Potential Knowledge

Potential Knowledge, Policy, or Training Gaps

Regarding Operation of FMS-Generation Aircraft

SECOND REPORT

Human Factors Committee

Automation Subcommittee

Air Transport Association

The Automation Subcommittee was formed by the Human Factors Committee to examine potential solutions to issues raised in the FAA Human Factors Team Report (1996) on Aircraft Automation. The FAA Team identified vulnerabilities in pilot management of automation and situation awareness. These included understanding the capabilities, limitations, modes, and operating principles of automated flightdeck systems, and choosing levels of automation appropriate to flight situations. This is the second report of the subcommittee. In the first report, we examined ways to make training for FMS-generation aircraft more consistent with carrier operating philosophy. In this paper, we examine potential gaps in the knowledge of pilots or carrier policy guidance surrounding limitations or design assumptions of FMS-based navigation.

Discussions within the subcommittee led to identification of six key issues and potential solutions that might be implemented within carriers. These issues are prioritized as follows:

The need for further guidance in choosing among levels of automation.

The need for pilots and carriers to detect and correct anomalous autoflight performance.

Procedural implications of functional differences in FMS and ground-based navigation.

Requirements to display and cross-check ground-based navaids

Improving ATC procedure compatibility with FMS-generation aircraft

The need to maintain underlying skills with extensive FMS experience.

We recognize that some of these issues ultimately require design or certification solutions. However, we believe that action is required in the near term by carriers or their pilots to prevent and correct commonly-occurring errors. For each issue, we attempt to discuss observed problems in some detail, provide supporting evidence suggesting a knowledge or policy gap, assess what pilots operating the aircraft may need to do to accommodate a limitation, and draft policy guidance member carriers might publish to their pilots. This paper leads, then, to an expanded statement of automation policy, covering a range of issues beyond what most member carriers have already addressed. As emphasized in its first paper, "Towards a Model Training Program," the subcommittee believes training revision is necessary to ensure pilots understand and act in accordance with carrier philosophy.

Issue One: Further Guidance in Choosing Among Levels of Automation

The FAA team recommended that carriers "provide guidance to crews concerning circumstances where autoflight should be engaged, disengaged, or engaged in modes with greater or lesser authority, conditions under which autoflight systems will not engage, will disengage, or revert to another mode, and appropriate combinations of automatic and manual control." However, the subcommittee concurs with the position advocated by most member carriers that operating manual guidance and initial and recurrent training should lead to application of pilot judgment rather than provide highly specific guidance on when to use what level.

The Subcommittee noted two types of guidance provided by carriers on this issue:

Authorization to choose levels of automation -- Each carrier has emphasized that proficiency is required in each level of automation, and has explicitly authorized pilots to choose the most appropriate level for each flight situation. Statements of this type appear today in most policy manuals.

Training for choosing among levels -- Some carriers have begun to offer guidance in training for when to choose what level, and this is a significant further step beyond simply authorizing such choices. However, these training statements have not been documented in policy or operating manuals. Such guidance would include activating versus deactivating automated systems for specific/special recovery maneuvers. For example, one member carrier has specified in training to disconnect autopilot and autothrottles to maintain control and extract maximum aircraft performance for: unusual attitude recovery, windshear/microburst, high altitude upset, GPWS terrain warning, engine failure at low altitude/energy state, flight instrument malfunctions, and mid-air collision avoidance. Though the subcommittee does not necessarily endorse this specific statement, we do believe this level of guidance is warranted.

While training has begun to expand guidance regarding levels of automation, little more has been written into policy or operating manuals as a part of the carrier’s operating philosophy. Most of these statements remain limited to authorization to choose levels appropriate to each situation.

Supporting Evidence

Significantly, several member carriers participated in the research conducted by the FAA Team in 1995. Despite the efforts described above, the Team found evidence leading to automation management and situation awareness concerns. Similarly, reports to ASRS and Partnership programs continue to reflect two tendencies consistent with the Team’s concerns:

Tendency to choose an inappropriate level of automation -- Even though carriers have explicitly authorized pilots to choose appropriate levels, pilots often attempt to program when it creates additional workload, or alternatively, to turn automation completely off even though some intermediate mode would relieve workload. This is exactly the issue to which automation philosophy statements were written. Further documentation to guide these choices is warranted.

Tendency to attempt to correct an "automation-induced" deviation by manipulating the automated system, rather than the controls of the aircraft -- a situation where manual control is clearly most appropriate, yet reports show preference for mode control over manual control. (The FAA Team pointed out that in some accidents, pilots have turned to an autoflight system to correct flight attitudes beyond the capability of the system -- in contrast to guidance in some member carriers’ training that immediate control requires manual control.) Again while carriers are highlighting this issue in training, publication of more detailed guidance is warranted.

Policy Guidance for Pilot Action

Application of pilot judgment is the immediate target of guidance on this issue. The subcommittee offers the following prototypical statement for publication in policy manuals:

Pilots will be proficient in operating their aircraft in all levels of automation. However, the level of automation used at any time should be the most appropriate to enhance safety, passenger comfort, schedule, and economy. Pilots are specifically authorized to choose what they believe to be an appropriate level of automation. In general, choices among levels can be guided by their functionality and the demands of the situation.

Where immediate, decisive, and correct control of aircraft path is required, the lowest level of automation -- hand-flying without flight director guidance -- will be necessary. Such instances would include escape or avoidance maneuvers and recovery from upset or unusual attitudes. With the exception of visual approaches and deliberate decisions to maintain flying proficiency, this is essentially a non-normal operation for flight guidance or FMS-generation aircraft. It should be considered a transitory mode used when the pilot perceives the aircraft is not responding to urgent aircraft demands. The pilot can establish a higher level of automation as soon as conditions permit.

When used with flight director guidance, hand flying is the primary takeoff and departure mode. It is also the primary mode for landings, except for autolands.

Where short-range tactical planning is needed (i.e., radar vectors for separation or course intercept, short-range speed or climb rate control, etc.), Mode Control or Flight Guidance inputs may be most effective. This level should be used predominantly in the terminal environment when responding to clearance changes and restrictions, including in-close approach/runway changes.

Autoflight coupled to the FMS/GPS is the primary mode for non-terminal operations and should be established as soon as "resume own navigation" or similar clearance is received. This level exploits programming accomplished pre-flight. Where the longer-range strategic plan is changed (i.e., initial approach and runway assignment, direct clearances, etc), Flight Management inputs remain appropriate. However, when significant modifications to route are issued by ATC, the pilot should revert, at least temporarily, to lower levels of automation.

The subcommittee believes a statement like this represents significant and needed guidance beyond what appears in carrier manuals today.

Issue Two: Detecting and Correcting Anomalous Autoflight Performance

Pilots have reported a significant number of situations in which the aircraft deviated from the pilot’s intended actions following selection of an autopilot mode. They may occur for a variety of reasons falling into two general categories -- (1) inadvertent selection of a mode or input of data by the pilot, and (2) deliberate selection of a mode expecting different performance than the mode is designed to provide. The former have been referred to as input errors, and the latter as automation surprises or mode errors. In either case, the pilots must detect and correct the path of the aircraft, but the latter case reflects a deeper problem -- the pilot does not understand the logic by which the mode functions in the reported situation. As a result, carriers must position their pilots to ensure that mode and data errors are quickly corrected and must position themselves to ensure that "anomalous functions" are documented in manuals and communicated in training.

Supporting Evidence

Each member carrier represented on the subcommittee has reported events where pilots encountered autoflight performance they did not expect, but on review found these to be characteristic of the underlying software or hardware design. For example:

Pilots of MD80 aircraft and its variants have reported altitude deviations following entry of a speed restriction into the Flight Guidance Control Panel. Typically, the aircraft was operating in Perf Cruise mode when ATC restricted speed. The PF dialed in the speed or mach setting, then engaged Speed Select. The autopilot then complied with the speed, but began a spontaneous climb or descent. These events result from the design assumptions of the autoflight system software. Exiting Perf Cruise, the autopilot needs both speed and altitude/vertical speed targets. The pilot has provided the speed target. The altitude target is obtained by examining the aircraft’s current vertical speed. Because Perf modes allow 150 ft. of altitude variance to minimize pitch/power changes, the aircraft is often in a shallow climb or descent. In these events, the altitude/vertical speed mode has defaulted to vertical speed. The pilots expected it to default to altitude hold, as the aircraft had previously been at cruise. The obtained mode was annunciated on the FMA, but undetected by the pilots for some period of time. Training pilots to dial in the desired speed/mach, but selecting altitude hold on the FGCP (MCP) is addressing the particular problem.

On F100 and A300 aircraft with the autopilot engaged in certain flight envelopes, pilot elevator input forces are sensed as unwanted inputs and are trimmed out by the autopilot. No force disconnects are implemented, and autopilot trim in the opposite direction of input is not inhibited as on some Boeing aircraft, for example. This has resulted in events that were perceived or described by pilots as runaway trim. For example, the pilot of an F100 aircraft did not disengage the autopilot when initiating a visual approach, but believed he had. Stab trim then moved to both full nose-up and full nose-down positions in response to elevator inputs and configuration changes. The autopilot was attempting to maintain the last target selected on the MCP, which was altitude hold. This sequence ended when torque forces applied to the manual trim wheel by the PNF were sensed as a fault, disengaging the autopilot. Importantly, the pilots believed the autopilot to have been disengaged throughout the maneuver. A similar event resulted in an A300 accident at Nagoya, Japan, when the FO/PF engaged TOGA mode, but attempted to stay on the glide slope with forward elevator pressure. Nearly full nose-up trim was obtained as the autopilot sought go-around pitch. The aircraft eventually pitched into stall attitude when the autopilot was disengaged, go-around thrust applied, and flaps retracted. In both of these events, the pilots expected action counter to the underlying software design, though the modes engaged were annunciated on the FMA. The A300 has been modified since the accident so that high control column force will disconnect the autopilot.

FMS arrivals and approaches may be flown with lateral and vertical navigation engaged, and the lowest altitude restriction on the profile set in the altitude window. The VNAV mode honors all intermediate restrictions. On the B757/767, member carriers have reported events in which the aircraft was falling behind (above) VNAV path and the pilot selected FLCH or VS to expedite the descent. Altitude protection is forfeited for the intermediate restrictions by this action. This is a serious error if the pilots are not monitoring the performance of the aircraft at the intermediate restriction. Unsatisfied with the performance of VNAV, the pilot has selected a mode that meets the descent goals, but removes altitude protection, and does not recognize that tradeoff in real time.

Other examples can be described for virtually every model of FGS, FMS, or GFMS-equipped aircraft.

Events of this type represent underlying misunderstandings of the functioning of particular modes by the pilot, a lack of strategy for confirming modes engaged or annunciated, or unusual or counter-intuitive entries into a mode or envelope. Alternatively, they may be viewed as inaccurate design assumptions of how a pilot would use or encounter a mode, or how an ATC clearance would affect mode selection. Countermeasures are necessary at three levels:

Pilot strategy – pilots must deliberately scan the FMA to determine whether autopilot and autothrottles are engaged and in what modes. In a previous subcommittee paper, "Towards a Model Training Program," the subcommittee discussed this as analogous to the schedule bidding process. A mode selection is a bid, which must be compared with its annunciated award. Then aircraft performance must be continuously scanned for reassignments -- deviations from selected and annunciated targets. These actions would catch and correct an overwhelming majority of mode errors reported to member carriers. The subcommittee found that each carrier has emphasized in training the need to confirm results of autoflight selections to prevent mode surprises and confusion. However, autoflight systems can also change modes autonomously, often with only FMA indications (flashing the mode a number of times, for example). So, ongoing monitoring is required, not simply selection and confirmation. A number of data sources identify situations where pilots failed to monitor or control the actions of an autoflight system in a timely manner. This may reflect both an inappropriate level of trust in the autopilot during critical flight modes such as altitude level-off and a tendency to "fly the aircraft through" a flight guidance or flight management system. These events often reflect a failure to continue scanning the performance of the aircraft following selection and confirmation of an autoflight mode. The subcommittee noted that policy and procedural guidance on this issue remain limited.

2. Airline reporting – where seemingly anomalous autoflight performance can be traced to a design assumption or software, it must be documented to pilots in operating manuals and reviewed in training. Many of these events reflect a mode functionality expectation by the pilot that is not valid. If these can be documented and/or highlighted in training, they may be overcome by changing the expectation. This requires capturing the events though a reporting program. This is an argument for pursuing Partnership Programs and deliberately reviewing the reports for mode errors. Additional sources might include service difficulty reports reviewed by Maintenance management.

3. Manufacturer reporting – where large numbers of similar events are found to be associated with a particular design assumption or software implementation, software updates and changes are warranted. Each manufacturer has implemented such changes through software upgrades. They can accomplish such corrective actions only to the extent they are made aware of events by their airline customers. Reliable feedback processes must be established or existing processes strengthened to assure this type of action.

Policy Guidance for Pilot Action

The subcommittee recommends that member carriers review their procedures and training to assess the extent to which they promote a pilot strategy of autoflight use that confirms the annunciation of selected modes and continues scanning for anomalous performance. The subcommittee offers the following prototypical statement for publication in policy manuals:

Pilots must confirm the results of autoflight selections to prevent mode or course surprises and confusion. A selection on the Mode Control or Flight Guidance panel must be checked against its result on the Flight Mode Annunciator. An input into the FMS/GFMS-CDU must be checked against its resulting course displayed on the Nav Display, and the pilot making the input must confirm the resulting course with the other pilot prior to executing the change when feasible. And in all cases, both pilots must continue their scan to ensure the autopilot performs as directed and anticipated.

Additional Recommended Actions

The subcommittee recommends that member carriers establish or review existing pilot reporting systems to ensure they can identify and respond to events resulting from mode errors. We also recommend that member carriers review their process of reporting such events to manufacturers to ensure that ongoing software revision efforts are geared to problems encountered in line operations, and to their fellow carriers to ensure lessons learned by one carrier’s pilots are communicated to others’.

Issue Three: Procedural implications of functional differences in FMS and ground-based navigation.

FMS/GFMS systems navigate in fundamentally different ways from pilot tracking or autopilot coupling to ground-based navigation signals. The FMS uses inertial, satellite, and/or ground references to determine its position and navigate to waypoints defined by latitude and longitude. Pilots and earlier-generation autopilots track courses, bearings, or radials provided by a ground-based navaid. An FMS makes use of databases of waypoints, navaid locations, and procedures to accomplish the ground track for published procedures.

However, charts and databases are not identical on a variety of measures. Databases do not always correspond with charted fix names, bearings, or radials, and do not include all charted procedures. In the majority of situations, these differences are of no consequence -- despite naming or depiction differences, the FMS navigates the same ground track for an approach, SID, or STAR as a pilot flying via radio navigation. However, from time to time, pilots have brought to the attention of their carriers situations where the FMS did not fly a procedure as defined by radio navigation. Reasons for differences in approaches were described in a 1997 report by Transport Canada and include:

· Not all approaches are in the database.

· Waypoint identification may differ from chart to FMS.

· Waypoints may be added to or deleted from a procedure.

· Courses and bearings may differ from chart to FMS.

· Duplicate identifiers require database conventions that may not be apparent to the pilot.

· Revision cycles for charts and databases are not identical.

Pilots must determine whether they are flying the charted procedure for which they are cleared. Given the capabilities and limitations of existing nav databases, pilots will encounter discrepancies, ranging from a simple name difference that leads to the same ground track to selection/activation or database errors that result in a substantially different course. Significant discrepancies more often result from selecting and activating a procedure incorrectly, but may also signal a database error that needs to be brought to the airline’s and database provider’s attention and corrected. Detection and correction requires a thorough briefing and cross-check that is not called for in most member carrier policies, procedures, or training.

Supporting Evidence

Each member carrier participating on the subcommittee was able to provide example events.

Pilots have selected an approach other than the one for which they were cleared. This usually occurs when there are multiple approaches of the same type to a runway. For example at Reno, Dallas/Fort Worth, and Washington National, there are multiple ILSs to 16R, ILSs to 13R, and LDAs to 18, respectively. Except for very-recently introduced Advanced FMSs, navigation databases are limited to one approach of each type to each runway. The others simply are not in the database, and pilots have selected and flown one when cleared for another. Depending on the procedure, this can result in significant track differences on the approach or missed approach.

Pilots have failed to select a correct transition for a SID, STAR, or approach. This usually occurs where charting/database convention incompatibilities, or a failure of the procedure-designer to comply with conventions, result in a leg that is part of the charted procedure being labeled a transition in the database. Depending on the procedure, this can result in track differences such as cutting a corner defined by the transition waypoints.

Pilots have failed to cross-check step-down fixes on an approach that do not appear in the database, but are honored through vertical navigation constraints. This could result in a significant error on a non-precision approach, because VNAV is not used and the constraints are not depicted. However, the error has been reported to member carriers to date only for fixes outside glideslope intercept on precision approaches. In these cases, pilots have often engaged the approach mode and failed to monitor crossing altitude on non-depicted fixes outside the depicted ILS "feather."

Pilots have continued on an FMS track or course that deviated from the track required on an arrival. For example, an arrival into one airport ended at a waypoint from which a turn to downwind was required. At this point, the aircraft would revert to heading hold and fail to make the turn. Controllers at the airport described this as a frequent error, and reports resulted in the heading off the waypoint being added to the database.

Pilots have entered an incorrect holding pattern after having been instructed to hold as published at a fix. In these cases, two patterns were published at the same fix, usually one at high and one at low altitude. Only one appears on each chart and the database cannot store multiple patterns at the same fix. Depending upon the traffic pattern in the area, this can result in loss of separation with other traffic.

A variety of other examples could be provided. Each may be viewed in two different ways -- as an operator error or as a database problem. The subcommittee is aware of and supports the activities of the industry working group pursuing standardization between charts and nav data. However, we believe that these limitations will always exist in some form and pilots must be prepared to detect and correct them.

Policy Guidance for Pilot Action

The Subcommittee recommends that member carriers review the extent to which their pilots need to know the underlying database issues, but more importantly, the extent to which their procedures emphasize the pilot actions required to ensure the aircraft flies the track required by a procedure. We offer the following prototypical statement for publication in policy manuals:

For a variety of reasons, displayed FMS legs making up a departure, arrival, or approach procedure may not correspond with charted fix names, bearings, or radials even though the database is designed to follow the same ground track. However, from time to time, pilots have encountered situations where the FMS did not fly a procedure as defined by radio navigation or in compliance with ATC expectations. Therefore, pilots must brief and cross-check charted procedures against FMS data to ensure they have selected the correct procedure and will comply with their clearance.

Before departure, thoroughly review your assigned departure and cross-check the waypoints obtained with your desired course. If you select or build a transition, verify between pilots that it matches your clearance and produces the desired track. Ask ATC for clarification if any conflict exists.

Before arriving in the terminal area, thoroughly brief the arrival and approach you expect to fly and cross-check fixes presented by the FMS against fixes depicted on the approach chart. Should the runway or approach change and you wish to use the FMS for the new approach, that same level of cross-check is essential. If time constraints or circumstances prevent your cross-check, decline the clearance or tune and identify radio aids to navigation and fly the approach in a lower level of automation.

Issue Four: Display and Cross-check of Ground-based Navaids Against FMS Map Display

Except for those aircraft designed to meet Required Navigation Performance (RNP) for the Approach Phase (B-737 or B-777 with Advanced FMS, for example). Flight Management Systems are certified for enroute and terminal navigation, but not for approaches. Except for special FMS, GPS, and RNAV procedures, approaches are flown relative to or from ground-based navaids. So presumably, a pilot may (from an FAR perspective) take off, accomplish a SID and its transitions, navigate enroute, and accomplish a STAR and its transitions to the initial approach fix, all in LNAV without direct reference to ground-based navaids. But by the initial approach fix, the pilot must tune, identify, and monitor the navaids that define the approach; to ensure the path flown by the aircraft complies with the required track.

Are those FAR requirements sufficient for ATA member carriers? A review of procedures across carriers suggests it is not. The subcommittee encountered the following range of policies:

At least one airline has not published a ground-based navaid policy.

One requires one pilot to tune, identify, and display ground-based navaids on any approach where raw data can be displayed on the EHSI. For an NDB approach, cross-check is required. (This is very close to the FAR requirement.)

Another requires one pilot to display ground-based navaids below 25,000 ft. in Latin America, and lists other requirements specific to the type of approach in aircraft Training and Operating Manuals.

Another stipulates that the PNF will have ground-based navaids selected on precision and non-precision approaches prior to final course interception and the final approach fix, whenever below grid MORA in Latin America, and during departures or approaches to airports listed in Company pages (such as European, Mexican, and special US airports).

Another requires the PNF to tune, identify, and monitor ground-based navaids throughout the flight. The PF may display and use LNAV guidance. Accuracy of FMS updating is traded for constant pilot cross-check.

Clearly, no industry standard exists though individual carriers have established when ground-based navaids must be displayed or cross-checked. However, other potential requirements have been left undefined by one or more carriers. When is a cross-check acceptable (i.e., against the RDMI) and when is a deviation display required (i.e., EHSI)? Who must display ground-based navaids (CA/FO, PF/PNF)? Do region-specific requirements generalize to any other International or Domestic operations?

These issues change with the introduction of Advanced FMS aircraft certified to comply with Required Navigation Performance (RNP) in the Approach Phase. Example aircraft include B-737 and B-777 with Advanced FMS. These aircraft are certified to accomplish published RNAV approaches solely by reference to the FMS. However, for all other approaches, cross-check against ground-based navaids is required. Pilots transitioning to and from these aircraft must understand these distinctions. Inappropriately generalizing RNAV procedures to non-RNAV approaches on these aircraft, or transferring these procedures to non-RNP aircraft must be prevented.

Supporting Evidence

Each member carrier participating in the subcommittee reported events that highlight misunderstanding of or absence of guidance concerning ground-based navaid requirements:

Map shifts have been encountered occasionally at a variety of locations (for example within the U.S. at BNA, DFW, LAX, and SAT). These must be detected and corrected by the crew by reference to ground-based navaids or by ATC advisory. Detection becomes critical in the approach environment, but is potentially an issue any time the aircraft is below grid MORA.

Approach deviations have been reported where a crew followed FMS course guidance that diverged from the localizer or radial defining the approach segment. The ground track specified by the procedure must be flown, so ground-based navaids defining the procedure must be at least cross-checked. Such events are evidence that the cross-check was not accomplished or properly weighted by the crew.

Similarly, crews have continued approaches in instrument conditions after the failure of a ground-based navaid when the pilots persuaded themselves the map display sufficed. It clearly does not.

Terminal area deviations have involved incorrectly flown SIDs and STARs where the wrong transition has been entered or wrong course built by one pilot. There is no FAR requirement to cross-check these procedures against ground-based navaids, though procedures at certain airports have resulted in company requirements. Only one carrier specifically requires pilots to cross-check against ground-based navaids defining all SIDs and STARs, though several have emphasized in procedure having the chart out and available during the departure and arrival and have encouraged their pilots to cross-check those courses as a technique.

Most policy requirements beyond those required by FAR appear to be geared towards protecting pilots against map shifts. If they were written to support identification and correction of erroneous FMS data or pilot inputs, would they be any different? The subcommittee is concerned that pilots may not understand the reasons underlying a company’s ground-based navaid policy and may not apply it correctly in the critical situations it was designed to resolve.

Policy Guidance for Pilot Action

The Subcommittee recommends that member carriers evaluate and define their requirements for reference to ground-based navaids. Member carriers are observing a variety of techniques being carried out by pilots where procedure might clarify their understanding and prevent or correct error. The key question is, "Who must tune, identify, and display or cross-check what ground-based navaids for each phase of flight:"

Takeoff?

Departure Climb including SID and transition?

Enroute navigation including unique requirements of overwater, European, and Latin American operations?

Arrival including STAR and transition?

Approach including unique requirements of precision and non-precision approaches?

Published RNAV approaches on RNP aircraft?

A key question surrounds when a CDI display is required -- and this may be one of the best ways to approach decisions about a ground-based navaid policy.

The subcommittee offers the following prototypical statement for publication in operating manuals:

Except for those aircraft designed to meet Required Navigation Performance (RNP) for the Approach Phase (B-737 or B-777 with Advanced FMS, for example), Flight Management Systems are certified for enroute and terminal navigation, but not for approaches. Except where prohibited by bulletin or company-specific pages in the Airway Manual, pilots may accomplish a SID and its transitions, navigate enroute, and accomplish a STAR and its transitions to the initial approach fix solely by FMS navigation, but not approaches.

Except for published FMS, GPS, and RNAV instrument approach procedures, approaches are flown relative to ground-based NAVAIDs. For all other approaches, prior to the initial approach fix, one pilot must tune, identify, and monitor (on a CDI display, where available) the navaids that define the approach. These actions are necessary to ensure the path flown by the aircraft complies with the ground track required by the approach procedure. The function of the FMS and Nav display during an approach is to assist your situation awareness -- not to fly the approach. Any discrepancy between the Nav Display or Flight Director based on FMS/GFMS guidance and raw data from navaids defining the approach must be challenged and resolved immediately. Should the ground based signal be lost, the crew must abandon that approach if in instrument conditions. On all instrument approaches inside the final approach fix in IMC weather conditions, a go-around is required whenever unreliability or full scale deflection of the ground-based approach navaids is encountered.[Note: this paragraph describes what is necessary for the pilot to comply with FMS certification.]

Specific autoflight and display modes required for precision and nonprecision approaches are specified in each aircraft flight manual. Requirements to accomplish published FMS, GPS, and RNAV instrument approaches are published in the operating manual of fleets so equipped. In addition, ground-based navaids defining a course must be tuned, identified, and monitored where specified by bulletin or company-specific pages in the Airway Manual, and when operating in Latin America below FL250. [Note: this paragraph describes additional, company-specific requirements.]

Issue Five: Improving ATC Procedure Compatibility with FMS-Generation Aircraft

Two issues involving ATC were raised in the FAA Human Factors Team report or in the deliberations of the subcommittee: Last-minute runway, departure, or approach changes are a frequent source of increased workload and error on FMS aircraft. A number of ATC procedures fail to take advantage of FMS capabilities or are structured in such a way as to interfere with their use.

Supporting Evidence

Regarding last-minute runway, departure, or approach changes, member carriers represented on the subcommittee provided a number of examples of errors resulting from pilots attempting to comply. Part of the problem --rushing to comply -- generalizes to non-FMS aircraft. What is unique is an ambiguity of how to set up navigation for such a change. Should the pilot attempt to use the FMS first when a change is issued? It provides course guidance for many departures and for approaches and missed approaches along with access to the required navigation frequencies. Alternatively, since reference to ground-based navigation is required, should it be completed first? The subcommittee noted several reports where pilots made significant errors, including not tuning the required navaids in the rush of such a change.

Regarding ATC procedures that are not compatible with FMS aircraft, there appear to be a number of enhancements possible to existing ATC procedures that would directly benefit these aircraft without creating special procedures and without decrement to non-FMS aircraft. In general, the FMS is of little help for vector SIDs. Selection of the JFK7, for example may result in no legs appearing on the legs page or on the Map display, depending on the runway and whether there is a common point for all climbs or transitions from that runway after takeoff. This results in a very complex departure that must be built, rather than selected, if the pilots wish to use the FMS. In the short term, establishment of a standard, or default, vector or radial associated with each fix from which the departure is exited, would greatly reduce workload in the departure phase and make navigation errors less likely.

Policy Guidance for Pilot Action

Further guidance to pilots on response to ATC clearance changes in the terminal area is warranted. The subcommittee offers the following prototypical statement for publication in policy manuals:

Proper use of automation will reduce your workload, freeing you to complete other tasks. Improper use will do just the opposite. Whenever possible, avoid FMS/GFMS programming during critical phases of flight. Complete as much programming as possible during low workload phases. ATC clearance changes in the terminal area directly challenge this requirement.

A departure change during taxi for takeoff requires review of the assigned departure. If the FMS is to be used for navigation during the departure, pilots must cross-check the waypoints obtained with the desired course. However, pilots may choose to navigate the departure by ground-based navaids if update and cross-check of FMS moving map displays would distract from primary ground and flight duties.

While pilots must tune, identify, and monitor all applicable approach navaids for every approach and landing, it is not necessary to update FMS moving map displays close-in to the landing airport where "heads down" data entry would distract from primary flight duties.

Additional Actions

The Subcommittee recommends that the ATA Air Traffic Management Committee initiate discussions on developing enhancements to ATC departure and arrival procedures, especially including vector SIDs, to benefit operation of FMS aircraft.

Issues Six: Maintenance of Underlying Skills with Extensive FMS Experience

One final issue discussed by the Subcommittee requires consideration beyond policy statements. We review it here to encourage member carriers to consider its broader implications while they discuss setting policy for operating FMS-generation aircraft. Billings (1997) has spoken of the potential of operators to become disengaged from the underlying processes that have been given over to automated systems, and described how that can result in reduced or in-ability to carry out those processes when the automated system is disengaged or disabled. To the extent that the operator must be able to carry out those processes in an abnormal or emergency situation, the underlying skills must be maintained. Applying that line of thought to pilots, we could expect those functions that are predominantly carried out by automated systems on an FMS-generation aircraft to suffer some skill loss. This might include hand-flying the aircraft in phases of flight were the autopilot is predominantly used, thrust control when autothrottles are disengaged, calculations of climb or descent targets or timing without FMS assistance, and continuous navigation by reference only to ground based navaids.

Supporting Evidence

Evidence of any change in such skills among Part 121 pilots is limited. What exists is based upon either anecdotal reports by Training departments or upon accident, incident, or event reporting and analysis. Member carriers have described possible examples including additional training required by First Officers with extensive FMS experience upon upgrading to Captain on less-automated aircraft (instrument scan and descent planning are frequently cited), activation -- rather than deactivation -- of autoflight systems in recovering from excursions from controlled flight in at least two accidents, and events in which pilots have assumed disengaged autothrottles were engaged and applied no thrust control as the aircraft accelerated or decelerated out of the desired flight envelope. In fact, whatever the assessment of supporting evidence, much of the emphasis in recent advanced aircraft maneuvering training has involved potential loss of flying skills and "automation dependency." It is clear that many member carriers have concluded that maintaining underlying skills is a challenge, with or without controlled scientific studies to back those beliefs.

But perhaps the best evidence for skill loss with extended use of autoflight and flight guidance/management systems has come from the recent decertification of Omega Navigation Systems. A surge in navigation deviations on aircraft formerly equipped with ONS and not yet equipped with GPS was observed in reports to Partnership Programs and NASA ASRS in late 1997. The source of these deviations was typically a failure of the pilot flying to tune and identify a new navaid, or select a new or correct radial on station passage, resulting in failure to make a required turn. Similar errors involving incorrect calculation of segment distances resulted in early course turns. These are basic functions of instrument navigation that were, until recently, assumed by ONS coupled to the autopilot. When that function was removed, pilots had difficulty in reapplying a well-learned and understood process they had performed throughout their careers. This is exactly the phenomenon Billings describes in more general terms.

Issues Requiring Member Carrier Review

Though the evidence is admittedly mixed, the Subcommittee is concerned about two issues -- maintaining skills that remain necessary in FMS aircraft, and skills that are necessary when transitioning to a less-automated aircraft. Each of the following are potential concerns:

1. Assembly of situation awareness from disparate instruments rather than only from a map display remains a critical skill, but can become unexercised operating an FMS aircraft in a non-threatening environment. Map displays present valuable and key elements of situation awareness, but not all of them. For example, until the advent of EGPWS, no terrain information was displayed. Pilots have always been required to assemble position, course, and terrain information in some form of mental map described as situation awareness. With map displays, some but not all elements are automatically displayed or are pilot selectable. Do pilots routinely practice integrating non-displayed elements in non-threatening environments? This seems unlikely, and if not, represents a challenge to maintaining these skills. Such skill is occasionally critical, as in the case of a map shift, or in recovery from an inadvertent track deviation. Member carriers should look for opportunities to test and reinforce these skills in training and checking.

2. Instrument cross-check condenses toward the primary flight display on FMS-generation aircraft; more so with integrated primary flight displays. Cross-check of other instruments is necessary in certain phases of flight and this requirement broadens with certain types of approaches. This a direct challenge as member carriers attempt to resolve the raw data policy issues discussed above. Member carriers should act to assess and correct any scan problems during training and checking.

3. Similarly, with the known high reliability of FMS navigation, PNF monitoring skills may go unchallenged – if deviations are very rarely detected, the motivation to search for them naturally declines. But, the PNF must be as alert as the PF, regardless of level of automation available in the aircraft. A low probability, high criticality error is exactly the one that must be caught and corrected. Member carriers should assess and emphasize these skills.

4. Flight path management, though a key function of FMS, continues to require pilot judgment skill. For example, while calculating descents is automatic, the pilot must do so quickly in response to ATC-imposed crossing restrictions. This remains necessary because the validity of these clearances must often be assessed in less time than is required to set them up in the FMS. Otherwise, the pilot discovers that the opportunity to make the restriction passed while he and the FMS were calculating it.

The Subcommittee noted that at least one member carrier makes simulator time and instructors available to FMS-experienced FOs upgrading to Captains on analog aircraft, prior to the pilot beginning the scheduled training footprint. The subcommittee views this as one potential means for tackling this issue and encourages member carriers to develop alternatives.

Conclusion

The subcommittee sees five of these six issues needing further published guidance for line pilots. Most member carriers have already taken the step of publishing automation philosophies or policies authorizing pilots to choose appropriate levels of automation for each situation. Carrier and industry experience have reached a point where further policy statements are possible and warranted. The subcommittee calls on member carriers to review the following draft policy, customize it to the unique needs of the carrier and its pilots, and publish it in whole or part in appropriate manuals.

The Subcommittee also recommends that the Flight Systems Integration Committee and FMS Task Force review the extent to which these issues remain or change with next-generation aircraft, and the extent to which design innovations may resolve them.

References

Billings, C. E. (1997). Aviation Automation: The Search for a Human-Centered Approach. Mahwah, NJ: Lawrence Erlbaum Associates.

Appendix -- Draft Automation Policy

1. Operating Policy

Pilots will be proficient in operating their aircraft in all levels of automation. However, the level of automation used at any time should be the most appropriate to enhance safety, passenger comfort, schedule, and economy. Pilots are authorized to choose what they believe to be an appropriate level of automation.

2. Choosing among levels

In general, choices among levels can be guided by their functionality and the demands of the situation.

When used with flight director guidance, hand flying is the primary takeoff and departure mode. It is also the primary mode for landings, except for autolands.

3. Confirming inputs to autoflight systems

4. Cross-checking FMS data against charted procedures

5. Raw data monitoring and cross-check requirements

Except for published FMS, GPS, and RNAV instrument approach procedures, approaches are flown relative to ground-based NAVAIDs. For all other approaches, prior to the initial approach fix, one pilot must tune, identify, and monitor (on a CDI display, where available) the navaids that define the approach. These actions are necessary to ensure the path flown by the aircraft complies with the ground track required by the approach procedure. The function of the FMS and Nav display during an approach is to assist your situation awareness -- not to fly the approach. Any discrepancy between the Nav Display or Flight Director based on FMS/GFMS guidance and raw data from navaids defining the approach must be challenged and resolved immediately. Should the ground based signal be lost, the crew must abandon that approach if in instrument conditions. On all instrument approaches inside the final approach fix in IMC weather conditions, a go-around is required whenever unreliability or full scale deflection of the ground-based approach navaids is encountered. [Note: this paragraph describes what is necessary for the pilot to comply with FMS certification.]

6. Dealing with ATC clearance changes

Click Here To Go Back