Pilotless Planes

That dream is a lot closer to reality than you might think, with companies like Diamond Aircraft and Aurora Flight Sciences having already demonstrated fully autonomous flight in small general aviation aircraft. Other industry leaders, including heavyweights like Airbus Group, have announced initiatives to debut in the next few years (though the world still waits for news of technology to allow an aircraft to fold up into a briefcase at its destination à la the popular 1960s cartoon The Jetsons, which was set in a futuristic world in which cars were replaced by highly automated aircraft).

There is also the nightmare: You're trapped in an aircraft as the avionics become overwhelmed with some situation they were never programmed to manage. No pilot, no controls, no one to call for help.

We've read the first nightmare reports from this future, too, with news earlier this year of a Tesla driver killed when the vehicle's sensors failed to recognize the bright, white side of a big-rig trailer turning ahead of it against a bright, white sky. The Tesla Autopilot feature required its driver, Joshua Brown of Florida, to be alert and ready to take over at anytime. But can you blame him completely for becoming complacent with a system that had previously racked up 130 million miles of service across the Tesla fleet without a fatality?

So, which future does aviation face, and how do we get there? Is it possible that pilots have come to the end of their usefulness, or will our robotic pilots always need a human Second-in-Command?

According to some, the technical argument already has been won. The results are in, and we pilots officially are obsolete.

"Most flights are flown 98 or 99 percent by the autopilot," says Stephen Rice, an associate professor of Human Factors at Embry-Riddle Aeronautical University. "A study showed that Boeing and Airbus pilots only manually flew the plane for three to six minutes per flight."

With fly-by-wire systems, in which commands are relayed via computer to flight-control surfaces and engines, there's an increasingly sophisticated digital backbone even in general aviation aircraft. The avionics even on a new single-engine plane can fly an approach down to minimums. And, sorry to break it to you, but the electronics will fly the approach better than you can.

Sure, the plane still needs you pushing buttons and telling it what to do, but the execution is wired now. Literally. And, even the button-pushing can be outsourced.

At Aurora Flight Sciences, the commands for its Centaur Optionally Piloted Aircraft can come from the ground. The company has modified a twin-engine Diamond DA42 for three modes of flight with varying automation.

In the first, the plane is flown by a human. Nothing innovative there.

In the second mode, the Centaur becomes an unmanned drone flown by a remote pilot pushing those avionics buttons from the ground.

In the third, the remote pilot flies the plane with an onboard safety pilot for see-and-avoid awareness, enabling passenger operations.

This isn't an experiment. It's a full-fledged commercial product, though one with limited current applicability. At present, the Swiss Defense Department is using Centaur. Here in the United States, regulatory hurdles currently make the plane difficult, if not impossible, to sell and operate.

"The end goal and the vision of our CEO was to create an air taxi where you come out to [company headquarters in] Manassas, Virginia, and you push the button and it just takes you to Boston," says Jeff Harlan, Aurora's program director for the Centaur. The aircraft "will essentially do that today, but there are a lot of hurdles to get through. If you were just going from Point A to Point B, it would do that. But once you get up in the airspace and air traffic control starts telling you to do different maneuvers, someone has to be involved."

Eventually, there will be methods for an air traffic controller to insert commands directly into the avionics. That's a detail, Harlan says, "But it's all doable." He's right. Controller to pilot datalink channels have been in use with commercial and corporate aircraft for years already.

Aurora's results are matched by Diamond Aircraft itself, which has demonstrated an auto-land feature called eSafe that's intended as a future safety device. Say the pilot becomes incapacitated. Engage the auto land, and the plane finds the nearest suitable runway and lands. The automation includes the intelligence to route around weather, deploy flaps and gear, and manage auto throttles and brakes. For the approach, it uses a GPS system enhanced with radar and laser altimeters. The Diamond DA42 test aircraft has also flown takeoffs and auto-cruise at the company's Wiener Neustadt headquarters in Austria.

Diamond's research partner, Stuttgart, Germany-based Aviotech, also plans a so-called Easily Piloted Vehicle (EPV) to go along with the current testing on optionally piloted, unmanned and remote-pilot aircraft. The EPV will strengthen the already available flight envelope protection tools that prevent pilots from overbanking in turns, reducing airspeed to a stall or increasing speed beyond the plane's design limits. In addition, the aircraft will have route envelope protection to protect against controlled flight into terrain, airspace violations, traffic and routing that exceeds fuel onboard.

"This enables less trained pilots to safely fly under instrument rules and in nearly all weather conditions," Aviotech CEO Steffen Hesse said in a written statement to Plane & Pilot. Beginning around 2025, Aviotech sees technical and regulatory readiness for the EPV: "Aircraft of this class will be under automatic control during all phases of flight, including automatic takeoff and landing capability," Hesse writes.

Then, there are a host of concept programs, most notably the Vahana project recently announced by Airbus Group's A³ division, based in California's Silicon Valley. In a recent blog post, project executive Rodin Lyasoff wrote about the company's Vahana air taxi, which has been in development since February.

Vahana would be a completely pilotless vertical takeoff and landing cargo and private passenger aircraft.

"Many of the technologies needed, such as batteries, motors and avionics, are most of the way there," wrote Lyasoff. Airbus sees such aircraft as potential solutions for highly urbanized megacities such as Mumbai, Tokyo or Sao Paulo. Think of the Star Wars scenes of the aerial highways over the city-planet of Coruscant and you get the idea.

Of course, the military already has been flying drones safely for years now, though it doesn't have to follow FAA certification or operations rules. In 2013, more than 11,000 drones were flying U.S. military missions, a figure that represents more than half the total of the world's commercial airliners, according to Boeing.

"The Global Hawk, if I'm not mistaken, I don't think has ever crashed," says Embry-Riddle's Rice. A drone is different than a passenger plane by size, payload, power plant and mission. Still, he says, "we know that it can be done, the pilotless plane."

So, if the technical problems are largely solved, can we have our Jetsons air-pods, please? Not so fast: It turns out the human factors and societal considerations are much harder problems.

Those factors are what have led National Transportation Safety Board Chairman Christopher Hart to dismiss the idea of truly pilotless planes. In a speech this summer at the National Press Club in Washington, D.C., Hart argued that human pilots will always be an essential check on automated systems.

"A highly trained, proficient human operator can save the day by being the most adaptive part of the system," he said. His poster boy for that argument: Chesley "Sully" Sullenberger, who successfully landed a US Airways Airbus A320 on the Hudson River in 2009 after losing both engines to a catastrophic bird strike. No lives were lost.

Could an autopilot have made that landing? Possibly. In fact, there's evidence that the A320's automated envelope protection kept Sully from stalling the plane as he neared the water at super-slow speeds and a high angle of attack.

The more interesting question is: Would an automated system have made the same decision to even try a water landing?

"Sullenberger landed in the river because he didn't want to tear up the roads and buildings and kill a bunch of people on the ground," says Rice. "What sort of morality is the autopilot going to be programmed with? Is it going to save the 200 people onboard at the expense of 400 on the ground? Is it going to take the most utilitarian approach where it just counts up the most lives saved? The autopilot can handle those decisions. The thing I worry about is, who is programming it?"

The other counterpoint to the notion that only a "Sully" onboard can prevent accidents is the list of tragedies that an autonomous or remote-pilot system could have prevented. In 2015, a Germanwings pilot locked his co-pilot out of the cockpit and proceeded to dive Flight 9525 into the ground, killing all aboard. The crash developed in slow motion, taking nearly 10 minutes to descend from an initial cruising altitude of 38,000 feet to impact. It would have taken only a few moments for a remote co-pilot or an autonomous system to assess the situation and intervene.

Here's where this discussion turns decidedly philosophical. Statistically speaking, there's no doubt that when automation and artificial intelligence are employed, the technologies save more lives than they cost. A full 94 percent of automobile accidents in 2015 were due to driver error, according to National Highway Traffic Safety Administration analysis. Aviation studies vary by source, but generally find that human error causes between 40 and 70 percent of aviation accidents.

Still, people seem to feel better with Sully at the controls, as opposed to HAL. Part of the problem comes from unrealistic expectations we humans have of automated systems. Remember that Tesla Autopilot statistic? More than 130 million miles without a fatality for a system released as a beta, or experimental, feature. That compares favorably to fatal manned automobile crashes that occur on average every 93 million miles, according to Insurance Institute for Highway Safety statistics---and the system will only get better over time. In fact, Tesla CEO Elon Musk just announced that the latest upgrade to the Tesla Autopilot would prevent crashes like the one that claimed Joshua Brown's life by recognizing the hard-to-see truck and stopping the car in time to avoid the crash.

Still, there's something vivid and horrible about the computer hurtling you, helpless, toward the side of that tractor trailer. It seems qualitatively worse than a driver trying valiantly to steer around the hazard, despite the millions of miles of better outcomes.

Our imaginative minds apply the same screwy logic to the skies.

"No one is claiming that autopilots are going to be perfectly safe," says Rice. "All they're claiming is that they're going to be on average safer." Shouldn't we accept that?

Perhaps because of this human desire for control, autonomous vehicle advocates have been locked in a debate about just how much control we pilots can be trusted to maintain. On the ground, the battle is between vehicles like the Tesla, which require a human ready to assume control at any moment, and those that Google is developing, which have no controls at all---no steering wheel, no gas and---gulp---no brakes. Just trust us.

Craig Smith, Research Director for Transportation Security at the security firm Rapid7, says the latter approach is worth the gamble.

"I've been leaning towards the Google side of things," he says. With human-assisted systems, it's easy for the vehicle maker to default responsibility to the driver. "As the manufacturer, you're washing your hands of liability. But once the driver has been in a self-driving car for months, they're not going to pay attention. If you take that away so that the company has to build it to be as safe as possible, they take ownership of what happens."

Aviotech's Steffen Hesse agrees: His Easily Piloted Vehicle concept "implies a paradigm change. The flight control system is the last authority, not the pilot," he says. "Pilots don't need to be involved all the time, as the aircraft is in control and monitoring all the time."

If that means no more bragging to your non-pilot friends about those butter landings, so be it. It's going to be a long, incremental process to get there, so your ego will have plenty of time to adjust. The immediate next generation of automation is much more likely to look like a Centaur or a Diamond with auto-land than The Jetsons space cars. That's in part due to regulation---that 20-or-so-year cycle needed to change rules and certifications.

For instance, Aurora's Harlan points out that there's currently no available sensor technology to replicate the sense-and-avoid sophistication of a safety pilot.

The ground-based remote co-pilot system that Rice envisions raises a whole new set of questions. For commercial and business aviation, how many flights might the remote co-pilot handle at once? Airline economics and pilot shortages suggest an opportunity to have the remote co-pilot check in on multiple flights, like a call center operator. Could a competent remote pilot handle 10 flights at once? A hundred? At what point does the pilot aloft start hearing hold music and a message that "We are currently experiencing higher than normal volume. Please hold, as your flight is extremely important to us"?

There's also the question of engagement. "How do we translate situational awareness to the guys on the ground?" Rice asks. "Say they're responsible for 100 flights at a given time. If something happens to flight number 87, they have to figure out what happened, then jump in, fix the problem and keep the plane from crashing. It's going to be tough because it takes a special kind of person to monitor all that information and yet be able to focus in on a single point at the time needed. I'm not sure we have the answer for how to do that."

And, there's a lost sense of crew. When airliners went from a three-member cockpit to two in the 1970s, the change to human dynamics was minimal. While it hasn't happened in commercial flying yet, if it were to come to pass, the change of going from two crewmembers to one would mean the pilot would be locked in a cockpit, isolated for hours at a time. Sort of like your average Cessna driver, but with 200 souls onboard.

Lastly, as aircraft gain the ability to be directed remotely, they also gain hacking vulnerabilities. At the highest level, we'll need tight security around air traffic control or remote pilot facilities.

In addition, Smith points out, even innocuous systems can be used to gain access to flight control once everything is digitized and networked. Take the example of cars again: "If you're pressing a [computerized assistance button like in the OnStar system] so you can unlock your car, a hacker can do the same." Once inside the vehicle's computer systems, the hacker could theoretically start the car. They could steer the car. "They don't have to use the functionality the way it was intended," he says.

In 2015, hacker Chris Roberts made the controversial claim that he had used exactly that kind of "network pivot" method to gain access to the avionics on a United Airlines flight. He broke into the plane's in-flight entertainment system and said he was able to use the connection that network had with the plane's moving map data as a digital pathway to the flight controls. This kind of pivot is a common hacker's trick. Though United and the electronics makers dispute the exploit, the idea at least remains feasible.

Even if all the aircraft's local systems are secured, there's still a dangerous dependency on external data if pilots are reduced and eventually eliminated. In 2012, researcher Andre Costin demonstrated the ability to alter the Automatic Dependent Surveillance-Broadcast (ADS-B) data that all U.S. aircraft will adopt for location reporting and traffic avoidance by 2020. Costin showed at a Black Hat USA conference that it's possible to delete aircraft from the system, as well as add false or ghost aircraft signals.

It's bad enough for a pilot to consider landing on a runway where an unreported plane sits. But, what if there's no pilot at all to recognize the ADS-B database error?

"You're trusting everyone to play nicely, to play by the rules," says transportation security expert Smith. "If you're acting on that data, it could cause a serious problem."

With all of these issues to be worked out, it's clear even developed technologies like the Centaur won't see their full, autonomous potential for a while, or a couple of FAA-regulatory-cycle whiles.

In the meantime, expect small, incremental progress. Who would have thought we would have drones operating in the national airspace system today. Amazon and Google are currently testing small unmanned aircraft for package delivery. And, cargo operators have taken the first interest in developing remote co-pilot capabilities. That makes sense, because packages don't have the same irrational fear of automation that passengers do. If systems can be developed and tested in these lower-stakes environments, that can clear the way for more ambitious autonomous passenger aircraft.

Says Aviotech's Hesse: "Acceptance will gradually rise with Optionally Piloted Vehicle operations for special purposes, like aerial surveillance in the first place and more generally unmanned operations in civil airspace becoming more common in parallel to that."

While the timeline for full autonomy aloft may be 50 years, Rice says, "I would be shocked if this doesn't happen, because everything is driving it---the economics, the manufacturers and the consumers. Once they realize it's going to be safer in the long run, they're going to want it."

So don't throw away your pilot certificate just yet. It's worth noting that even George Jetson's space car in that far-off future still had a control stick.

A commercial pilot with instrument privileges, Grant Opperman is a writer and business strategy consultant who flies himself to more than 20 states across the U.S. for business and pleasure.