It was one of those cool fall mornings that made me glad I was on a 6 a.m. flight out of our bucolic little valley. First flights in the morning are rarely delayed or canceled, and a cornucopia of news awaited at the NBAA-BACE convention in Vegas. Since I was only going for a couple of days, any airline turbulence would cut into it significantly.
One thing was sure. There would be no actual turbulence during the total of about three hours we’d be airborne (with a stop in Seattle). A massive high had settled over the northern Pacific, and the air was absolutely still over thousands of square miles.
That, of course, was the perfect setup for fog, and I wonder if there was some fudging of the numbers for the takeoff clearance. Regardless, we were soon climbing through thick soup and didn’t top out into the flawless bright blue until about 1,500 AGL. The view of the Cascades in a bed of mashed potatoes never gets old, but it was soon time to sink into the gloom for the approach. As the Dash-8 slipped through the sharp boundary of bright and grey, my elderly seatmate got visibly uncomfortable.
“How can the pilot see?” she asked of no one in particular, so of course I answered. “Oh, the pilot isn’t flying,” I enthused like all good know-it-alls do. I could see her blanch under the veneer of carefully applied makeup, and her eyes widened. I hastened to add that a computer was in charge and it was doing a much better job of getting us to SeaTac than any mere mortal. I was pretty sure the old Bombardier turboprop wasn’t set up for a CAT IIIC approach so I assured her that as soon as the pilot could see the ground he or she would be taking over. I told her she would know when that happened because the ride would get perceptibly rougher.
Sure enough, the morning rush on I-5 appeared and there was a slight change in attitude on all axes as the autopilot relinquished control to human hands. Anything but a greaser would have been a surprise, and we touched softly abeam the vertical wind sock. I’m not sure I soothed my seatmate, but I was satisfied with my cameo performance as aviation expert. It was going to be a good day.
When I think back to my explanation, I’m not sure I left the correct impression, though. I think she left the cramped confines of the Dash believing that pilots were along for the ride and not really necessary. Now I’m wondering if the remarkable events of Dec. 20 at Rocky Mountain Metropolitan Airport fed that narrative just a little.
When I came across the account of the first Garmin Autoland activation in a Facebook group that tracks 7700 squawks on ADS-B sites (I know, I should try getting a real life) I knew it was going to be big in the aviation world. But I guess given the high profile aviation has gained (I hesitate to say “earned”) in the mainstream media for runway incursions, ATC issues, and the tragic collision in Washington last January, I shouldn’t have been surprised that it took off like wildfire across all the networks and news organizations. We were proud to have played a small role in ensuring that the network news folks got the story straight on what Autoland can do and, perhaps as important, what it can’t do.
We did so while we still had some questions of our own because, as things often go, the circumstances weren’t straightforward. It was like pulling teeth getting information out of anyone directly involved in the incident when we expected a more, uh, celebratory response. Eventually, most of the story dribbled out in the form of terse, noncommittal statements, and by midweek we had most of the bare essentials of what happened in that 36-minute repositioning flight from Aspen to Rocky Mountain.
But there was still a gaping hole in that we hadn’t heard from the pilots, who were the only ones to directly witness the marvelous technology in action. They are also the only ones who can explain why they elected to allow the system to do its thing even though they did not appear to be “incapacitated” in any way. I’m pretty sure it’s not a scenario among the hundreds or thousands that were simulated before Autoland was certified and installed on hundreds of airframes (and counting).
And it raises some pretty big questions as automation advances in both competence and acceptance in some corners of aviation. The Air Force is turning four-engine tankers into refueling drones, and uncrewed fighters are mixing it up with human Top Guns to see who’s better.
Autonomous Cessna Caravans routinely share airspace with crewed traffic as the companies behind their development build toward commercial deployment of aircraft designed for human-controlled flight that will operate unoccupied.
And it’s just assumed that the eVTOLS that are predicted by some to fill the skies whisking commuters over the clogged streets below will have a chip at the controls.
That’s not to mention the furious debate over single-pilot operations in airliners with autonomy, augmented by remote control from the ground, serving as a backup. Let’s not forget how artificial intelligence could be employed in all these scenarios.
Somehow, however, I think we all believe that these marvels of technology still operate under our control and do our bidding. What’s uncomfortable about the Autoland incident is that even though the pilots were right there, they were passengers by choice and the system couldn’t have cared less whether they were there. We know that thanks to a chance encounter by our good friend and fellow aviation journalist Max Trescott and his prescience in packing a digital voice recorder in his backpack.
As we report in today’s AvBrief newsletter, Trescott happened to be flying in Colorado at the time and monitoring the Guard frequency. He heard the whole exchange and recorded much of it after hurriedly pulling the recorder from his bag. In doing so, he gave us a little more insight into the event and how it played out.
What that 30 seconds of audio clips revealed is that while it was engaged, Autoland was firmly in charge. In fact, at one point, the system actually put up a small roadblock to the pilots actually taking a role in the process when, as designed, it locked the radios on the Guard frequency. It was a point of confusion for the pilots that was cleared up by another pilot who was monitoring 121.5. “It’s not going to let you switch unless you cancel the Autoland,” said the other pilot. The system is designed to send out a posit report every five minutes until it gets to the destination airport environment, when it also starts broadcasting on the CTAF frequency.
The choice of language is interesting. “Not going to let you switch” implies a surrendering of control that I’m not sure was envisioned in the thousands of hours that went into developing the system. While it’s far from “Open the pod bay doors, Hal” it did present the pilots with a choice. They could either be active participants in the resolution of their predicament by stopping or interrupting Autoland to get on the regular frequency or they could monitor the process and intervene only if things went sideways.
The news was obviously relayed to the unflappable tower/ground controller at Rocky Mountain Metro, and he started cleaning up the airspace and getting things organized on the ground. The airport belonged to Garmin Autoland when the King Air and its two occupants executed a perfect approach and landing. In one of the videos I saw, the props were still turning when the two pilots left the plane, presumably leaving the final act of securing the aircraft to the box in the avionics bay.
The pilots’ choice to ride it out is already being hotly debated, and the discussion is pretty evenly divided between those who think the Autoland should have been turned off as soon as the humans had their oxygen masks on and those who think the system is another tool for pilots and there to be used, as designed, at their discretion. We still don’t know why the pilots made that choice, and I won’t be endorsing or second-guessing their call until all the investigations are complete. There’s more that we don’t know, I’m sure.
One thing is sure. That decision turned an interesting and perhaps slightly newsworthy footnote into a full-on debate on who is really in charge on the flight deck and whether that changed at 23,000 feet over the Rocky Mountains. People a lot smarter than me will be looking at all the technical, ethical, and even philosophical issues that have arisen out of a remarkable moment in aviation history.
I’m thinking my seatmate on that morning flight was, in her own way, weighing a few of those same issues as she carefully gripped the damp handrail to walk down the slippery roll-up stairs on the ramp at Seattle.
I’m wondering if it wasn’t just simple curiosity–“let’s see what it does”.
That was also my take, like when I let the lane keeping feature of my car do it’s thing. Not that I’m an incompetent driver (or they were bad pilots) but it’s interesting to watch it in action.
I buy that logic. Seen it in too many people regarding other tech options, “We paid Big Bucks for this do-dad; and by God, we are going to make sure it works.”
Who’s “in charge”? I’m more interested in what almost no one is talking about: the Autoland operational limits.
Garmin presents Emergency Autoland as something you use with a healthy airplane and a sick pilot: the engine is running, the autopilot and flight controls are working, and there’s a suitable RNAV (GPS) approach (LNAV +V, LNAV/VNAV, LP +V, or LPV) to a runway that’s long enough, with weather inside the system’s limits.
Take away the engine, the flight controls, the nav, or push it outside that weather envelope and Autoland is basically 0% useful. At that point you’re back to normal emergency procedures: “You have the airplane.”
https://support.garmin.com/en-US/?faq=eus2y4gUfC30w2YpdTlu09
On the question of who’s PIC, it’s pretty simple. With Autoland off, the pilot is PIC. With Autoland running in a powered emergency, the system is flying the profile, but the pilot is still PIC because they can cancel it at any time. If the pilot is truly incapacitated, they’re technically still PIC on the paperwork, but in practice Autoland and ATC are flying the airplane. Autoland never becomes PIC; it’s a tool the PIC can use, or not, inside a fairly narrow operational envelope.
Then there’s how often that envelope even applies. In the U.S. there are about 5,100 public airports, and 2,035 of them have the kind of LPV-class approaches Autoland wants. That’s roughly 40% of the public fields. If you look at roughly 19,500 airports and strips, public and private, those same 2,035 are only about 10% of the total.
I’m not knocking Autoland. Used in its lane, healthy airplane, incapacitated or overloaded pilot, day or night IMC, suitable approach available. it’s a strong tool, but with limitations.
You bring up an interesting point, Raf, about Autoland’s utility in a single engine aircraft. The other limitations you mention (avionics, weather, etc.) still apply, but a dead engine – if there is only one – brings a new wrinkle into the mix. So perhaps the question might be whether a ballistic parachute should be the “go to” for singles and have the Autoland restricted to those who have at least two powerplants.
John, I agree. In a single, if the engine dies, Autoland is out. For singles it’s two lanes: healthy airplane with a sick or overloaded pilot, use Autoland; engine or major system failure is glide or chute, not the button. Cirrus is the only one really stacking both on singles (Autoland + CAPS), and CAPS still has to be pulled by a well-briefed human.
Long term, more WAAS RNAV (GPS) with vertical guidance at more airports would at least give Autoland more usable runways when the airplane is still healthy.
Well written overview Russ. Nicely done!
As with all new stuff the manual is thin, this incident will add some lines of SW and pages on how to step back either partially or completely. Guessing at a minimum operator/ATC SOPs will be updated.
7700 squawk means they could have held at any point, sorted it out with ATC and then rejoined appropriate IMC procedures once no longer in extremis.
My recent rental car experiences with newer cars and their SW nannies is that the use-cases are not complete for the real world…every nudge of the wheel to give vehicles parked on the shoulder safety space was met by the nanny turning right back at the parked vehicle. Every high tech “autonomous” vehicle has use case holes where they freeze…not always the safest response. AI is industry’s the magic solution, will need more convincing before hitting the I Believe button.
My favorite question for the future autonomous vehicles is who/what/how is it decided the planned flight is safe (weather and acft assessment)?
Let’s also not forget Murphy’s contribution, any time you really need the automation or comms backup, neither will be there, fine if the only loss is the vehicle, not so good if you’re sitting in 14A.
Has it been confirmed the depressurization event actually occurred?
I would give those pilots a little more credit than, “Hey, I wonder what this button does…”. More like, “We’ve got a legitimate safety-of-flight issue. This is as good a time as any to see what it really does.” The issue they had with communications is not one I would have anticipated, myself.
Having recently inherited a new Prius after a lifetime of driving stick-shift cars and trucks, I feel like a freshly-fledged student pilot. What I’m learning is pretty basic, and not always intuitive. If I walk up to the car with the key fob is in my pocket, the doors automatically unlock. But if I walk away with the fob in my pocket, I need to manually lock the doors? Clarke’s Third Law definitely applies here.
One wonders how much real-world flight experience the committee (you KNOW there was a committee) of software developers had in private aviation. In a real world emergency, “Aviate, Navigate, Communicate” have to be done simultaneously. And re-prioritized dynamically.
It appears that the committee wrote the specs for the easier problem of a catastrophic pilot-incapacitation event. They need to add an “I ain’t dead yet” button.
Ya forced me to look up ‘Clarke’s Third Law,’ Aviatrexx. I’m still roaring. Thanks.
(I’ll be using it on my wife when the TV remote confounds her now)
Looking at it this way, the two pilots involved were likely mesmerized by the fire they saw in the fireplace in the FBO, too.
SO far, we’ve added a “I ain’t dead YET” and “I believe” button. I’d add … “Are ya REALLY sure” button, too. Maybe AutoLand needs a lit control panel with various scenarios to pick from for the crew while leaving the “We’re all gonna die” button relabeled “For Passengers ONLY” in a conveniently accessible location while announcing over the cabin PA, “Sit down, shut up and hang on … I’ve got this now?
I want to hear from the pilots involved here; their silence is deafening. The ‘canned’ statement from Buffalo River Aviation is just that. It isn’t enough. I’m betting that their lawyers have advised them to make a bland statement and then be quiet? A public Q & A session would go a long way toward answering a lot of unanswered questions. If the airplane was ‘healthy’ and the pilots were ‘healthy’ … why the heck did they allow AutoLand to continue to command that airplane to include letting it go into full autoland to a landing … interested parties would like to know.
As pilots, we learn to make decisions — good and proper decisions — at every turn. It’s what separates us from land-based mortals. Lives inside and OUTSIDE the airplane are at stake. As I see it, these two didn’t do that here. Of course, they might say that a side window blew out and the noise and wind were so deafening that they chose to let the airplane do its thing. Case closed; correct decision. I think it wasn’t anywhere near that and that’s why they’re being mum.
Beyond that, Raf brings up some salient points. Maybe — just maybe — this first real world use of the system will bring changes to the AutoLand system software, placards and displays and crew training requirements as well as at least a SAIB — if not additional FAR — from the boys on Independence Ave.
The crew had a legitimate situation for using the AutoLand system, but also one from which they could easily recover or take over if they did not like the results. Perfect for gaining real world experience with this new technology. Not surprising at all that they rode it out to gain confidence in the automation and analyze for themselves its possible limitations.
Disagree – two healthy pilots in a healthy airplane declare an emergency that moves everyone else out of the way so they can get on the ground safely when all they had to do was fly the plane. They need to find another vocation.
Whose in charge? If someone, in this case one of the two pilots, pushed the Autoland button…Autoland is. If the pilot’s in this case, want to resume command, Autoland is completely dis-engaged, and they resume the complete command of the airplane. Completely either/or. I am not sure if this kind of scenario was considered by Garmin and the FAA during testing and certification. ATC hears from Autoland, “pilot incapacitation”. It appears there was no other way to contact ATC to clarify the nature of the emergency without disabling Autoland completely. The debate seems to be how the pilots on board should have/could have/if I was there… debate in this either/or situation. New, uncharted territory for the pilots on board this King Air, Garmin, ATC, and the FAA. Now is not the time for the blame game. Since, the entire system of ATC, the pilots on board, other traffic, first responders, and Autoland all performed well enough that no one got hurt, let’s be happy first with the outcome, secondly have an intelligent debrief with all parties, and third amend procedures as needed. However, so many folks want, seem to need participating in the blame game extracting guilt first followed with sentence and payment from the guilty as the pathway to an amendment for a potential solution for an event no one saw coming. While we blame the FAA as an agency that is happy only when making us unhappy, we seem to have absorbed the same tendencies when dissecting other pilots decision making. We were not in the King Air cockpit. Since the outcome was excellent, maybe, just maybe the crews decision making … ADM… was indeed good in this airplane, under those conditions, at that time.
The irony in this first use of Autoland in the wild, resulting in NO injuries, NO damage to the airplane, NO pilot FAR violations, as far as the FAA is concerned, there is NO accident or incident, therefore nothing to officially investigate. This could end up that nothing at all happens.
If this King Air scattered itself after Autoland engagement over an urban area to Colorado killing the crew and people on the ground, then you got a reason for a massive investigation, political posturing, demands for new FAR’s, and liability litigation against Pratt and Whitney, Textron Beech, Garmin… veritable field day for the lawyers, politicians, and a huge vent for the should have, could have, and I would have crowd.
Since there is “nothing to see here”… a golden opportunity for a rational debrief and discussion resulting in rational amendments of procedures could be lost.
Well, kinda. Except for the fact when Garmin Autoland was engaged, it transmitted an in-flight emergency. IFEs are occurrences that are always reported to a FSDO and investigated.