Multi-pilot advocate
By Paul Marks|July/August 2023
Richard Champion de Crespigny
Former Qantas Captain Richard Champion de Crespigny doesn’t believe the safe landing of his heavily damaged A380 airliner with 469 aboard in 2010 could have been accomplished with automation instead of the assistance of his four-person flight crew. That’s one reason he opposes ongoing research into reducing the number of pilots aboard passenger airliners. Since 2022, the European Union Aviation Safety Agency and the International Civil Aviation Organization have been studying Extended Minimum Crew Operations, in which two pilots do the takeoff and landing but only one would be at the controls for the cruise phase. EASA originally proposed beginning eMCO in certain airliners in 2025 “as a prelude” to end-to-end Single Pilot Operations (SiPO) beginning in the 2030s, but now says those dates are “unrealistic” and there is “no firm timeline” for either concept. Also, it is now studying SiPO for cargo freighters instead of passenger airliners. I spoke with de Crespigny in April and May. Here are our video conversations, condensed and lightly edited.
Q: What was your reaction when you first heard that this idea of having a lone pilot at the controls of passenger airliners and cargo jets was being considered?
A: I was amazed that they were even considering it, because it flies in the face of every bit of knowledge and experience gathered over the last 119 years of aviation that have helped make it the safest form of transport. To decide what is required to make any single-pilot operations safe, they need to understand automation, computers, human factors, risk, responsibility, teamwork and trust. And also, how aircraft work. And the best people to ask about all that are the pilots that will be affected. I’m not aware that these organizations have been in cockpits, which have been locked since 9/11, to watch what pilots do. I think it’s been motivated simply by airlines that are pressuring the regulators to help shave costs.
The European Union Aviation Safety Agency has not been shy about referring to costs: “A foreseen reduction in operating costs” is among “the driving factors” for considering Extended Minimum Crew Operations and Single Pilot Operations, the agency said at the International Civil Aviation Organization’s 2022 assembly. EASA asked ICAO to study how to ensure that such a shift would result in an “equivalent or higher level of safety compared to that achieved in current operations.” — PM
Airlines that have budgeted to buy aircraft 10 years in advance haven’t budgeted to train or keep their air crews. So a lot of these airlines, coming out of covid-19, are short of air crew. I think this single-pilot idea is a quick tactical fix to solve airlines’ strategic failures.
Q: Aviation’s post-covid recovery is occurring now, so how can these concepts help when they would be introduced so far in the future? Could there be other drivers?
A: The commercial aviation industry is genuinely curious about the success of drones, which have single pilots, albeit remote ones. Drones are everywhere now, delivering everything from pharmaceuticals to pizzas and parcels. It’s a natural succession, then, given the success of the drone industry, that they’re curious as to how ultimately we’re going to accommodate drone technology in passenger airlines — and yet keep it safe.
Q: One of the premises of eMCO [Extended Minimum Crew Operations] is that one pilot could rest in the cabin or sleep in their bunk while the other is at the controls during cruise, which EASA calls a “less challenging” phase of flight. What do you make of that?
A: EASA is assuming that automation can somehow be as resilient as a second, sentient, human pilot capable of thought, awareness, consciousness and prediction. It’s just not the case: Examples abound where automation has been shown not to be at all resilient, and our experience on QF32 was a good example of that. So believing automation is good enough to support eMCO demonstrates ignorance, because automation will never be as resilient as a second pilot — at least, not until we have sentient computers with humanlike intelligence some decades from now.
Q: EASA is proposing that under eMCO, two pilots would be at the helm during system failures, but failures often happen with no notice. So how quickly can a resting pilot come back to full situational awareness to aid the single pilot?
A: When military pilots lose consciousness after experiencing high g-forces, it takes at least 30 seconds for them to come back and be aware of what’s going on. There’s also a thing called sleep inertia, so that when you wake up, it always takes you a while to get your senses back. But it can take up to 20 minutes to get your senses back in an aircraft. So for one eMCO pilot to have a two-hour break — the current eMCO thinking being that two pilots would rotate, two hours on, two hours off — but be called back from their bunk 20 minutes before it is over is ludicrous: Sleep inertia will be a major challenge if the pilot is required [back in the cockpit] quickly because of an emergency, as they will not be coming onboard as an immediately competent pilot. And also, if the automation then fails, you’ve got a single pilot working with the pilot with sleep inertia — so they’re on their own for a critical part of the emergency.
Q: This does not sound terribly encouraging. Do you think the idea behind eMCO has been well thought through?
A: Well, EASA initially said that under eMCO, the single pilot in the cockpit would be allowed to take a toilet break [leaving the automation in control]. Now they’re suggesting that’s not the case, so their thoughts are changing dynamically.
On its website, EASA says one of the topics to be explored under the studies is whether a single pilot could “temporarily leave their station” for “breaks due to physiological needs” while still “ensuring an acceptable level of safety and security.” — PM
Now they’re saying they see a pilot having to take a toilet break as being like a malfunction, or an incapacitation, of the pilot. Because now, they don’t ever want to have no pilots in the cockpit. This is how little they have thought about it, and this is how mobile the goal posts are.
Q: Regarding end-to-end Single Pilot Operations, EASA has shifted to studying the concept for freighters initially, as opposed to passenger airliners. Is end-to-end flight with one human aboard ever wise?
A: When you’re looking at Single Pilot Operations for freighters, then you assume that the automation will take over when the pilot becomes incapacitated. For freighter aircraft flying over the oceans, there’ll be no loss of life beyond the pilot because the aircraft can’t hit a building, say. So as they experiment, if we imagine that SiPO has the same threat in its probability of failure as eMCO, the difference in risk is the consequence — and the consequence for a SiPO freighter aircraft crashing over water is negligible if a pilot is willing to take that risk.
Q: After initially talking about the late 2020s for introducing eMCO and 2030 for Single Pilot Ops, EASA has done away with the timelines, saying planemakers must demonstrate safety equal to two-pilot operations first. Do you expect automation could entirely replace pilots at some point?
A: Yes. I accept that one day there will be pilotless passenger and commercial cargo aircraft flying — but they will have to have automation based on yet-to-be developed sentient computer systems that can manage it safely. So I don’t mind that ICAO and EASA are looking at these eMCO and SiPO schemes, if the automation will support it. They can research anything they like — but don’t put an implementation date on it when the technology to enable it does not yet exist. I think it could take 10 years to invent these sentient computers and another 10 years to get them into cockpits.
Q: What role did having two pilots in the cockpit play in achieving the safety levels the flying public has become accustomed to?
A: Aviation has transitioned from initially being the most dangerous to the safest transport system in the world.
One hundred fifty-eight people died in commercial aviation accidents worldwide in 2022, the International Air Transport Association reported in March. — PM
This remarkable improvement in resilience was achieved by the requirement to have two licensed, trained and competent pilots in the cockpit. A problem is that safety, particularly in America where there hasn’t been a commercial passenger aircraft crash since 2009, has led people into a false sense of security.
He’s referring to Colgan Air Flight 3407, in which a Bombardier Q400 approaching Buffalo-Niagara International Airport crashed into a nearby residence, killing all 48 aboard and one person on the ground. The U.S. National Transportation Safety Board concluded that pilots did not react to stall warnings and that their “performance was likely impaired because of fatigue.” — PM
This is the curse of success. People have normalized aviation’s incredible safety so much that they’ve stopped appreciating why it’s safe. I had hoped aviation’s safety agencies had evolved since the time when we measured safety by the lack of accidents, to identifying the reasons we have become safe, but this latest initiative suggests they don’t know what pilots do in the cockpit, so they don’t understand why aviation is safe.
Q: Just what has moved aviation so inexorably to ever safer operations over time, would you say?
A: The industry is moving toward what’s called the Safety-II perspective, where we look at the reasons for success to ensure as many things as possible go right, rather than simply ensuring as few things as possible go wrong, as in the past. And if we look at the reasons for success in aviation, there are so many: Modern aircraft are much safer, and terrain and traffic warning systems and fly-by wire-technologies have improved safety. But recent gains in safety have come from the adoption of the field of human factors after the Tenerife airport disaster in March 1977.
This collision of two Boeing 747s at an airport in the Canary Islands remains the deadliest in aviation history. A 747 operated by KLM began taking off on a runway in dense fog and crashed into a PamAm 747 taxiing at the opposite end of the runway, killing 583. The disaster prompted changes in cockpit and radio communication procedures, including more team-based decision making by crews. — PM
With human factors in aviation, we’ve learned how humans are built, what they can do, how they respond and how we can build machines to interface to them. And we’ve had great success with that over the years, and it’s not something to be taken for granted because it’s not done in many industries. The fact that we’re safer has given people a false sense of security, one in which they think they can tamper with things that have made aviation safe.
Q: Are advocates of Single Pilot Operations considering how to progress the idea in a safe and proper way?
A: Firstly, isn’t it ironic that the people at ICAO and EASA — who decided they need to work in teams in safe environments on the ground — are deciding on behalf of pilots to take away their team support in high-risk environments in the air? This is arrogance at the highest level. The people pushing single-pilot commercial aircraft don’t know what goes on in the cockpit. They don’t know what they don’t know. Secondly, discussions about Single Pilot Operations must focus on threats, risks and resilience, as technology and security are enemies of each other: One tries to make things happen; the other tries to stop it. Our current technologies are incapable of replacing humans in the cockpit. We need to look no further than Tesla’s autopilot, or cybersecurity failures, to realize that computer systems are brittle. Single-pilot operation breaks the fundamental rule in aviation that every critical system must be replicated for resilience so that there is never a single point of failure. Every critical aircraft system, including the pilots, are duplicated — if not triplicated. That’s why we’re safe. So why are we thinking of breaking that, coming to a single point of failure, with that most critical thing of all: the pilot?
Q: What is it about automation that prevents it from being a human pilot’s backup?
A: The key here is that humans are sentient beings. Sentience combines thought, awareness, consciousness and prediction. Sentient computers will be made one day, but they are decades away. Scientists still cannot agree about the definition of consciousness, so coding it up in a computer is a long time away. Large language models like GPT-4 are not sentient.
Q: So in your view, it’s safer to have a human crew of at least two pilots, discussing the pros and cons regarding the wisest courses of action in a crisis?
A: If you have a fully functional crew, then you can work your way through the issues, yes. But imagine you only have software in control, and you have an automation disaster like the Qantas flight QF72, which was a failure of the flight control computer software in an A330 in stable flight over the Indian Ocean in 2008. Just one faulty computer introduced 42 incorrect stall warnings that commanded many uncontrollable nose-down maneuvers that injured over a hundred passengers. Or our flight, QF32, where 650 wires were cut, affecting 21 of the 22 systems and destroying half our networks. We lost system redundancy and system resilience. Within the fog of these disasters, the only things that got QF72 and QF32 passengers safely to Earth were their crews of many pilots.
Q: Tell me about QF32. It’s 10 a.m. local time on Nov. 4, 2010, and you’re the captain flying 469 people out of Singapore on an Airbus A380 at 7,000 feet. You have a first officer, a second officer and, unusually, two check captains on the flight deck too. What happened?
A: There were two loud, shuddering booms — a second apart — as the intermediate pressure turbine disc in engine No. 2 exploded into three pieces. Those large pieces in turn energized thousands of supersonic bits of shrapnel into a “cluster bomb” that punctured the wing and fuel tanks in around 15 places, causing 400 impacts on the fuselage and severing 650 wires used for critical systems like the flaps, slats and ailerons. It destroyed half of our computer networks. And our hydraulics went down from eight pumps to two. None of the engines were working normally, either: Engine 2 exploded, the other three degraded down either one or two levels of redundancy but still produced sufficient thrust.
Q: Imagine that QF32 had been a single-pilot operation and the pilot was suddenly incapacitated: How would automation alone have fared at guiding the airliner to a safe landing?
A: We’re dead.
Q: Why are you so sure?
A: In the Apollo 13 accident, NASA told Jim Lovell what to do to get back on the ground and how the crew were going to do it, and they did that by creating new checklists in the simulator.
After one of the command and service module’s oxygen tanks exploded, mission controllers instructed Lovell, Jim Swigert and Fred Haise to turn their lunar lander into a lifeboat to conserve fuel and electricity in the damaged module. — PM
On QF32, we had no NASA-type support. When David Evans, one of the check captains flying with us, punched into the Airbus laptop computer the failures from 12 different ECAM [Electronic Centralized Aircraft Monitor] checklists to see how we could land, the computer displayed that there was no solution — we couldn’t land. Even when David reentered different data that eventually gave us 139 meters of runway margin, independent aircraft warning systems shouted “speed” and “stall” warnings during our approach that proved this second set of speeds and calculations were wrong.
Q: Not what you want to hear with 469 adults and children aboard a double-decker superjumbo out over the ocean.
A: Right. But this was not a normal situation. So many sensors had been broken that the aircraft didn’t know shrapnel had cut all wires to the left-side wing brakes. And it could not detect or mitigate multiple holes in the wing that damaged its ability to provide lift. But despite these warnings, I persisted with the approach because we did control checks that proved the aircraft safe — even though we had only a 3-knot margin between stalling or overrunning the runway. Control checks were not written in any airline or Airbus manuals, but we did them because, unlike ECAM [the software that tracks performance], we humans were aware of the wing damage and predicted there could be problems.
Q: You’ve written in your books that you and your crew were bombarded with a blizzard of erroneous computer messages. What kind of flawed advice were the computers giving?
A: We had many extensive fuel leaks, and because there are not enough sensors in the fuel system to tell us what was wrong and incorrect ECAM logic, ECAM told us to transfer fuel from the good wing into the leaking wing — and that would have spoiled our day. We refused to do those checklists. We also received incorrect warnings about hydraulics and brakes. Dr. Thomas Enders, the chief executive of Airbus at the time, later wrote to me apologizing for the faulty ECAM logic.
Q: Switching gears: Has your experience running a software company helped you as a pilot as cockpits became increasingly computerized?
A: Absolutely, because aircraft are full of black boxes. And if you can understand the logic of how they’re meant to work, if you understand computing, you can understand the way they approach the subject.
Q: In closing, what’s your message to those pushing for Single Pilot Operations, whether it is by 2030 or later?
A: Think again. It’s fine to do disruptive research, but it’s naive to publish implementation dates. You need to talk to the pilots because unless you’re a pilot sitting in the cockpit when things go wrong, seeing and feeling the things that do go wrong — and they go wrong all the time — you have no idea what the pilots do and why they need as much support from their team in the air as the single pilot operations researchers get from their teams on the ground. You should not degrade safe systems if you don’t understand why they are safe. Single Pilot Operations with today’s technologies are not just wrong, they are dead wrong, and no safety authority, manufacturer, airline, pilot or passenger should support it.
