This is a presentation made for UNSW about the development of Automation and the kind of risks it brings to Aviation, if not properly designed.

1. TRAINING AND
AUTOMATION
Where is the right mix?
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

2. PILOTS’ TRAINING IS AN ISSUE LONG AGO
 Flight Crew Reliance on Automation (CAA, 2004)
 XL888T Several investigations undertaken following accidents and incidents (including that
mentioned in 2.4) tend to call into question the procedures relating to approach-to-stall
techniques for all types of modern aeroplane.
 AF447 In the absence of a constructed action plan, the dynamic management of a
situation becomes reactive or even random, with no anticipation. The increase in the level
of emotion, which reduces the ability to recall information, leads to a return to the simple
and basic rules in executing tasks in an unexpected situation.
 Asiana 214 …evaluate methods for training flight crews to understand the functionality of
automated systems for flightpath management, identify the most effective training
methods, and revise training guidance for operators in this area.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

3. WHY PILOTS’ TRAINING IS NOT AS GOOD
AS IT SHOULD BE?
 Because it’s a piece of the design:
 Good training is expensive in both, time and money.
 A properly trained pilot is not easy to replace.
 A training going beyond procedural knowledge could reveal design secrets.
 And these problems are avoided in these ways:
 Providing the pilots with user knowledge about the systems that are operated.
 Designing planes who hide the real difficulty to operate them (i.e. unstable airframes
with software help to handle them).
 Building very different planes with identical systems.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

4. THERE IS A NEW TYPE OF ACCIDENTS
 Saint Odile: An instrument, depending of the position of a switch, could mean angle or rate of descent.
 XL888T: The “minority report” approach failed: Two out of three sensors provided wrong information, triggering an automatic answer.
 AF447: A frozen sensor provokes a confusion state in a plane that, supposedly, could not stall and, hence, the crew did not practice its recovery. Wrong
behavior of the pilot. Environment: A warning goes off when the plane starts to recover and remains silent when the spped of the plane is out of valid
values.
 EMIRATES 407: A mistake at setting take-off power produced and accident. This mistake has happened several times, especially, with crews used to fly
varieties of the same plane.
 ASIANA 214: The pilot does not feel comfortable at landing manually the plane. A difference in the design of Boeing and Airbus drives the pilot to miss a
detail indicating that the engines are not supplying power (thrust lever position).
 BOEING 737MAX CASES: A new system, addressed to get a similar behavior of the plane to former generations of the same
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

5. USUAL ANSWER TO THESE NEW ACCIDENTS
 Pointing to “Human Error” in different ways:
 Lack of training.
 Complacency.
 Lack of Compliance.
 Most usual solutions:
 Introducing a new item in training, especifically addressed to deal with the last discovered problem (we will
deal with the next one when it happens).
 Emphasizing procedures that, supposedly, would have avoided the problem.
 In some cases, design changes are introduced and they are presented as “improvements”.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

6. PROBLEMS WITH THIS APPROACH
 Risk calculation model similar to the used by an insurance company: If the number of accidents is
below a threshold, the system is valid.
 Only minor adjustments are allowed.
 The existence of uncommon accidents is assumed.
 The efficiency of this model justify its use.
 Eliminates or limits the options of an alternative resource:
 Pilots appear more as supervisors than as actors (and people are more prepared for action than for
supervision).
 The wrong triggering of automatic processes can make harder the identification of the original
problem and, then, its solution.
 The system can show a fully developed emergency, without a previous warning that could have
helped to assess the situation.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

7. REASONS TO SUGGEST CHANGES
 The insurance company approach is not valid for public and an acceptability crisis could happen:
 People don’t accept in the same way an accident whose causes were unknown and another accident
whose causes were known and the accidents had been discounted in the design.
 An “assumed accident” position can become a “trending topic”, unshackling a tide that, in the present
environment, would be uncontrollable:
 i.e. an eventual ETOPS 370 related major event.
 New confusions related with automation.
 Planes loaded with lithium batteries.
 Right now, 737MAX events.
 Technically, keeping the positive side of the present approach and eliminate or limitate the negative side is
possible:
 Training based in the real functionality of systems instead of metaphors about how they work.
 “Ecological Interface Design” or similar approaches.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

8. HOWEVER, THAT’S NOT THE PRESENT TREND:
 Different actors are working to eliminate the first officer or, in some cases, to use drones for
cargo flights:
 Still more automation.
 Opening to “hacking” possibilities (see RQ-170 case).
 Introduction of Artificial Intelligence and Machine Learning:
 There is not a single system able to access the meaning of a situation nor to question itself.
 No guarantees about the correctness of the learned lessons (if wrong, that will become evident in
critical situations, not in ordinary ones).
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

9. TO FINISH WITH THE APPROACH:
 “The machine-machine is always superior to the man-machine” (Edgar Morin).
 If we insist using people like machines, we will incur in the same problems, corrected and increased.
 People are seen in the present approach as “imperfect information processors”.
 Error avoidance prevails over getting the best from involved people.
 If, instead, the potential of people is used, the environment should allow:
 More action than supervision.
 Functional knowledge, not metaphors nor “user transparent” systems.
 Automation must be designed keeping in mind the impact in situation awareness, not only workload.
NOTE: This is the approach that can be found in my recent book “Aviation and Human Factors”.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

10. NEXT SUGGESTED STEPS IN RESEARCH:
 First Step: To show the real value of Human Factor:
 Even the best reporting systems hardly capture apparently trivial actions cutting sequences to major issues:
 i.e. disregarding temporary communication failures.
 Recognizing and dealing with common issues like false warnings or software problems.
 Managing situations without a specific procedure.
 A specific reporting system should be prepare to capture this information:
 That could help to avoid the vision of “imperfect information processors”.
 Criticism to present practices in design and operation would be very well-founded instead of being dismissed as
“philosophy”.
 Second Step: Suggestion of changes in design and operation practices.
 Keeping, as much as possible, the Rasmussen rule: “The operator must be able to run cognitively the program
that the system is executing”.
 Analyze options like “Ecological Interface Design” and potential improvement.
 Analyze operations based on supervision instead of action.
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

11. THANK YOU VERY MUCH
https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos

12. https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos
“there is a risk that flight crew no longer have the
necessary skills to react appropriately to either failures in
automation, programming errors or a loss of situational
awareness”.

13. https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos
“No flight check procedure is defined in the Airbus A320 Maintenance Manual or in the other documents
available to operators”.
“The crew had licences and qualifications to undertake the flight but did not have the technical skills, the
experience, and the methods of a test crew to use this flight programme, even if it was not a test flight”.
“Angle of attack sensors 1 and 2 blocked during cruise due to frozen water present inside the casing of
these sensors. The system surveillance did not warn the crew of this blockage, which was more or less
simultaneous and at identical local angle of attack values”.
“The flight control law passed to direct due to the loss of the normal law operating conditions. The auto-
trim system was thus no longer available. The changes of law that followed did not allow the auto-trim
system to move from the nose-up position”.

14. https://orcid.org/0000-0001-8970-9152 José Sánchez-Alarcos
“The risk of loss of speed information related to crossing a high density of ice crystals was never
mentioned. Some incidents had been experienced by crews and information about them had been made
available to pilots (see paragraph 1.17.1.5.3.3). However, this information was not sufficient to get crews
to integrate the risks associated with the obstruction of Pitot probes in the management of threats in
cruise”.
“When the Captain returned to the cockpit, the aeroplane was in a rapid descent, though at an altitude
close to the cruise level it was at when he had left. Under these conditions, and not having experienced
the complete sequence of events, it was very difficult for the Captain to make a diagnosis”.