Human Factors

The crew of the ill-fated Lion Air 610 did not, with the loss of all 189 souls on board. As we now know, the crew of Ethiopian 302 on 10 March 2019 were also stymied by MCAS. From one of the safest aviation years on record in 2017, the industry was suddenly confronted with the unthinkable outcome of two brand new planes crashing within months of each other.

The crashes have raised questions over Boeing’s culture, the certification process and oversight by the FAA and changes will no doubt be made there. But what does it also mean for pilots, for their training, for the way those magnificent men and women interact with their flying machines?

Flying used to be a dangerous business. Books like Fate is the Hunter, pilot Ernest Gann’s 1961 memoir, talk of hairy incidents involving the Taj Mahal, of rescues from frozen glaciers, of using the stars to navigate. The early days of aviation were littered with accidents and being a pilot was a dangerous job, mainly due to technical problems with the aircraft.

Over the decades, the accident rate lessened as the industry matured and learned to deal with glitches and improve the system of fail safe and redundancy. Nowadays, you’re more likely to die in a car crash on your way to the airport than you are as a passenger in one of those shiny metal tubes.

Still, flying remains a stressful job. A 2018 study of over 1,000 British pilots by the Eindhoven University of Technology showed 20 percent of them had scores on a burnout scale comparable to those of people that are under burnout treatment. The researchers stated that the burnout levels among pilots were higher than those they had measured in other occupations.

While every day millions of flights pass without incident, the ones that do go wrong shake the entire industry, cause much soul searching — and improve the safety of every other aircraft.

THREE SECONDS TO REACT: IS THAT ENOUGH?
The aviation industry prides itself on its safety record.

Air accident investigations are not designed to apportion blame, but rather to determine why a crash happened and what steps need to be taken to ensure it doesn’t happen again.

One of the key findings so far is a disconnect between the assumptions that Boeing and the FAA used during the certification process for how quickly the pilots would react to abnormal situations on the 737 MAX and what happened in real life.

During the certification process, Boeing and the FAA used an assumption that pilots would be able to spot and take action in the event of a mis-trim situation within 4 seconds: one second to identify a problem and 3 seconds to react to it.

“We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would,” said NTSB Chairman Robert Sumwalt in the September 2019 report Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance, online at https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf

Pilots point out that it is especially hard to react within that time frame to an event where they may not have all the pieces of the puzzle to hand and where there are competing alarms demanding your attention.

“If you take a simple runaway stabiliser situation and present it to a pilot in the simulator, you probably can assume a 3 second reaction time,” Jon Horne, president of the European Cockpit Association, an organisation representing pilots across Europe, tells the WOFA. “But if you present it at the same time with an unreliable speed incident and the stick shaker going off, and the aircraft is falsely threatening a stall, and you’re trying to navigate away from terrain on departure, then the 3 second assumption is absurd.”

Horne says that in such a situation, it is probably more beneficial to take, say 30 seconds, to figure out which emergency needs to be dealt with first. “If you do manage to react within 3 seconds, chances are you’re reacting to the wrong thing and that doesn’t put you in a better position.”

The final Lion Air crash report showed that the two crews on the aircfaft that ultimately crashed had very different reaction times.

The Indonesian air accident investigators stated that the flight crew of the previous flight, Lion Air 43, experienced similar symptoms to the ill-fated Lion Air 610 and took around 3 minutes and 40 seconds “rather than seconds” after 12 MCAS activations to solve the repeated nose-down movement by performing stabiliser trim cut-out.

Along with providing more information to pilots about the systems on board their planes, it seems likely the industry may well have to revise some of those reaction assumptions for future designs. The crew of Lion Air 610 did not manage to identify the problem and find a solution. They did respond within the assumed 3-4 seconds to some of the nose down movements of MCAS, but their reactions were not sustained enough to overcome the repeated MCAS movements.

The crew did not maintain back pressure on the stick for long enough each time and trim the aircraft for that additional back pressure — moving a switch so the pressure they had to hold lessens.

As a result, each time they pulled back, they only countered part of the MCAS nose down. With each additional nose down input from MCAS, it built up until they could counter it no more.

The crews did not react in the ways Boeing and the FAA assumed they would.

PILOTS NEED ENOUGH INFORMATION, AND AT
THE RIGHT TIME

The MCAS situation is not the first time that pilots haven’t received detailed information about what systems were on their planes. Back in 1991, a Scandinavian Airlines McDonnell Douglas MD-81 operating SAS flight 751 crash-landed at Gottrora after the engines ingested ice during takeoff. The engines repeatedly surged, in part due to a system known as Automatic Thrust Restoration (ATR) increasing thrust, while the pilots were trying to reduce thrust. The engines failed and the plane crash-landed. There were no fatalities but the plane was damaged beyond repair.

The investigation revealed that the pilots were not aware of ATR, although this was not cited as the main factor in the crash. In contrast to the 737 MAX incidents, however, this was due to failures on the part of the airline. Descriptions of the system were contained in the Aircraft Flight Manual and the McDonnell Douglas Flight Crew Operating Manual but SAS pilots had no knowledge of it and were not trained on it.

In a chilling echo of the MCAS situation, the Swedish accident report stated: “it was a serious deficiency in flight safety that the pilots lacked knowledge of ATR and its function. ATR is activated without special indication and in such a way that it can escape the pilots’ notice.”

In a rational world, one might imagine that manufacturers should be keen to share information with their airline customers and pilots. Yet pilots say modern planes come with all sorts of software and systems whose inputs and potential pitfalls remain opaque.

“I think the general feeling is we would like a bit more info. Because it’s all software systems now, we would like a bit more info about them and what happens when they go wrong,” one Boeing 747 captain tells the WOFA, highlighting systems such as Flare Assist on the 747-8, designed to make the plane act like the previous variant upon landing. Should it fail, the captain says, pilots can expect higher stick forces upon landing and that’s about all they have been told about it.

There’s also spudder, a combination of spoiler and rudder, which helps to prevent unwanted roll should the engine fail after the V1 speed during the takeoff roll. “I’d been flying the plane for 4 or 5 years before I found out what it was. It’s a good idea, but would be nice to share it with pilots,” says the 747 pilot.

Few are expecting the situation to change any time soon, with manufacturers keen to keep their proprietary systems to themselves.

“The old boys’ school of thought that you have to know every circuit breaker is just not realistic in the modern world,” a Boeing 777 training captain explains. “For example, I can’t fix my car anymore. I don’t know what’s going on under the hood. Does that make the car any less safe? No, not at all.”

Yet a response might highlight that indeed there are concerns about the extent to which driver-assist systems like Tesla’s Autopilot affect safety. There must be some clear blue water between the old boys’ school of thought and the brave new world where pilots are unaware of key ways the aircraft flies.

COULD BETTER PILOTS HAVE RESOLVED THE PROBLEMS ON BOARD THE MAXES?

Along with the MCAS design problems, Indonesian accident investigators from the country’s National Transportation Safety Committee determined that the crew on that flight failed to coordinate their actions sufficiently.

The crash report paints a picture of a first officer who was overwhelmed by the situation and not communicating effectively with his captain. According to the report, training history showed deficiencies in his performance during his regular six-monthly simulator checks, including difficulty in aircraft handling and not being familiar with the non-normal checklist.

The first part of that checklist contains some memory items to be followed first (ably recalled by the captain of the previous flight), but it took flight 610’s first officer a remarkably long 4 minutes to locate the airspeed unreliable checklist and he did not recite any of the memory items. For comparison, the flight lasted approximately 11 minutes.

The location of that particular checklist is one of the first items listed on the cover page of the Quick Reference Handbook.

Despite some criticism of the pilots by investigations, an article by long-term aviation writer and pilot William Langwiesche for the New York Times in September, suggesting the pilots were mainly to blame for the 737 MAX crashes has drawn much condemnation. (Langwiesche’s article was published before the final accident report, itself a move opening him to criticism, and which is why hindsight may now feel harsh in judgment.)

Captain Chesley “Sully” Sullenberger, who glided an Airbus to land on the Hudson after a double engine flameout caused by a flock of geese, delivered a cutting rebuttal to that article in a letter to the magazine editor, available on Sullenberger’s website.

Having replicated the accident flights in a full motion 737 MAX simulator, Sullenberger concludes that it was wrong to blame the crew for not being able to handle what he terms a “pernicious and deadly design”.

“These emergencies did not present as a classic runaway stabiliser problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS,” Sullenberger explains.

THE INTERSECTION BETWEEN DESIGN AND PILOT TRAINING NEEDS ATTENTION

Sullenberger makes an important point about training and experience. While there are pilot errors to be found in any aviation accident, the key is to look at what led to those errors being made in the first place, whether that is training, systems or culture.

The Ethiopian crash in March also made it unavoidably clear that even having knowledge of MCAS was not enough in an emergency situation. That preliminary report stated that despite following Boeing safety recommendations, the pilots were unable to prevent the aircraft’s repeated nose-down movements.

“Inadequate pilot training and insufficient pilot experience are problems worldwide, but they do not excuse the fatally flawed design of the Maneuvering Characteristics Augmentation System (MCAS) that was a death trap,” Sullenberger notes in his letter.

It’s clear that Boeing designed the 737 MAX to minimise training requirements for those already flying the 737 NG of the late 1990s. CEO Dennis Muilenburg admitted as much during the second day of his hearing in Congress in October 2019.

“One of our design requirements that we worked with our airline customers was to do what we call level B training, computer-based training as a design objective,” he said in response to questions from Representative Sharice Davids.

The upside to a few hours of computer-based training is that airlines will not have to take pilots already familiar with one variant of a jet off the line for days at a time for extensive training on the new version. That is obviously a big plus for airlines who prefer their pilots to be in the air, generating revenue by carrying fare-paying passengers.

Muilenburg later added, though: “We don’t make training decisions based on economics. We try to make them based on safety.”

It also emerged during the hearing that major 737 MAX customer Southwest Airlines had a $1 million per plane rebate clause in a contract with Boeing, should the planes require new simulator training. Muilenburg declined to comment on specifics but said such clauses had become standard across the industry, although this claim was not able to be confirmed.

“The push across Boeing to limit costly pilot training requirements on the MAX, despite the company’s commitment to safety and pilot training, is clear from the questions we’ve heard today, the slides,” Davids, a congresswoman from the state of Kansas, stated.

Pilots say Boeing has gone too far this time in trying to stick to one type rating for a plane that is fundamentally different to the 737 that entered service back in the 1960s. The desire to make these new variants act like the older versions has driven the development of additional systems like MCAS.

“Where industry has pushed the boundaries of design is when it tried to retain some handling characteristics of a legacy design and had to right the characteristics to make it fly the same,” one 747 pilot tells the WOFA, saying Boeing needed a “kick up the ass”.

It’s not just Boeing that has been keen to sell planes on the basis of a common type rating. Airbus also has one type rating for its A320 single-aisle family of jets, promising a similar amount of differences training for pilots familiar with one variant of the family. Airbus, however, also touts that the twin engine A330, the A350 XWB and the A380 super jumbo have nearly identical flight decks and similar handling characteristics to the A320 family. This means pilots can be be current on more than one Airbus type at a time, enabling them to switch from long-haul A330 to short-haul A320, a concept known as mixed-fleet flying.

“For the A321neo, if you flare it like a normal A321, you’ll land halfway down the runway and that’s a significant thing,” one Airbus pilot says in an interview with the WOFA. “You can see the commercial interest in having everything on a common type rating, but they’ve both gone too far.”

MCAS…
was a death trap.
“SULLY” SULLENBERGER

MODERN, RELIABLE AIRPLANES MEAN THE “STARTLE EFFECT” IS LESS FAMILIAR

It seems that before the crashes, the Brazilian aviation authorities were among the few to have picked up on the MCAS system. They recommended additional training for pilots on it because it constituted a significant difference to the 737 NG.

It remains to be seen whether US and European authorities will mandate more simulator training for 737 MAX pilots. Or whether this will translate to changes for other “differences” courses.

“Enlarge training footprints. Just because the manufacturer or the regulator has a minimum that doesn’t stop an operator from going over and above these requirements,” says Stuart Beveridge, Safety & Technical Director of the Australian Federation of Air Pilots (AFAP), when asked what lessons can already be learned from the crashes.

Beveridge highlights that, these days, pilots may have less training and experience than the assumptions used by manufacturers in designing jets. One area of training that may come under additional scrutiny from global regulators is the startle effect, which can hinder a pilot’s decision-making and problem-solving skills when under pressure. Canadian regulators have been quoted as saying this could be an area for action.

“I am a big believer in the startle factor,” a 777 training captain says. “The difference between us and the younger pilots and this is why the startle factor is so key, is that when I was 30 years old, every day that I flew something broke. You got very good at managing non-normal situations, no matter how small. Nowadays we are flying aircraft that just don’t break down, so that adds to the startle factor because you don’t have that daily experience.”

Trying to make their pilots more resilient to startle has seen some airlines change their six-monthly simulator checks to bring in additional distractions and scenarios.

“In the old days, every 6 month check was a standard V1 cut, followed by a return, missed approach and then a landing,” says the 777 training captain. “Now the intention is to do scenarios that make the pilot think about factors like is my aircraft flying safely? Do I have fuel? Do I need to stop climbing? You have to recognise what’s going on really quickly. It’s all about getting back to ‘let’s get this thing flying’.”

Jon Horne of the European Cockpit Association tells the WOFA that one of the better training techniques can be to present pilots in the sim with an ‘unwinnable’ situation, where you can’t have a successful outcome by following exact procedure. “The aim is to see if they understand as a pilot that in practice what you need to do above all else is put the plane on the ground safely and that isn’t necessarily possible by saying that I have followed all of the rules.”

Horne explains: “For example, if you are going to run out of fuel, but the airports you can reach are below weather minima, then break the minima, because it’s better to take the risk on technical non compliance with weather minima and be on the ground than fall out of the sky at 5,000 feet because you have run out of fuel.”

However, he cautions that such scenarios can only ever be left for the unassessed part of the simulator check, saying that regulation and putting it to a formal assessment could mean such startle scenarios doing more harm than good.

The startle effect…can hinder a pilot’s decision-making and problem-solving

THE BALANCE BETWEEN AUTOMATION AND HAND
FLYING SKILLS COULD DO WITH SOME THOUGHT

Another issue raised by the crashes is the debate on manual flying and the degradation of hand flying skills.

Automation is here to stay and the “good old days” of seat-of-your-pants flying will not be making a return.

New technologies and new designs — not just new automation — come with new problems, though.

Who would have thought that the design of a cup holder would force the costly diversion of a Condor A330 flying from Frankfurt to Cancun in February this year? In that example — sure to be a human factors classroom classic given the near-tragedy of small snowballing errors — the pilot spilled coffee from a cup too big for the cupholders over the flight deck instrumentation.

Automation has undeniably made flying safer. But one of the issues it has created is that pilots risk losing manual hand skills. A reliance on automation also adds to the negative effects of startle when something goes wrong.

But finding the time and place to practice hand skills is fraught with questions. Some airlines are not keen to let pilots turn off the automation at will with paying passengers on board, especially as computers can aid pilots in more accurately flying to headings and flight levels, thus reducing fuel burn and flight time.

“Some airlines do encourage manual flying in appropriate conditions; however, we then have a somewhat perverse situation with pilots ‘practising’ hand flying with fare-paying passengers on board, when this could really be done in the simulator,” AFAP’s Beveridge comments.

“I’d like to see airlines enlarge their training footprint to build and maintain manual skills, including non-jeopardy sessions where pilots would be more free to make mistakes and openly experience different situations.”

One A320 captain the WOFA spoke to says his airline does let them practice hand flying, but to use their judgement: when traffic permits and on fine days, when both the cloud ceiling and visibility are OK, weather known as CAVOK to pilots.

“It wouldn’t be such a good idea to take out the automatics on a busy Saturday in August in London. If it’s CAVOK at a nice quiet Greek airport and you take out all the automatics, it’s one of the best parts of the job.”

However, Beveridge also raises an important point, which goes back to both basic situational awareness, and good presentation of information to pilots.

“I also think the question needs to be asked: is it actually lack of hand flying skills that is getting pilots into trouble, or is it at the more basic level, a lack of understanding or awareness of the state their aircraft is in? It’s no good being able to hand fly if you’re not presented with good information or aren’t able to comprehend it in the first place.”

The 777 training captain the WOFA spoke to concludes that, for all the fancy software on board today, the principles of flying remain the same.

“Get it down to pitch and power and that’s the same. So get that basic stuff right and it will hold you in good stead when things do go wrong,” he explains. “The first thing you need to do in an emergency is recognise what’s going wrong — not so much in it’s a hydraulic malfunction — but is the aircraft flying safely, and if it isn’t then make it fly safely.”

Indeed, the Lion Air crash report even highlights a section of the flight crew training manual, which says just that: “increased reliance on automation has de-emphasised the practice of setting known pitch attitudes and thrust settings. However, should an airspeed unreliable incident occur, the flight crew should be familiar with the approximate pitch attitude and thrust setting for each phase of flight.”

The 777 training captain adds that one weakness in automation is the belief that when it’s going wrong, the aircraft will fix itself. “We’ve had a big change in philosophy, When I first got here, it was all about flying on automation. Ten years later, if things go wrong, the attitude is disconnect it and get back to the basic flying skills of pitch and power.”

As with all accidents, no single factor is to blame, and 100% safety can never be guaranteed. Technologies will change and present new problems for manufacturers, regulators, airline and pilots to deal with. And humans will always make errors, but they can also save the day — and have done so on numerous occasions.

This almost poetic line from an official US report on oversight of the 737 MAX sums it up nicely: “the enviable safety record of the aviation system is a direct result of human capabilities. At the same time, all aviation accidents are the result of human limitations.”

The first thing you need to do in an emergency is recognise what’s going wrong.