THE VIEW FROM ABOVE

The ‘automation problem’

By Captain Ed Pooley
There is clearly an automation
problem. But what is the real
cause of it? And why has it
taken so long to become
obvious?

Captain Ed Pooley is an
experienced airline pilot who for many
years also held the post of Head of Safety
for a large short haul airline operation.
He now works with a wide range of
clients as a Consultant and also acts as
Chief Validation Adviser for SKYbrary.

10
The rapid rise in the extent to which We should also remember that flying on effective knowledge-based decision
the pilot of a modern transport aero- transport aeroplanes no longer involves making.
plane manages and controls their much actual flying – and when it does,
aircraft with the aid of automated it is rarely undertaken without the ben- Perhaps you are not convinced? Let me il-
systems is well known. During this efit of at least some ‘automation support’. lustrate my point by looking at a couple of
change, the accident rate has stayed The majority of the generation of pilots superficially well known accidents where
low despite a continuing rise in air- now in the vicinity of retirement had the all did not go well:
craft movements. It seems to me that benefit of much more opportunity to fly
the extent to which a lack of compe- manually because automation was less First, the Air France Airbus A330 (AF447)
tence1 of pilots as the direct cause of extensive. This provided them the context which crashed in mid Atlantic in 20092. The
accidents has not diminished and, for the overall task of flight management two co pilots were (jointly3) in charge of the
relative to other such causes, has rather than it nowadays being, on almost aircraft whilst the Captain took his planned
probably increased. every flight, the central task. Only in the rest in the cruise. It was a night flight and
case of the take off have the means to the aircraft had been in level fight in IMC
It is possible to see that the effects of automatically control the aircraft through for some time with the autopilot engaged.
high levels of aircraft automation ap- automatic system management not yet Then, unexpectedly, they were faced with
pear to have been two-fold: been found. Interestingly, that is the one a sudden successive but ultimately very
flight phase where the key to aircraft brief4 loss of all air speed indications and
Pilots’ Knowledge of both their flight safety – appropriate pilot decision an uncommanded disconnection of the
automated systems and the way making based on readily recalled knowl- autopilot. Although there was no strictly
they interact with how aircraft edge – is still crucial if an unexpected situ- applicable checklist for such an occurrence
fly however they are controlled ation occurs, although of course it rarely given that it was not considered sufficiently
is often insufficient to cope with does. likely at the time, the immediate pilot ac-
abnormal events unless these tion in such cases was – and remains – ‘do
are resolved by straightforward Much has been made of the importance nothing’. But one of the pilots almost im-
checklist compliance. of cross-monitoring in a two pilot flight mediately initiated and sustained a climb,
deck as a defence against inevitable hu- something that was inevitably going to
The extent and nature of the De- man error. Much emphasis has also been lead rapidly to a stall5, which it did. Despite
cision Making which is required placed on compliance with the compre- the stall warning – for which there is an ef-
to operate a highly automated hensive set of rules and procedures which fective mandatory response – the pitch up
aeroplane today is quite different aim to cover all the situations which it is was continued. And the other pilot failed to
from that required to fly most sim- anticipated that pilots will ‘normally’ en- intervene verbally or by taking control. By
ilar-sized aeroplanes thirty years counter. But in the context of automation, the time the Captain hurriedly returned to
ago. both these contributions to safety are, the flight deck, the aircraft was fully stalled
whilst unquestionably important, simply and descending at 10,000 fpm leaving him
The relationship between these two attempts to treat the symptom not the insufficient time to assimilate what was
components of pilot competence cause. The focus needs to be placed firmly happening and regain control. 44
is important. Decision making in
the event of abnormal occurrences
which are not covered by a ‘scripted’ 1- ICAO, in Doc 9995, a recently issued Manual describing a new approach to pilot training based on the demonstration
of a number of defined competencies, defines competency as "a combination of knowledge, skills and attitudes required
procedural response often requires to perform a task to the prescribed standard". The eight competencies which are defined include "aircraft flight path
‘background’ knowledge. Before management, automation" and “aircraft flight path management, manual control".
automation became so dominant, 2- For more detail on this see:
http://www.skybrary.aero/index.php/A332,_en-route,_Atlantic_Ocean,_2009_(LOC_HF_AW)
such knowledge was usually avail- And to see what the public are being 'told' in a surprisingly coherent and fairly accurate account published recently
able on account of more frequent general media, see http://www.vanityfair.com/business/2014/10/air-france-flight-447-crash
use. But now it is rarely required and 3- The Captain did not explicitly designate one of them as the senior pilot and Air France procedure on the matter was
has either never been acquired at all arguably ambiguous.
4- All three airspeed indications were lost for around 30 seconds and two for around a minute.
or since forgotten due to lack of use 5- The angle of attack which corresponds to normal high altitude cruise is usually relatively close to that at which a stall
either on the line or in training. warning would be triggered.

HindSight 20 Winter 2014 11

THE VIEW FROM ABOVE

The ‘automation problem’ (cont'd)

The aircraft had been crossing the zone

of convective weather known as the
ITCZ6. This region was already well known
as a potential environment for ice crystal
icing at temperatures below -40°7 and the
potential for this to cause temporary loss
of the dynamic air pressure necessary for
airspeed to be computed and displayed.
No other flight instruments failed8 and all
that was required was to continue in level
flight with the same engine thrust and at
the same aircraft pitch attitude. The lat-
ter is the basic way aircraft are controlled
and an indication of pitch attitude would
have been enough to continue the cruise
temporarily even if altitude and engine ILS Glideslope was out of service and engaged, it would no longer track the
thrust indications had also failed, which the weather conditions did not warrant selected speed, the mode providing
they had not. The investigation was not the issue of clearances to fly the avail- this function having been overridden
able to account for the actions of one co able Localiser-only procedure. The Pi- by manually setting idle. As the Asiana-
pilot or the inactions of the other. But, on lot Flying (PF), a trainee Captain being designated stabilised approach ‘gate’
the evidence presented, you may recog- supervised by a Training Captain and at a height of 500 feet was passed, the
nise that perhaps a 'startle' phase degen- with the relief First Officer occupying aircraft was not stabilised in accordance
erated very quickly into confusion and the Observer seat, decided that rather with the specified criteria10 but nothing
uncertainty. This replaced the rational re- than fly a visual approach, he would use was said. With the thrust remaining at
sponse that is usually founded in any pro- the automatics to capture the Localiser idle, the aircraft began to progressively
fessional by an underlying grasp of how and set the Vertical Speed mode so as descend below the correct vertical pro-
their 'machine' works. What happened to to follow the standard vertical profile file. It seems that none of the pilots were
two pilots 'working together' seems to as detailed on the Localiser-only plate. able to comprehend the reason why the
me to have been impossible if there had Localiser capture went as intended but view out of the window of the runway
been not just knowledge about the state right from the start, the PF had diffi- perspective then steadily became more
of the automated systems but at a very culty in properly controlling the verti- and more abnormal as also confirmed
fundamental level about how all aircraft cal speed. About 1500 feet and about by the visual descent path guidance
fly. Of course prompt compliance with 3.5 miles out, somewhat higher than provided by the PAPI11 as the latter pro-
the mandatory stall warning drill could the correct vertical profile required, he gressively changed from white/white/
have saved the day but the investigation made inappropriate mode selections white/red (just above profile) at 500
was also unable to explain the absence of and, when they caused the autopilot to feet agl through the two intermediate
that. I should mention that the flight en- begin to climb the aircraft, he decided stages to reach red/red/red/red (sig-
velope protection function on this aircraft to resolve the situation by disconnect- nificantly below profile – stop descent
type which prevents pilots ‘accidently’ ing the Autopilot and manually select- until profile regained) at 219 feet agl.
losing control of their aeroplanes by tak- ing flight idle thrust. But he was un- It appears that once below 500 feet,
ing them into a stall despite stall warning aware that having left the Autothrottle none of the pilots had noticed that the
activation became inoperative because
the applicable control law changed from 6- Inter Tropical Convergence Zone
‘Normal’ to ‘Alternate’ when all three air 7- Such icing results from ice crystals which encounter heated parts of an aircraft such as engines and pitot tubes
data computers registered a lack of valid being heated to melting point and then temporarily re-freezing.
8- Although there was intermittent loss of Fight Director guidance on both pilots’ Primary Flight Displays.
input for airspeed calculation.
9- For more detail on this see:
http://www.skybrary.aero/index.php/B772,_San_Francisco_CA_USA,_2013_(LOC_HF_FIRE_AW)
Second, the Asiana Boeing 777 (OZ214) 10- Because the rate of descent was 1200 fpm when around 700 fpm would have been expected, because the
which crashed at San Francisco in 20139. thrust setting was not appropriate to the aircraft configuration and because more than ‘small changes in heading
and pitch’ would have been required to maintain the correct flight path.
On a VMC day, ATC gave the crew a visual 11- Precision Approach Path Indicator - see:
approach at San Francisco because the http://www.skybrary.aero/index.php/Visual_Approach_Slope_Indicator_Systems for a description

12
the passive willingness of
some aircraft operators to
permit pilots who have not
been adequately prepared must be assured rather than assumed the past than there is today. But what
to fly the line in all the before the appointment is confirmed.
The management decision that the
has actually kept the accident rate12
low? Automation of course! It’s grown
situations they might find Trainee Captain was ready to begin the rapidly in both its capability and in its
themselves in is not new. final phase of his command upgrade
also seems, in my opinion, to be at the
reliability. Its effect has been to change
the role of the pilot into one which re-
Indeed, the history of acci- very least questionable. The capabili- quires – most of the time – a different
dents and incidents appears ties of modern flight simulators, pro-
vided they are combined with com-
set of skills underpinned by additional
knowledge. But these new skills do not
to indicate that there was petent management decision making replace pilots’ need to have the ability
about whether trainee commanders to manually manage and fly the aircraft
proportionately far more of have reached the 'almost-ready' stage, during infrequent and unexpected de-
this 'passive willingness' in mean that line training has become a partures from the automated normal-
confirmation of competence not an ity. There will always be some situa-
the past than there is today. exploration of it. I think the evidence tions that do not lend themselves to a
of this Investigation shows that the prescribed SOP response even with the
competence of the trainee was still be- number of these that now exist. Com-
airspeed was dropping, the thrust was ing explored. He had insufficient con- pliance culture can certainly help avoid
at idle, the rate of descent was increas- fidence in his ability to fly the aircraft accidents but alone it is not enough. A
ing far in excess of that which would be without using the automatics to the deeper background appreciation of
expected for a descent on the correct maximum extent possible and having the big picture – both how aeroplanes
profile and the progressive increase in decided to rely on the automatics, he actually fly and how the automated in-
pitch in an attempt to ‘reach’ the runway was unable to use them properly. Then, terface between the pilot and his par-
was rapidly creating a pitch attitude when it all began to go wrong, he did ticular machine functions – is a funda-
which was completely at odds with not understand how they worked. As mental part of competence13.
that which would normally be seen. All with AF447, the day could have been
these are fundamental requirements saved in the early stages, and indeed Think back to the Qantas A380 which
for the collective situational awareness in this case much later, by the simple suffered an uncontained engine fail-
of the crew. Recognition of any one of expedient of compliance. The Asiana ure in 201014. The consequences of the
these would have constituted a require- stabilised approach SOP was cleared collateral damage which followed this
ment for an immediate go around. But stated and clearly breached both at caused the (fortunately) augmented
in the end, a very late recognition that the specified 500 feet 'gate' and then crew to abandon the ECAM-directed
the aircraft was – to put it mildly – not continuously once below it. response in favour of action informed
going to make the runway only led to by their knowledge-based ad-hoc de-
the initiation of a go around at 90 feet I take the view that the passive will- cisions. Yet just like all the others, this
agl. Whilst this would not have been ingness of some aircraft operators to crew usually had a routine automated
too late on a normal approach, it was permit pilots who have not been ad- flight focused primarily on diligent
at the prevailing low energy state of the equately prepared to fly the line in all system management. Think, too, of
aircraft. The tail hit the low sea wall just the situations they might find them- the Cathay Pacific A330 crew who,
before the runway threshold and broke selves in is not new. Indeed, the history also in 2010, got their aircraft safely
off after which fuselage was no longer of accidents and incidents appears to on the ground in Hong Kong when
controllable and a crash was inevitable. indicate that there was proportionately both engines began to malfunction
far more of this 'passive willingness' in after they had unknowingly loaded 44
The complete lack of situational aware-
ness of the newly appointed Training
12- Recorded incidents attributed to ‘pilot error’ (as opposed to accidents) have by contrast increased because of a
Captain who watched this scenario combination of better reporting and better investigation processes, especially the widespread use of recorded flight
unfold is particularly difficult to un- data to put alongside the narratives submitted by pilots.
derstand. This is the very strand of 13- Knowledge is at the core of the recent competency-based ICAO pilot training guidance referenced earlier and in
competence that underpins the essen- the Airbus adaptation of it for A350 type rating training is explicitly, rather then implicitly defined as a 'competency'
- see 'Learning from the evidence' pps 24-32 in Safety First (the Airbus Safety Magazine) Issue 18, July 2014
tial performance of a senior Captain 14- For more detail on this see:
appointed to this role and, as such, it http://www.skybrary.aero/index.php/A388,_en-route_Batam_Island_Indonesia,_2010_(LOC_AW)

HindSight 20 Winter 2014 13

THE VIEW FROM ABOVE

The ‘automation problem’ (cont'd)

contaminated fuel for their flight15. reduce the prevalence of occasions similar cost/benefit balance. In both cas-
Again the crew demonstrated their abil- when the performance of pilots leads es, as well as being more efficient than
ity to deal with a situation for which ex- to the crash of an essentially or even humans, it is also more reliable - until
isting prescribed responses alone were a fully serviceable aircraft. And we will that is, it fails. Which is when the licence
not enough to secure a safe outcome. see more instances of recovery from holder in ether case has to pick up the
I see these responses as a clear indication potential disasters such as the Qantas pieces rather like they used to do as a
that the crews involved must have been and Cathay Pacific examples quoted. full time job before automation. When
both selected and trained by their em- this happens, the response expected
ployers in a way that enabled these im- It is perhaps worth reflecting that, on of controllers, as with pilots, is likely to
pressive performances. the evidence available, the industry as be time-sensitive and require recovery
a whole and the regulatory system in from a situation in which:
So I conclude that, whilst the way auto- particular can reasonably be charac-
mation is delivered in aircraft design can terised as having been sleepwalking automation may have been manag-
always be improved, the root of the auto- towards the situation we are now in. ing a situation which is more com-
mation problem we are seeing today does There has been a failure to realise that plex than the human would have
not lie primarily – as many human factors the undoubted safety benefits of au- been.
experts will tell you – in system design. tomation needed a lot more attention the human may well be 'startled' and
Rather, it lies in ensuring that people with to pilot qualification and pilot training their initial response less than opti-
the right aptitude and ability are trained than we have seen in all but a relatively mal.
as pilots in the first place. And that they few enlightened operators. there may be no pre-trained re-
are thereafter provided with type and sponse which fits the scenario.
recurrent training which is compatible Finally, can we expect the ‘automation the realism of prior training for "the
with a job which now typically has very problem’ to get worse if there contin- unexpected" may have been poor
long periods of automated routine punc- ues to be no ‘structural’ response to and / or the frequency of exposure to
tured only very rarely by the challenge the underlying cause I have identified? it may have been insufficient.
of something (completely) unexpected. Unfortunately, the answer is a resound- the automation abnormality may
Even with the very best selection pro- ing ‘yes’. We are rapidly moving towards have been unintentionally precipitat-
cesses, a successful outcome to any path the time when both pilots on the flight ed by one's own action (or inaction).
through training is not a guaranteed one. deck will have gained all their experi-
There is a very heavy responsibility on all ence in the ‘automation age’. The con- And there is another rather important
aircraft operators to ensure that they do sequences of the transition to automa- similarity linking pilots' and controllers
not release pilots to line flying duties until tion have so far been masked by the response to the challenges of automa-
there is solid evidence that all aspects of broader experience which older pilots, tion – their licence holding status. In my
their professional competence have been especially those in command, have view this brings with it a personal pro-
clearly demonstrated to be compatible had. In some cases, their personal con- fessional responsibility which is just as
with their role. version to automation may have been much a part of the solution to automa-
incomplete but their reversion skills tion issues as the obvious responsibili-
A similar training challenge can be found were ingrained through early-career ties of employers to ensure they recruit
in other jobs where the role of automa- use and have been readily accessible people with the right aptitude and then
tion has rapidly increased and has also when suddenly needed16. But we are ensure that they provide them with the
delivered greater overall safety by this now rapidly leaving that comfort zone training they need to manage both the
very fact. So whilst in aviation, we cer- with only best practice at leading op- normal and the abnormal. The latter
tainly need an operating culture under- erators showing the way for the rest…. may require ad hoc decisions based on
pinned by procedures and compliance, rarely-recalled knowledge and the re-
the real foundation is, as in other compa- Now what if anything does all this sponsibility to possess and be able to
rable risk bearing occupations, the right mean in terms of the automation and apply it is very much in the interests of
people in the right jobs who are trained safety in ATC? In principle, automation both the individual and their employer.
in the right way. Then we will be able to for both controllers and pilots has a Now there's some more complexity...
and a need for ANSPs and their Regu-
lators to take a lead from best practice
15- For more detail on this see:
and not be content with achievement
http://www.skybrary.aero/index.php/A333,_Hong_Kong_China,_2010_(LOC_RE_GND_FIRE)
16- Think of the A320 successfully ditched in the Hudson River off Manhattan in 2009 after a multiple bird strike - of safety management at the threshold
details at: http://www.skybrary.aero/index.php/A320,_vicinity_LaGuardia_New_York_USA,_2009_(BS_LOC_AW) . of audited compliance.

14