off the coast of Indonesia. Just introduced in 2017, the Boeing 737-8 MAX aircraft is one of the industry’s most modern and complex. Again, investigators decided that the crash was a product of a sensor issue causing the automation to malfunction and pilot error. This time, an angle-of-attack sensor error caused the Maneuvering Characteristics Augmentation System (MCAS), a new feature of the 737-8 MAX, to trim the pitch nose-down in order to avoid entering an aerodynamic stall. In addition, erroneous stick shaker and other audible warnings were all triggered due to the faulty angle-of-attack sensor.
The pilots counteracted by applying nose-up trim, flipping a switch which temporarily disabled the MCAS. The cycle of trim nose-down and nose-up repeated itself more than two dozen times before the aircraft entered its final dive. Unlike the Air France flight 447 incident, the automation never gave up control. However, the MCAS could have been shut off, as was demonstrated on a previous Lion Air flight. Despite the fact that the MCAS could have been turned off, it was still obvious that the pilots were unaware of what was causing their aircraft to pitch down. This, again demonstrates the potentially fatal disconnect between “man” and “machine.” The Air France and Lion Air flights are just a couple out of a multitude of automation- related aircraft accidents. “A 2013 report by the FAA found more than 60 percent of 26 accidents over a decade involved pilots making errors after automated systems abruptly shut down or behaved in unexpected ways.” [4]
While there is no question that automation has improved the safety of air travel, automation-related incidents have become a bigger portion of the incidents that still do occur. Especially as automation becomes more sophisticated, the likelihood of incidents caused by automation failure and lack of understanding of the automation system by pilots will continue to increase. Thus, so long as automation and humans share control over an aircraft, it is likely that automation-related aircraft accidents will still occur and could possibly worsen with time. From three-person flight crews, flight decks quickly evolved to the two-person flight- crew design found today. The technological innovations which have made greater automation possible have been greatly responsible for the rapid change in flight deck design philosophy. While the two-person flight deck defines the current standard, one-person flight crew and fully autonomous aircraft are rapidly approaching.
This next section will consider the benefits and detriments of this surely impending future. Starting with single-person flight crew flight decks, many aircraft manufacturers and institutions have already spent considerable research and development assets studying this design. When asked about a single-pilot future at Boeing, Charles Toups, a vice president at Boeing, said this, “We are studying that, and where you will first see that is probably in cargo transport, so the passenger question in off the table.” [5] Meanwhile, Airbus officials have made the following the comment on single-pilot aircraft: “The more disruptive approach is to say maybe we can reduce the crew needs for our future aircraft. We’re pursuing single-pilot operation as a potential option and a lot of the technologies needed to make that happen has also put us on the path towards unpiloted operation.” [6] Institutions, like NASA have also been working on developing single-pilot aircraft concepts. “Under the single-pilot understanding for distributed simulations program, the team will research the crew capacity, ground and flight deck resource management, physiological monitoring technologies and automation needed to make SPO viable, in addition to addressing technical, certification and policy issues that will emerge.” [7]
It is evident that while many companies and institutions are exploring single-pilot aircraft designs, there are many differing sentiments driving this research. Boeing appears to be skeptical of a single-pilot aircraft for human commercial transport but understands that commercial cargo missions could work. Airbus, and its child think tank A3, are considering single-pilot aircraft for their “air-taxi” drone, the Vahana. Lastly, NASA took a more distributed approach investigating not just flight deck design, but the ground support tools associated with flight. NASA investigated how the workload found on a common two- pilot aircraft would be newly distributed amongst the single-pilot and a “super” dispatcher. Despite the dissimilarities in motivation surrounding single-pilot aircraft research, one major shared motivation is the current lack of pilots. One major benefit of single-pilot or fully autonomous aircraft is that it eliminates the need for a large pilot workforce. Pilot workload can be decreased overall, while also allowing for the piloting skill of the population to not be diluted by less-skilled newcomers.
The major fear surrounding single-pilot aircraft operations can be summed up by the tragic Germanwings flight 9525. On March 24th 2015, a Germanwings Airbus A320 crashed in the French Alps. The crash was ruled to be deliberately caused by the co-pilot, Andreas Lubitz. Shortly after reaching cruise altitude, first officer Lubitz waited for the captain to use the bathroom, where he then locked the cockpit door and initiated a controlled descent into the mountainous region below. This tragic accident is frequently cited as an argument against single-pilot operations. Had the captain been present, it would have been unlikely for the first-officer to commit such an act.
The FAA and EASA (European Aviation Safety Agency) quickly responded to the accident by mandating that all flights have at least two flight-crew members in the cockpit at all times. Now, if a pilot were to use the bathroom, a flight attendant would step into the cockpit to monitor the other pilot and other aircraft systems. Many pilot unions cite the security risk demonstrated by Germanwings flight 9525 as the primary argument against automation replacing two-pilot with single-pilot aircraft. The final aircraft configuration that will be explored in this paper is the fully autonomous commercial transport aircraft. That is what are the implications of a future where large transport aircraft will run fully autonomously and how likely is such a future? Starting with the implications of an aviation industry where the majority if not the entirety of commercial transport class aircraft is autonomous, some of the major issues discussed earlier in the 2-pilot aircraft section go away. Namely, the issue of the hand-off problem becomes irrelevant.
Without a pilot to “hand off” to, the communication dissonance between man and machine no longer needs to be solved. However, this raises many questions. Specifically, if there is no pilot to backup the automation system, will the system be robust and creative enough to save the aircraft and those inside the aircraft in the event of a system failure or the unexpected. As Amy Pritchett, an associate professor of aerospace engineering at the Georgia Institute of Technology said, “Technology can have costs of its own. If you put more technology in the cockpit, you have more technology that can fail.” Going off of this, it is undoubtable that fully autonomous aircraft will be the most complex to date, and thus the possibility of system failure also increases.
The two biggest technical challenges associated with fully autonomous aircraft will be creating a system so robust that highly creative solutions can be achieved especially in what one might consider “high-stress” situations without the safety net of a human pilot. The second is ensuring that the autonomous systems are not vulnerable to external attacks. It is simply fact that a perfectly robust automation system cannot be built. However, complex algorithms which utilize artificial intelligence can be developed to create an automation system that will perform better than a human in almost all circumstances. As seen in many of the examples listed above, if a sensor were to fail, the automation would need to understand what sensor readings are incorrect and still fly the plane safely. But perhaps most importantly, in the case of a major system failure, would the automation be able to develop a creative solution quickly? Using U.S. Airways flight 1549 as an example, for fully automated human commercial transport class to be accepted, the automation will need to be able to devise a solution as creative as the one devised by Captain Sullenberger. As a quick refresh, U.S. Airways flight 1549 was a scheduled domestic flight flown by an Airbus A320. During the aircraft’s initial climb, the aircraft struck a flock of geese, shutting down both of its engines. Unable to reach any airport, captain Sullenberger and first officer Jeffrey Skiles proceeded to land the aircraft in the Hudson River.
Technologically, it is still unknown whether an automation system could be sophisticated enough for this type of creative solution development. The optimization problem that would need to be solved would be extremely complex, and the automation system would need to place human life as the optimization variable of highest priority. Anything else would not be trusted by the flying audience. So what are the prospects of fully autonomous human transport class aviation becoming a reality? Technologically speaking, autonomous aviation is already a reality. Complex autonomous drones have been flying for decades already, and that technology is only going to improve from here on out. Commercial aviation itself is also highly automated: “In a recent survey of airline pilots, those operating Boeing 777s reported that they spent just seven minutes manually piloting their planes in a typical flight. Pilots operating Airbus planes spent half that time.” [8]
Alongside the technological requirements of autonomous flight, the social stigma behind autonomous flying would also need to change. Flying is already among the most feared activities in the world. Flying in an aircraft controlled by a machine would surely top that list. One notable psychological effect of human-controlled aircraft that comforts passengers is that the pilot’s own life is at stake so it is in his or her best interest to fly the plane as safely as possible. When a machine is controlling the aircraft, it is hard to develop the same understanding and empathy of whether or not the autonomous system truly understands the importance of flying as safely as possible. An interesting prospect to consider is the effect that autonomous vehicles will have on the autonomous transport class aviation industry.
Perhaps, it’s less about how comfortable people are with self-flying aircraft, but more about people being uncomfortable with any self-controlled machine. It very well could be possible that once the general population becomes comfortable with self- driving cars, self-flying planes will be complete normalcy. Over the years, automation has played an extremely integral role in the commercial transport class of aviation. While there are obvious benefits and detriments to the increased automation experienced in the industry, automation is the biggest contributor to the significantly decreased number of accidents in recent times. Automation will continue to play a role of ever-increasing importance. It’s not a matter of if, but a matter of when all of commercial aviation becomes automated. But, before that time comes, the technological and human factors related byproducts of such automation will need to be carefully studied. Only then will commercial aviation be able to sustain fully autonomous flight.
