Emergency Autoland puts Garmin on the bleeding edge of autonomous flying

Had this been a real emergency, and not a demonstration for The Air Current, the aircraft would have shut its engine down after coming to a stop on the runway. Also upon activation, EA would also have tuned its transponder to 7700, alerting the ground to an emergency and a digitized voice would broadcast to the nearest enroute controllers, towers or common traffic channels and on 121.5, the universal emergency frequency, on the second radio. EA does everything — even estimate and set the altimeter for the landing field elevation within a hundredth of an inch of mercury — except route around traffic, which it assumes will be done by controllers clearing the way for an emergency situation.

Aviation automation has largely, until now, been designed with a pilot in ‘the loop’ and there as a monitoring backstop, should something go wrong. In a few instances, aircraft have been programmed to take over for a brief period to fly away from danger. Garmin has spent nearly a decade designing this fully-autonomous landing system assuming that something already has — specifically if the aviator at the controls of this single-pilot airplane has become incapacitated. Rather than teach a passenger to land in a crisis or watch helplessly as an aircraft runs out of fuel and crashes, Garmin built a safety system it hopes will never need to be used.

EA is remarkable in its simplicity. Letting the aircraft make decisions and fly itself feels completely, well, unremarkable. “We have an airplane, we know where it is. We have airports, we know where they are. Find them, connect the dots. Go,” said Bailey Scheel, EA’s project manager and a senior aviation systems engineer for Garmin. Now in its late phases of being certified by the Federal Aviation Administration for use first on the M600 and Cirrus’s SF50 Vision Jet, Garmin has created something with the power to change aviation forever.

Garmin is understandably reluctant to acknowledge that they’ve established a system that has, by design, removed pilots from flying and making decisions. The contrast between Garmin — which spends about $200 million on research and development each year — and the spate of Silicon Valley start-ups advancing autonomous air vehicles is stark. EA isn’t conceptual. And it’s not some far-off technology boosted by glossy marketing. What Garmin has developed and delivered to Piper and Cirrus for production is the bleeding-edge of flying autonomy and one that is on the verge of gaining regulatory approvals.

Related: Bell wants to lead the revolution that’s trying to kill it

It doesn’t take a radical futurist to see that Garmin has created the technology backbone and a roadmap to evolve the decision-making power of EA into autonomous aircraft like eVTOL craft or make landings in normal operations, assist larger two-pilot aircraft, or even reduce a crew requirement with a digital co-pilot. But is that imminent? Hardly, says Phil Straub, Vice President and Managing Director of Garmin’s aviation business. “I think we’re early right now.”

“I’ll speak lightly into this because I know single-pilot operations can be a controversial thing with some emotions and different viewpoints,” said Straub in an interview. “I do think that this technology represents another layer of safety.”

While deeply controversial in commercial aviation, flying with just one person at the controls is anything but rare in the world in which Garmin has thrived. High-performance aircraft like the M600 and the Vision Jet are both certified for single-pilot flying, so are light jets like the HondaJet, Embraer’s Phenom 100 and 300 and aircraft as large as Cessna’s CJ4. And any commercial aircraft flight with nine or fewer seats in the U.S. can be flown with a single pilot. Before its demise, Great Lakes Airlines took 10 seats out of its Beech 1900D fleet due to a shortage of pilots.

Related: New rules from China set to worsen the global pilot shortage

“So perhaps one could say maybe at some point look at a single-pilot operation and say, this is one more level of safety or hole in the Swiss cheese you gotta line up before they were to all line up that way,” said Straub. “I think there’s rationale to that.”

“I think automated systems that keep the pilot in the center are going to make flying more accessible, you’re going to make it safer” with simplified vehicle operations, said Straub. “And I think,” he added, from “Garmin’s perspective…you’re going to see that it requires fewer crew in larger, more complex airplanes.”

Regulating The Future

The FAA isn’t quite ready to certify fully-autonomous passenger-carrying vehicles yet or digital co-pilots and Garmin had to convince the U.S. aviation regulator that the context for EA’s operation was inherently different than those for normal operations. “The catastrophic event’s already happened. So everything we do from there is us just trying our best help,” said Scheel.

“There was a probably a little bit of skepticism in the beginning with the FAA talking about its intended function,” said Straub. Garmin is “not trying to bring CATIII auto-land1CATIII auto-land, which is only possible on commercial airliners, requires triple-redundant systems for minimum decision height of 100 feet. EA is capable of landing in zero visibility conditions. in the Piper M600…we’re trying to increase safety. You get that alignment, then all of a sudden informs of basis to figure out how can we go forward.”

Garmin has had to navigate not one, but three different branches of the FAA to get the system approved. The aircraft certification office for implementation on the aircraft, the flight standards group for the operation of the system and now the air traffic organization because of the broadcasting functions. It’s a prime example of how a single integrated system is trying to gain approval with a dis-integrated regulator. “As much as I’ve appreciated their cooperation there, [the FAA’s] willingness to find ways to get things done” it’s been slow-going, said Straub.

Related: Searching for 40-year old lessons for Boeing in the grounding of the DC-10

The project might’ve been done sooner in 2019, had it not been for the government shutdown that curtailed any certification efforts. The FAA was first briefed on Garmin’s EA project in September 2015.

And Garmin is making its final push toward EA’s certification in the middle of the most highly-scrutinized time for the aviation regulator in its 61-year history and arguably the most important debate around the role of automation in the cockpit following the 737 Max crashes in Indonesia and Ethiopia in October 2018 and March 2019. Today, the fleet remains grounded and the FAA is still evaluating training and software changes for the Boeing aircraft.

Related: Boeing details changes to MCAS and training for 737 Max

“It’s an extra pause,” said Scheel of the FAA’s pacing. “I think everyone’s kind of taking that extra breath and just thought some things through again, just to make sure we’re not missing anything.”

With the Max crashes in mind, part of the FAA’s approval and validation of the system was ensuring EA could be easily deactivated. It can be with a press of the autopilot switch. But convincing the FAA to support certification, also came down to illustrating the system’s redundancy and limitations. If the radar altimeter has failed, for example said Scheel, the aircraft will use GPS for its flare. It “won’t be as nice of a landing, but it will still try. There’s no giving up at that point.”

“There are situations that the FAA just realized that we might not be able to do anything,” said Scheel. “Like the pilot’s not wearing a shoulder harness and slumps over the controls. We can’t overpower the controls, that’s just a regulation requirement, we can’t do that.”

All that would be part of the regulator’s normal due diligence of such a system, but Scheel said that since the 737 Max grounding, the FAA has done an additional “review of things that they just want to hear and be sure we proceed prudently and we’re doing the right thing at the right time.”

Finding the edge cases

While EA may look like a major leap, it’s actually an incremental step for Garmin. Its ESP and EDM systems — acronyms that stand for Electronic Stability and Protection and Emergency Descent Mode — which have been flying for years, are the backbone of EA. ESP is effectively a digital envelope protection that uses servos monitoring the position of the airplane to “nudge” the flight controls back to a safe attitude. And EDM will automatically take over and descend the aircraft if there is a pressurization failure or it determines the pilot might be suffering from hypoxia.

To design EA, a cadre of engineers went in search of a 7,000 foot-deep canyon and then set about getting stuck at the bottom of it. There are no 7,000-foot-deep canyons on Earth, but the company’s engineers had to dream up the edge cases for EA to help it make decisions for itself. Using test benches running Laminar Research’s X-Plane simulator software, Garmin needed to verify EA could “make smart decisions when we get into those corner cases so that it knows how to get out of it in those scenarios,” said Dustin Kilgore an aviation systems engineer at Garmin. 2So what would the airplane do? It would make a circling climb to avoid the terrain, searching all the way up for a place to land. Once it cleared the canyon walls, it would find its path to a safe airport. As it flies, EA is constantly amassing a list of suitable airports in the background, allowing each emergency route to be crafted within 500 to 800 miliseconds.

Related: Exploring the vast Earth Microsoft has created for Flight Simulator 2020

EA made its first test flight in May 2014. And it would take about two more years and constructing fake airports in the sky at 5,000 feet to prove EA could work. With control of its own databases, Garmin can “basically trick the airplane to believe that there was an airport and we would practice a flare at altitude,” said Jessica Koss, Garmin’s senior spokeswoman. Garmin’s first full auto land came in February 2016.

Not Artificial Intelligence

While on its surface, EA looks a lot like the work of artificial intelligence. “We could’ve done artificial intelligence, we could’ve done computer vision,” said Kilgore of the patented system.

It’s not. In 2019, certification of an AI-driven system isn’t possible. The FAA, nor any regulator, has yet to create a framework for certifying so-called non-deterministic systems. In technical terms, non-deterministic refers to the inability to objectively predict an outcome. “I think [AI] has its use,“ said Kilgore. “But as far as certifying it, I don’t know that you’re going to find a good use case where you can certify until you can explain what it’s doing.”

EA is, however, entirely deterministic. At every point, Garmin’s algorithm knows why it making the decisions it is given the inputs. “In this case, we can go back and we can understand exactly what it’s going to do and it’s going to be repeatable,” said Kilgore. “We tried not to overcomplicate the problem for what it’s intended to do.”

And what it’s intended to do is to get a healthy airplane with an ailing pilot out of harms way. It’s not ready to be a fully automated system in normal operations, and those challenges — particularly related to the interaction of a healthy pilot and their ailing airplane — have yet to be solved, but it is one big step in that direction.

Write to Jon Ostrower at jon@theaircurrent.com