DRAFT
Safety Enhancement 30
Revision 3
Mode Awareness and Energy State Management Aspects of Flight Deck Automation
DRAFT Final Report
February 5, 2008
Table of Contents
Acronym List
1.0 Introduction
1.1 Background
1.2 Methodology Overview
1.3 Summary of Results and Recommendations
1.4 Report Organization
2.0 SE–30 Automation Policy
2.1 Philosophy
2.2 Levels of Automation
2.3 Situational Awareness
2.4 Communications
2.5 Verification
2.6 Monitoring Automation
2.7 Command and Control
2.8 Recommendation Summary
Acronym List
A/TAuto Throttles (Boeing)
A/THRAuto Thrust (Airbus Fly-by-wire)
AFSautomatic flight system
AIDSAccident and Incident Data System
APautopilot
ASIASAviation Safety Information Analysis and Sharing
ASRSAviation Safety Reporting System
CAMIConfirm, Activate, Monitor, Intervene
CASTCommercial Aviation Safety Team
CDUcontrol and display unit
ECAMelectronic centralized aircraft monitoring (Airbus)
EICASengine indication and crew alerting system (Boeing)
FAAFederal Aviation Administration
FCUflight control unit (Airbus)
FDflight director
FMAflight modes annunciator
FMCflight management computer (Boeing)
FMGSflight management guidance system (Airbus)
FMSflight management system
FPVflight path vector (Airbus)
GPSglobal positioning system
INSinertial navigation system
JIMDATJoint Implementation Data Analysis Team
LNAVlateral navigation
MCPmode control panel (Boeing)
navaidsnavigational aids
NDnavigation display
PARCPerformance-Based Aviation Rulemaking Committee
PFpilot flying
PFDprimary flight display
PMpilot monitoring
PNFpilot not flying
SESafety Enhancement
VNAVvertical navigation
VOR–DMEvery high frequency omnirange station–distance measuring equipment
VVMVerbalize, Verify, Monitor
CAST SE–30, Revision 3 Final Report1
DRAFT
1.0 Introduction
1.1 Background
Automation has contributed substantially to the sustained improvement in air carrier safety around the world. Automation increases the timeliness and precision of routine procedures, and greatly reduces the opportunity to introduce risks and threatening flight regimes. In short, automation has been very positive. Nevertheless, in complex and highly automated aircraft, automation has its limits. Equally or perhaps more critically, flightcrews can lose situational awareness of the automation mode under which the aircraft is operating or may not understand the interaction between a mode of automation and a particular phase of flight or pilot input. These and other examples of mode confusion often lead to a flightcrew’s mismanagement of the energy state of the aircraft or to the aircraft’s deviation from the intended flight path for other reasons.
The Loss of Control Joint Safety Analysis Team, chartered by the Commercial Aviation Safety Team (CAST), identified this issue as a factor or problem in several major accidents in the United States and around the world. The subsequent CAST Joint Safety Implementation Team recommended in Safety Enhancement (SE) 30 that CAST charter a Joint Implementation Data Analysis Team (JIMDAT) subteam to address mode confusion in cooperation with a working group chartered by the Performance-Based Aviation Rulemaking Committee (PARC), which was in the midst of a more broadly based study of issues related to automation.
In late 2005, CAST chartered the SE–30 Data Review Team to undertake this task (see appendix A to this report for the team charter). The team was directed to restrict its work to the issue of mode confusion and to work closely with the PARC, which continued to address a more comprehensive range of automation issues. The SE–30 Data Review Team was charged with producing a prototype automation policy, or an exemplar, for aircarriers. The exemplar would combine a set of best practices in the industry with suggested additions to fill any identified voids. The ultimate objective of any policy exemplar would be to help minimize the frequency with which flightcrews induce automation errors and to help flightcrews recognize and correct automation errors in a timely fashion, regardless of the source of the error.
1.2 Methodology Overview
To identify any such voids, the team began by reviewing hundreds of reports from the Aviation Safety Reporting System (ASRS) and from other public data sources, including the Federal Aviation Administration (FAA)’s Accident and Incident Data System (AIDS) and the National Transportation Safety Board’s Accident and Incident Database, all of which were compiled by the FAA’s Aviation Safety Information Analysis and Sharing (ASIAS) center. The final dataset included 480 incident and accident reports during 14CFRPart121 operations by U.S. air carriers.
The team then reviewed in detail 50de-identified ASRS reports from pilots over the preceding 5years (2000 through2006). The reports dealt solely with automation incidents involving energy state management and mode awareness, and allowed the team to conduct a gap analysis between guidance in air carrier automation policies and pilot actions described in the reports.
The SE–30 Data Review Team also requested and received current automation policy statements from 16air carriers from which the team sought to identify common concepts and operational best practices that could contribute to a prototype automation policy for the entire industry. Such a policy would be designed to minimize the frequency with which flightcrews inadvertently induce automation errors, or fail to recognize and correct any errors in a timely fashion.
Ultimately, the team derived a set of recommended automation policy components that, if incorporated in policy and reinforced in training, would allow pilots to trap or avert many acute automation errors.
See appendix B to this report for a detailed discussion of data gathering, data extraction parameters, data set discrimination, gap analysis, and subject matter expert review.
1.3 Summary of Results and Recommendations
Among the 16 air carrier automation policies, the most common concept was, as stated by one air carrier, to “use the level of automation that will best support the desired operation of the aircraft.” This concept is fine if the flightcrew understands what the automation is doing at the time of the problem onset, and is then able to determine if the current or another automation level will better suit the operation. However, nearly all incident reports shared one common factor: regardless of whether an error was pilotinduced or was a function of the automation system, pilots did not understand what the automation was doing, or did not know how to use it to eliminate an error. In all 50cases, pilots were unable return the aircraft to the desired flight path in a timely manner. This was because of two root causes: (1) inadequate training and system knowledge, and (2) the unexpected incompatibility of the automation system with the flight regime confronting pilots in their normal duties. Consequently, the team’s recommendations emphasize specific elements that air carriers should incorporate into their automation policies and which should be systematically reinforced.
The most generic recommendation addresses an automation philosophy that should permeate any air carrier’s policy. While recognizing that automation has brought major improvements to safety, the team recommends that air carriers promulgate and systematically reinforce the philosophy of “fly the airplane.” If pilots recognize that they do not understand the nature of an anomaly and precisely understand the solution, pilots should not choose to continue in an unstable or unpredictable flight path or energy state while attempting to correct an automation anomaly. Instead, flightcrews should revert to a more direct level of automation until the aircraft resumes the desired flight path and/or airspeed. This may ultimately require that the flightcrew turn off all automation systems and fly the aircraft manually. When the aircraft once again is flying the desired flight path and/or airspeed, the flightcrew can begin to reengage the automation, one system at a time. Below is a recommended statement to be included in air carrier automation policies and systematically reinforced.
At any time, if the aircraft does not follow the desired vertical flight path/ lateral flight path and/or airspeed, do not hesitate to revert to a more direct level of automation withoutdelay:
■Revert from FMS guidance to non-FMS guidance: AP/FD modes engaged—pitch attitude and bank angle, altitude, verticalspeed, heading, track, or selected speed as required, or
■Switch from non-FMS guidance to manual hand- flying:
→ AP/FD modes disengaged.
→ A/THR or A/T (as required) disengaged and thrust set manually.
In addition to this recommended philosophical foundation, the team developed a broad set of elements that should be incorporated in all air carrier automation policies. The policy recommendations are organized into seven topics:
■Philosophy
■Levels of automation
■Situational awareness
■Communication
■Verification
■Monitoring
■Command-and-Control
The team further recommends that air carriers assess their policies against these seventopics, fill any identified gaps, and ensure each element is regularly reinforced in operating procedures and training programs.
1.4 Report Organization
Section 2.0 of this report presents the team’s recommendations in order of priority within each of the seven topics of automation policy. These recommendations constitute the exemplar, or SE–30 Automation Policy.
The following appendixes are available under separate cover. Appendix A contains the team’s charter. Appendix B discusses the methodology in more detail. AppendixC summarizes each of the 50 incidents the team examined in detail. AppendixD is an analysis matrix that scores each of the 50 detailed cases against key characteristics. Appendix E summarizes the automation policies that 16 air carriers voluntarily submitted to the team, without identifying the individual carriers. AppendixF presents the results of a gap analysis that compares automation policies for each of the 16aircarriers against the exemplar. Appendix G contains a list of the subject matter experts. Finally, appendixH lists regulatory and guidance support references for use of automation.
2.0 SE–30 Automation Policy
2.1 Philosophy
The optimum use of automation requires the integrated and coordinated use of the following systems:
■Autopilot/flight director (AP/FD);
■Auto Thrust (A/THR) or Auto Throttles (A/T)[1]; and
■Flight management systems (FMS)
Three generations of flight guidance systems are currently in airline service, providing different levels of integration and automation:
■Non-glass-cockpit models, that feature—
→Partial integration (pairing) of the AP/FD and A/THR or A/T modes;
→Vertical and lateral AP/FD modes; and
→Lateral navigation only (that is, inertial navigation system (INS) or FMS/global positioning system (GPS)).
■First glass-cockpit/FMS aircraft generation, that features—
→Full integration of AP/FD and A/THR or A/T modes;
→Vertical and lateral AP/FD modes; and
→FMS vertical and lateral navigation.
■Fully integrated, automated aircraft, that feature—
→Full integration of flight guidance and management (AP/FD, A/THR–A/T, andFMS modes);
→Vertical and lateral AP/FD modes; and
→FMS vertical and lateral navigation in all flight phases.
Higher levels of automation provide flightcrews with an increasing number of options and strategies to choose for the task to be accomplished (for example, to comply with airtraffic control requirements).
The applicable air carrier’s Flight Crew Operating Manual (FCOM)/Aircraft Operating Manual (AOM) provides specific information and operational recommendations for each aircraft type.
2.1.1 AP–A/THR and AP–A/T Integration
Integrated AP–A/THR or AP–A/T systems feature an association (pairing) of AP pitch modes (elevator control) and A/THR or A/T modes (thrust levers/throttle levers[2]). Integrated AP–A/THR or AP–A/T systems operate in the same way as a pilot who handflies with manual thrust:
■Elevator is used to control pitch attitude, airspeed, vertical speed, altitude, flightpath-angle, and vertical navigation profile or to capture and track a glideslope beam.
■Thrust levers or throttle levers are used to maintain a given thrust or a given airspeed.
■Throughout the flight, the pilot’s objective is to fly either—
→Performance segments at constant thrust or at idle (for example, takeoff, climb, or descent), or
→Trajectory segments at constant speed (for example, cruise or approach).
Depending on the task to be accomplished, maintaining the airspeed is assigned either to the AP (elevators) or to the A/THR (thrust levers) or A/T (throttles levers), as shown in table 1 below.
Table 1. AP–A/THR and AP–A/T Integration
A/THR or A/T / A/PThrust levers/ throttlelevers / Elevators
Performance Segment / Thrust or idle / Speed
Trajectory Segment / Speed / V/S vertical profile altitude glideslope
2.1.2 Automation Design Objectives
The automatic flight system (AFS) is an integral part of the automatic and manual control system of the aircraft; its design objective is to assist the flightcrew throughout the flight by—
■Relieving the pilot flying (PF) from routine tasks and thus allowing time and resources to enhance his/her situational awareness and/or for problem solving tasks, or
■Providing the PF with adequate attitude and flight path guidance through the flight director (FD) for hand-flying.
The AFS provides guidance to capture and maintain the selected targets and the defined flight path, in accordance with the modes engaged and the targets set by the flightcrew on either the flight control unit (FCU)/mode control panel (MCP)[3] or on the FMS control and display unit (CDU):
■The FCU/MCP constitutes the main interface between the pilot and the autoflight system for short-term guidance (that is, for immediate guidance such as radar vectors).
■The FMS CDU constitutes the main interface between the pilot and the autoflight system for long-term guidance (that is, for the current and subsequent flight phases).
On aircraft equipped with either a flight management guidance system (FMGS) or flightmanagement computer (FMC)[4], featuring both lateral and vertical navigation, twotypes of guidance (modes and associated targets) are available:
■Selected guidance: The aircraft is guided to acquire and maintain the targets set by the flightcrew, using the modes engaged or armed by the flightcrew (that is, using either the FCU or the MCP target setting knobs and mode arming/engagement pushbuttons).
■FMS guidance: The aircraft is guided along a pilot-defined FMS lateral navigation (LNAV) and a vertical navigation (VNAV) flight plan, speed profile, and/or altitude targets/constraints.
2.2 Levels of Automation
Understanding and interfacing with any automated system, but particularly the AFS, ideally requires answering the following fundamental questions:
■How is the system designed?
■Why is the system designed that way?
■How does the system interface and communicate with the pilot?
■How does the pilot operate the system in normal and abnormal situations?
Air carriers should ensure the following aspects are fully understood by flightcrews for the optimum use of automation:
■Integration of AP/FD and A/THR or A/T modes (that is, pairing of modes);
■Mode transition and reversion sequences; and
■Pilot-system interface for—
→Pilot-to-system communication (that is, for target selections and modes engagement); and
→System-to-pilot feedback (that is, for cross-checking the status of modes andaccuracy of guidance targets).
When flightcrews perform an action on the FCU/MCP or FMS CDU to give a command to the AFS, the pilot has an expectation of an aircraft reaction and, therefore, must have in mind the following questions:
■What do I want the aircraft to fly now?
■What do I want the aircraft to fly next?
[RJM1]This implies also answering the following questions:
■Which mode did I engage and which target did I set for the aircraft to fly now?
■Is the aircraft following the intended vertical and lateral flight path and targets?
■Which mode did I arm and which target did I preset for the aircraft to fly next?
To answer these questions, pilots must understand the role of the following controls and displays:
■FCU/MCP mode selection keys, target-setting knobs, and display windows;
■FMS CDU keyboard, line-select keys, display pages, and messages;
■Flight modes annunciator (FMA) on the PFD; and
■PFD and navigational display (ND) displays and scales (that is, for crosschecking guidance targets).
The effective monitoring of these controls and displays promotes and increases the flightcrew awareness of the status of the autoflight system (that is, modes being engaged or armed) and the available guidance (that is, for flight path and speed control). The active monitoring of controls and displays also enables the pilot to predict and anticipate the entire sequence of flight modes annunciations throughout successive flight phases (that is, throughout mode transitions or mode reversions).
Air carriers should emphasize the optimum use of automation by ensuring—
■Disciplined adherence by flightcrews of standard operating procedures.
■A clear understanding of pilot flying (PF) and pilot not flying (PNF)/pilot monitoring (PM) task sharing by flightcrews.
■Standard call outs are well-defined.
■Disciplined use of normal checklists by flightcrews.
2.2.1 Engaging Automation
Before engaging the AP, ensure—
■Modes engaged (check FMA annunciations) for FD guidance are the correct modes for the intended flight phase and task,
■Appropriate mode(s) are selected, and
■FD command bars do not display any large displacements. If large displacements are commanded, continue to hand-fly until FD bars are centered before engaging the AP.
Engaging the AP while large commands are required to achieve the intended flight path may result in the AP overshooting the intended vertical target or lateral target, and/or may surprise the pilot because of the resulting large pitch/roll changes and thrust variations.
2.2.2 Use the Correct Level of Automation for the Task
On highly automated and integrated aircraft, several levels of automation are available to perform a given task, either FMS modes and guidance or non-FMS modes and guidance.
The correct level of automation depends on the task to be performed: a short-term task (that is, tactical choice, short and head-up action(s) on FCU/MCP, immediate aircraft response required) or a long-term task (that is, strategic choice, longer and head-down action(s) on FMS CDU, longer-term aircraft response). The phase of flight is important, such as departure, en route climb/cruise/descent, terminal area, or approach and landing, as well as time available to make either a normal selection/entry or a last-minute change/entry.