“I believe any good pilot has a certain skepticism. If he or she isn’t a skeptic, they are headed for trouble. This seems especially true with the computer—and when I say computer I include FMS, autopilot and all. Being skeptical means a pilot refers to raw data to be certain the FMS etc., is doing its thing correctly. This is not always easy because as the computer develops it makes raw data more difficult to see, find and use.” – Captain Robert Buck, TWA
I have been known, on occasion, to talk to the autopilot. “Why on earth are you closing the throttles now?” or “What? Who told you to fly at 210 knots?” It’s possible that this could be a little unnerving to an unsuspecting first officer, but there are occasions when it is necessary to question the autopilot’s intentions or even its situational awareness. Sometimes I have to intervene: ”No, no, let’s not do it that way… here, let’s try this mode…” And every so often, “Oh for goodness’ sake, stop making this harder than it is…” a comment usually associated with disconnecting the thing.
Some of that comes from the early days of my career, the first five thousand hours of which involved Convairs and Metroliners with no autopilots and no flight directors. We hand flew all day, er, night, every day and night. This was a pattern only gradually altered by flying the 727, whose autopilot was equipped with an input control that we commonly referred to as the “lurch lever” because the spring tensions were not well calibrated to the G tolerances of the typical passenger’s posterior. On legs under an hour, many of us never engaged the autopilot at all, nor did we activate the flight directors unless we were flying an instrument approach. We simply flew pitch and power like we always had.
It might sound crazy, but airline pilots once flew trips without ever engaging the autopilot.
But most of it comes from a strategy to manage two parallel and integrated situational awarenesses: the old, original one (where are we, where are we going and at what angle of attack), along with a new one (where does the autoflight system think we are, where does it think we want to go, how is it going to get us there and, perhaps of separate but equal importance, where are we within one or more flight envelopes that it is designed to protect us from departing?). Both situational awarenesses are vital to safety. But with the advent of the second awareness, the automation awareness, it has become common for the authorities, manufacturers and various other august bodies of expertise to start describing pilots as “systems operators” or “system managers.”
This is not really a new idea. In 1953, Guy Murchie, writing in his book Song of the Sky, rather presciently predicted “a maplike screen on which will be projected pips of light representing not only his own position but those of other craft, enabling him to monitor the traffic situation continuously and check navigation by eyesight in the densest cloud.” This is a curiously accurate description of an FMS-driven Navigation Display with TCAS superimposed. By 1959, General Pete Quesada, the first FAA Administrator, observed that, with respect to military pilots, “The day of the throttle jockey is past. He is becoming a true professional, a manager of complex weapons systems.”
But back in 1939, writing in his masterpiece, Wind Sand and Stars, the French airmail pilot Antoine de Saint-Exupery anticipated how we might lose control of this evolution. He wrote that,
In the enthusiasm of our rapid mechanical conquests we have overlooked some things. We have perhaps driven men into the service of the machine, instead of building machinery for the service of man.
It is easy to intuit how the concept of a manager of systems veers toward a man in the service of the machine. With the acceleration of automation in the cockpit, and the mishaps and accidents that have resulted, it seems to me that we have never truly resolved Saint-Exupery’s point. On the one hand, the pilot in command remains the final authority as to the operation of the aircraft. On the other, the pilot is an operator of complex systems that he is no longer expected to understand.
A few years ago, David Blair and Nick Helms published a thoughtful paper entitled “The Swarm, the Cloud, and the Importance of Getting There First,” a treatise on remotely piloted aircraft operated by the US Air Force. They concisely and carefully captured Saint-Exupery’s dichotomy in more contemporary terms:
The first truth of special operations holds that humans are more important than hardware. In other words, technology exists to enable people to fulfill the mission. This is the capabilities view of technology: machines are amplifiers of human will, better enabling them to make something of their world. By exercising dominion through technology, people gain greater command over their environment. The alternative is that humans are important to operate the hardware—that people are subsystems within larger socio-mechanical constructs. This view, cybernetics, encloses people within closed control loops that regulate systemic variables within set parameters. Rather than human versus machine, the true discussion about the future of RPAs addresses capabilities versus cybernetics.
The original intent of contemporary cockpit automation arose from the capabilities view of technology, in particular the capability to optimize aerodynamic efficiency while also optimizing airspace utilization. This was, and still is, clearly a machine in the service of man. The intent of automation began to migrate toward the cybernetics view with the notion that we could automate human error out of the equation. In my experience, this migration happened about the same time we transitioned from experienced instructors hand-drawing schematics on whiteboards to well-meaning but very inexperienced people flipping Powerpoint slides salted with schematics from the maintenance manual.
Is this technology in service of man or vice versa?
Cockpit automation is today widely discussed and trained from the cybernetics view of technology. This has been powerfully reinforced by the extensive understanding of human factors as a deterministic, predictable discipline, indeed, by the fundamental understanding of behavior from the deterministic view of neuroscience.
In their 2014 report entitled “A Practical Guide for Improving Flight Path Monitoring”, the Flight Safety Foundation noted that,
Multiple studies have shown that many pilots poorly understand aspects of autoflight modes, in part because training emphasizes correct “button pushing” over developing accurate mental models. Simply stated, it is impossible to monitor a complex system if a pilot isn’t sure how to correctly operate that system or what type of aircraft performance can be expected from each autoflight mode. A pilot who has an accurate mental model of the autoflight system can then learn how to use each mode and will be able to accurately predict what the aircraft will do next in a given mode in each specific situation.
A short trip through Mr. Peabody’s Wayback Machine will place us in a new-hire flight engineer classroom. The instructor is a retired chief master sergeant, and he is diagramming by hand the disassembly, piece by piece, of an air conditioning pack. By the time he is done, the new pilots will thoroughly understand how a pack works, and therefore have a solid grasp of what they are looking at on the pack temp gauge… at least that was the plan in those days.
In order to get rid of the flight engineer, we had to get rid of the pack temperature gauge. The thinking was that by automating the systems and improving the system status annunciations, we could make the task of monitoring systems much simpler. As we automated, we also watered down the ground school; there was no longer any reason to truly understand the system at a component level, since the automation would tell you all you needed to know. This is precisely the trajectory that Murchie had in mind when, continuing his 1953 description of a future cockpit, he said that,
Elimination of everything unessential is a big load off the crew’s brains. When the flight engineer wants to check whether his battery generators are working he used to have to read a dial needle pointing to numbers of amperes of charge or discharge. In the future he will only see a green or red light indicating “yes” or “no.” With fifty such indicators shorn of their wool, the crew will be spared much of the dangerous excess of information from which they have long had to select, abstract, interpolate, extrapolate, derive, and ignore—sometimes literally to the point of death. The airplane will enter a new phase of progress.
But along the way, I believe a very subtle paradigm shift occurred. Back in the day, we had a vague idea of approximately where we were in space. Between the A-N ranges, ADF pointers and LORAN systems, we were generally sure of which hemisphere we were flying in, and with some skill we could place the airplane over a runway threshold safely and reliably, albeit with little surety of exactly where we had been in the process of getting there. Whilst sorting out the bearings, radials and tones, it was essential to keep all one hundred and twelve cylinders lubricated, firing properly and not consuming more gasoline than was absolutely necessary. Monitoring had a great deal to do with aircraft systems, and less to do with the flight path. The flight path was more a matter of technique as long as one avoided an unintended stall.
But at the same time we were automating away little dials pointing at numbers indicating amperes, we were increasing airspace occupancy exponentially. Frequency, frequency, frequency. More flights, more options, more consumer choice, more tailored load factors, more capacity and then more capacity management… all while still operating approximately the same number of outer markers as we have for over sixty years. Capacity is choked; this leads immediately to tightening the longitudinal and vertical spacing between aircraft, as well as such things as Performance Based Navigation (PBN), Reduced Vertical Separation Minimums (RVSM), RNAV departures and arrivals, and the like. All of this is basically intended to obtain the maximum arrival rate possible for each runway at each terminal.
About the only way to fly an RNAV arrival to a busy airport is with lots of automation.
So the importance of flight path management has become supreme, and highly automated. In this manner, the airspace infrastructure has evolved into the kind of larger socio-mechanical construct that Blair and Helms described, in which people are subsystems. Along the way, the shift in paradigm, as well as a culture mesmerized with automation and digitization, slowly and unwittingly displaced procedural knowledge with declarative knowledge.
Simon Hall, of Cranfield University, has described declarative knowledge as, “the knowledge that the system works in a certain way,” and contrasted this with procedural knowledge, which he describes as, “ knowing how to use the system in context.” He explains that
The basic skills associated with “manually flying” an aircraft are predominantly based on procedural knowledge, i.e. how to achieve the task. However, the use of automation to control the flight path of an aircraft is taught as declarative knowledge. Pilots are required to manage systems based on a knowledge that the autoflight system works in a particular fashion. So, the pilot is faced with the same operational task of controlling the flight path but employs two different strategies of cognitive behaviour depending upon whether the task is manually or automatically executed.
It is important to stop for a minute and put this concept under a microscope. In the days of the flight engineer, declarative knowledge and procedural knowledge were more or less balanced, and they were integrated. Declarative knowledge supported procedural knowledge, and we were taught both. If you wanted to get the generator on line, you were going to have to synch the generator frequency to the bus frequency; you had to understand how this worked, and you had to be able to make it work, because it wasn’t going to do it by itself.
But right there, at that inflection point, is where the problems of automation gain a foothold, precisely because automated systems will do it by themselves. It is no longer a matter of procedurally operating a system; it is a matter of watching the system procedurally operate itself. When the Flight Safety Foundation describes an “accurate mental model which will enable the pilot to predict what the airplane will do next in a given mode for each specific situation,” they are referring entirely to declarative knowledge, a knowledge of how the system works, with the expectation that the pilot’s speed of cognition will exceed the system’s own procedural operation.
In the old days, the pilot’s speed of cognition controlled the procedural operation. Nothing would happen until you were ready for it to happen, because you had to make it happen. You could get behind the airplane moving in space, and you could get behind the situation in time, but it was pretty hard to get behind the systems. Today, you’d better be on your toes, because the automated system is going, with or without you. Indeed, the very phrase “predict what the airplane will do next,” as if this were a matter of conjecture, implies that the airplane has a mind of its own.
Yet the premise behind watered-down training is that the modern, sophisticated, fly-by-wire airplane is too complicated for the pilot to fully understand, and thus he or she has no need for extensive knowledge of the aircraft design and architecture. This is entirely in line with Murchie’s 1953 prediction that the crew “be spared much of the dangerous excess of information from which they have long had to select, abstract, interpolate, extrapolate, derive, and ignore.” Sixty years later, in the 2013 report Operational Use of Flight Management Systems, the Performance Based Operations Aviation Rulemaking Committee said that:
Pilot knowledge of the basic airplane systems is not as detailed as in the past. The WG recognizes that in the past, information was trained that was not needed or beneficial. The concern is that depth of systems knowledge may now be insufficient, and this may be operator dependent.
And so we arrive at the rather matter-of-fact condescension expressed in a pivotal statement following the 737 Max debacle:
A high-ranking Boeing official told the Wall Street Journal that “the company had decided against disclosing more details to cockpit crews due to concerns about inundating average pilots with too much information—and significantly more technical data—than they needed or could digest.”
Saint-Ex would have disagreed with some of Boeing’s philosophy.
St.-Exupery would have disagreed with this view. He wrote, also in Wind, Sand and Stars, that
The machine which at first blush seems a means of isolating man from the great problems of nature, actually plunges him more deeply into them. As for the peasant so for the pilot, dawn and twilight become events of consequence. His essential problems are set him by the mountain, the sea, the wind. Alone before the vast tribunal of the tempestuous sky, the pilot defends his mails and debates on terms of equality with those three elemental divinities.
In today’s terms, the cybernetic view of technology may, at first blush, seem a means of isolating the pilot from the essential problems of flight; it is easy to interpret envelope protection features this way. But at the same time, the capability view of technology amplifies human will, better enabling us to make something of our world. By exercising dominion through technology, we gain greater command over our environment… and thus we are plunged more deeply into those essential problems.
The deeper plunge into the essential problems of flight brings us, inevitably, to the problem of airmanship in an automated cockpit. When Staint-Exupery refers to the terms of equality on which we debate those three elemental divinities, he is referring specifically to the airmanship of his day. He began his approach to this question with an understanding of the mountains, the seas and the winds… the things which influence the sky, the great problems of nature into which the airman will shortly be plunged. He was interested in “all that happened in the sky,” things which signaled “the oncoming snow, the threat of fog, or the peace of a blessed night.”
We are still very interested in the threat of fog or oncoming snow. We are also very interested in windshear, convective available potential energy, lifted indexes, microbursts, outflow boundaries, ice crystal icing, collision coalescence freezing drizzle formation, and certainly turbulence, including mountain waves—pretty much anything that can ruin the peace of a blessed night.
To this we must add an understanding of the machine, an intuitive sense of its balance, its harmony, and its energy, a feel for how the machine leverages its precipitous position in the sky to resolve the problems of nature. To Saint-Exupery, the machine was the engine and flight controls all connected by stringers and spars and cables; today, we must include the complement of automation as part of the machine. For example, we must be constantly aware of pitch, power and vertical speed, while we also scrutinize Actual Navigation Performance (ANP) exactly as Saint-Exupery scrutinized the howl of the wind in the wires of his Breguet 14.
But in Saint-Exupery’s day, the idea of the pilot as a systems manager was unheard of, as was the contemporary suite of management school lexicon used to describe the systems manager. Terms such as discipline, professionalism, team skills, self-improvement, and skill acquisition were barely yet in anyone’s vocabulary. Nor were the now-classical superlatives, such as uncompromising, optimal, systematic and exceptional. Recent definitions of airmanship tend to include some or all of these terms; yet, in my opinion, all of them really beg the question. So what is airmanship really, and how does it work in an automated cockpit?
Let’s leave the management school semantics and centuries-old conceptual structures about discipline, obedience, and compliance behind for a while. All of these are tools we use to achieve the goal; they are not the goal. Rather, let’s begin by revisiting the words of FAR 91.1065(d):
For the purpose of this subpart, competent performance of a procedure or maneuver by a person to be used as a pilot requires that the pilot be the obvious master of the aircraft, with the successful outcome of the maneuver never in doubt.
Airmanship starts with the person in the left seat, no matter what the airplane.
The pilot, as the obvious master of the aircraft, forms the anchor of a definition of airmanship. This clearly refers to Saint-Exupery’s idea of the machine in the service of man. It also focuses responsibility and authority for the operation of the aircraft solely with the pilot, while placing distinct emphasis on knowledge and expertise. And yet, we have to be careful of the subsequent language, because the phrase “never in doubt” suggests the elimination of uncertainty, and that is a dangerous premise.
Looking back through early revisions and amendments to this regulatory language, it seems likely that the elimination of uncertainty was never really the intent; the language is always qualified with the words, “The applicant’s performance will be evaluated on the basis of judgment, knowledge, smoothness, and accuracy.” Indeed, the presence of the word judgment belies certainty; however, the problem is that an implicit expectation of certainty can create barriers to effective airmanship. For example, the successful outcome of a landing is always in doubt; this is the point of a no-fault go-around policy, which leverages the judgment and knowledge parts cited above.
Sadly, the expectation of certainty has a long history of coloring the understanding of mishaps. From the 1930s through the 1950s, the Civil Aeronautics Authority was so certain it understood what caused accidents that it published this axiom: “The capable and competent pilot will never allow an airplane to crack up.” Simple as that.
The paradox is that while we must have some degree of certainty that the flight will be successful—if it we didn’t, we would never fly—flight itself is inherently uncertain. While we cannot accept unmitigated specific risk (an unsafe condition with a probability of one), we have to be prepared to accept, and manage, the uncertainty associated with probabilistic risk (an unsafe condition based upon the averaged estimated probabilities of all unknown events). The interface between our own actions and the operating environment is the critical focal point. We can get into trouble if we assume that our own actions will assure the certainty of a successful maneuver.
The French philosopher Edgar Morin describes this paradox in what he calls the “ecology of action:”
As soon as a person begins any action whatsoever, the action starts to escape from his intentions. It enters into a sphere of interactions and is finally grasped by the environment in a way that may be contrary to the initial intention. So we have to follow the action and try to correct it if it is not too late, or sometimes shoot it down, like NASA exploding a rocket that has veered off course.
Ecology of action means taking into account the complexity it posits, meaning random incidents, chance, initiative, decision, the unexpected, the unforeseen, and awareness of deviations and transformations.
From this perspective, airmanship may be less about managing systems and quite a bit more about managing uncertainty. To some extent, this permeates our early flight training; we are warned by our mentors to “always have an out,” and we spent a lot of time looking for good fields to use in the event of a forced landing. As young pilots, we are impressionable and can easily envision a myriad of things going wrong, and as we strive to blend into the level of competence that we believe surrounds us, we prepare as thoroughly as we can. But as we develop an experience base, certainty seems more accessible. Indeed, one of the significant problems of modern aviation is that serious failures occur extremely rarely, and the uncertainty of our early flying days is replaced with an almost inevitable, and comfortable, complacence.
Morin goes on to discuss the use of strategy to manage uncertainty. He says that,
Strategy should prevail over program. A program sets up a sequence of actions to be executed without variation in a stable environment, but as soon as the outside conditions are modified, the program gets stuck. Whereas strategy elaborates a scenario of action based on an appraisal of the certainties and uncertainties, the probabilities and improbabilities of the situation. The scenario may and must be modified according to information gathered along the way and hazards, mishaps or good fortune encountered. We can use short term program sequences within our strategies. But for things done in an unstable, uncertain environment, strategy imposes.
A stabilized approach is not a program, it’s a strategy.
Probably the best definition of strategy that I have seen describes it as a “high level plan to achieve one or more goals under conditions of uncertainty,” a definition coined by Miryam Barad. This definition fits well with Morin’s concept. So what is an example of a strategy in the cockpit? The most compact example might be the stabilized approach concept. This can be achieved with or without automation, with or without a glass cockpit, and can be arrived at from a wide variety of descent profiles and lateral entries to the approach procedure. It can be achieved with or without a normal landing configuration, for example, in the case of a flap or slat failure. Nor does it necessarily lead to a smooth landing! Rather, it represents a high level plan to achieve a landing within the touchdown zone, on centerline and aligned with the runway, under conditions of some uncertainty, such as wind, braking action, pilot technique, even nominal fatigue.
A program, on the other hand, is manifested in profiles, litanies, callouts, checklists, and automated sequences. These have critical value as short term program sequences. But they themselves will not resolve instability or manage uncertainty.
Note that Morin is quite clear about the need to modify the scenario of action “according to information gathered.” The pilot must know exactly what he or she wants to do with the airplane, how the environment is likely to influence the plan, how the plan is evolving with the changing situation, and then how to utilize the all of the tools, including the short term program sequences inherent in the automation, to execute the plan.
With the strategy established, the application of Morin’s idea of the ecology of action is best considered through a short exploration of two concepts: prudence and mindfulness. These are common terms, and most of us assume that we know what they mean. In fact, both have very specific definitions, and in the case of prudence, a very long history.
In the fifth century, St. Augustine described prudence as “the knowledge of what to seek and what to avoid.” More specifically, in the seventh century, Isidore of Seville said that, “A prudent man is one who sees as it were from afar, for his sight is keen, and he foresees the event of uncertainties.”
But oddly enough, and at the risk of freewheeling completely off the rails of technical discussion, the best description of prudence that I have found was offered by St. Thomas Aquinas in his historically pivotal tome, the Summa Theologica, which he compiled during the thirteenth century. The word prudence derives from the Latin “providentia,” which means foresight. Thomas strengthened Isidore’s idea when he said that foresight “implies the notion of something distant, to which that which occurs in the present has to be directed.” He said that prudence is “right reason (what today we might call observed truth) applied to action.”
It turns out that St. Thomas’s ideas on prudence more or less make up the original foundation of what we consider as crew resource management. He describes three core elements:
- Taking counsel, an act of inquiry, often seeking the opinion of others… first officers, flight attendants, dispatchers, mechanics, flight instructors, FSS briefers… lest something be overlooked. Thomas was quite clear on the assertion that a single person is often unable to capture all that matters to a given situation. Today, this speaks to the limits of human cognition within a dynamic environment.
- Judging of what you have learned, an act of consideration, speculation, and for us, forming the opinions required by FAR Part 121, followed by an act of decision. Thomas splits this into two capacities: docility, the willingness to learn from others and decide accordingly, and shrewdness, the ability to draw accurate, “just-in-time” conclusions when there simply is no opportunity for extensive counsel or contemplation.
- Executing command, the act of authority, in other words fulfilling the obligation bestowed on the pilot-in-command by FAR 91.3.
Thomas Aquinas, the first man to define CRM?
These three elements form the structure within which “that which occurs in the present” is directed toward “something distant.” If we listen carefully, we will hear these elements in the FAA’s explanation of FAR 91.1065, when they state that “The applicant’s performance will be evaluated on the basis of judgment, knowledge, smoothness, and accuracy (taking counsel, judging of what was learned, and executing command).” Remarkably, in the summer of 1901, Wilbur Wright reached back to these early discussions and penned what was probably the first description of prudence applied to air safety:
All who are practically concerned with aerial navigation agree that the safety of the operator is more important to successful experimentation than any other point. The history of past investigation demonstrates that greater prudence is needed rather than greater skill.
This brings us to an exploration of the more contemporary idea of mindfulness, “a rich awareness of discriminatory detail,” in the words of Karl Weick and Kathryn Sutcliffe. They elaborate on this by saying that being mindful means paying attention in a different way; it is to see more clearly, not to think harder and longer. You stop concentrating on those things that “confirm your hunches, are pleasant, feel certain, seem factual, are explicit, and that others agree on.” You start concentrating on things that “disconfirm, are unpleasant, feel uncertain, seem possible, are implicit, and are contested.” Mindfulness acknowledges the very same uncertainties which Isidore claimed a prudent man would foresee. This is the debate with Saint-Exupery’s elemental divinities.
Airmanship, in this context, can then be salted with more of Weick and Sutcliffe’s organizational ideas. First and foremost, the airman is preoccupied with failure, meaning what has already failed, what is failing at the moment, and what is likely to fail. The periodic twitch of a torquemeter, an unusual imbalance in generator load, a steady divergence between actual fuel burned and planned fuel burned, an unexpected collapse of the visibility, an unexpectedly long—or short—touchdown, an omitted checklist step, or certainly any number of unexpected automation behaviors… all of these things preoccupy the airman. What went wrong? Why did it go wrong? What does a particular failure mean? Is it a precursor?
Secondly, he or she is reluctant to simplify, despite seductive pressure to “eliminate everything unnecessary,” because simplification “obscures unwanted, unanticipated, unexplainable details and in doing so, increases the likelihood of unreliable performance.” This is certainly applicable to autoflight system function, but really to almost everything we do. There is no way to simplify the effects of airframe ice accretion, microbursts, or runway braking action, nor is there any simplification applicable to human behavior and error. Simplification invokes certainty, which flies straight into the face of the uncertainty which Isidore claimed prudence would anticipate. We cannot afford to obscure unwanted, unanticipated or unexplainable details.
Thirdly, the airman is sensitive to operations, a “watchfulness for moment-to-moment changes in conditions.” In this way, the airman “slows down the speed with which we call something ‘the same.’” The airman recognizes that today is not the same as yesterday, that the situation is ever changing, evolving, and uncertain. The same flight, in the same airplane, from the same gate is not the same today as it was yesterday. There are small differences which can have disproportional effects.
Lastly, the airman builds and maintains resilience, the quality of “recalibrating expectations, making sense of evolving uncertainties, and learning in real time.” To borrow from Weick’s writing on this, with some adaptation, a resilient cockpit works to keep errors small, improvises workarounds that preserve adherence to the strategy, and absorbs change while updating the strategy.
With the ideas of prudence and mindfulness front and center, let me turn to what I believe is the most important strategy implicit in good airmanship: the protection of the margins. Whether it be a forty five minute fuel reserve, 1.3 Vso, a 0.8% margin over net climb gradient, or a twenty mile berth around the downwind side of a thunderstorm, a core strategy of airmanship is the protection of the margins. The margins anticipate and buffer uncertainty. They provide space and time for any subordinate strategy to be modified. We cannot allow things of which we are already certain to erode the margins, lest the buffer against further uncertainty be lost.
Checklists and SOPs maintain safety margins and catch errors.
To that end, we land on the centerline for a reason: to preserve a seventy five foot margin of pavement on either side, to accommodate at least some of the threats that are “infinite in number, [and] cannot be grasped by reason,” like some combinations of hydroplaning and wind gusts, main gear trunnion fractures, airport snowplows wandering aimlessly around runways… in other words, the average estimated probabilities of all unknown events.
Further, we use standard operating procedures to track the centerline of the safe operating space, and to ensure that the procedural margins, and the error traps integrated within those margins, are available to function in the background. Standard operating procedures are themselves a strategy, a subset of the idea of protecting the margins; they are not a litany. They are intended to manage the ecology of action, and to track an action as it begins to deviate from our intention. This, too, is another way of looking at envelope protection, seen through the lens of the capability view; we gain greater control of our environment by using automation to ensure that critical aerodynamic margins are protected when hours and hours of sheer boredom lead to distraction or inattention, or are occasionally interrupted by brief moments of stark terror followed by a startle response.
These ideas largely inform both the old situational awareness, the aeronautical one, and the new situational awareness, the one aimed at automation. The thread that ties all of these ideas together is the acceptance of uncertainty. When Saint-Exupery uses terms like a debate with elemental divinities, or a tempestuous sky, he is describing uncertainty.
At this point, we can perhaps suggest a general definition of airmanship:
Airmanship is the application of both prudence and mindfulness so as to always remain the obvious master of the aircraft, and to construct, modify and execute the necessary strategies to ensure that the safe outcome of the flight is never manifestly in doubt, while always protecting the margins in anticipation of uncertainty.
If we see the operating environment only as a socio-mechanical construct, such as the National Airspace System, and thus teach only the cybernetic view of technology, we create a systems operator who is unprepared to debate on terms of equality with the mountain, the sea, and the wind, or, for that matter, with the central processing unit of the flight control computer. His terms have been dictated by the set parameters within a closed control loop, designed to trigger Morin’s “sequence of actions to be executed without variation in a stable environment.” The foresight is pre-programmed, trapped within the closed control loops, and limited to a narrow set of anticipated threats, or specific risks. This is antithetical to airmanship, because those parameters will eventually fall out of equality with the vast tribunal of a tempestuous sky.
The fundamental flaw in attempts to adapt the cybernetic view of technology to the problems of flight lies in the belief that we have expanded our knowledge to a point at which we have absolute, predictable, and repeatable control within a tempestuous sky. We don’t, and likely never will. An analog world will simply swat away a digital mindset.
If, on the other hand, we interpret automation through the capability view of technology, automation will always be subordinate to strategy, a machine in the service of man. Further, if we approach automation as capability, we are prepared for the degradation of that capability. Such degradation merely leads to modification of the strategy. Eventually, if need be, we will fly the approach by hand, using basic or even standby instruments, still remaining within the strategy of a stable approach.
Airmanship thus begins with strategy. Prudence facilitates an expectation that the action we have taken will begin to escape our intentions. A continuous loop of taking counsel, judging of what we have learned, and executing command, modifying the scenario “according to information gathered along the way and hazards, mishaps or good fortune encountered,” tracks the action and corrects its evolution, as it is grasped by the environment, so that the strategy is preserved, or, if necessary, modified, such as when we abandon the approach and go around. In this way, we remain the obvious master of the aircraft.
But human will cannot be amplified in ignorance. We need to recalibrate our automation training paradigm. We must begin with a discussion not of how the automation works, but of how we want to fly the airplane, what the essential problems of flight are, and then augment this broad discussion of strategy with the greater capabilities afforded through automation. Likewise, in all cases, we must emphasize how degraded automation impacts that capability within the original, overarching strategy. Finally, we must remain aware of uncertainty, and reference the training curriculum to the management of uncertainty. Memorizing “the litany” in isolation just won’t cut it, because the litany is a short term program, a closed control loop.
In the end, we can only preserve mastery of the aircraft if we understand airmanship as the management of uncertainty, not simply the management of systems. We must know how the airplane is constructed to achieve the design capabilities, and match this with a strategy for how we want the airplane to be flown to utilize those capabilities, and then insist that the autoflight systems fly our plan. When those systems don’t fly our plan, we need to step in and do some of that pilot stuff. The automation can never be allowed to become the master of the airplane, obvious or otherwise; in no case can it be allowed to place the successful outcome of any maneuver in any doubt whatsoever.
That is the essential nature of the conversation that I have with the autopilot.
- Runways anchor our life—an airline pilot reflects - May 11, 2022
- Ice bridging: the myth that won’t die - November 30, 2020
- Icing diversions—an overlooked threat - October 12, 2020
Wow. I don’t believe I’ve ever read a more accurate, applicable, and readable description of the dichotomy between pilot and automation. There is a list of things you never what to hear your pilot say. The number one, of course, is “Watch this!” As automation has become more and more prevalent–especially in the general aviation community of single-engine puddle jumpers–I’ve added, “Why does it keep doing that?”
If you don’t know, something is seriously wrong.
Hi Steve,
I have only one question. Before 2001 the airline industry in the U.S. never went more than two years without a fatal accident. Since 2001 there have only been two fatals. And the most recent was in 2009 at Buffalo.
If the “airman” of yore were so good, and the switch flippers of today so bad, why did the airman used to crash so much, and the switch flipper wreck so rarely?
Something must working right. Maybe we are better “airman” today than you think.
Mac Mc
Mac, I would suggest several aspects to the decline in domestic Part 121 fatalities. The two higher level changes have been the introduction of Safety Management Systems and the longer term evolution of crash survivability in transport category design (clearly seen in Asiana). Within the SMS structure, the development and application of Flight Operations Quality Assurance programs, and the parallel development of Aviation Safety Action Programs, have made a significant difference in air carrier safety. In addition to all that, we have to consider the benefits of specific technologies such as TCAS and EGPWS, as well as the contribution made by envelope protection systems. All of this is difficult to quantify without access to proprietary data; however, as you have said, a pretty clear inflection in the trends is visible in the publicly available data beginning around 2001.
That is not so clear to me in Part 135 and Part 91. Both show a steady decline in fatality rate and aircraft damage rate, however those declines do not show the same kind of inflection points as Part 121 does. And we’d have to normalize that data with an operational metric like the sale of aviation gasoline, which also shows a steady decline (obviously!).
The UPS 1354 accident at Birmingham may be case study for where a conversation with the autoflight system might have made a difference, as it was certainly not doing what they expected it to do, since they had failed to correctly program it. And for sure, a better understanding of both prudence…simply identifying the closed runway with the NOTAM before departure, instead of getting it from the ATIS…and mindfulness… the report is loaded with things that “disconfirm, are unpleasant, feel uncertain, seem possible, are implicit, and are contested”… could have prevented that disaster. And yet what happened to that crew is not that far removed from many ASAP reports that my own company publishes each month internally.
Excellent article Steve, and I strongly agree that SMS, FOQA and ASAP are very powerful and important programs that provide immense amounts of useable data. It’s useful data that provides detailed analysis leading to appropriate corrections to unwanted trajectories. This data comes from the most important source – the cockpits and the pilots themselves (with some from sensors and ATC). I’ve seen the power of these programs first hand. When used appropriately, thoughtful and timely actions are developed – they can help improve the system we operate in.
Thanks for this important discussion.
Norbert Wiener and Mr. Peabody in the same article – clearly a man after my own heart! If you had referenced B.F. Skinner I would sell you my first born.
That said, human factors may be a predictable discipline in the right setting but it is far from deterministic.
Kim,
I actually was quite intrigued with Skinner in college, mainly the idea of how you could apply errorless learning to flight instruction!
Can’t even see the ASI in that cockpit.
What a great article! Thank you!
That was fantastic! Well written and a wonderful analysis of man vs machine. I enjoyed it very much and learned from it. Having just retired after 34 years of flying Boeings and MDs I can relate. Mr Green gets it.
BTW, I should have mentioned I have never read a better definition of Airmanship than Mr. Green’s.
Steve, first I must congratulate you for an exceptional piece of work. As an older, recently, but no longer, “Rusty Pilot” now current and flying a couple hundred hours a year in your old stomping ground with its scores of flight schools and associated traffic, I want to thank you for raising consciousness and awareness about the limitations of both flight systems and pilots abilities. Mindfulness must be a constant if we are to reduce the number of Part 91 accidents and enjoy lower insurance rates. That comes only from each pilots commitment to Aviate Navigate and Communicate…each and every time. Thanks for a great and provocative read.
A few moths ago, Mac McClellan was pondering the definition of “Airmanship” in his monthly AOPA editorial. I took a stab at sending him something – but alas unworthy of publication.
I concur with another reader’s comment that Steve Green’s definition was the best I’ve ever seen, but his obvious skill at wordsmithing did not allow him to shorten it into a very meaningful statement that goes: “Airmanship is the management of uncertainty“.
Minor critique on my part – max kudos for Greens ability to have learned and distilled all of that wisdom from all of his flights into something meaningful regarding the management of uncertainty in flight.
This was a great read. It should be included in the training program for captain upgrades. The information incorporated in this article would heighten the awareness of individuals moving from the right to the left seat. As the function of the pilot changes, so does the accountability in the cockpit. Although more and more automation seems more prevalent in every aircraft build these days, pure airmanship should always be front and center, just in case the system decides to stop behaving for a bit.
”New Dawn”
This is one of those solid-gold pieces that should be required reading for pilots. I’ve had this discussion, I won’t call it debate, with pilots and instructors. I’m no Luddite but my opinion is that for student pilots flying an airplane and managing a computer are two very different things. Should beginning students start with ForeFlight or a G-1000 or first learn to fly the airplane using round dials? My opinion is that learning to control the airplane with as few procedures as necessary is better for beginning students if only because mastery is simpler and the takeaway is confidence which is invaluable. Starting out with a computer steepens the learning curve and distances him or her from initial learning of the airplane, airmanship, the airspace, communications, landing and takeoff, to name a few. It also creates reliance on one type of software.
Should square-one be a GPS moving map or a paper chart? I give Garmin, Foreflight and Avidyne their due. But should instruction be based on what happens to be installed in the panel regardless of its complexity and sophistication? Getting a student’s line of sight OUT of the airplane should be a priority. Obsession with computer screens is consistent with the video-game generation but glass comes at the cost of looking DOWN rather than out. Should transitioning to glass come after learning some basic instrument skills?
I never knew someone could make flying so complicated
In decades of reading anything and everything relating to a aviation I could get my hands on, this is simply one of the finest, most informative, and most enjoyable articles I have ever read. Thanks Steve.
Very interesting article but too academic/lengthy.
Please keep it simple,
Thanks
Excellent article Steve,
For those who want more information, and another way to look at the subject, I would highly recommend reading professor, and NASA scientist, Dr. Earl Wiener writings, papers, and Laws, that apply . He puts everything in a concise, simple manor.
https://aviationweek.com/wieners-laws
Fascinating article. Captain Green combines philosophy, cognology, history, technology, automation and behavioral and functional competencies making a quite interesting read. One reviewing the BEA Final Report for Air France Flight 447 (Airbus A330) can see how his article lends insight as how automation can run amuck (behavioral and systems failure); and then there is the Boeing Max.
Nicely done Captain.
Steve, so well written, and so very persuasive–I do wonder how your article will be received by today’s young student who does not have the memories and experience’s we 20th Century born fliers have. We grew up with pencil, paper, and slide rulers. They have grown up with cell phones. laptops, and electronic flight bags.
I am an old student pilot who studied Skinner in college. The Air Force used his methods in the ’60’s in my Undergraduate Navigation School (and else where) and my early student pilot text book also used his technique (never finished my license back then). As my older flight instructor now has said, learn to fly and understand the airplane and then we will deal with ForeFlight and the GPS; look out the window and not at your iPad–what are the 21st Century born CFI’s saying?
I still carry paper charts and have been known to say a few expletives to the GPS. GPS has dampened the need for navigators but maybe they will return as the Air Force is now concerned about GPS being spoofed. Annapolis is teaching celestial again.
Flying around the world in both hemispheres, I started with celestial, and later had INS and LORAN, but always backed it up with celestial, and of course, all starting with Dead Reckoning, something a computer does not do or display. We all know what happened to the Korean Air Flight that was shot down over the Kamchatka Peninsula because as best could be determined, the aircrew had incorrectly loaded their Present Position into the INS prior to departing Anchorage (garbage in; garbage out).
I concur with everything you have written, but will today’s generation comprehend it when they are used to speaking to LEXUS or equivalent and getting the answer they think they want. I am sure the buggy whip makers said the same thing when Daimler invented the automobile. We all know about HAL in Stanley Kubrick’s: “2001: A Space Odyssey”. You might want to break it up into smaller chunks if possible, given this generation’s expectation of a “six to 10 minute message”.
Ditto with the comment, make this required reading for all Captain Applicants but make it for First Officers too. Remember talking to one Captain or First Officer who was flying a new Boeing 757 out of Hawaii who had to return to Hawaii, as a glitch in the flight management system would not let them climb above FL 250. Colonel Glenn had to hand-fly his Gemini Friendship 7 Spacecraft when he had his heat shield problem–automation is great, but the “old seat” still has a lot of knowledge.
A lot there to digest. I took two sittings but I’m a bit slow perhaps.
One of the worst things my chief charter pilot mentor could say about a pilot was “he’s a linear thinker”. One of the best things the boss could say about a pilot is “he knows how to think”.
Hopefully I still do.
Automation is only as good as its programming and inputs (sensors and human)…when there are insufficient or poorly thought through “use cases” or strategies for dealing with inaccurate or conflicting sensor or human inputs, automation fails to enhance safety.
Airmanship is similarity only as good as training (human “use cases”) and situational awareness which is dependent on the vagaries of human attentiveness.
The real problem area is the seam when automation fails to resolve an incident and the human is oblivious to what’s about to drop in their lap…an overload of inputs conflicting with their complacency in an extremis situation (Buffalo, Air France, San Francisco). Pilots cannot be utterly dependent on automation to achieve a safe outcome in challenging conditions…at some point they will encounter a sensor or systemic failure or operations outside the design envelope. While redundancy is good, there are also often lurking single point failures somewhere in the design susceptible to voltage spikes, software or grounding issues.
Yes, we have autonomous trains at the airport, but the environment is tightly controlled and unchanging…with the option to stop if conditions exceed programming. Some years ago a subway system ran fully auto until a fatal during a snowstorm resulted from conditions beyond its programming…while train “operators” were discouraged from intervening. There’s a world of difference between autonomous and semi-autonomous operation…and the day you are dependent on remotely monitored autonomy is the day your comm links drop.
Humans are awful at monitoring automation, yet automation needs monitoring for failures and off-design operations…this seam needs continued attention before the day that monitoring is the sole reason pilots are still onboard.
…and anyone who thinks autonomous operation is more cost effective than a starving pilot or two has never been through software development!
Sheer brilliance. Excellent article. Thanks.
Excellent discussion of the man-machine interface in the context of flying. This provides a good framework also for thinking about the future role of the pilot as the results of automation loops grow to encompass longer timeframes and become less uncertain.
While a great companion piece to read alongside watching Children of the Magenta, this also serves as a great primer for Complexity Science and Cynefin.
I don’t have interest in becoming a pilot, but someone I knew just recently passed away in an airplane accident out of MI so I was interested in learning how it could have happened given the two pilots were quite experienced. Thanks for sharing and it’s such a great read!