What Happens If Both Pilots Become Unconscious Mid-Flight?
The cockpit is silent. The autopilot hums. Outside, the aircraft is doing exactly what it was told to do. Inside, nobody is awake. Here is what happens next — and why the answer is more complicated, and more terrifying, than any airline will tell you.
A modern commercial cockpit during cruise. The autopilot flies. The FMS navigates. But when the crew is incapacitated — what happens next? Image: askapilot.net
It is a scenario most passengers would rather not think about. You are somewhere over the Bay of Bengal, six hours into a long-haul flight. The autopilot is doing its job — 38,000 feet, on track, on time. And in the cockpit, both pilots are unconscious. No warning. No radio call. No handover.
This has happened. People have died because of it. And when you look closely at how aviation has — and has not — solved this problem, the picture is more sobering than any pre-flight safety card will admit.
This guide covers everything: the real causes, the accidents that changed aviation rules, the safety layers that exist today, where those layers fail, and what regulators are doing about the gap that remains.
What Is Pilot Incapacitation — And Why Does "Both" Change Everything?
Pilot incapacitation is the official term for when a crew member becomes unable to carry out their assigned duties. It exists on a spectrum: partial incapacitation means degraded performance — confusion, slow reactions, slurred speech. Total incapacitation means completely unresponsive.
Single-pilot incapacitation is trained for in every airline operation. The other pilot takes over, declares the emergency, and lands the aircraft. The scenario is serious, but the solution is defined. Airlines rehearse it in the simulator. It is a solved problem.
Dual incapacitation is categorically different. When both pilots are down simultaneously, there is no internal fallback. The aircraft keeps flying. The FMS keeps navigating. The autopilot keeps holding altitude. And nobody in the cockpit is doing anything about it.
The aircraft becomes what accident investigators call a ghost flight — a perfectly functional machine executing its last instructions with no awareness that its operators are gone. It will continue until the fuel runs out. Then it will not.
The Causes: What Makes Both Pilots Go Down at Once
Understanding dual incapacitation starts with understanding why two trained, medically certified professionals can lose function simultaneously. The causes fall into distinct categories — some far more likely than others.
Hypoxia — The Silent Killer
Hypoxia is oxygen deprivation at altitude. It is the most dangerous cause of dual incapacitation for one precise reason: it does not feel dangerous. The early effects of hypoxia are euphoria, reduced anxiety, and a false sense of competence. Pilots in hypoxic states have been recorded laughing, making irrelevant comments, and failing basic tasks while reporting that they feel completely fine.
At 35,000 feet, the time of useful consciousness without supplemental oxygen is approximately 30 minutes. At 40,000 feet, it drops to under 10 minutes. In a rapid decompression scenario — where cabin altitude jumps suddenly — that window collapses to as little as 4 minutes.
Crucially, both crew members breathe the same air. A pressurisation failure affects both pilots simultaneously. If neither catches it fast enough to don their quick-don oxygen masks, both go down together.
Carbon Monoxide Poisoning
CO is colourless and odourless. Sources include faulty bleed air systems, electrical fires behind panel walls, or smoke from cargo holds. Symptoms mimic fatigue and hypoxia — headache, confusion, loss of fine motor control. Both pilots can be progressively incapacitated without either recognising what is happening until it is too late to act.
Contaminated Food or Drink
Airlines require pilots to eat different meals specifically because of this risk. The rule exists precisely because cases have occurred — two crew members consuming the same contaminated item and becoming simultaneously impaired. When both pilots ignore the different-meal rule, the risk is real and the consequences documented.
⚠️ The rule both pilots sometimes break: The different-meal protocol is a formal airline SOP at most carriers worldwide. It is also one of the most casually ignored rules in commercial aviation. Incident databases contain multiple cases of dual food-related impairment. The rule works when followed. It does not always get followed.
Smoke and Toxic Fumes
Avionics fires, electrical smoke events, and fume contamination from bleed air have all been documented as incapacitation causes. Unlike hypoxia, smoke provides a visible warning — but also tends to act faster and leave less time for corrective action. If oxygen masks are not donned immediately, both crew members can be overwhelmed.
Simultaneous Medical Events
This is the rarest scenario but receives the most public attention. Cardiac events are the single largest cause of single-pilot in-flight incapacitation deaths. Two simultaneous cardiac events in the same cockpit is statistically very rare. But it has occurred, and airline medical screening programmes exist partly to reduce this probability.
- Hypoxia from pressurisation failure — High consequence, moderate probability in aircraft without robust warning systems. Silent onset makes it the most dangerous.
- Carbon monoxide or toxic fumes — Moderate probability in ageing fleets. Difficult to detect without CO monitoring in the cockpit.
- Contaminated food/drink (same item) — Low probability if protocol is followed. Documented cases exist when it is not.
- Smoke / avionics fire — Low probability, high speed of incapacitation. Visible warning but limited reaction window.
- Simultaneous cardiac or medical events — Very low probability. Mitigated by medical screening requirements (DGCA Class 1, FAA First Class).
What the Autopilot Actually Does — And What It Cannot Do
Here is the reassuring part: the autopilot does not know or care whether the pilots are conscious. It will hold altitude, heading, and speed for as long as the aircraft has fuel — which on a long-haul aircraft can be eight to fourteen hours.
On a modern Airbus A320, Boeing 737 MAX, or Boeing 787, the autopilot is capable of maintaining level cruise flight, following the FMS-programmed route, and managing minor disturbances entirely without human input. The aircraft will fly exactly where it was last told to fly, for as long as it can.
But the limits are absolute and well-defined:
- CAN do: Maintain altitude, heading, airspeed, and lateral navigation on the programmed FMS route. Hold cruise flight for many hours.
- CANNOT do: Respond to a TCAS Resolution Advisory requiring a climb or descent. Deviate around developing weather. Communicate with ATC. Initiate descent or approach without pre-programming. Land the aircraft (on most types). Recognise that something is wrong.
- WILL do when fuel runs out: Alert with fuel warnings that nobody will respond to. Eventually, the engines flame out. The aircraft enters an unpowered descent. Without control inputs, it will not glide cleanly.
🔵 The critical misunderstanding: "The autopilot will keep flying it" is technically true but dangerously incomplete. The autopilot will keep flying it on the last heading, at the last altitude, until the fuel is gone. It has no ability to recognise the emergency, no ability to call for help, and no ability to bring the aircraft home.
The Role of ATC When Pilots Go Silent
Air traffic controllers are trained to treat radio silence as an emergency indicator. The process that activates when a crew stops responding is defined, formal, and — in some cases — astonishingly effective. In others, it is not enough.
Stage 1 — Communication attempts: The controller makes repeated calls on the assigned frequency, then on 121.5 MHz (the international emergency frequency). Nearby aircraft are asked to relay. If the target aircraft is equipped with SELCAL, that system is triggered.
Stage 2 — ALERFA activation: Under ICAO Doc 9426, if no contact is established after defined intervals, the situation escalates to Alert Phase (ALERFA). The departure and destination airports are notified. Adjacent FIRs (Flight Information Regions) are alerted. Military radar tracking begins.
Stage 3 — DETRESFA and military intercept: If the aircraft continues without response, Distress Phase (DETRESFA) is declared. Intercept aircraft — typically military fast jets — are scrambled. The intercept serves two purposes: visual inspection of the cockpit, and an attempt to signal the crew using ICAO-defined visual signals (wing rocking, formation flying, flashing lights).
What intercept aircraft cannot do: Force the commercial aircraft to land. Take control. Bring the crew back to consciousness. They can observe, document, and follow — and in some cases, buy time by alerting destination airspace — but they cannot save the aircraft if nobody inside it can respond.
The entire ATC emergency chain, from first missed radio call to intercept jets on station, can take 15–25 minutes in well-resourced airspace. Over the ocean, above remote terrain, or in less-resourced FIRs, it can take far longer.
Real Cases: When Both Pilots Were Actually Gone
The following accidents are the most thoroughly investigated dual incapacitation events on record. Each one changed aviation safety protocols in ways that still affect every commercial flight operating today.
Helios Airways Flight 522 · Boeing 737-300 · Athens, August 14, 2005
This is the definitive case. Flight ZU522 departed Larnaca, Cyprus for Athens on a routine morning service. During a maintenance check the previous night, the cabin pressurisation system had been left in manual mode. It was not reset before departure. No pre-flight check caught it.
As the aircraft climbed through FL180, the cabin altitude warning horn activated. The captain called maintenance on his mobile phone — while airborne — apparently confused about which alarm was sounding, reportedly believing it was the takeoff configuration warning. Meanwhile, the aircraft continued climbing. The crew had no supplemental oxygen donned. Hypoxia was progressing silently.
Both pilots lost consciousness. The first officer was likely incapacitated first, the captain shortly after. A flight attendant — Andreas Prodromou, who held a private pilot licence — was later found at the controls in the final moments. He had entered the cockpit after the reinforced door opened (the crew had apparently not engaged the lock). He transmitted a distress call but was unable to save the aircraft.
For the next two hours, the Boeing 737 flew on autopilot, entered the holding pattern programmed into the FMS for Athens, and circled — making six complete holding pattern turns — before running out of fuel at low altitude. It struck a hillside near Grammatiko at 12:03 local time. All 121 passengers and crew were killed.
Hellenic Air Force F-16s intercepted the aircraft. They could see the captain slumped at the controls and oxygen masks deployed in the cabin. There was nothing they could do.
Learjet 35 · Near Aberdeen, South Dakota · October 25, 1999
Golf professional Payne Stewart and five others were on a chartered Learjet 35 from Orlando to Dallas when the aircraft climbed to FL480 with no further radio contact. F-16s from multiple Air Force bases were scrambled over the following hours to track and observe the aircraft.
Through their canopies, intercept pilots reported frosted windows — a sign of extreme cold inside the cabin, consistent with rapid pressurisation loss and a frozen, hypoxic crew. For four hours, the Learjet flew straight and level on autopilot across the American Midwest, completely unresponsive, while military aircraft shadowed it from below.
The aircraft eventually ran out of fuel and entered a spiral dive. It struck a field in South Dakota. There were no survivors. The NTSB investigation determined a pressurisation failure had likely incapacitated the crew within minutes of reaching cruise altitude. Nobody had time to don oxygen masks.
Multiple Documented Incidents · IATA Safety Database
Aviation authorities do not always publicise food-related incapacitation events prominently, but the IATA safety database and FAA incident records document multiple cases of simultaneous crew impairment from shared catering items. In at least two cases, the aircraft was managed by a third crew member — a relief pilot or senior cabin crew with aviation training — who prevented a catastrophic outcome.
What these cases share: both crew members consumed the same item, contrary to the different-meal SOP. Both experienced roughly simultaneous onset of symptoms. In the cases that ended safely, a third qualified person was available. In aircraft types with a two-person crew and no additional pilot, the outcome of this scenario would have been Helios-equivalent.
A Trainee Pilot's Perspective — What Training Teaches You About This
The moment I understood why hypoxia is different from every other emergency
I am currently undergoing CPL flying training and have completed all DGCA theory examinations. In Air Regulations and Meteorology study, hypoxia gets a dedicated section — but the description alone does not convey what makes it uniquely dangerous. The thing that struck me when I went deeper into accident case studies is this: in almost every other in-flight emergency, the pilots know something is wrong. Engine failure has sound and feel. Fire has smoke. Even a stall has buffet and a stick shaker. Hypoxia has nothing. You feel normal, even good, right up until you cannot think clearly enough to recognise that you cannot think clearly. That feedback loop — where the tool you need to assess the problem is itself the first thing the problem takes — is what makes it categorically different. Every cockpit drill we learn for pressurisation loss starts with the same immediate action: don oxygen masks. Not after you confirm the problem. Not after you assess severity. Immediately. The four-minute window is not a guideline. It is a biological fact. And as Helios 522 showed, missing that window by even a few minutes is the difference between an incident and a mass-casualty accident.
The Safety Systems Designed to Prevent Dual Incapacitation
Aviation does not assume that pilots are infallible. The entire safety architecture assumes human failure and builds redundancy around it. Here is the current layered defence against dual incapacitation — including honest assessments of where each layer holds and where it does not.
- Cabin altitude warning system — activates at 10,000 ft cabin altitude. The critical first alert. If caught immediately and oxygen donned, hypoxia is prevented. If missed, ignored, or misidentified (as in Helios 522), the chain leads directly to incapacitation. Effectiveness: high if acted on immediately. Near zero if ignored or misidentified.
- Quick-don oxygen masks — cockpit masks deliver 100% oxygen within 5 seconds of deployment. They are the primary defence against hypoxia and CO poisoning. Both pilots must deploy them immediately upon any pressurisation alarm. Training emphasises this but some accidents show compliance failures. Effectiveness: very high if deployed in time.
- EVAS (Emergency Vision Assurance System) — on some aircraft types, provides a clear vision zone through smoke for the PF to fly the aircraft. Not universal. Effectiveness: partial, smoke-specific.
- Cockpit door two-person rule — most airlines now require at least one cabin crew member to enter the cockpit whenever a pilot leaves, ensuring the cockpit is never occupied by a single person. Designed to prevent a locked-door incapacitation scenario. Effectiveness: good if followed, but adds complexity around door protocols.
- ADS-B continuous position broadcasting — makes ghost-flight scenarios far easier to track. Post-MH370 improvements have dramatically increased oceanic surveillance coverage. Effectiveness: high for tracking. Does not prevent incapacitation.
- CRM (Crew Resource Management) training — mandatory under ICAO Annex 6. Pilots are specifically trained to recognise hypoxia symptoms in their crew partner and challenge unusual behaviour. Early intervention is the intended outcome. Effectiveness: significant if the observing pilot catches early symptoms. Ineffective if both are affected simultaneously.
- DGCA Class 1 and FAA First Class medical standards — comprehensive cardiovascular, neurological, and psychological screening at regular intervals. Designed to catch high-risk medical conditions before they manifest in the cockpit. Effectiveness: good for chronic conditions. Cannot prevent sudden acute events.
- The four-minute incapacitation window at altitude is not an abstraction. It determines the design of every pressurisation emergency drill.
- Donning oxygen masks immediately on a pressurisation alarm is not a suggestion — it is the only action that matters in the first 15 seconds.
- CRM training for hypoxia recognition exists precisely because the affected pilot cannot self-assess. Your job is to watch your fellow pilot as much as your instruments.
- The different-meal rule exists in SOPs for a documented reason. Following procedures that seem procedural is not bureaucracy — it is accident prevention.
- Simulator training for dual incapacitation scenarios is a DGCA and ICAO requirement. If your type rating training does not include it, ask why.
Can a Passenger or Cabin Crew Land a Commercial Aircraft?
This is the question every person reading this is asking. The honest answer is: under almost all realistic scenarios, no — but it is not impossible, and the industry is thinking about it more seriously than it used to.
Modern glass cockpits look nothing like general aviation aircraft. An Airbus A320 FMGC, an Efis display suite, the FCU — none of it resembles a Cessna 172. Even experienced GA pilots with thousands of hours on light aircraft have found themselves unable to manage a commercial cockpit without specific type training.
That said: ATC controllers are specifically trained to talk untrained individuals through basic aircraft control in extreme emergencies. There are documented cases of small aircraft being successfully talked down. For a large jet, the scenario requires the aircraft to still be in controlled flight, at a manageable altitude, with enough fuel, with ATC able to establish communication — and even then, the probability of a successful outcome without type-trained input is very low.
Several airlines are quietly researching whether simplified emergency control interfaces — a panic-button descent mode, a guided autoland activation sequence for an untrained operator — could be made available to trained senior cabin crew on certain aircraft types. This is not yet operational. But it is being discussed at serious levels within EASA working groups.
"The cockpit door keeps threats out. But it also keeps help from getting in when the people inside can no longer ask for it."
— Aviation safety analyst, quoted in IFALPA Safety Bulletin, 2018What ICAO, FAA, and DGCA Require
These are the mandatory regulatory frameworks that define how airlines must prepare for pilot incapacitation scenarios.
ICAO Annex 6, Part I — requires that all commercial operations under ICAO-compliant jurisdictions have documented procedures for pilot incapacitation, including dual incapacitation scenarios, and that crews are trained on these procedures at mandated intervals. See the ICAO Annex 6 documentation portal for the current edition.
FAA Advisory Circular AC 120-88A — provides guidance on preventing crew incapacitation through crew rest requirements, medical standards, and operational procedures. The FAA also issued Airworthiness Directive 2006-16-01 following Helios 522, mandating pressurisation system improvements on Boeing 737 variants.
DGCA India (CAR Section 7, Series M) — mandates Class 1 medical certification for all commercial pilots, renewed every 12 months under age 40 and every 6 months thereafter. The CAR also requires simulator-based incapacitation training for all ATPL holders at approved training organisations. India's regulatory framework is aligned with ICAO standards, which means the protections described here apply to all pilots operating in Indian airspace.
Future Technology: Can We Close the Gap?
The aviation industry is actively working on solutions, though none are yet operationally deployed at scale on commercial fleets.
Remote pilot takeover systems: Military UAV technology applied to commercial aviation. A ground-based operator with the right system could theoretically assume control of an aircraft if both pilots are incapacitated. The technology exists. The regulatory framework, cybersecurity architecture, and liability structure do not — yet. EASA has published exploratory research on this concept under its Single European Sky programme.
Biometric monitoring systems: Sensors in pilot seats, headsets, and flight suits that continuously monitor oxygen saturation, heart rate variability, and neurological activity. If readings fall below safe thresholds, the system could automatically alert ATC, trigger an emergency descent protocol, and lock in an autoland approach — all before any crew member loses consciousness entirely. Several major carriers are piloting (in the operational sense) cockpit biometric systems. Airbus has filed patents in this space.
Enhanced autoland and ground takeover: Boeing's development programme for the 777X and future platforms includes research into autonomous emergency landing capability — the aircraft executing a full approach and landing without crew input. The technology is demonstrably available in test environments. Certifying it for commercial service requires regulatory frameworks that do not yet exist.
Single-pilot operations (SPO): Controversial but under active research by EASA and NASA. SPO reduces two-crew long-haul operations to one pilot, compensated by ground-based monitoring and enhanced automation. Critics point out that SPO eliminates the mutual-monitoring CRM layer that is the primary defence against single incapacitation — and by definition cannot address dual incapacitation, since there is no second pilot.
The Uncomfortable Bottom Line
Aviation has spent fifty years making single-pilot incapacitation a solved problem. Dual incapacitation is one of the very few scenarios where the industry's answer remains, fundamentally: hope the autopilot holds long enough for ATC to notice, hope a military jet can get there in time, hope someone on board can do something.
That is not a condemnation of aviation safety. It is a consequence of probability. Dual incapacitation is so rare that building the entire safety infrastructure around it would mean enormous cost and complexity for a statistically tiny risk reduction. Every safety decision in aviation involves exactly this calculus — and aviation remains by several orders of magnitude the safest form of mass transportation ever created.
What Helios 522, the Payne Stewart accident, and dozens of smaller documented incidents collectively teach us is this: the margin between a pressurisation alarm and total cockpit incapacitation is measured in minutes, not hours. The window for the critical response — don oxygen, confirm pressurisation, initiate emergency descent — is narrow enough that a few seconds of confusion or misidentification can close it permanently.
The safety systems work when they are used correctly and immediately. They fail, catastrophically, when they are not.
The people who understand this best are the ones sitting behind reinforced cockpit doors at 38,000 feet, running checks that most passengers never think about, on every single departure. The training exists. The equipment exists. The procedures exist. The question, as Helios proved, is always whether the humans in the critical moment use them in time.
For ICAO's official guidance on pilot incapacitation, see SKYbrary's Pilot Incapacitation article — the aviation safety knowledge portal maintained by ICAO, EASA, and Eurocontrol. For NTSB accident investigation reports including the Payne Stewart accident, visit ntsb.gov.