Anyone who has worked for an airline is probably familiar with the staff travel system. Most employee tickets are issued on a space-available basis, but certain personnel receive much higher priority, particularly pilots, aircraft mechanics and technical staff travelling to carry out operational duties.

A flight may be fully booked, but if a pilot needs to reach another airport to operate the next service, or a mechanic must travel to repair a grounded aircraft, getting that person to the right place at the right time becomes an essential part of the airline's operations.

In aviation, people who appear to be ordinary passengers can sometimes form part of an operational backup arrangement.

The events aboard Flydubai flight FZ1073 on September 30 demonstrated this in a way no one would ever have wished.

Building redundancy so one failure does not bring down the system

According to information released so far, the Boeing 737 MAX 8, operating from Dubai to Tel Aviv, experienced a serious cockpit emergency when the first officer attacked the captain and attempted to seize control of the aircraft.

Two other Flydubai pilots were aboard the flight, travelling to undertake separate operational assignments. When the incident unfolded, they helped bring the situation under control, took over the cockpit and landed the aircraft in Tabuk, Saudi Arabia.

The investigation by authorities in the United Arab Emirates is still underway, leaving many aspects of the incident unresolved.

The lesson is not that airlines should now assign additional pilots to every flight.

The two pilots were aboard FZ1073 because of the airline's operational requirements, not because anyone had anticipated an emergency of this nature.

Yet their presence illustrates one of aviation's oldest safety principles: never build a safety system on the assumption that everything will always go according to plan.

Modern commercial aircraft are designed with multiple layers of redundancy.

Electrical systems have alternative power sources. Hydraulic systems operate through multiple channels. Navigation and communication capabilities do not depend entirely on a single piece of equipment.

The objective is to ensure that a single failure does not immediately leave the aircraft uncontrollable.

Qantas flight 32 on November 4, 2010, remains a widely cited example.

Shortly after an Airbus A380 departed Singapore, one of its engines suffered a catastrophic failure, sending debris into several aircraft systems.

Despite damage to multiple components, the flight crew managed to return to Changi Airport and land safely.

Several systems had failed, but enough functioning equipment and human capability remained to keep the situation under control.

The same philosophy extends to aspects of aviation that passengers rarely notice.

When planning a flight, pilots do not calculate fuel requirements based solely on the amount needed to travel from the departure airport to the destination.

They must also account for contingency fuel, alternate airports where required, and the final fuel reserve that must be maintained.

Conditions at the destination airport may be perfectly normal when the aircraft takes off, only for thunderstorms or a runway incident to develop several hours later.

An alternative must therefore be considered before the flight even begins.

Airline staffing is organized according to a similar logic.

Carriers must develop crew schedules that comply with limits on flight hours, duty periods and rest requirements.

They also need procedures for dealing with situations in which a scheduled pilot falls ill, a previous flight is severely delayed or a crew reaches its maximum permitted duty time.

Reserve pilots are therefore not simply employees sitting idle because they have no work to do.

They are part of an airline's ability to keep operating when the original schedule can no longer be followed.

Crew repositioning serves a similar purpose.

In aviation terminology, "deadheading" or "positioning" refers to transporting crew members to locations where they are needed for operational duties.

On an aircraft's seating chart, that person may appear to be just another passenger.

But from the perspective of an airline's wider operational network, their presence could determine whether another flight departs on time or whether a series of subsequent flights is disrupted.

Viewed in isolation, a seat occupied by a repositioning pilot might appear to be a seat that could otherwise have been sold.

Viewed across the entire network, however, its value is very different.

Sometimes, capacity that is not being fully utilized is precisely what gives a system room to respond when something unexpected happens.

The International Civil Aviation Organization (ICAO) uses the concept of *resilience* to describe the ability to maintain or restore safe operations when disruptions occur.

The underlying principle is that when one component unexpectedly fails, the remaining parts of the system must be capable of preventing the situation from escalating.

This becomes particularly important in an industry under constant pressure to improve efficiency.

An aircraft sitting on the ground costs money. An empty seat represents lost revenue. Reserve personnel, spare equipment and additional time built into operating schedules all come at a price.

But when every resource is pushed to its absolute limit, the system has less capacity to absorb unexpected disruptions.

Redundancy does not mean having as much spare capacity as possible.

An airline cannot keep an unlimited number of pilots waiting on standby, just as an airport cannot duplicate every facility simply to guard against potential failures.

The more practical question is how much backup capacity is appropriate for the risks associated with each operation and what alternative remains available if the original plan fails.

What should Vietnam's aviation sector prepare for as operations expand?

In Vietnam, this approach is already reflected in regulations governing flight crew duty periods.

The country's Civil Aviation Safety Regulations establish limits on duty hours and flight time over specified periods, alongside requirements for standby duties.

These provisions may appear largely administrative, but their underlying purpose is to prevent aviation operations from relying on the assumption that people can work continuously without any deterioration in performance.

Air traffic controllers are also subject to limits on the amount of time they can spend actively directing aircraft and requirements for rest between duty periods.

These breaks do not generate additional flights.

However, a controller experiencing fatigue or reduced concentration can become a vulnerability affecting the entire system.

Such issues will become increasingly important as Vietnam's aviation industry enters another phase of development.

With Long Thanh International Airport coming into operation, the airport and route networks expanding, and demand for skilled aviation personnel rising, the pressure to maximize the use of aircraft, infrastructure and human resources will intensify.

As traffic volumes increase, even a relatively minor disruption can spread more easily across multiple parts of the system.

For airlines, the questions are highly practical.

If several flight crews simultaneously reach their maximum duty limits because of prolonged delays, how will the airline manage the remaining flight schedule?

If an aircraft develops a technical fault at an airport away from its main operating base, how will mechanics and replacement parts be transported there?

If an information technology system supporting flight operations becomes unavailable, what alternative arrangements will allow the airline to maintain essential functions?

Airports and air navigation service providers face similar challenges.

A backup power supply is useful only if it is regularly tested.

An emergency response procedure can be trusted only when the people responsible for carrying it out have practiced it.

That is why even unlikely scenarios must be included in emergency exercises.

These may involve power outages, technology system failures, temporary runway closures or large numbers of aircraft diverting to the same airport at the same time.

Such exercises can also reveal where an organization has become excessively dependent on a particular individual, piece of equipment or supplier.

If the failure of any one of these components leaves no viable alternative, that dependence represents a serious vulnerability.

Maintaining backup capacity undoubtedly involves substantial costs.

Yet in aviation, some of the most valuable resources are those that are rarely needed and, for that very reason, are easily mistaken for unnecessary expenses.

Ideally, an airport fire truck will never have to respond to a major aircraft accident.

That does not make it redundant.

A reserve flight crew may spend an entire day waiting without being called into action.

But on the one occasion when those pilots are needed, their availability may prevent a chain of subsequent flights from being canceled or subjected to lengthy delays.

The two pilots aboard FZ1073 probably boarded the aircraft expecting nothing more than transportation to another location where they would carry out their next assignment.

Neither could have anticipated that, just hours later, they would become involved in handling a serious emergency in the cockpit.

Aviation cannot prepare for every possible crisis.

But a well-designed aviation system must strive to ensure that when the first plan is no longer viable, there is still another person, another piece of equipment or another course of action capable of bringing the aircraft home safely.

Nguyen Phuoc Thang (Hoa Binh University)