Abstract - avia.gov.ua

Three Drivers of Safety: Safety

Culture, CRM and Training

Capt. Ricardo Génova Galván, PhD, FRIN∗

SAFER-U Project Key FCL [email protected]

January 11, 2021

Abstract

This paper has been written within the activities of the SAFER-U (Strengthening the Aviation Frameworkand European Regulations for Ukraine) programme funded by the European Union (EU) that was launchedin 2019 to harmonise Ukraine’s aviation regulatory framework with EU standards.

Although the programme focuses on the implementation of EASA regulations in Ukraine, taking intoaccount the nature of regulations, especially how they take into account human values, attitudes andpractices, it has been considered interesting to familiarise the personnel affected by the new regulations –flightcrew licensing (FCL), aero-medical (MED) and flight operations (OPS) inspectors of the State AviationAdministration of Ukraine (SAAU) and Ukrainian stake-holders— with the philosophy that supports themand how they are being applied by stake-holders elsewhere.

The paper supports a presentation in which the evolution of the ideas and concepts that led to thedevelopment of Crew/Cockpit Resource Management, Safety Cultures and new training methodologies arediscussed. The intention of the author is to provide those who attended the presentation and who would liketo have a deeper knowledge of the issues discussed therein with a handy reference of the topics that werediscussed.

I. Introduction

A ir transport is a complex system madeup of five components: (i) aircraft that are

operated in an (ii) environment by (iii) humans,individually or within an (iv) organisation, fol-lowing a set of (v) procedures. Over time thesecomponents have been managed with criteriaand methodologies that have made air trans-port safety levels a reference for other meansof transport; methodologies that were initiallydeveloped for air transport are now applied inareas ranging from nuclear power plant opera-tions to medicine.

∗Doctor of PhilosophyFellow of the UK Royal Institute of Navigationhttps://www.linkedin.com/in/ricardogenova/

This robust system has been built on twoideas, (i) the system is imperfect, it has to beconstantly monitored and improved and (ii) thesystem cannot be safe if any of its componentsis not safe. Based on this, learning from itsown failures the system has been reinventingitself over time through the introduction of newtechnologies and concepts.

Aircraft are now much more reliable thanever before: the introduction and subsequentevolution of the jet engine drastically reducedthe possibility of engine failure in flight, like-wise, the introduction of glass cockpits andfly-by-wire control systems have created a newkind of aircraft in which a set of coded ins-tructions governs the operations managing vo-lumes of data impossible to be managed by

1

mailto:[email protected]

Three Drivers of Safety: Safety Culture, CRM and Training

humans. In normal conditions these codesprovide protections that ensure that aircraftwill always operate within their safe flight en-velopes; in addition to this the taking into ac-count of ergonomics as well as advances inthe study of human factors have reduced thefrequency of human errors that could lead torisky situations. Finally new regulations andthe recognition that safety must be an impor-tant part of the aeronautical culture have cre-ated the highly safe and secure environmentwithin which air transport takes place.

The reliability of humans is much lower thanthat of aircraft systems, measurements of thenumber of errors made by humans when per-forming repetitive tasks show that the prob-ability that they make a mistake is 10−2, ifergonomic criteria are taken into account andspecific training to perform the task is pro-vided, this probability may be reduced to 10−3,being low by human standards this probabilityis much higher than those required for fail-ures in aircraft systems that must be in therange 10−5 to 10−9 (FAA, 1988). For this rea-son humans are the weakest elements of theaviation system, unlike computer codes loadedon the aircraft, whose execution is always car-ried out in exactly the same way, humans arevery flexible and their reliability is highly vari-able, physical or emotional disturbances af-fect their performances over time; on the sameflight the performance of the pilot may changeas a result of sleep loss or fatigue, also inthe course of a pilot’s professional life his orher performance may be temporarily affectedby emotional problems or permanently by adeterioration of psycho-physical abilities thatcould lead to the temporary or permanent sus-pension of the privileges of his or her licence.These human-created disturbances have beenidentified since the dawn of commercial avia-tion; eighty years ago the first serious analysisof the causes behind aviation accidents madeby Meier-Müller (1940a,b) already showed that∼70% of the accidents were due to errors madeby humans, a value that has remained cons-tant over the years as shown by Lautman &Gallimore (1987); Helmreich & Foushee (1993)

or Wiegmann & Shappell (2017). Despite thishigh value, the negative effect of humans in airtransport is less than in other modes of trans-port, where it is estimated that between 80%and 90% of accidents are due to human error(Drew, 1963; Baron, 1988; Shappell & Wieg-mann, 2013).

However, despite their unreliability humansare the only elements of the aviation systemthat are flexible and capable of modulate andadapt their reactions after making evaluationsof situations they may encounter based on theirtraining and previous experiences; this flexibi-lity —which is absent in automatic systems—is responsible for many incidents not evolvinginto serious accidents.

II. The importance of human

performance and organisations’cultures

T hree accidents clearly show the impor-tance of human performance and organi-

sational cultures to ensure that adequate safetylevels are maintained.

A. B-737 on January 13, 1982

A Boeing 737 departed from Reagan NationalAirport in Washington D.C. on January 13, 1982under severe winter weather; the crew actedunder pressure due to a delay in their depar-ture caused by the adverse weather conditionsand did not properly de-iced the aircraft, dur-ing the take-off run anomalous engine readingswere ignored and once airborne the aircraftcould not fly due to the ice and snow that hadaccumulated on the wings and crashed intoa bridge while the pilots were attempting awatery landing on the Potomac River, all 74persons on board and four motorists died inthe accident.

The report adopted by the US National Trans-portation Safety Board (1982) describes howafter the aircraft had been de-iced at the gate

2


under heavy snow, had problems in the push-back due to the slippery surface of the tarmacand used reverse thrust to assist the tug, a pro-cedure that was contrary to the policy of thehandling agent. Although the aircraft had beende-iced heavy snow was falling and the useof reverse power blew more slush and snowtowards the front of the aircraft. Even withthe help of reverse thrust the tug, which hadno chains, could not push the plane and theengines were shut down with the reverses de-ployed and with another tug was moved fromthe gate and the engines were re-started. Afterthese manœuvres the engine anti-ice was notused.

When the aircraft was taxiing, 40 minutesafter the de-icing had been completed, the co-pilot made a comment to the captain aboutthis fact and an informal discussion on thistopic continued fin the next 4 minutes, duringthis time differences between the parameters ofboth engines were observed by the pilots butno action was taken. The take-off run started50 minutes after the de-icing had been com-pleted. During the take-off run the co-pilotdetected that things were not going right andcommunicated this to the captain but the take-off was not aborted, two seconds after lift-offthe stick shaker was activated just before theaircraft struck a bridge and hit the water.

According to fellow pilots the captain had"good operational skills and knowledge", hisleadership skills being described as "not dif-ferent from other captains", however his B737qualification had been suspended during 3.5months in 1980 after his performance duringa line check had been unsatisfactory in "ad-herence to regulations, checklist usage [and]flight procedures such as departures and cruisecontrol, approaches and landings"; again, in1981 he received an unsatisfactory grade on arecurrent proficiency check due to "deficien-cies in memory items, knowledge of aircraftsystems and aircraft limitations". The co-pilotwas described by friends and other pilots aswitty, bright and outgoing and someone who"knew his limitations", he had completed all

his checks satisfactorily.

The probable cause of the accident deter-mined by the US National TransportationSafety Board (NTSB) was "the flight crew’sfailure to use engine anti-ice during groundoperation and take-off, their decision to take-off with snow/ice on the airfoil surfaces of theaircraft, and the captain’s failure to reject thetake-off during the early stage when his atten-tion was called to anomalous engine instru-ment readings. Contributing to the accidentwere the prolonged ground delay between de-icing and the receipt of ATC take-off clearanceduring which the airplane was exposed to con-tinual precipitation, the known inherent pitch-up characteristics of the B-737 aircraft when theleading edge is contaminated with even smallamounts of snow or ice, and the limited expe-rience of the flight crew in jet transport win-ter operations" (National Transportation SafetyBoard, 1982).

B. DC-10 on July 19, 1989

When this DC-10 was cruising at 37 000 ft with285 passengers and 11 crew members on boardit suffered an uncontained failure of the #2aft (tail-mounted) engine and lost the threehydraulic systems. Following this failure theaircraft entered a right descending turn butthe captain managed to return to level flightusing differential thrust with engines #1 and #3.The hydraulic fluid had been completely lostbecause hydraulic lines in the right horizontalstabiliser had been severed by debris from thefailed engine and hydraulic power could notbe recovered with the air-driven generator.

The flight crew was standard on the type:captain, first officer and flight engineer. Anoff-duty company DC-10 training check air-man who was traveling on first class and wasinvited to the cockpit to assist the crew, the cap-tain directed him to take control of the throttlesto reduce the workload of the other pilots; forthe remaining of the flight pitch and roll werecontrolled with differential thrust. The flight

3


diverted to SUX1 which was the nearest air-port.

During the diversion, which took 44 minutes,the captain organised the crew, evaluated withthem the possibilities they had, making deci-sions supported by a deep knowledge of theaircraft and its systems. Descending towardsSUX, the aircraft, controlled only with engines#1 and #3, flew three orbits while fuel wasjettisoned and after evaluating the effects oflanding with or without landing gear it wasdecided to use it and it was extended followingthe alternate gear extension procedure. Withall firefighting and emergency teams deployed,at an airport with a level of services below thatrequired for a DC-10, the aircraft landed on therunway but skidded to the right, cartwheeledand ignited. There were 111 fatalities, 47 seri-ous and 125 minor injuries, 13 occupants werenot injured.

According to the NTSB the probable cause ofthe accident was "the inadequate considerationgiven to human factors limitations in the ins-pection and quality control procedures" (Na-tional Transportation Safety Board, 1990).

C. A-320 on January 15, 2009

On January 15, 2009 an Airbus A-320 with 5crew members and 150 passengers on boarddeparted from LaGuardia Airport in New Yorkin good weather. Two minutes after take-offwhen the aircraft was climbing through 2 818ft AGL it encountered a flock of geese and as aresult of several impacts both engines startedto decelerate, then started a sequence of eventsin which the flight crew went through all ap-plicable emergency procedures, tried to relightthe engines, flew the aircraft, coordinated withair traffic controllers the options they had toland the crippled aircraft and instructed thecabin crew about the situation. Three and ahalf minutes after the impacts the crew per-formed a watery landing on the Hudson River.Within seconds of the ditching the crew mem-

1 Sioux Gateway Airport in Sioux City, IA, USA

bers and passengers initiated evacuation of theaircraft. The aircraft was lost but there were nofatalities.

In the report of this accident the NTSB recog-nises that the performance of the flight crewmembers was a contributor to the survivability(National Transportation Safety Board, 2010).

D. What these accidents show

Looking at these accidents, we see in 1982an aircraft with no mechanical problems thatcould not stay in flight as a result of a seriesof human errors. On the contrary, in 1989and 2009 aircraft whose airworthiness were se-riously compromised flew and landed thanksto the actions of their crew.

In the 1982 B-737 accident communicationbetween pilots in the cockpit did not followany standard, the co-pilot was communicatingabnormalities he was observing in colloquialways that did not prompt any captain’s reac-tion, both pilots were using the same infor-mation but in different ways which led to thereality to be interpreted through different men-tal models which could not be modulated asa result of the attitude of the captain. The co-pilot was fully aware that the situation that ledto the crash was developing but the culturethat prevailed then did not give him enoughtools to make the captain react; furthermore,as happened with many captains those years,the captain did not realise that the co-pilot rolewas to assist him and implicitly assumed thathe was captain because he knew more than theco-pilot, taking this assumption to its limits hedisregarded informations from other sourcesthat could have made him aware of what wasgoing on. With his attitude the captain wasshowing a wrong concept of what leadershipis or, more precisely, he was showing an ideaof leadership that prevailed in those years andis not accepted nowadays2.

2 In those years a false concept of what a military pi-lot was had been transferred to the airlines, it wasconsidered that any good pilot should have a "TopGun" profile manifested in an aggressive, individua-

4


Things had changed in 1989 when the DC-10 accident happened. In this case the crewhad a very good knowledge of the aircraft andits systems and the captain was fully awarethat he was leading a team, he created an at-mosphere that helped to relax a very stressfulsituation and throughout the emergency heencouraged assertiveness and was able to diffe-rentiate between status and expertise, changinghis decisions when he understood that the al-ternatives presented by his team were betterthan his own3.

A completely new scenario is shown bythe 2009 A-320 accident. A technologicallycomplex aircraft with both engines failed wasflown during 3.5 minutes by a crew that com-plied with the standard operational procedures(SOP) acted as a team and used all the re-sources they had at hand to safely bring theaircraft to the ground. In this case the crewacted as a team with a single mental image ofthe situation, fully aware of what each mem-ber of the team was doing and, more impor-tant, of what was going to do as the situationevolved. Transcriptions of the internal and ex-ternal communications during the emergencyshow a highly professional crew focussed ontheir tasks in full control of themselves andthe situation. The A-320 with the protectionsprovided by its flight control laws acted likea "third pilot" in a high complexity dynamichuman-machine system which during a criticalevent reduced the workloads of the pilots cre-ating a symbiosis in which the crew and theaircraft worked together in search of the sameend.

listic personality and a coercive way of exercising hisauthority. They can still be found, they are known byany chief pilot and most of their peers, identified by avariety of names —Boomerangs, Broncos or Cowboysin English, Pájaros Locos (Woody Woodpeckers) inSpanish to mention a few— they are a real risk totoday’s flight operations

3 For example initially his intention was to retard thethrottles before the flare but changed his decision afterthe check-airman said that based on his experiencedin simulators the throttles should be used until theaircraft was on the runway

E. Lessons learned

The extremes of human performance shownin these accidents, from the loose actions in1982 to the strict application of procedures in2009, are not random, they depended on theexisting culture when each accident happened.Although actions such as those that took placein the 1982 accident today would be unaccept-able back then they could be accepted as risksthat had to be lived with this is so because weact based on ethical and cultural values thatchange over time: what is acceptable todaymay not be acceptable tomorrow when we willhave new elements of judgment and a newperception of things (Calman, 2004).

Although in the 1970s the contribution ofpoor communications and lack of coordina-tion among crew members or among them andATC had been identified in several aviationaccidents4, at the end of the decade human fac-tors were still in their infancy and recommen-dations made by the FAA urging operators totrain pilots to properly manage cabin resourcesso that captains learned to accept the participa-tion of other crew members in their decisionsand to promote their assertiveness were nottaken seriously. In fact the operator of the B-737 crashed in 1982 had not provided its crewwith said training, in spite of this in the con-clusions of the investigation no reference wasmade to the operator for said omission.

In those years nothing suggested thatorganisational cultures could be contributingfactors behind accidents, it was accepted thataccidents were the result of personal shortco-mings and the usual response to an accidentwas a typical "blame and punish" approach thatnow is recognised as not resulting in any im-provement of safety (Reason, 2016). This some-what fatalistic interpretation of accidents haschanged in the last decades as a result of ad-vances in psychological research that have pro-vided new insights into the dynamics of groupinteractions and human performance (Foushee& Helmreich, 1988; Helmreich & Foushee, 1993;

4 Most notably at the Tenerife 1977 accident

5


Guzzo & Dickson, 1996; Prince & Salas, 2000).Group dynamics, ergonomics and human per-formances are now included in many univer-sity curricula as a result of which the so farhidden subtleties behind many aviation acci-dents have been identified and it is now fullyaccepted that errors made by skilled humansare rarely the root causes of accidents, thoseerrors being mere symptoms of flaws and limi-tations inherent to the systems in which thosehumans work (Dismukes, 2017).

These new concepts and ideas form the basesof the three pillars that support the safety ofpresent day air operations: (i) safety culturesand safety management systems (SMS), (ii)crew resources management (CRM) and (iii)training.

III. Safety Culture

A lthough as early as in 1931 H. W. Heinrichand collaborators (Heinrich et al., 1941)

developed the so-called "Five-Dominoes The-ory" of accidents in which an unsafe socialenvironment was the first of five dominoes tofall in an accident sequence5 it was not untilthe aftermath of the 1986 Chornobyl accidentthat the concept of safety culture was devel-oped (Ukrainian Nuclear Society, 2019).

A safety culture is expressed through an or-ganisational commitment to safety throughoutall levels of an organisation, it is based on theassumption that any safety-oriented behaviourcan only be understood by the interaction ofbasic assumptions, values and norms (both im-plicit and explicit), in organisations with solidsafety cultures it is a top-level priority thatpermeates the whole organisation, such organi-sations characterise by (i) acknowledging thatthe activities of the organisation are alwayserror-prone, (ii) internally creating a blame-freeenvironment in which individuals may report

5 The other four being (i) faults of persons, (ii) unsafe actsand mechanical or physical hazards, (iii) the accidentand (iv) injuries

errors without punishment, (iii) promoting in-ternal collaboration across the organisation toseek solutions to vulnerabilities and, last butnot least, (iv) a commitment to direct resourcesto address safety concerns.

Depending on the attitude of organisationstowards safety Hudson (2001) establishes fivesafety culture maturity levels in organisations,in ascending level of maturity:

1. Pathological: Who cares as long as we arenot caught?

2. Reactive: Safety is important, we do a lotevery time we have an accident

3. Calculative: We have systems in place tomanage all hazards

4. Proactive: We work on the problems thatwe still find

5. Generative: Safety is how we do businessround here

The operator involved in the WashingtonD. C. 1982 accident (National TransportationSafety Board, 1982) is an example of an or-ganisation with level 1 or 2 safety culture,something that was not uncommon in yearsin which safety was considered to be some-thing that should only be monitored in flightoperations and the ability and improvisationcapacity of pilots were relied on to solve pro-blems that might arise. Upgrading the orga-nisational safety culture level is done throughsafety promotion to raise organisation aware-ness and change behaviour using the tools pro-vided by Safety Management Systems (SMS),these systems are now applied in all areas ofaviation and to be effective in an organisationa prerequisite is a strong organisational safetyculture (Piers et al., 2009)

Implementation of an effective safety cultureis usually hampered by the balance betweensafety and productivity (Stolzer et al., 2011), itis not often easy to justify that implementationof safety measures may to increase financialgains, for this reason it is important that the im-plementation of the measures is done througha top-down approach in which measures orchanges are planned by top management from

6


top to bottom: Managers assign the tasks tothe employees, which are then executed.

Implementation of safety cultures and SMSsin all areas of aviation is now a requirementboth of the ICAO and the EASA.

A. ICAO

Following the 2010 ICAO High-level SafetyConference a new Annex 19 consolidates safetymanagement provisions previously containedin six other Annexes and sets the States’ safetymanagement responsibilities and processesframed under the State safety programmes(SSPs).

The Annex is supported by (i) the SafetyManagement Manual (SMM; Doc 9859, ThirdEdition), (ii) the Global Aviation Safety Plan(GASP; Doc 10004), (iii) the Global Air Naviga-tion Plan (GANP; Doc 9383) and (iv) the SafetyOversight Manual (SOM; Doc 9734). It extendsthe provisions of SMS to organisations respon-sible for the type design and/or manufactureof engines and propellers and sets new provi-sions for the protection of safety data, safetyinformation and related sources.

One of the highlights of Annex 19 is theintroduction of the notion of integrated riskmanagement. Formerly organisations had la-yered management systems composed of manysub-systems that created duplications and in-creased costs, set objectives that could be con-tradictory and in which responsibilities werediluted; these problems were greater the largerthe size of the organisation and their solu-tion requires a holistic approach that integratesthe different sub-systems as functional com-ponents of an overarching safety managementsystem that addresses the threats to the organi-sation through an integrated risk managementthat takes into account areas such as security,environment or finance that before were notconsidered important for the safety of the ope-rations6.

6 The lack of integration was manifested in the B-737 acci-dent in Washington in 1982: the handling department,

The SMM is the backbone of the ICAO safetyprinciples, it has been updated to include thechanges introduced by Annex 9 and, followinga general trend in Aviation, its latest edition—the fourth (2018)— is less prescriptive andcollects in three blocks the bases of safety mana-gement:

1. Fundamentals of safety management:Chapters 1-3

2. Development of safety intelligence: Chap-ters 4-7

3. Implementation of safety management:Chapters 8-9

This Manual also provides a summary ofstandards and recommended practices (SARPs)as well as guidance on the ICAO SSP frame-work and on SMS implementation, operationand maintenance.

Following the publication of Annex 19 theexisting State Safety Programme (SSP) provi-sions were upgraded and are now integratedwith the State Safety Oversight (SSO) systemCritical Elements (CEs) and the SMS provisionswere extended, as stated above, to manufactur-ers, the deployment of safety management inan State is done through the SSP at State leveland the SMSs of its stakeholders, this approachimproves the safety performance of each ser-vice provider and this in turn improves theState’s safety performance.

B. EASA

The EASA regulations adapt and apply thecontents of ICAO Annex 19 following two prin-ciples: (i) potential risks are different for dif-ferent organisations, they depend on the acti-vity carried out by the organisation and otherfactors inherent to it and (ii) each aviation or-ganisation is responsible for the safety of itsoperations.

In agreement with the ICAO guidelines theEASA regulatory system uses an integrated

acting independently from the operations department,did not coordinate with the handling agents the pro-cedures to follow in cases of icing

7


Figure 1: Integration of ICAO’s safety elements in the State Safety Programme.

management system approach which embedscompliance, compliance monitoring and safetyrisk management in the regulations, this ap-proach ensures that whenever a user is apply-ing the EASA regulations is applying safetyprinciples even if the user is not aware of this.

To ensure that this system works, three le-vels of control are established, one at Europeanlevel, another at State level and another at or-ganisational level.

European level

European Plan for Aviation Safety

The European Plan for Aviation Safety (EPAS)is a high level SMS that identifies needs, set ob-jectives and establishes coordination principlesto ensure the continuous improvement of avia-tion safety in Europe, to meet these goals theplan relies on Member States and their stake-holders to manage safety effectively.

The EPAS is driven by the EASA Basic Re-gulation7, acting proactively it identifies emer-ging industry safety risks and takes actionsbefore they evolve. To develop the plan theEASA works in close collaboration with theMember States and other stakeholders, it isproduced annually with a horizon of four years.Examining relevant safety information sourcesthe EASA identifies the main areas of concernthat affect the European aviation safety system,establishes priorities of issues and evaluatesoptions to address them. It then sets out thestrategic actions necessary to mitigate thoseconcerns and keep safety risks within accep-table levels.

The main document that supports the EPASis the EASA Annual Safety Review (ASR) apublic document published yearly to informthe public of the safety level in European civilaviation8, this document includes safety risk

7 Regulation (EU) 2018/1139 of the European Parliamentand of the Council of 4 July 2018

8 https://www.easa.europa.eu/document-library/general-publications/annual-safety-review-2020

8

https://www.easa.europa.eu/document-library/general-publications/annual-safety-review-2020







Figure 2: Relationship between ICAO’s and EASA’s safety programmes and plans.

portfolios which focus on the various Europeanoperational domains and uses Safety Perfor-mance Indicators (SPIs) to monitor the imple-mentation of mitigation actions.

The preparation of these documents requiresreliable data that show the safety levels ofthe system and the risks that could exist, forthis purpose the EASA promotes the commu-nication by individuals, anonymously or not,of risks they perceive or of events they areaware of, in addition Commission Implemen-ting Regulation (EU) 2015/1018 lists the occu-rrences that shall be obligatorily reported byEASA Member States and organisations withinthose States and voluntarily by other Statesand organisations, these communications aresubmitted in the European Aviation Report-ing Portal9. Furthermore the EASA promotesthe use of Flight Data Monitoring (FDM) byoperators through the European AuthoritiesCoordination Group on Flight Data Monitoring(EAFDM) and the European Operators FlightData Monitoring Forum (EOFDM), a forum inwhich operators and the Agency share theirbest practices in the use of FDM.

9 http://www.aviationreporting.eu

Another programme, the Data4Safey Pro-gramme, is under development, it will uselarge volumes of data10 to identify safety risksin a proactive way analysing trends and situa-tions which can lead to a safety hazard.

The implementation of the EPAS is moni-tored by the Safety Management TechnicalBody (SMTeB), all member States as well asobservers are members of this technical body,its monitoring includes providing recommen-dations on safety management and EPAS im-plementation as well as supporting States withthe implementation and maintenance of theirSSPs.

State level

State Safety ProgrammeState Plan for Aviation Safety

Some safety issues are better identified and as-sessed at State level than at European level, ta-king these issues into account together with thehigher level provisions of the EPAS each State

10 Safety reports (or occurrences), data downloaded fromFlight Data Recorders, ATC data, weather data areonly a few from a much longer list

9

h


Identi�cationof safetyissues

Assessment ofsafety issues

De�nition andprogrammingof safetyactions

Implementation& monitoring

Measurementof safety

performanceSafety RiskPortfolios

1

2

34

5

© [email protected]

Figure 3: European safety risk management cycle.

generates its State Safety Programme (SSP) inwhich the main threats to safety in the State’scivil aviation system are identified. These plansare published yearly together with State Avia-tion Safety Plans (SASP)11 where the actionsto mitigate the risks identified in the SSP areoutlined.

Organisational level

Safety Management System

SMS is the tool used by an organisation to im-plement and manage its safety culture and toapply the mitigation measures required by itsrisk profile, this taking into account of elementspertaining to the organisation makes it impossi-ble to apply any SMS outside the organisationfor which it was prepared. Relevant EPAS orSSP/SPAS topics are included in the SMS in ad-dition to risks specific to the organisation andits activities. Day-to-day activities of the orga-nisation are addressed as a continuous processby the SMS.

The critical elements of any safety oversightsystem defined by ICAO Annex 19 and all the

11 National Aviation Safety Plan (NASP) in the ICAOterminology

elements needed to establish an SMS are in-cluded in Part-ARA of the EASA regulations,these general requirements are consolidated inPart-ORO and Part-ORA of the same regula-tions, by this reason the starting point of anySMS is compliance with the regulations. Inaccordance to these regulations organisationsare required to communicate to the author-ity safety-relevant occurrences (ORA.GEN.160),the authority has the obligation to collect,analyse and disseminate this safety informa-tion (ARA.GEN.135) and to provide the EASAwith a copy (ARA.GEN.125); ARA.GEN.200 re-quires the establishment of internal audit andsafety management processes including a sys-tem to provide feedback to the authority andnomination of one or more persons responsibleto the authority for the compliance monitoringfunction.

The EASA’s SMS principles are applied inthe different domains of aviation as follows:

1. Initial and continuing airworthiness:A risk-based approach is already appliedto the determination of the Level of In-volvement (LOI) of the competent autho-rity in compliance verification in productcertification (Regulation (EU) 2019/897; re-lated AMC/GM in EDD 2019/018/R).SMS is required to all Continuing Air-worthiness Management Organisations(CAMO) that manage the continuing air-worthiness (Regulation (EU) 2019/1383).In addition SMS is being introduced intothe requirements of Part 21 Design (Sub-part J) and Production (Subpart G) organi-sations, and Part-145 Maintenance organi-sations.

2. Aircrew:In addition to organisations providingtraining for commercial licenses (ATPL-MPL-CPL and Type Ratings) SMSs arerequired for aero-medical centres andFlight Simulation Training Devices (FSTD)qualification certificate holders (Commis-sion Regulation (EU) No 1178/2011 asamended by Commission Regulation (EU)No 290/2012).

10


Alleviations are provided for ATOs pro-viding training only for the Light Air-craft Pilot License (LAPL), Private Pilot Li-cense (PPL), Sailplane Pilot License (SPL)and Balloon Pilot License (BPL) (AMC1ORA.GEN.200).

3. Air Operations:SMS is required for commercial air trans-port (CAT), commercial specialised opera-tions (SPO), and for operators conductingnon-commercial air operations with com-plex motor-powered aircraft (NCC).

National rules apply to commercial opera-tions of balloons and sailplanes unless theState decides to apply Commission Regu-lation No 965/2012 in which case a SMSis required.

4. ATM/ANS (Air Traffic Management/Air Na-vigation Services):SMS is required for providers of ATSand CNS services (Commission Regula-tion (EU) 2017/373).

5. Air Traffic Controllers (ATCOs):ATCO training organisations are requiredto set up an SMS (Commission Regulation(EU) No 2015/340).

6. Aerodromes:Part ADR.OR of Commission Regulation(EC) No 139/2014 requires aerodrome ope-rators to implement and maintain an SMS.

IV. Crew Resource Management

T he origin of Crew Resource Management(CRM) dates back to the Resource Manage-

ment on the Flightdeck conference sponsored byNASA in 1979 (Cooper et al., 1980). In thisconference, the little importance that had beengiven to the behaviour of pilots and the wayin which they communicated was highlighted,until then it had not been realised how thepersonalities of the crew could affect the waysaircraft were operated, especially when abnor-mal or unexpected situations arose. As a resultof this several universities initiated the studyof group dynamics, leadership, interpersonal

communication and decision-making in air-craft cockpits. This research soon revealed thatcockpits are not isolated environments and thatflight operations are heavily affected by cul-tural traits, following these evidences psychol-ogists started to develop units of psychologicaltraining for pilots12, creating a new disciplinethat was initially called "Cockpit ResourceManagement" or "Command-Leadership Re-source Training" (CLR) and as it matured cameto be named "Crew Resource Management"(CRM).

The first clear evidence of the benefits thatCRM brought to aviation was the outcome ofthe DC-10 accident at SUX in 198913. The ope-rator, United Airlines, was involved, togetherwith Pan American Airways, in the early de-velopment of CRM and in 1981 implementedCRM training programmes for pilots aimedat improving teamwork and decision makingin the cockpit, educating pilots to use all avai-lable sources —information, equipment andpersons— to identify existing and potentialthreats and to develop, communicate and im-plement plans and actions to avoid or mitigatethem. The crew of the crashed DC-10 had beentrained in CRM and in the course of the acci-dent applied the principles they had learned.

The analysis and comparison of what hap-pened in the B-737 crashed in 1982 and in theDC-10 in 1989 clearly show how the behaviourof the pilots in the cabin had evolved in thoseyears. Communications in the cockpit beforethe 1982 B-737 crash did not follow any pattern,from the transcriptions of the cockpit voicerecorder (CVR) it is clearly noted that the con-cept of an integrated crew was lacking. On thecontrary in the 1989 DC-10 accident the crew

12 These studies were based on seminal research on cul-tural effects and human factors in aviation carriedout by Prof. Robert L. Helmreich at the University ofTexas at Austin and Prof. John K. Lauber at NASA’sAmes Research Center. For his work in this area Prof.Helmreich was awarded in 1994 the Flight Safety Foun-dation Distinguished Service Award

13 Of the 296 passengers and crew on board, 112 diedduring the accident, while 184 people survived

11


Figure 4: Evolution of CRM programmes.

acted like a team, in the 44 minutes before theaircraft crashed an intense interaction was de-veloped between the crew communicating ata rate of 31 communications per minute (My-ers, 1996), during that time the crew devised astrategy to control the aircraft, assess the dam-age, choose a diversion airport and preparedthe cabin crew and passengers for the crashand a fourth pilot was recruited, among thepassengers at all times every pilot was fullyaware of what the other pilots were doing, de-cisions were shared and the captain knew howto conduct communications to relieve stress14.

14 Captain Al Haynes was the pilot of the flight, in hiswords: "As for the crew, there was no training pro-cedure for hydraulic failure. We’ve all been through

When this accident happened CRM was anew concept, since then the following six gen-erations of CRM have passed as it has beencontinuously evolving to adapt to emergingchanges in aviation:

one failure or double failures, but never a completehydraulic failure. But the preparation that paid off forthe crew was something that United called cockpit re-source management, or command leadership resourcetraining. Up until then we kind of worked on theconcept that the captain was THE authority on theaircraft. What he says, goes. We had 103 years offlight experience there in the cockpit, trying to getthat aeroplane on the ground, not one of which wehad actually practised, any one of us. If I hadn’t usedCLR , if we had not let everybody put their inputin, it’s a cinch we wouldn’t have made it" quoted byHelmreich (2006)

12


1. First generation (1979) – Training was li-mited to pilots and focused on leadership,effective communication, analysis of in-terpersonal styles and correction of be-havioural deficits.

2. Second Generation (1986) – Namechanged from "cockpit" to "crew" to reflectthe importance of crew interaction in safeflight. Modular training was introducedand courses were team oriented focusingon team building, stress management andsituational awareness.

3. Third generation (1990) – Training wasextended to cabin crew, dispatchers andmaintenance personnel. Joint cock-pit/cabin crew training was introduced.Organisational culture was taken into ac-count and pilots were trained on skillsthey could use to work more effectively.Problems associated to glass cockpits andaircraft automation are becoming evidentand are taken into account in some CRMcourses.

4. Fourth generation (1994) – CRM ceased tobe an isolated training element to becomeintegrated as an essential component ofany flight training and flight operationsprogramme. New threats associated toflight deck automation and glass cock-pits were taken into account. With theintroduction of the FAA advanced quali-fication programme (AQP) CRM was in-tegrated into technical training and pro-cedures so that checklists included CRMissues. The AQP gave operators the abi-lity to develop new training curricula re-flecting the needs and culture of the or-ganisation, line-orientated flight training(LOFT) and line-operational evaluation(LOE) were introduced as a requirementof AQP.

5. Fifth generation (1996) – It was recognisedthe inevitability of human failure, theconcept of error management was intro-duced, behaviours that are taught and re-inforced become countermeasures againsterror and strategies to mitigate the con-sequences of error. The concept of "just

culture" was developed and the line ori-entated safety audit (LOSA) and threatrecognition and management (TEM) pro-grammes were introduced.

6. Sixth generation (2001) – The positive andnegative effects of profesional cultures wasconsidered and the threats associated tothe operating environment were added tothe threats within the cockpit.

Any CRM programme is tailor-made foreach organisation and must be based on re-liable information about what is happening inthe organisation and the problems that mayarise during operations, the main sources ofdata are (i) evaluations of crew performance intraining and on the aircraft, (ii) incident reports,(iii) surveys of crew perceptions of safety andhuman factors, (iv) analyses of flight recordersdata that are part of the flight operations qua-lity assurance (FOQA) programmes and (v)results of line operations safety audits (LOSA).

The LOSA programme

The objective of the LOSA programme is tocollect operational data that provide a reliablepicture of the operator and are used to definethe organisation strategies in safety, operationsand training. Areas of strength in the orga-nisation and those where weaknesses exist arehighlighted by this programme.

Data about crew behaviour and situationalfactors are collected during normal operationsby experienced observers in the cockpit to iden-tify threats to safety and how they are ma-naged, the data show the risks faced by theoperator due to threats15, errors16 or undesiredaircraft states17 observations are made underthe condition that no crews will be disciplined

15 Events or errors that are not caused by the crew, i. e.weather, ATC errors or airport characteristics, amongmany others

16 Crew actions or inactions that lead to a deviation fromwhat was intended or expected, i. e. procedural e-rrors, communication errors or aircraft handling errorsamong others

17 Speed deviations, incorrect systems configuration, un-stable approaches, etc

13


as a result of any observed actions, both ne-gative and positive aspects in the operationsare recorded, positive aspects may be used asmodels in training.

Most LOSA observations are made usingchecklists based on the "Line/LOS Checklist"initially published by the University of Texas(Helmreich et al., 1999b), the ICAO LOSA Ma-nual (Document 9803) includes several exam-ples of such checklists.

LOSA collects data from an external ob-server’s perspective, data from other perspec-tives are provided by reporting programmessuch as the FAA’s Aviation Safety Action Part-nership (ASAP) or EASA’s Aviation Safety Re-porting, merging these data in large databasesas the European Safety Database will providea powerful tool to manage the safety of theaviation system.

Threat and error management

Analyses made by Helmreich (2000) of LOSAdata gathered by several airlines show thaton average 72% of all flights face one ormore threats, with an average of two threatsper flight, similar values have been found byThomas (2004) and Klinect et al. (1999). In a setof 323 observations of line operations Thomas(2004) observed 451 threats, the most common,which account for 90% of all threats are shownin figure 5, among them the most serious onesare, in this order, operational pressures (i. e. de-lays, late arrivals or equipment change) andmeteorology (i. e. thunderstorms, turbulence, ic-ing, wind shear): their frequencies are rela-tively high and in both cases they are the mostdifficult for the crew to manage.

In his survey Thomas (2004) also recorded508 errors committed by the crew when res-ponding to a threat or simply when executinga routine task18. Unlike threats, produced by

18 Surprisingly captains were responsible for the majorityof the errors, with first officers responsible for lessthat one fourth of them. This could be the resultof a negative effect of experience and seniority in

Figure 5: The most common threats encountered byflight crews (Thomas, 2004).

external agents, errors are produced by crewmembers and, especially when they occur inresponse to a threat that has been detected,may lead to a cycle that may result in addi-tional errors, incidents or accidents; in fact itis estimated that in around two-thirds of airaccidents these series of errors committed bythe crew are involved (Helmreich & Foushee,1993).

In the classical view errors were not giventhe importance they have, it was assumed thatthey were just accidental. This view was cha-llenged by the research carried out by Prof.Helmreich and collaborators at the Univer-sity of Texas, their work culminated in 1994showing that in all tasks carried out by hu-mans there will always be the possibility oferrors; they are inevitable and rather than try-ing to avoid them humans —flight crews in ourcase— should be trained to recognise and ma-nage them, this completely changed the way inwhich flight crews were trained, until then theyhad been trained only in the technical skillsneeded to operate an aircraft, since then anadditional training in the non-technical skillsneeded to identify errors and manage themwas introduced. The main objective of thistraining is to educate flight crews to developtheir analytical thinking and coordination ca-pabilities in order to make them more efficientand effective when carrying out their duties,its contents are based on the analyses madein what has been called "threat and error man-agement" (TEM) framework, this is a both amethodology of safety and a set of techniques

communications between captains and first officers

14


Figure 6: The TEM model (Helmreich et al., 1999a).

to implement that methodology. With TEMexperience is relegated to the background and isreplaced by attitudes and skills that any crewmember can apply from the beginning of hisor her career using the tools provided by it.

TEM actions are grouped in any of the threeelements that are at play in every accident orincident, they are:

1. Threats defined as "events or errors thatoccur beyond the influence of the flightcrew, increase operational complexity, andwhich must be managed to maintain themargins of safety". They occur indepen-dently of the crew, but must be managedby them, they can be anticipated or notand may even be hidden, (i. e. design flaws)and are grouped into two categories: (i)environmental threats are outside the di-rect control of the organisation, examplesare weather or airspace congestion, and (ii)endogenous threats that originate withinflight operations such as aircraft malfunc-tions or handling problems.

2. Errors are "actions or inactions by theflight crew that lead to deviations fromorganisational or flight crew intentions orexpectations", when committed the safetymargins may be reduced and the probabi-lity of adverse events to occur increases.Errors are usually caused by momentary

Figure 7: The flight crew error management model(Helmreich et al., 1999a).

lapses or by mismanagement of threatsbut they may also be caused by deliber-ate actions, these are called non-complianterrors and are usually the result of viola-tions of the SOPs. Crew errors are dividedinto three groups:

(a) Aircraft handling errors, due to head-ing, speed or configuration devia-tions,

(b) Procedural errors, caused by devi-ations from regulations, FCOM re-quirements or SOPs and

(c) Communication errors, caused bypoor communications between the pi-lots or between them and externalagents such as ATCOs, cabin crewand ground personnel.

3. Undesired aircraft states (UAS) definedas "flight crew-induced aircraft position orspeed deviations, misapplication of flightcontrols, or incorrect systems configura-tion, associated with a reduction in mar-gins of safety", examples are unstable ap-proaches, deficient aircraft handling ornavigation deviations. The UAS is gen-erally the end result of threats and errorsthat were not well managed and led toa cascade of errors as a result of whichthe UAS developed. Examples are unsta-bilised approaches, hard landings or navi-

15


gation deviations.

According to Merritt & Klinect (2006), 4 500LOSA observations show the following pictureof the three elements of TEM:

1. Threats:(a) On average the typical flight en-

counters 4.2 threats per flight, ofthose around 75% are environmen-tal threats and around 25% are en-dogenous threats. Only 3% of flightsencounter no threats but in 17% ofthe flights seven or more threats areencountered.

(b) 40% of all threats occur before startand during taxi-out, 30% occur dur-ing the descent, approach and land-ing phases.

(c) 43% of environmental threats appearduring the descent, approach andlanding phases and 73% of endoge-nous threats before start and duringtaxi-out.

(d) Adverse weather and ATC accountfor about one quarter of all observedthreats, they are followed by aircraftthreats (about 13% of all observedthreats) and airport conditions (about7% of all observed threats).

(e) About one-tenth of all threats aremismanaged by the crews, leadingto some form of error.

(f) 13% of aircraft threats, 12% of ATCthreats, and 11% of adverse weatherthreats are typically mismanaged.When the frequency with which dif-ferent threats occur is consideredATC threats emerge as the most prob-lematic threat. In particular, complexclearances and last-minute changesfrom ATC are the most problematicof all threats for crews.

2. Errors:(a) One or more errors are committed in

about 80% of the flights, the averagebeing 3 errors per flight.

(b) About 40% of errors occur duringdescent, approach and landing andabout 30% before start and during

taxi-out. The phase with the largestnumber of mismanaged errors (55%)is descent, approach and landing, thisis the most problematic phase fromthe point of view of errors.

(c) About 50% of all observed errors areprocedural, about 30% are due to air-craft handling and about 20% arecommunication errors. If we lookat the mismanaged errors the orderchanges, about 75% of all misman-aged errors are in aircraft handling,about 25% are procedural and a negli-gible percentage in communications.

(d) Among procedural errors the largestnumbers arte, in this order, in check-lists, callouts and SOPs cross verifica-tions.

(e) About 25% of all errors are misman-aged; 6% of all errors lead to addi-tional errors and 19% lead directlytom an undesired aircraft state..

(f) In mismanaged errors manual han-dling errors amount to 36%; automa-tion, instruments and radio errorseach make up 16%; checklists errorsamount to 5% and crew-ATC commu-nication errors to 3%.

3. Undesired aircraft states:(a) In about 33% of flights a UAS event

occurred.(b) About 20% of UASs correspond to

system configuration errors, they oc-cur in about 9% of flights. Speed ex-cursions follow at 16% and lateral orvertical deviaitons and incorrect au-tomation configuration at about 13%,these two groups occur in approxi-mately 7% of flights.

(c) Unstable approaches occur in 5% offlights, only 5% of those unstable ap-proaches result in a go-around.

(d) About 30% of UASs are the result ofa chain of events that starts with athreat that is mismanaged and leadsto an error that is also mismanagedand leads to the UAS.

16


Figure 8: TEM tools.

At the core of TEM is the recognition thatthreats are always present as well as the possi-bility of making mistakes when dealing withthem; firewalls are provided to flight crewsto help them to identify and trap threats anderrors so that they do not propagate and af-fect safety. These firewalls may be (i) "hardresources" embedded in the system such asregulatory provisions, protections included inthe aircraft systems, checklists or SOPs amongothers and (ii) "soft procedures" embedded inthe workflows of flight crews so that they cananticipate, recognise and recover any situationthat may affect the safety of the flight, theseinclude, among others, briefings, planning, or-ganisation of the work in the cockpit, cross-check and monitoring or situational awareness.

CRM training

The troika CRM-LOSA-TEM work togetherto improve the operational safety, the observa-tions made with the LOSA programme are ca-tegorised and analysed within the TEM frame-work and the required non-technical skills are

included in the CRM training.

Both the ICAO and the EASA require ope-rators to implement training programmes inCRM; the EASA requirements are detailed inORO.FC.115, and associated AMCs (three) andGMs (seven).

The CRM training shall be specified in theoperations manual and shall be provided toevery crew member when he or she joins theoperator, elements of this CRM training are in-cluded in the aircraft type or class training, inthe annual recurrent training and in the com-mand course. The contents of these trainings,for multi-pilot operations, are shown in table 1taken from AMC1 ORO.FC.115

A comprehensive guide for the implemen-tation of CRM, including practical examplesprovided by operators, may be downloadedhere19

19 Or here if you do not have an electronic version of thispaper:https://www.easa.europa.eu/sites/default/files/dfu/CRM%20training%20implementation.zip

17

https://www.easa.europa.eu/sites/default/files/dfu/CRM%20training%20implementation.zip





Training element Initialoperator’s

training

Operatorconversion(new fleet)

Operatorconversion

(new operator)

Annualrecurrent

Commandcourse

General Principles

∗Human factors in aviation∗General instructions on CRM principles and objectives∗Human performance and limitations∗Threat and error management

In-depth Required Required Required Required

Relevant to the individual cockpit crew member

∗Personality awareness, human error and reliability, attitudes and behaviours,self-assessment and self-critique

∗ Stress and stress management∗Fatigue and vigilance∗Assertiveness, situation awareness, informationacquisition and processing

In-depth Not required Not required Required In-depth

Relevant to the cockpit crew

∗Automation and philosophy on the use of automation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Required. . . . . . . . . . . . . .

In-depth. . . . . . . . . . . . . .

In-depth. . . . . . . . . . . . . .

In-depth. . . . . . . . . . . . . .

In-depth. . . . . . . . . . . . . .

∗ Specific type-related differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Required. . . . . . . . . . . . . .

In-depth. . . . . . . . . . . . . .

Not required. . . . . . . . . . . . . .

Required. . . . . . . . . . . . . .

Required. . . . . . . . . . . . . .

∗Monitoring and intervention Required In-depth In-depth Required Required

Relevant to the cockpit and cabin crew

∗ Shared situation awareness, shared information acquisition and processing∗Workload management∗Effective communication and coordination inside and outside the cockpit∗Leadership, cooperation, synergy, delegation, decision-making, actions∗Resilience development∗ Surprise and startle effect∗Cultural differences

In-depth Required Required Required In-depth

Relevant to the operator and the organisation

∗Operator’s safety culture and company culture, standard operating procedures(SOPs). organisational factors, factors linked to the type of operations

∗Effective communication and coordination with other operational personnel andground services

In-depth Required Required Required In-depth

∗Case studies In-depth In-depth In-depth In-depth In-depth

Table 1: EASA’s CRM training scheme

V. Technical Training

I n the years after the Sioux City DC-10 ac-cident in 1989, aviation underwent a rev-

olution that totally changed the engineeringof the aircraft and its operation. This revolu-tion involved (i) conceptual changes due tothe development of safety cultures and theimplementation of CRM and (ii) advances inengineering and aircraft design with the in-troduction of flight-by-wire (FBW) and "glasscockpits"20. With these changes the aircraft

20 The introduction of FBW and its digital managementtools —the flight-management system (FMS)— werenot well accepted by a large group of pilots, mostof the criticism was directed at what was perceivedto be limitations on the pilot’s authority due to theprotections included in those systems. In the viewsof those pilots an example of this was the accident ofan A-320 in September 1993 at Warsaw, in which theaircraft overran the runway after aquaplaning duringa landing in a rainstorm with high airspeed and atailwind; a contributing factor in this accident wasthe delayed deployment of the spoilers and reversethrust: even though the pilot selected them the air-craft’s flight control laws included a protection thatprevented the activation of the spoilers and reverse

and their systems are now active elements inflight operations, establishing a symbiosis withthe pilot in which the aircraft modulates thepilot’s orders to optimise the flight path andensure that throughout the flight the aircraftstays within its safe operating envelope.

These facts were clearly manifested duringthe 3.5 minutes elapsed between the impactwith the geese and the splashdown of the A-320 in the Hudson River in 2009. The crew onthis flight worked in an organisation that hada strong safety culture in place and had beentrained in CRM procedures that had been inte-

thrust until the aircraft was firmly on the ground. Bi-ased perceptions, whose analysis is outside the scopeof this paper, were behind many of these criticisms.With the passage of time the contribution of digiti-sation to the improvement of safety of air transporthas become increasingly evident. An example of howthese systems react to avoid serious accidents is thecase of a military A-330 Voyager that in 2014 entereda steep dive in which the airspeed reached M.86 andwas recovered to controlled flight, and an extremelyserious near-miss was avoided, after the automaticactivation of the protections of the aircraft (MilitaryAviation Authority, 2014)

18


grated into their ground and flight trainings, asa result of this when their highly sophisticatedaircraft was involved in a situation that metall the conditions to end up in a serious acci-dent with great loss of life they had the skillsand tools needed to work as a team and theywere aware of the importance of opening linesof communication between them and sharingcommon goals. During the emergency each pi-lot knew what the other was doing and, moreimportant, what would be done next, through-out the glide towards the water all cockpit com-munications were clean and concise; in addi-tion the protections provided by the aircraftwere active until touchdown, helping the pilotto fly the aircraft21

Apart from helping to improve safety, digi-tisation created new problems. The fact thataircraft are now able to protect themselves hasled to the belief in certain areas that the re-quirements in the selection of pilots or in theirtraining levels can be reduced. Similarly thefact that aircraft are now highly reliable havecreated a false feeling of normalcy among pi-lots who live with the feeling that "nothingever fails" and whose workloads under nor-mal conditions are very low because automa-tisms are in charge. This was not the case inprevious generation aircraft in which the lackof automation made the workload in normalconditions high and pilots maintained highlevels of attention throughout the flight; thenthe possibility of having to deal with a fail-ure was always present and when it occurredit was faced with a small increase in work-load. On the contrary systems are much morecomplex in the new generation of aircraft andthe complexity of failures is greater, frequentlydemanding greater workloads from the pilotsthan in previous generation aircraft. This un-balance between workloads before and afterfailures seriously affects flight safety becausenow when something happens pilots are much

21 The aircraft was in α-mode from 150 ft to touchdownand the flight control system limited the aircraft’s nose-up attitude (ANU) attenuating the side-stick inputsbelow 100 ft

more surprised or startled22 than before andmay take the wrong actions creating undesiredaircraft states or accidents23. Recognition ofthese problems in the pilot-aircraft interfaceled to a long-standing debate on the adequacyof the profiles now sought in pilot selectionand of the curricula of training programmes.In any case, unlike what happened with safetycultures and CRM, there have been no seriousresearch into the psycho-technical profiles thatpilots should have and the training they shouldreceive in their type rating courses.

Pilot’s selection

The criteria used in pilot selection should bepart of the safety cultures of operators, makinguse of human resources, psychological and psy-chometrics principles to select pilots that willbehave logically and with a lot of commonsense in their future job, the selection processshould ensure that each recruit will in the fu-ture comply with the requirement set forth inEASA Annex III 1.a.1 to Regulation (EC) No216/2008 that "a person undertaking trainingto fly an aircraft must be sufficiently matureeducationally, physically and mentally to ac-quire and demonstrate the relevant theoreticalknowledge and practical skill” and yet, an on-line survey by the IATA Pilot Training TaskForce (2019) that reviewed industry selectionsystems found that "only a minority of airlineshave a specific selection system in place thatis structured and scientifically-based", in manyairlines the only requirements for entry beinga medical certificate and a type-rating whichis surprising because recruiting and selecting

22 The "startle" effect is an uncontrollable, automatic reflexthat is elicited by exposure to a sudden, intense eventthat violates a pilot’s expectations. This physiolo-gical reaction responds to what may be perceived as aharmful event and may lead to actions inappropriatefor the situation. The EASA provides guidance tooperators to cope with these situations(Field et al.,2018)

23 The startle effect was considered a factor in the 2009A332 accident in the Atlantic Ocean (BEA, 2012) or inthe 210 A-320 accident in the Karimata Strait (Indone-sia) (KNKT, 2014)

19


TechnicalSkills

• Application of Procedures (APK): Identi�es and applies procedures in accordance with published operating instructions and applicableregulations using the appropriate knowledge

• Aircraft �ight path management–manual (FPM): Controls the aircraft �ight path through manual �ight including appropriate use of�ight management system(s) and �ight guidance systems

• Aircraft �ight path management–automation (FPA): Controls the aircraft �ight path through automation, including appropriate use of�ight management system(s) and guidance

Cognitive Components

• Problem solving and decision making (PSD): Accurately identi�es risks and resolvesproblems. Uses the appropriate decision-making process

• Situation awareness (SAW): Perceives and comprehends all of the relevant informa-tion available and anticipates what could happen that may a�ect the operation

• Workload management (WLM): Manages available resources e�ciently to prioritiseand perform tasks in a timely manner under all circumstances

Social Components

• Communication (COM):Demonstrates e�ective oral, non-verbal andwritten commu-nications in normal and abnormal situations

• Leadership and teamwork (LTW):Demonstrates e�ective leadership and teamwork-ing

• Knowledge (KNO): Demonstrates the knowledge required for safe and e�cient oper-ations. Demonstrates ability to source the necessary information

Non-technicalBehaviours

© [email protected]

Figure 9: Pilots’ competencies (IATA, 2013; ICAO, 2013).

the right people should be a critical elementfor any organisation.

It is impossible to train pilots to face all pos-sible situations she or he would face in an air-craft, for this reason any candidate to be a pilotmust have set of skills, knowledge end atti-tudes that allow his or her to resolve complexsituations without any previous training. In2013 the IATA and the ICAO identified ninecompetencies every pilot must have. Threecompetencies are technical skills: applicationof procedures (APK), aircraft flight path man-agement in manual mode (FPM) or with au-tomation (FPA); the other six are non-technicalbehaviours groped in cognitive and social com-ponents, problem solving and decision-making(PSD), situation awareness (SAW) and work-load management (WLM) belong to the firstgroup and communication (COM), leadershipand teamwork (LTW) and knowledge (KNO)24

to the second (IATA, 2013; ICAO, 2013).

Pilot’s training

Although new elements such as education insafety cultures and CRM principles have beenincluded in the training of pilots, the curriculaof the training programs to obtain and main-tain the validity of the type-ratings follow the24 KNO is only recognised by the IATA

same criteria that were in place when the air-craft and the environment in which they ope-rate were very different from today. Althoughthe high reliability of current engines has al-lowed EASA to certify the A350 XWB for upto 370 minutes ETOPS operations one of themost important elements in type-rating initialcourses and recurrent training are still the en-gine failures during take-off to the point thatboth the FAA and EASA issued safety alerts25

to recommend that other failures be includedin the training during take-off to avoid a trendthat had been detected whereby any failurethat appeared in that phase was identified withan engine failure even if it was not26. On thecontrary, despite the fact that as early as in 1996an FAA panel27 warned about the problemsthat pilots had to understand the operation ofcertain automatisms still much attention is stillnot paid in their training to these details theprevalent criterion being that pilots do not needa full understanding of how systems operate orof the system’s underlying design philosophy.This criterion is behind a highly expensive andinefficient training system, developed to satisfythe needs of an aviation that ceased to exist

25 FAA SAFO 09008, Date 04/06/09; EASA SIB No: 2009-09, Issued 27 April 2009

26 As happened in the 2008 MD-82 Madrid accident inwhich a stall warning after take-off was interpreted asan engine failure (CIAIAC, 2011)

27 See Abbott et al. (1996)

20


many years ago, in which pilots are trainedto respond to events in a rote manner. Al-though investigations of serious incidents andaccidents show that in most cases there are twocomponents, one technical and another non-technical, training curricula rarely take intoaccount non-technical skills and instead givetoo much importance to train pilots to solveevents such as engine failures after take-off orin-flight depressurisations that they will rarelyexperience in their professional careers. Like-wise the events trained in simulator sessions re-present only a minimal fraction of the amountof situations that any pilot faces every day andmust resolve, without any previous training,simply by applying common sense and a seriesof skills that he or she has developed by himor herself. Leaving the development of thoseskills in the hands of the pilots is a big holein the safety of the aviation system becauseit leaves in the hands of a random element —whether or not an individual has certain skills—the resolution of the problems that may arise.Solving this fact requires a radical change inthe training methodologies that are applied inaviation: pilots must be educated to developconceptual elements that they can later use topropose adequate solutions to any situationthey may encounter when operating an aircraftand thus favouring the improvement of safety,a fact that is clearly shown in CRM and TEManalyses.

Although some patches such as line-orientedflight training (LOFT) (ICAO, 1989) or theFAA’s AQP initiative (FAA, 1991, revised in2017) were applied they still left many gaps inthe training that pilots need to deal with therisks faced by today’s aviation. Looking for arobust training system capable of filling thesegaps in 2007 the IATA launched the "IATATraining and Qualification Initiative" (ITQI) or-ganising different working groups composedof representatives from academic institutions,airlines, authorities, manufacturers, interna-tional organisations, pilot representative bo-dies and training organisations. These groupslaid down the bases for a new paradigm intraining now known as "Evidence-Based Train-

ing" (EBT), which aims to develop and assess apilot’s overall ability in a variety of core compe-tencies rather than measuring his or her perfor-mance when facing certain events or when per-forming certain manoeuvres. The programmehas been endorsed by ICAO, EASA, IATA andIFALPA and is now the A-350 training standard(IATA, 2013; ICAO, 2013; Norden & Owens,2014).

EBT training focuses in developing the ninecompetencies identified by the IATA (2013) andthe ICAO (2013) which are considered to coverall situations in which the pilot may be in-volved. It is assumed that mastering thesecompetencies any pilot may manage any ab-normal situation encountered in flight. Themain characteristics of the programme are:

1. It is based on evidences identified in CRMand TEM programmes,

2. the programme is tailor-made for eachoperator and is adapted by fleet and typeof operation,

3. puts more emphasis on normal operationsand human performance, and

4. encourages rational out-of-the-box thin-king with developed methodologies tomanage risk.

Implementation of EBT programmes re-quires a certain level of maturity in the autho-rities and stake-holders, both instructors andthe authority inspectors who approve and over-sight the programme must have new skills verydifferent from those that have been requireduntil now28. With EBT the tick-on-a-box ap-proach to training disappears, instructors mustbe able to analyse behaviours and create men-tal images of the chain of events that are behindthe failures that they observe and motivate stu-dents to be able to learn from the recognitionof the failures they made.

28 The same happens with the introduction of perfor-mance-based oversight (PBO) and performance-based-regulations (PBR). EBT, PBO and PBR stem from anew paradigm in which responsibilities are sharedbetween stake-holders and authorities in a system inwhich flexible regulations provide stake-holders withthe possibility of adapting some regulations accordingto their operational peculiarities

21


To be successful (i) EBT programmes requirelast generation FSTDs able to reproduce withhigh fidelity any situation that may be encoun-tered in flight and (ii) pilots with personal pro-files that allow them to continuously developthe nine basic competences included in the pro-gramme; this implies a revision of the criteriaapplied in the initial screening of pilots.

In the wake of the endorsement of EBT bythe ICAO the EASA is gradually amendingPart-ORO to include the requirements neededfor a full deployment of EBT in Europe29. Thebasic implementation of EBT is already in-cluded in Part-ORO Subpart FC as follows:

1. GM1 ORO.FC.230(a);(b);(f): lays down theprinciples to apply EBT criteria to the re-current training and checking in FSTDs

2. GM2 ORO.FC.A.245 allows the applica-tion of EBT to the recurrent training andchecking in FSTDs in the framework ofapproved alternative training and qualifi-cation programmes (ATQP)

This implementation does not cover thewhole recurrent training in airlines, the opera-tor proficiency check (OPC) and licence profi-ciency check (LPC) are still needed. The EASAis now working in further regulatory changesthat will include OPC and LPC within the EBTprogramme and will also broaden its scopeto cover the initial type rating and operatorconversion course so that a single training phi-losophy will be present in the airline.

Acknowledgements

I like to thank Mrs Larayne Dallas, librarian ofthe University of Texas Libraries for her helpin locating documents written by Prof. Helm-reich that are deposited in the UT Libraries.My thanks also to Mrs Danila Lavrenov of theUkrainian Nuclear Society for giving me accessto an unpublished paper by Prof Razi Kamilov

29 This process is detailed in EASA ED Decision2015/027/R, Opinion No 08/2019 (A) and accompa-nying documents, they can be downloaded from theEASA website

on the Three Mile Island nuclear accident

References

Abbott, K., Slotte, S., Stimson, D., et al. Federal Aviation Adminis-tration Human Factors Team Report on: The interfaces betweenflightcrews and modern flight deck systems. Technical report,1996.

Baron, R. G. Human factors in the process industries. In Sayers,B. A., editor, Human Factors and Decision Making: Their Influenceon Safety and Reliability, Symposium for the Safety and ReliabilitySociety, pages 1–9, 1988.

BEA. Final report on the accident on 1st June 2009 to the AirbusA330-203 registered F-GZCP operated by Air France flight AF447 Rio de Janeiro–Paris. Technical report, 2012.

Calman, K. C. Evolutionary ethics: can values change. Journal ofMedical Ethics, 30(4):366–370, 2004.

CIAIAC. Informe técnico A-032/2008. Accidente ocurrido a laaeronave McDonnell Douglas DC-9-82 (MD-82), matrícula EC-HFP, operada por la compañía Spanair, en el aeropuerto deMadrid-Barajas, el 20 de agosto de 2008. Technical report, 2011.

Cooper, G., White, M., & Lauber, J. Resource management onthe flightdeck: Proceedings of a NASA/Industry workshop(NASA CP-2120). Moffett Field, CA: NASA-Ames Research Center,1980.

Dismukes, R. K. Human error in aviation. Routledge, 2017.

Drew, G. C. The study of accidents. Bulletin of the British Psycho-logical Society, 16(52):1–10, 1963.

FAA. AC 25.1309-1A - System Design and Analysis. Technical re-port, Federal Aviation Administration, Washington, D.C., June21 1988.

FAA. AC 120-54A -Advanced Qualification Program. Technical re-port, Federal Aviation Administration, Washington, D.C., Au-gust 9 1991, revised in 2017.

Field, J., Boland, E., Van Rooij, J., Mohrmann, J., & Smeltink, J.Startle Effect Management. (Report Nr. NLR-CR-2018-242). Eu-ropean Aviation Safety Agency, 2018.

Foushee, H. C. & Helmreich, R. L. Group interaction and flightcrew performance. In Human factors in aviation, pages 189–227.Elsevier, 1988.

Guzzo, R. A. & Dickson, M. W. Teams in organizations: Recentresearch on performance and effectiveness. Annual review ofpsychology, 47(1):307–338, 1996.

Heinrich, H. W. et al. Industrial accident prevention. a scientificapproach. Industrial Accident Prevention. A Scientific Approach.,(Second Edition), 1941.

Helmreich, R. L. & Foushee, H. C. Why crew resource manage-ment?: Empirical and theoretical bases of human factors train-ing in aviation. In Weiner, E. L., Kanki, B. G., & Helmreich,R. L., editors, Cockpit Resource Management, pages 3–45. SanDiego, CA:Academic Press, 1993.

Helmreich, R. L. Culture, threat, and error: Assessing systemsafety. In Safety in aviation: The management commitment: Proceed-ings of a conference. Royal Aeronautical Society London, 2000.

Helmreich, R. L. Red alert. Flight Safety Australia, 10(5):24–31, 2006.

Helmreich, R. L., Klinect, J. R., & Wilhelm, J. A. Models of threat,error, and CRM in flight operations. In Proceedings of the TenthInternational Symposium on Aviation Psychology, pages 677–682,1999a.

Helmreich, R. L., Klinect, J. R., Wilhelm, J. A., & Jones, S. G. TheLine/LOS Checklist, Version 6.0: A checklist for human factorsskills asssessment, a log for external threats, and a worksheet

22


for flightcrew error management. Technical report, The Uni-versity of Texas Team Research Project Technical Report 99-01,1999b.

Hudson, P. Safety management and safety culture: the long, hardand winding road. In Warwick Pearse, C. G. & Bluff, L., edi-tors, Occupational Health & Safety Management Systems - Proceed-ings of the First National Conference, pages 3–32. Crown ContentMelbourne, Australia, 2001.

IATA. Evidence-based training implementation guide. InternationalAir Transport Association, Montreal, Canada, 1st edition, 2013.

IATA Pilot Training Task Force. Guidance material and best practicesfor pilot aptitude testing. International Air Transport Association,Montreal, Canada, 3rd edition, 2019.

ICAO. Human Factors Digest No2: Flight crew training: CockpitResource Management (CRM) and Line-Oriented Flight Training(LOFT), Circular 217-AN/132. International Civil Aviation Or-ganization, Montreal, Canada, 1989.

ICAO. Manual of Evidence Based Training, Doc 9995 AN/497. In-ternational Civil Aviation Organization, Montreal, Canada, 1stedition, 2013.

Klinect, J. R., Wilhelm, J. A., & Helmreich, R. L. Threat and e-rror management: Data from line operations safety audits. InJensen, R. S., editor, Proceedings of the Tenth International Sym-posium on Aviation Psychology, pages 683–688. Columbus: OhioState University, 1999.

KNKT. Aircraft Accident Investigation Report - PT. IndonesiaAir Asia Airbus A320-216; PK-AXC Karimata Strait Coordi-nate 3o37’19"S - 109o42’41"E Republic of Indonesia 28 Decem-ber 2014. Technical report, 2014.

Lautman, L. & Gallimore, P. Control of crew-caused accidents. InInternational Air Safety Seminar Proceedings, volume 40, pages81–95, 1987.

Meier-Müller, H. Flugwehr und technik, 1:412–414, 1940a.

Meier-Müller, H. Flugwehr und technik, 2:40–42, 1940b.

Merritt, A. & Klinect, J. Defensive flying for pilots: An introduc-tion to Threat and Error Management. The University of TexasHuman Factors Research Project, The LOSA Collaborative, 2006.

Military Aviation Authority. MAA DG/SI/01/14 – Convening Or-der for Service inquiry investigation into aircraft occurrence in-volving Voyager ZZ333 on 9 FEB 14 at 1549Z. Technical report,c© Crown Copyright, 2014.

Myers, D. G. Social psychology. New York: McGraw-Hill, 1996.

National Transportation Safety Board. Air Florida Inc. Boeing 737-222, N62AF collision with 14 St Bridge, near Washington Na-tional Airport Washington D. C. January 13, 1982. (Report No.NTSB-AAR-82-8), 1982.

National Transportation Safety Board. United Airlines flight 232:McDonnell Douglas DC-10. Sioux Gateway airport. Sioux City,Iowa, 19 July 1989. (Report No. NTSB-AAR-90/06), 1990.

National Transportation Safety Board. Loss of thrust in both en-gines after encountering a flock of birds and subsequent ditch-ing on the Hudson River, US Airways Flight 1549, AirbusA320–214, N106US, Weehawken, New Jersey, January 15, 2009.(Report No. NTSB/AAR-10/03), 2010.

Norden, C. & Owens, D. A350: The flagship of a new trainingconcept: Learning from the evidence. Airbus: Safety First, 18,July 2014.

Piers, M., Montijn, C., & Balk, A. Safety culture framework forthe ECAST SMS-WG. European Commercial Aviation Safety Team(ECAST), 2009.

Prince, C. & Salas, E. Team situation awareness, errors, and crewresource management: Research integration for training guid-ance. Situation awareness analysis and measurement, pages 325–347, 2000.

Reason, J. Managing the risks of organizational accidents. Routledge,2016.

Shappell, S. A. & Wiegmann, D. A. Human factors investigationand analysis of accidents and incidents. In Encyclopedia of Foren-sic Sciences, pages 440–449. Elsevier, 2013.

Stolzer, A. J., Halford, C. D., & Goglia, J. J. Implementing safetymanagement systems in aviation. Ashgate Publishing, Ltd., 2011.

Thomas, M. J. Predictors of threat and error management: Identifi-cation of core nontechnical skills and implications for trainingsystems design. The International Journal of Aviation Psychology,14(2):207–231, 2004.

Ukrainian Nuclear Society. Low safety culture of the entire system- the cause of the Chornobyl accident, 2019. URL https://ukrns.org/en/publications/item/1272-low-safety-culture-of-the-entire-system-the-cause-of-the-chernobyl-accident.

Wiegmann, D. A. & Shappell, S. A. A human error approach to avia-tion accident analysis: The human factors analysis and classificationsystem. Routledge, 2017.

23

https://ukrns.org/en/publications/item/1272-low-safety-culture-of-the-entire-system-the-cause-of-the-chernobyl-accident



Abstract - avia.gov.ua

Documents

Transcript of Abstract - avia.gov.ua