By Jan W. Steenblik, Technical Editor
Air Line Pilot, November/December 2004, p.24

ALPA held its 50th annual Air Safety Forum August 18-19 in Washington, D.C. The event, open to the public, drew more than 250 ALPA pilot safety representatives, management pilots, and representatives of the aviation industry and U.S. and Canadian government agencies.

Ten panel discussions and two presentations by aircraft manufacturers covered a wide range of important aviation safety topics. A few examples follow:

Capt. Terry Lutz (Northwest), director of ALPA’s Aircraft Development and Evaluation Programs, and First Officer Dave Hayes (Northwest), director of ALPA’s Aircraft Certification Programs, talked about throttles-only control (TOC) and propulsion-controlled aircraft (PCA).

"Very few [airline] accidents have occurred in which loss of normal flight control occurred," Capt. Lutz noted. "However, between 1974 and 2004, five airline accidents involving loss of normal flight controls took 1,098 lives. And of 3,447 airplanes flown by U.S. carriers, 1,607—46.6 percent—have no mechanical backup flight controls."

NASA has tested TOC in seven different airplane types in flight, including three transport types (B-747, B-777, and MD-11). The tests showed that pilots could maintain gross control of heading and flightpath in all of the types tested, but that using TOC to make a safe landing on a runway is "exceedingly difficult."

The agency thus conceived and tested the PCA system—a software-based system with future adaptability—and has achieved nearly normal landings with it. Flight tests showed "an ILS-coupled PCA system can make safe landings over a very wide range of conditions," F/O Hayes reported.

The PCA system, he pointed out, requires no new hardware; provides excellent control like a conventional autopilot; is cost-effective; and could be certified for airline use fairly quickly. It could provide a safe resolution of inflight aircraft system failures plus ground-to-air attacks by shoulder-launched missiles and other smaller arms.

Capt. Lutz and F/O Hayes said ALPA will continue to advocate that airframe and engine manufacturers develop PCA systems and incorporate them into their products, and that PCA systems be made a requirement of certification for transport category aircraft. They said that both the Department of Homeland Security and the Transportation Security Administration have expressed interest in the concept. On the international front, ALPA will work through the International Federation of Air Line Pilots Associations and the International Civil Aviation Organization to promote the PCA concept internationally.

Capt. Paul McCarthy (Delta, Ret.), IFALPA principal vice-president for technical standards, Capt. Lindsay Fenwick (Northwest), chairman of ALPA’s Accident Analysis Group, and Jim Johnson, managing attorney in ALPA’s Legal Department, made up a panel on criminalization of aircraft accidents.

Airline pilots, they warned, have been prosecuted for being involved in airline accidents. The risk is greater abroad.

"In the United States, the lack of successful prosecution has been a combination of culture and luck," explained Capt. McCarthy, who has been a practicing attorney. "In foreign countries, it’s been sheer luck. Local law controls—where the accident happens is the sole factor determining exposure to prosecution."

In foreign countries, several airline pilots have been prosecuted. U.S. and Canadian pilots have no special immunity abroad.

The definition of admissible evidence varies greatly in other countries. All jurisdictions accept flight data recorder information, radar data, and air traffic control communications as admissible evidence. Most accept cockpit voice recorder transcripts. A few accept an official accident report.

IFALPA wants two amendments made to ICAO Annex 13, the international agreement that deals with accident investigation.

First, says IFALPA, Annex 13 should adopt a uniform standard of culpability. The Warsaw Convention to ICAO uses a standard of "willful and wanton misconduct" to differentiate between simple negligence and intent. "We believe this is appropriate," Capt. McCarthy declared.

Second, appropriate chapters of Annex 13 should be amended to make clear that the opinion and analysis portion of the accident report should not be used in civil or criminal legal actions. ICAO Annex 13 should explain (1) what these portions of the report are intended to accomplish, and (2) the chilling effect of continuing to use such safety-oriented information in a punitive way.

Capt. Eduardo Menini, Embraer 170/190 project pilot, shared details from his company’s flight test development program for the Embraer 170, 175, 190, and 195. Unlike the earlier Embraer small jets, the 170/190 family has underwing engines.

Teamwork involving groups specializing in flight mechanics, performance, aerodynamics, flight controls, system engineering, and flight test, working together through the development and certification flight test process, was a key factor in the success of the program, Capt. Menini said. He added, "Human factors issues have to be treated as part of the design from scratch all the way to validation."

Capt. Menini explained that the EMB-170/190 family uses fly-by-wire for several high-level functions. Those involving the elevator are the angle-of-attack limit function, elevator thrust compensation, and column gain shaper (i.e., change in required control column force). The rudder is included by means of the yaw damper and turn coordination (via the autoflight control system, or AFCS). The roll spoilers also are FBW, as are the speed brake/ground spoilers, and the spoiler mixer, which combines speed brake and roll spoiler actuation. In the horizontal stabilizer system, FBW provides automatic configuration trim (to compensate for spoiler deployment), plus elevator offload to the stabilizer to reduce trim drag.

The AOA limiting function, one of the most important FBW features of the EMB-170/190 family, is provided by the flight control module through a command to the elevators. The ACFS provides stall warning through the stickshaker. The AOA limiting function also provides an elevator variable stop continuously set by an algorithm that takes into account such key variables as actual AOA, AOA rate of change, and aircraft configuration.

The EMB-170/190 stall, said Capt. Menini, "is defined by the pilot reaching the aft control column stop, regardless of the aircraft CG position and type of maneuver (straight, turning, or accelerated stall). This leads to uniform, repeatable, and safe flight characteristics at the edge of the flight envelope."

Three researchers from the NASA Ames Research Center discussed their ongoing work on some human factors issues vital to pilots.

Dr. Barbara Burian talked about NASA’s Emergency and Abnormal Situations Project—specifically, issues in designing checklists for emergency and abnormal conditions. She cited dozens of factors that go into the design of checklists, procedures, and manuals, from physical properties (size, weight, materials) to engineering accuracy and grammar and punctuation.

Dr. Burian provided several examples of ambiguous, misleading, incorrect, out-of-sequence checklists that airlines have used. Checklist designers, she pointed out, have followed different philosophies in directing pilots to the correct checklist—the "gateway" checklist, several separate checklists, and a single integrated checklist.

Many factors should drive checklist design and content, she said: differences in aircraft and equipment design; understanding of how different types of fires are ignited, fed, and spread; type of operations (ETOPS, passenger vs. cargo); assumptions about efficacy of crew response and expectations about amount of time available; human factors considerations, understanding of human performance while under stress; history of the airline, history within the airline industry; philosophies, company policies, and economic considerations; and regulations, advisory circulars, and other guidance material.

Dr. Burian compared checklists and procedures for dealing with smoke, fire, and fumes in four contemporary jet airliner types, focusing on where in the checklist pilots would find guidance on emergency descents and diversions, and how that guidance was stated. The placement, emphasis, and wording of the directive to land at the nearest suitable airport varied widely among the checklists.

She noted that, in a study of 15 inflight fires that occurred between January 1967 and September 1998, the Transportation Safety Board of Canada found that the average amount of time between the detection of an onboard fire and when the aircraft ditched, made a forced landing, or crashed was 17 minutes.

Ben Berman discussed pilot training for emergency and abnormal situations. The mission of the ongoing NASA study, he said, is to (1) understand, in detail, how the airline industry trains airline pilots today for emergency and abnormal situations, and (2) assess practices, procedures, and philosophies.

"We’re making on-site visits to U.S. FAR Part 121 carriers," he explained. "These involve a five-day visit by two NASA researchers, including structured interviews and simulator observations and document reviews. We’re looking at two fleet types at each airline, if available. So far, we’ve completed eight site visits and are planning at least one more. We’re collecting and organizing data for analysis; we’re still raising questions."

The project has already revealed several common issues "raised by nearly everyone we’ve seen," Berman said. These issues include the following:

• Fixed training "footprint" issues: Footprints vary across airlines, but for each airline, footprints remain essentially fixed; with limited time for training, what should be trained?

• Another issue: Normal vs. non-normal procedures—which non-normal procedures should be trained?

• What does "train to proficiency" mean? The original implication, Berman asserted, was "no normal ceiling on training. The current implication is no formal floor on training." Also, there’s a big difference between training and mere exposure to information. Related concerns include (1) performance in recurrent training and checking, and (2) validity of checkrides.

• Measuring effectiveness, Berman pointed out, can be handled several ways: Operational data (FOQA/ASAP/LOSA [line-oriented flight audit] data, irregularity reports, and accident/incident reports), plus the simplistic notion, "We aren’t killing people, so we must be doing well." Another way is by grading training/checkride data—pass rates, first-look grades, session grading; "our pass rates are excellent; that shows we’re doing well."

• Then there’s AQP (Advanced Qualification Program) vs. Part 121: Traditional training under FAR Part 121 was driven by FAA requirements; AQP is designed to let data indicate problems and demonstrate corrective response. AQP carriers apparently have adopted the data-driven philosophy. However, questions have arisen about the effectiveness of AQP in practice.

Airlines vary widely in how they integrate crew resource management into simulator training, practice, and evaluation. These issues are related to AQP vs. Part 121 training programs. "Nearly universal support exists for recurrent LOFT [line-oriented flight data]," Berman reported. "Everybody likes it, or wants it, or wants more of it." However, does current LOFT methodology provide desired training in making decisions?

• Another common issue: Absence of standards within/across airlines. This includes assignment of duties during non-normal situations—who’s the pilot flying (captain, first officer, or current pilot flying)? who handles the radios (the pilot flying, or the pilot monitoring)? who handles memory items (the pilot flying, "whoever gets to it first," or the pilot monitoring)? who guards and confirms critical items? Another area lacking standards within/across airlines is use of automation during non-normal situations.

• Systems knowledge: Regarding pilots’ ability to analyze the situation, Berman noted, the old view was, "You should be able to build the airplane." The new view is, "If you can’t see it, touch it, or affect it, you don’t need to know about it."

• "Light-driven" responses by pilots—i.e., pilots responding to caution, advisory, and warning lights—are another area of interest to researchers. Such pilot responses may inhibit analysis, cause problems during "unannunciated" and misleading situations, and burden Quick Reference Handbook writers to make the QRH a "cookbook."

• Moreover, rushing, stress, and workload management are thorny issues: Problems seen in training and/or on the line may not always involve technical or procedural knowledge or abilities; rather, they may be human reactions to stress and overload. Real emergencies are not the same as emergencies in a flight simulator. Should pilots be trained to manage workload and stress?

"The study is still in its initial stages," Berman advised. "We welcome your input!"

Dr. Key Dismukes gave a compelling presentation, "The Limits of Expertise: The Misunderstood Role of Pilot Error in Airline Accidents." He reviewed NTSB reports of the 19 U.S. airline accidents between 1990 and 2000 attributed primarily to crew error and asked, "Why might any airline crew in the situation of the accident crew be vulnerable to the same error?"

No one thing, Dismukes emphasized, "causes" accidents; they are a confluence of multiple events, actions taken or not taken, and environmental factors. He noted six overlapping clusters of error patterns: (1) inadvertent slips and oversights while performing highly practiced tasks under normal conditions, (2) the same under challenging conditions, (3) inadequate execution of non-normal procedures under challenging conditions, (4) inadequate response to rare situations for which pilots are not trained, (5) judgment in ambiguous situations, and (6) deviation from explicit guidance or SOP.

He also discussed several "cross-cutting" factors that contributed to flight crew errors:

• Situations requiring rapid response (nearly two-thirds of the 19 accidents): Examples include upset attitudes, false stickshaker activation after rotation, anomalous airspeed indications at rotation, pilot-induced oscillation during flare, and autopilot-induced oscillation at decision height. These happen only very rarely, but they involve high risk. Surprise is a factor, and the pilots, not having time to think, must respond automatically.

• Challenges of managing concurrent tasks (a factor in the great majority of accidents): Workload was quite high in some accidents, but in most, time was available to perform all required tasks. Pilots are especially vulnerable to error when switching attention among tasks, interrupted, distracted, or forced to defer tasks out of normal sequence. This vulnerability is inherent in basic cognitive processes: A person can attend to only one distinct task at a given instant; once our attention is diverted from a task, we do not always remember to resume the task if not prompted. Better monitoring can help prevent/catch errors, but monitoring is itself a concurrent task and vulnerable to the same factors that produce errors.

• Equipment errors and design flaws (occurred in two-thirds of these accidents): Some equipment failures/design flaws precipitated the chain of events (e.g., false stickshaker after rotation); others undermined the pilots’ efforts to respond (e.g., stickshaker failed to activate when aircraft approached stall).

• Stress: Acute stress hampers performance by narrowing attention ("tunneling") and reducing working memory capacity. "The combination of surprise, stress, time pressure, and concurrent task demands can be a lethal setup," Dismukes warned. NASA has begun a project to research the effects of stress on crew performance.

• Shortcomings in training and/or guidance (a factor in more than one-third of the accidents): Examples include inadequate guidance to pilots about known problems (e.g., high sensitivity of wings without leading edge devices to minute amounts of frost) and upset attitude recovery training. Also, how should the aviation industry deal with the fact that pilots can’t be trained for every possible situation?

• Plan continuation bias: This is an unconscious bias to continue with an original plan despite changing conditions. It appears stronger as one nears completion of activity (e.g., approach to landing). This bias may prevent pilots from noticing subtle cues that the original conditions have changed, and may combine with other cognitive biases such as frequency sampling bias ("It’s always worked before") and the fact that responding reactively is easier than thinking proactively.

• Social/organizational issues.

• Actual norms may deviate from the Flight Operations Manual: Few data are available on the extent to which accident crews’ actions are typical.

• Competing pressures on pilots (e.g., pressure to meet schedule vs. conservative response to ambiguous situations) have not been studied or acknowledged very much: Pilots may not be consciously aware of the influence of internalized competing goals.

Dismukes offered "no easy solutions." He urged all parties to "recognize that most accidents are systems accidents," and to find the "hidden vulnerabilities of systems." Pilots, managers, and designers of equipment and procedures, he argued, "should be well-educated about human cognitive characteristics and limitations." They should review procedures to ensure they do not contribute to inherent cognitive vulnerabilities, and insist on conservative, hard lines in critical situations.

Noting that researchers need better information on how the airspace system typically operates, and how pilot respond to it, Dismukes called for beefed-up training, including training for upset attitude recovery and other rapid-response situations, plus more training on monitoring.

"We must acknowledge the inherent tradeoffs between safety and [air transportation] system efficiency," he concluded. "We must include all the parties in analyzing the tradeoffs, and make policy decisions explicit."