In the past few years, pilot qualifications to manage abnormal situations while operating large commercial jets have dominated discourse about loss of control–in flight (LOC–I). Yet reducing the risks in this accident category at the level of resilience engineering also is essential, several subject matter experts told the ALPA Safety Forum 2012, held in August in Washington by the Air Line Pilots Association, International.
“While the ultimate responsibility of flying the airplane remains with the pilots, we have learned that crews are not all adequately trained to handle these automated systems, especially in high-demand situations,” said Dave McKenney, a captain for United Airlines and ALPA’s director of pilot training programs, who moderated a session on automation. “Most operators recognize that the use of automated systems may not always reduce the workload but in fact may actually increase it and lead to error. And when an automated system fails, [we have] relied on the human pilots to intercede and resolve the issues. … The automated systems must be clear [as] to the message and the information they provide to the pilots. The pilots need to know the status of the aircraft at all times and be able to predict what the system is doing so they can anticipate changes that need to be made.”
One audience member expressed a view shared by others: The industry essentially expects flight crews to “intervene during any or all malfunctions with the aircraft system through the use of manual flying skills” but normally requires pilots to engage automation from takeoff until a few minutes before landing, with minimal or no procedures to help them maintain manual flying skills.
Presenter David Woods, an Ohio State University (OSU) professor currently specializing in complexity science1 and adaptive-systems engineering, said that this issue has been identified and addressed since 1996 by U.S. Federal Aviation Administration specialists and academic researchers for the National Aeronautics and Space Administration (NASA), and in 2012 by specialists studying related issues for the Department of Defense.
“We pointed out that de-skilling and erosion of pilot skills would contribute to difficulties in this plan, this model of safety … that it was brittle, it wasn’t as effective as we thought,” Woods said. “And it was going to become less effective because the automation worked so well. … The recommendation we made back in the middle-1990s was, ‘[Pilots] have to practice more non-routine situations. You have to practice handling a cascade of events. … Initial training to proficiency was getting easier and easier, but long-term growth of expertise — the new forms of airmanship that are necessary — were lagging behind. … We still have not taken this seriously. We have new cases of problems in this area, and it is time we moved forward [and] got proactive.”
The airline industry often takes for granted in 2012 the precise autoflight guidance of large commercial jets — including their automated responses to non-normal situations — compared with a few decades ago, said Mike Carriker, a captain and chief pilot, new airplane development, Boeing Commercial Airplanes. “On the [Boeing] 787 … if both engines fail, you hit [FLC, flight level control], heading select [HS] and sit there,” he said. “The autopilot stays engaged on the RAT [ram air turbine] and the engines go into auto-relight.”
Current-generation airplanes typically provide closed-loop flight control systems with alleviations and compensations; flight directors integrated with the autoflight system; full-time autothrottles; engine autostart; full authority digital engine control (FADEC); flight management computers that tune frequencies in the navigation system as necessary; engine indicating and crew alerting systems; automation of cabin pressurization and other systems controls; and global positioning system receiver accuracy far higher than 15 years ago, with robust navigational redundancy from technology such as ring laser gyros, he said.
On such flight decks, however, further improvements to pilot training will have to complement this handover of functions to the automation. “How you build resilience in the system is [by giving] the pilot the same capability as the automatic system,” Carriker said. “Then you try to encourage the pilots to fly that manual system and [to] understand what the airplane just did on the automatic system. So when the automatic system drops, [pilots will realize,] ‘I’ve been here before. I’ve been on approach. … I know the pitch attitudes. … I know how this airplane flies.’”
From the high-level perspective, automation design and flight path management originate from philosophies written by airframe manufacturers. Ideally, these shape operator policies, procedures and practices as the creators intended, said Helena Reidemar, a first officer with Delta Air Lines and ALPA’s director of human factors. Sometimes, however, these “4P” elements become disjointed or even conflict with each other.
“We’ve been seeing way too many automation surprise and startle issues in recent years,” she said. “We need to reverse that trend, and it’s time to do that at the threshold of NextGen [the U.S. Next Generation Air Transportation System]. … In [this] near-term future, we’ll be working with tighter tolerances, self-separation, 4-D trajectory2 — we need to maintain some manual flying skills more than anything,” Reidemar said. “Automated systems are a tool for the pilot — not a replacement of us as operators or as monitors — and we need to consider the role of the automation in the overall system. Manual flying skills — cognitive and psychomotor skills — will degrade if they are not practiced.”
Any effort to update an airline’s philosophy, policies or procedures with respect to automation should begin with an understanding of the manufacturer’s formal automation philosophy, she advised. “Manufacturers’ automation philosophy [in two examples] is about design … it doesn’t talk about the operation and it provides little guidance for training, procedures, division of labor, workload management,” Reidemar said. “Then we need to work within our own organizations to fix the disconnects.”
She cited the work of NASA scientist Asaf Degani3 in flow-diagram visualizations of the ideal and non-ideal relationships among philosophy, policy, procedures and practice. “Unfortunately, we can find ourselves in situations where there is no overarching philosophy,” Reidemar said. “And this is truly problematic for the pilot and the organization. Now you are in uncharted territory. Nobody wants to be there. And it is not expected in normal operations. Perhaps the aircraft is doing something unexpected that we have no mental model for. Think Air France [Flight] 447 or Colgan [Air Flight] 3407. The complexity of component interactions can truly lead to some unanticipated systems behavior.”
While anticipating further NextGen implementation, taking the high-level perspective enables all responsible entities to introduce flight path management as “part of an elegant whole for [pilot] proficiency standardization — coherency in the broadest sense,” she added.
This effort also requires operators to be knowledgeable, considerate and highly sensitive to the limitations of current and anticipated automation. “Traditionally, we have seen [the company policy of selecting] the maximum automation available as necessary for [the] phase of flight,” Reidemar said. “That’s no longer sufficient. … [Airlines will have to] minimize the impact on the flow of traffic, and then maximize the smoothness and elegance of the human-automation interaction, mode switching and crew interface.”
She presented examples of the diversity of airline automation philosophies that she has studied. In one case, the de-identified airline used automation to a minimal degree and did not revisit the practice for 30 years, until recognizing potential savings in time and fuel that required rewriting its philosophy, policy and procedures. “So be cautious in just changing the order or flow of things,” Reidemar said. “You need to actually back it up and support it with policy, so the expectation for the pilot is clear.”
She described two airlines operating the same aircraft type, the Airbus A330, but one with a relatively rigid culture prohibiting open descent below 1,000 ft and another with a relatively flexible culture prohibiting open descent below 500 ft. “So two airlines [are] operating the same aircraft [with] significantly different philosophical differences in their automation policy,” she said.
Debates about automation benefit from a reality check against the old days, said Terry Lutz, a captain and experimental test pilot, Airbus. “The [pilot’s] navigation and communication roles are now largely automated, but the pilot still has to do the basic aviating task,” he said. “And a new task has been required of the pilot … to manage the overall mission. … If you look at the flying task in 2012, you realize that there is still a manual skill set required. But there is now a new skill set, which is extensively mental, that’s also required.” He cited progress in automated flight controls and “thrust-by-wire” engine controls that should factor into safety conversations about automated flight path management.
“You can view the controllers in modern fly-by-wire airplanes as either ‘super autopilot’ controllers, or you can view them as pilot controllers where the airplane itself is compensating for all of the undesirable motions — for the Dutch roll, for example, for the short-period mode of motion, for phugoid4 and to control the spiral, [all of] which will allow you to fly a very precise bank angle,” Lutz said. “Whether it be the sidestick controller that we use [in an Airbus] airplane or the manual controller in the Boeing 787, you also have two [flight] axes in one controller. Excellent HMI [human-machine interface provides] for force displacement and rate capability, and in pitch you find that it is basically a pitch rate command/pitch attitude hold. And in roll, a roll rate command and a bank angle hold.
“We can have an airplane today [in which] you can take off at maximum gross weight, have an engine failure and continue to rotate and take off and the airplane will stay wings level, maintain its heading and allow you to climb out and operate your normal procedures after that.”
Sea of Complexity
Thinking of pilots in an abstract way — as a flight deck subsystem notable for unique capability in risk management and system resiliency — yields further insights into an overall LOC–I solution, according to OSU’s Woods. “It’s very complex what you do … extremely complex what you manage … under fast-paced conditions,” he told pilots attending the forum session. “Sudden things can happen; unexpected and non-routine events occur. This is the sea of complexity that you operate in. … You end up being a critical ingredient in making this complexity work every day.”
Within the science of complexity and resilience engineering, a critical concept relevant to aviation safety can be expressed by the terms brittleness and resilience. These academic disciplines’ goals in analyzing complex adaptive systems, he said, include identifying failures in the interactions, understanding/measuring how systems are brittle, and extracting lessons about sources of resilience from aviation incidents or accidents so that extra “adaptive capacity” can be applied to future situations.
Commercial air transport has proven to be a popular example to other industry sectors of how people function as a hidden source of resilience. “When systems fail, they reveal points of brittleness and they reveal hidden sources of resilience,” Woods said. “There are regularities about how complex adaptive systems fail. … The question is, ‘Can resilience be engineered into organizations that carry out complex activities?’”
Teams of complexity scientists have noted since about 2000 that “the automation [in air transport] creates a layer of apparent simplicity over those increasing interdependent relationships, between more and more parts, so that everything looks simple and runs super smooth until it doesn’t,” he said. “Then we see cascades [pilots] have to try to keep up with. We see tipping points, we see surprises. … You have to be able to keep up with the cascade of events when a sensor failure [occurs,] and you don’t know what to trust in terms of cockpit indications. … You have to maintain a control margin [so] that you can act to compensate for those unexpected or non-routine events.”
Taking his complex adaptive system resilience approach is particularly relevant to compensating for any gradual de-skilling of airline pilots. “You’ve gotten good [in balancing safety and efficiency] because you have adapted,” Woods said. “[But] the present is more precarious than we think, and it’s a common finding from all approaches to safety, from an organizational perspective, that safe organizations are constantly on edge, recognizing that past success is no guarantee of future ultra-high safety performance.”
Questions and Concerns
One attendee recalled that Airbus’s Lutz, on another occasion, mentioned people imagining large commercial jets equipped with a “big red button, the recovery button.” Lutz said, “I think from both the Airbus and Boeing standpoint, what we are going to see … in future designs is [that] even in degraded modes … degraded hydraulics or degraded electrics or degraded flight control modes, you’re going to have some basic protections in the airplane that will keep you from exiting the … normal flight envelope. I think you’ll also find the ability to use the autopilot in a lot of degraded situations.”
He cited an existing automated system that maintains flight control on the Airbus A380, which is both a hydraulically controlled and an electro-hydrostatically controlled airplane. “We can switch off eight hydraulic pumps [two on each of four engines] and still fly the airplane normally on the electro-hydrostatic actuators and use the autopilot,” Lutz said.
The concept of a fully automated recovery system sounds great, he added, but current technology may not be up to the task because of the complexity. “Let’s think about it,” he said. “But to actually flight-test it and make it happen in the situations where you want it to happen — and then go to all the fringe cases — is very, very difficult.”
Boeing’s Carriker noted that one of the technology-based solutions from company engineers has been the adoption of transient-free switches between normal airplane modes of operation, which reduces the probability of situations requiring non-normal piloting. “You roll the airplane and [select] a switch in the overhead [panel] that turns on the flight controls,” he said, describing an in-flight demonstration. Activating that switch causes no perceptible tactile-feedback change such as a bump or a thump, he said.
Other attendees voiced concern about whether the future airspace environment will have enough margin of error for emergency changes of the programmed flight path by pilots. “The coming changes through NextGen–SESAR [Single European Sky Air Traffic Management Research] airspace, and the efficiencies [that authorities attempt to design] into that airspace in order to increase the density of operations are going to force us … to rely on automation to the exclusion of allowing either a human pilot or a human controller to intervene,” one attendee said. If pilots cannot turn the airplane safely within the constraints of the airspace, “Isn’t that the most brittle system you can imagine?” he asked.
Airbus’s Lutz reiterated that fly-by-wire technology compensates for the relatively imprecise human control inputs and aircraft type–specific aerodynamic characteristics. “We also have to provide [solutions] on the training side so that pilots can see that they can, in fact, fly the airplane in those environments,” he said. “And if they can’t, if manual control is not possible, then other measures have to be taken if traffic becomes truly that dense in NextGen.”
- Specialists in complexity science study how adaptive systems work, focusing on “how people in various roles learn, recognize, anticipate,” Woods said.
- In NextGen and SESAR planning, 4-D trajectories are four-dimensional paths — latitude, longitude, altitude and estimated time of arrival — that aircraft take or are expected to take.
- Degani, a scientist based at the NASA Ames Research Center, has applied expertise in human interaction with computers and automated systems to aviation safety contexts.
- Phugoid refers to a long-period longitudinal oscillation in the airplane’s flight path.