Financial Drivers

Chapter 6 discussed the human factors and safety management system implications. The improvements in the late 1990s cited were based on the principles that not making errors would lead to more reliable aircraft; consequently a 3% financial gain can be simply made in the Engineering annual budget. A similar approach to financial savings must be used to underpin any future aircraft modifications and changes to the procedures. The travelling public will not be willing to pay an additional anti-terrorism or anti-pilot homicide premium on each and every flight, because the frequency of such events is so low. That said, the security risk cannot be discarded, as repeated historical events have proven, as the most intent individuals will plan and carry out their dastardly acts, destroying aircraft and killing innocent passengers and crews.

The key to any potential improvements that have been suggested thus far in this chapter must be based upon the ultra-long-term financial savings that airlines seek, and manufacturers claim. All modifications will need to be driven by the Airframes' Original Equipment Manufacturer, e.g. Airbus or Boeing. Changing the operation of the aircraft to limit what can be done in-flight by flight deck occupants is a task that can only be achieved by the airframe OEMs. Chapter 5 presented the background and state of the art technology for maintenance management. While some data are transmitted live, much of the aircraft's performance data are downloaded on a weekly basis, with each download providing around 1 ТВ per sector. If all such data were to be uploaded via satellites, the quality of the aircraft operation and maintenance predictions would improve. While the carriers will be concerned that the transmission of aircraft performance data is expensive, the irony is that major social media platforms are currently working on a low earth orbit provision to allow users to upload their activities/photos/videos using an ultra- low-cost satellite service. This is because much of the world's social media target demographic audience does not have an effective 3G/4G/5G mobile telephone provision, or a cable-supported Wi-Fi access. The development of this type of low-cost social media satellite data service would be a disruptive product, and the traditional satellite data providers would need to adjust their data pricing accordingly to compete with the new emerging technology. These low-cost satellite communication services have been in development for a significant number of years, with the large corporations behind these future services being Facebook, SpaceX and One Web.

Live Streamed Data Reducing the Fuel Burn

The potential gains from a full operational live data stream, with the introduction of the single-use code per sector (to start the engines/operate each sector) would also bring a second measurable gain: namely that of routing and efficiency. Currently, while routing is planned within the Flight Operations of an airline, the active flight crews can request АТС to vector to different bearings/altitudes as they see fit. An active system would allow the ground staff to communicate better with flight crews when 'more favourable' flight profiles are considered. АТС would benefit from such a system. This is because ATC’s electronic planning infrastructure would be able to much more accurately predict when the airspace would be occupied by the respective aircraft, so the most optimum applications can be applied. For example, if saving time was the principle factor, aircraft on approach could be given a higher approach speed before commencing the 'long final approach'. Alternatively, a more environmental approach would be possible with Continual Descent Approaches (CDAs), allowing the engines to use significantly less fuel from the top of the descent, converting the potential energy gained from altitude into the kinetic energy of the airspeed in this steady descent profile. Furthermore, the streamed live performance data would quantify the actual fuel burn in real time, and as fuel consumption has financial implications, this would be an immediate gain that the airlines would like to monitor more carefully. With reduction in fuel consumption, there comes a significant emission reduction capability, because the output of each engine can be recorded, optimised and compared. The data would contain the values of the reduced fuel flows, the reduced lubrication oil consumption, and both of these performance metrics can then be employed to calculate the reduction in the CO, and changes in other gaseous emissions (e.g. NO_x, NO, water vapour, etc.). These accurate, logged savings in environmental gains (and reduced fuel burns) could be used to reduce the costs of the EU's Emissions Trading Systems (EU ETS), a blanket charging system on all large commercial aircraft entering and operating within the European airspace. The data would support an immediate EU ETS cost saving that is imposed on the carrier.

Live Streamed Data Reducing Deviation from Flight Plans and Further Reducing Fuel Burn

The ability to monitor the flight crew's adherence to the approved flight plan in a live-streamed data context would also highlight any changes in the human performance (e.g. latencies). Fatigue in flight crews has always been an underlying problem that airlines and regulators have attempted to monitor and improve. Unless the observer is within the flight deck, the use of pilot-targeted questionnaires using Likert scales to estimate levels of fatigue and lethargy is not accurate, and lacks numerical quantification. The live data streamed information would allow much more sensitive observations to be made and recorded, perhaps with comparisons to an individual's previous flight performance data sets, or with the performance mean of the fleet based crews. The fewer deviations made by the pilots flying the plan, and the increase in the monitored flight characteristics would potentially reduce the fuel burn and improve the environmental aspects.

Data Security and Encryption for Uninterrupted Landing Systems

If an uninterrupted landing system were to be fitted to a live commercial aircraft, the principle objective would be for such a system to be sufficiently secure from interference from the non-authorised sources. Data encryption is a highly mathematical technique that allows for packets of data to be transmitted and received, preventing the information contained within the transmission to be decoded or changed. Hackers, malicious programmers and rogue states would have an interest in taking command of a distant commercial aircraft, and potentially causing a homicide act by deliberately crashing the aircraft into the ground/other aircraft/building/sea. Therefore, any system fitted would require the airframe OEM to have operational military-grade encryption, such as Advanced Encryption Standards (AES) using a 256 bit-key or higher with an End 2 End Encryption (E2EE). Military communications require the highest levels of security. For example, a government with a nuclear deterrent wishes to allow its leaders to control the nuclear devices, thus assuring total security. The political leader requires the ability to transmit coded signals and data transmissions to submarines, etc., commanding a nuclear attack if needed, as detailed by the Ministry of Defence/Defence Nuclear Organisation, UK. If such communication levels were compromised, such is the risk, it would be possible to deploy and detonate a nuclear device without even needing to be physically present with such a nuclear weapon. Military encryption is always evolving, including the application of quantum physics, where pairs of electrons can be used to code and transmit data, ensuring that data cannot be intercepted or deciphered without the intended recipients being made aware of the security breach.

The Boeing Corporation, Airbus Group, BAe Systems, etc., are all providers of the most secure data systems to the militaries in the USA and Europe. As with any such system that has been designed, endorsed and observed by any of these major airframe manufacturers, the expectation is that the highest level of AES would be employed, and not the lowest cost option that has recently come to light with one manufacturer's safety systems. Any uninterrupted landing system would need to update its capabilities remotely, in a similar manner to the way personal computing operating systems communicate with their designers to perform regular security patch updates.

The Flight Management Computer and Satellite Data Unit would be the ideal avionic computing systems to host the additional circuit boards within these Line Replaceable Units (LRUs). The inclusion of a bespoke printed circuit board in both LRUs would give the necessary performance requirements, allowing for fully-encrypted data to be received from the OEM, and aircraft performance to be transmitted securely back to the OEM servers.

Uninterrupted Landings and Risks Posed from the Aircraft’s Occupants

If a commercial aircraft were to require the deployment of the uninterrupted landing system, one significant risk that is posed is the persons that remain inside the flight deck and the passenger cabin. It can be assumed that hostile persons who have taken command of a commercial aircraft, which subsequently has an uninterrupted landing system activated, are not going to remain passive observers when the aircraft descends and lands under the control of the manufacturer. Chapter 7 highlighted the dangers presented by fire in a confined space, such as a pressurised aircraft. The flawed concept of flight crews switching-off the aircraft's ventilation system in the vain hope of extinguishing a fire is a historical decision that has proven to kill the passenger. These occupants would suffer the immediate effects of smoke inhalation because the gases are highly toxic, and the reduced ventilation flow has little or no effect on the seat of the fire. Worse still, if the aircraft is flying at altitude (about 20,000ft), the loss of pressure encourages the onset of hypoxia in the aircraft' occupants. A fire that becomes established with a high heat flux, with the exposed surfaces being heated by radiant sources to temperatures exceeding 500°C (932°F) will cause a flashover event, where the pyrolosis of materials in the zone will produce a flammable gas that will spontaneously combust. If the occupants within the aircraft recognise that the aircraft is no longer under their direct control, and they were to start a fire, it is plausible that before the aircraft can land the fire's flashover will cause the aircraft to crash catastrophically - something which an uninterrupted landing system has no direct control over. Fire events are not a new problem for airlines, and the UK's AAIB final report (1988) for the British Airtours engine fire at Manchester airport in 1985 directly addressed the problems pertaining to fire in an aircraft that leads to mass fatalities. The report findings specifically recommend that the airlines provide smoke hoods for all of the passengers, and the manufacturers modify the aircraft to include a water spray system (drawn from the potable water supply) as the technology existed in 1988, and would form a lifesaving 'twin strategy'.

Another potential source of aircraft in-flight sabotage during the descent phase would be posed if an individual gained access into the electrical and avionic bay. As these bays are located within the pressurised areas of the airframe, an occupant can easily access this sensitive area and interfere with all of the equipment. A solution to this significant problem would be to retrofit

FIGURE 9.13

Airbus A380 photo with Electrical and Avionic bay proximity to the forward cargo bay door- rastered boxes.

the floor trapdoor from the flight deck to the bay area with the same protective measures used on the flight deck door. Multiple electronic locks would be necessary; the structure around the trap door would be increased; and all the floor panels from the passenger cabin forward, including the flight deck would need to have ballistic Kevlar materials (included in the composite structure) to prevent ballistic penetration or attack. The panels will also require fastening securely from below the cabin structure, to prevent a determined passenger/pilot, etc., from lifting up the floor panels in the cabin to gain access to the hold and the sensitive avionic bay. This is because the electrical and avionic bay protrudes aft of the flight deck, behind door 1. The checkerboard rastered boxes (Figure 9.13) on the nose of the aircraft, represents the electrical and avionic bays. It is possible to open the forward cargo bay door (from the outside), and inside the forward cargo bay (on the right or forward bulkhead) is a small door. This small internal door (which can be opened from either side) leads into the electrical and avionic bay. Once inside the electronic and avionic bay, an individual can climb up a small ladder, open the floors' trapdoor and climb up to enter the inside the secure flight deck (behind the observers' seat). A simple internet-based search will identify videos of pilots demonstrating the navigation of this route, from the flight deck down to the cargo bay, returning to the flight deck.

Likewise, airlines will need to give careful thought to aircraft fitted with underfloor rest areas for crews, or underfloor toilet facilities. Both of these features would give a determined cabin occupant access to the forward cargo compartment and latterly the avionics bays and the 'secure' flight deck. Modifications would require the additional use of further Kevlar in composite wall panels, etc.

Lastly, any uninterrupted landing systems fitted and monitored by the manufacturer must not be considered by the OEM to be a subscription-based service. The OEM should consider the costing of any potential system as a positive marketing for brand, to make their airframe the safest and most efficient in its class. The airline's potential cost savings will drive the sales and leasing of the aircraft that are fitted with full monitoring and communication devices.