Thursday, June 2, 2011

Sullenberger on the Fallacy of Pilot Error


I'm starting a crusade for a more judicious use of the term "pilot error" and I nominate as my campaign poster boy…Tada! -- Capt. Chesley Sullenberger.

The newest member of the formerly obscure community of aviation safety commentators has a new gig on CBS News.

From that platform he can say what many others who don’t have his good looks or American hero status have been saying, and he can make these points to the very people who have recently been given a somewhat mangled version of what happened on Air France Flight 447.

By that I mean that when Capt. Understatement said on television that the pilots of the Airbus 330 found themselves without essential flight information, in the dead of night out over the Atlantic en route from Rio de Janiero to Paris, they were “in a very difficult situation.” They could not work out the problem in the time they had, he said, which was more or less, three minutes.

This exceedingly moderate but important context put forward by the Airbus captain who handled the Hudson River landing of USAirways Flight 1549 in January 2009, is part of Sullenberger’s schtick and I’m delighted. He’s retired from USAirways, (and I hope, still enjoying "rock star sex") but he hasn’t lost his seven-mile high perspective.

As he wrote in his book, Highest Duty, fly-by-wire airplanes can be enormously helpful to the pilot, but contrary to the position taken by Airbus in William Langewiesche’s book, Fly by Wire, these airplanes cannot – correction – should not be “pilot proof”.

Sullenberger has been making this argument since Langewiesche's book, Fly by Wire came out last year. The book attributes much of the credit for the successful outcome of Flight 1549 to the technology behind the Airbus airplane. Langewiesche’s position launched these two knowledgeable and literate pilots into a public debate (channeled through me) in The New York Times.

On his CBS News appearance, Sullenberger told news anchor Harry Smith that the Air France disaster was a seminal event precisely because it raises anew the question of how man and machine work together in highly automated airplanes. “We have to wonder whether making airplanes more technologically advanced makes it more difficult for pilots to recover when things go awry," he said.

Harry was listening and so I hope, was his audience, the very same folks who have been exposed to the irresponsible headlines proclaiming Black Boxes Point to Pilot Error or the even more incredibly inaccurate AOL Travel story that said; "the black box from Air France Flight 447 showed that pilot error was to blame.
"

What Sullenberger brings to the discourse is the plea to hold-your-horses, because what-the-hell-does-pilot error mean in a situation like this? The pilot isn’t alone in the conduct of a flight. The pilot is part of a system.

By saying this publicly, Sullenberger says what Key Dismukes, pilot, scientist, biophysicist, author and overall big thinker on the subject of human factors has been saying for years.

So I called Key the other night to get his take on all this “pilot error” news babble. (And also because I need little excuse to listen to Key talk about human performance. His performance is always brilliant.)

“The airplane, the designer, and the pilot are part of a complex system,” Key said. “Under certain circumstances things happen that leave the crew trying to figure out what’s going on.”

In the case of Air France 447, “all of a sudden everything starts going wrong; The surprise, its discombobulating. They can’t process it, it doesn’t map against what was happening four seconds ago.”

So in the quiet room in Paris where the parties investigating the crash listen to the cockpit voice recorder and compare what the pilots did with what was actually happening, the question is “Why did the pilot pull nose up when he should have done the reverse?” And if the investigators are conscientious - I’ve met a few of them and they seem to be -  they will not simply conclude there was something wrong with the decision-making abilities of these particular pilots - end-of-story. Or even that their training was deficient. They will look at the entire system of which these particular pilots were a part. Because pilot error isn’t a cause, it’s a clue. It suggests something is wrong with the larger picture.

Airplanes evolve. Over the past century of flight they have become more fuel efficient, more capacious, more robust and more complex, while the human remains essentially the same; fallible, prone to complacency on the negative side, flexible and able to improvise on the positive.

“Every day, somewhere in the air a cockpit crew averts disaster by routinely dealing with equipment malfunctions, weather uncertainties, or unscripted situations,” Key says, reminding me these are the not-to-be-ignored strengths of the human over the machine.

So that if an airplane evolves to a point that it relies on the plusses of the human and fails to take into account the minuses it is the system that has erred, not the pilot.

Don't believe it? Just ask Sully.

18 comments:

Tim Kern said...

Yes, all true. (Sully knows his stuff.) On the other hand, with all that modern technology available and so many things to check, the pilots missed the crucial fact that the airplane was stalling.

In a less-pilot-proof airplane, they would never have missed that, instrument failures or no. In airplanes as in life, attitude is everything, and that Airbus was hanging in a bad attitude for quite a while.

Mike Danko said...

Christine, great article. "Pilot error" is one of the most overused phrases in aviation. Part of the problem is the conflict of interest inherent in the NTSB's "party system" of investigation. That system inevitably shifts blame away from manufacturers and on to pilots. By now, the public is spring-loaded to accept "pilot error" as the cause of virtually any accident, regardless of what the pilot was up against.

Rob Mark said...

Isn't it interesting that the media - sorry, I know I'm part of that bunch - grabbed on to a logical conclusion that the pilots had screwed up based on what the BEA released Friday.

Of course, that wasn't the entire transcript of that last 10 minutes now was it? Did anyone hear the captain taking command of the situation or was he a deer in the headlights as well?

Some of our readers claim the only reason the BEA gave us what they did last week was because they were sure we'd all eat it up and make it clear that no finger could be pointed at Air France or Airbus. It looks like most outlets did just that too.

Perhaps in the end, we'll find those two giants - Air France & Airbus - did not have an culpability.

But then why release information that could ONLY lead us to believe three dead guys screwed up?

Rob Mark, publisher
Jetwhine.com

Anonymous said...

Great article! Unfortunately most media people just want to know who's fault "it" was and - as the reader - media want simple answers (best not more than 12 words!). In aviation these answers do not exist. If you really want to learn something from accidents you need to dig much deeper than just saying the Captain was not in the Cockpit or the Pilot Flying pulled the stick.

Joerg Handwerg
Member of the Board, Spokesman
German Airline Pilot's Association

Anonymous said...

Am I the only one who believes that a major part of the problem is the ultra computerization of the aircraft and the SOP's which demand that the pilots engage the auto pilot just after lift off and stay in Autopilot mode until after landing. What happens to the Flying skill of those crews. I know a few A380 pilots who when the have to do their annual check, admit that the first session is bad, the second better and the final session good. they have rekindled their flying skills.

Editor said...

Anyone who places one iota of blame on these pilots has never been spit out of a thunderbumper - something that tends to disorient one just a bit.
And whether the pilot or the computer is in charge, airspeed information is critical to maintaining control. Google "Northwest Airlines Flight 6231" for a good example - that was the 1974 case of a B727 with pitot ice.

John Eakin

Foos said...

As a non-pilot, I approach this situation with an eye to who has the most to gain by a particular outcome (in this case who will the general public percieve is at falt).

I find it interesting that the BEA investigators are government officials, and I know that the French government owns 22%of EADS the mother corporation of Airbus and there is a percentage of Air France ownership that the French government holds through pension funds.

In the end, it is in the best interest of the French government to minimize blame on Airbus/EADS and Air France versus the pilots because the business impact could be in the tens to hundreds of millions of dollars.

Not being a conspirast here, just a realist...Prime Minister Merkel called President Obama when the AT&T acquisition of T-Mobile was announced to ensure the administration supported it. Why, because Deuschte Telecom has a big investor, the German Government. It happens all of the time in Europe with state owned or partially owned corporations...

Frank Caron said...

The pilot error is an old concept from the 70-80’s. Focusing on the people “in charge” at the time of the event was always ending on the pilots as the “final” operators of the aircraft.
Today, the focus has expanded and two concepts are intrinsically linked and mixed together: HUMAN ERROR and SYSTEMIC APPROACH.
A commercial flight is made possible by a full and complex system. This system requires the following organisations or agencies (maybe more, but just to make it simple).
• An aircraft manufacturer including researches and development department;
• A regulatory certification agency
• The airline (including the crew that will operate the aircraft for the flight, the training provided, its safety management, etc.)
• Its maintenance organisation
• The numerous suppliers that support the aircraft on the airport (refuelling, cattering, etc.)
• The Air Traffic Control
• The regulatory Civil Aviation authority
• Etc.
Based on this, the pilots are only one component of the system. And the current trend about accident-incident investigation is to try to analyse the deficiencies of system, not only the deficiencies of the pilots, which has been called the SYSTEMIC APPROACH…
Now:
• Who is developing and manufacturing airliners?
• Who is responsible for the certification process?
• Who manage and run the airline, who trains pilots, who manage the safety, etc.?
• Who repair the aircraft?
• Who provide the numerous services to aircraft on ground?
• Who manage and run the ATC?
• Who manage and run the Civil Aviation authority?
All these previous question does have a single answer: HUMAN PEOPLE, at every level, at every stage…
That is the reason the focus on error has shifted from pilots to the numerous human that are involved in the very complex system.
Now about the AF447 outcome, I think it is better to wait for the final conclusions. Because the initial data released were just facts, some people released their own interpretation about these facts that are definitely incomplete. There is no doubt the pilots are deeply involved. Even though it seems their behavior was not appropriate, let’s wait for the final report. By the way there are still several different suppositions about what may have happen (as an example one being the loss the vertical fin).

Frank Caron (Ph.D)
www.culturailes.com

Anonymous said...

Both engines were operating, therefore the airplane had total electrical power and two good attitude indicators (plus a stand-by attitude indicator)one wonders what was missing from their training syllabus? If you lose both airspeed indicators, fly attitude and thrust settings (83-85% N1) and NEVER stall the aircraft. Training is everything....where was it? I know, I flew for 42 years; everything from the Electra to the B-747.

Pete Frey said...

So, like Colgan, we again get a description from the investigative agency that can only describe the actuality of the event by repeatedly referencing angle of attack.

Angle of attack is measured by vanes on the outside of the fuselage and delivered to various devices in the A-330 and the Q400, including the Flight Data Recorder, but not to the pilots flight display.

Why is angle of attack so vital to our understanding, yet nowhere is this information provided to the pilots? How can we expect them to act appropriately if they are not provided with such essential and basic information?

Airline Pilots are taught to fly the correct angle of attack by flying an exact speed for the estimated weight of the aircraft. Without the airspeed indication, supplied through the pitot tube, this is becomes extremely difficult and once the aircraft's attitude is upset; nearly impossible.

Airline pilots are not taught nor practice actual aerodynamic stall recovery. Even if they wanted to, the flight simulators do not have any actual flight fidelity below stick shaker. How an airliner flys, reacts or misbehaves in actual stall is a mystery to all but the manufacturers test pilots.

Frank Caron said...

The pilot error is an old concept from the 70-80’s. Focusing on the people “in charge” at the time of the event was always ending on the pilots as the “final” operators of the aircraft.
Today, the focus has expanded and two concepts are intrinsically linked and mixed together: HUMAN ERROR and SYSTEMIC APPROACH.
A commercial flight is made possible by a full and complex system. This system requires the following organisations or agencies (maybe more, but just to make it simple).
• An aircraft manufacturer including researches and development department;
• A regulatory certification agency
• The airline (including the crew that will operate the aircraft for the flight, the training provided, its safety management, etc.)
• Its maintenance organisation
• The numerous suppliers that support the aircraft on the airport (refuelling, cattering, etc.)
• The Air Traffic Control
• The regulatory Civil Aviation authority
• Etc.
Based on this, the pilots are only one component of the system. And the current trend about accident-incident investigation is to try to analyse the deficiencies of system, not only the deficiencies of the pilots, which has been called the SYSTEMIC APPROACH…
Now:
• Who is developing and manufacturing airliners?
• Who is responsible for the certification process?
• Who manage and run the airline, who trains pilots, who manage the safety, etc.?
• Who repair the aircraft?
• Who provide the numerous services to aircraft on ground?
• Who manage and run the ATC?
• Who manage and run the Civil Aviation authority?
All these previous question does have a single answer: HUMAN PEOPLE, at every level, at every stage…
That is the reason the focus on error has shifted from pilots to the numerous human that are involved in the very complex system.
Now about the AF447 outcome, I think it is better to wait for the final conclusions. Because the initial data released were just facts, some people released their own interpretation about these facts that are definitely incomplete. There is no doubt the pilots are deeply involved. Even though it seems their behavior was not appropriate, let’s wait for the final report. By the way there are still several different suppositions about what may have happen (as an example one being the loss the vertical fin).

Frank Caron (Ph.D)
www.culturailes.com

jdavisson said...

Tim is correct, the airplane stalled and once a swept wing jet stalls it goes flat and typically is unrecoverable, thus the emphasize in training of stall "avoidance".

Anonymous said...

Pete, you couldn't be more wrong. Airline pilots are trained in aerodynamic stall recovery. Usually, every proficiency check begins with performing a "stall series"; Clean, Approach Flaps, and Landing Configuration. Additionally, every advanced simulator I've operated for the past 12 years has had "fidelity below stick shaker", in other words, it flies like an airplane would under those conditions, and recovery from an aerodynamic stall is in every Simulator Training Syllabus for a Type Rating. As for angle of attack, it is the angle between the mean aerodynamic chord of the wing and the relative wind over the wing. In strong turbulence, angle of attack indicators have a tendency to be inaccurate. If airspeed indications are lost (icing, instrument failure, air data computer failures, etc) the only recourse for the pilot is to fly attitude and thrust settings recommended by the manufacturer in the Aircraft Operations Manual.

Anonymous said...

Congratulations to the most of the writers. You are all alive..
Nobody was on AF flight. One factor is reason for the first descision: surprise. After the second(s) of surprise you are able to REact. 82 to 85% N1....hm...you can choose: Overspeed or stall. Dont forget Mr. 747 flyer: you are IN a thunderstorm. Hard changing winds. YOU never will do a powersetting for the whole time. I wasn´t on board and not in the cockpit, so nobody, Sully too, can say what really was happening there. A voicerecorder only can tell us what was the sound in the cockpit but not the thoughts and the worrys of the pilots. If the Checker tells you (Pilots): come on lets land at the Hudson today...what will you think? You cant have a training for that situations.
Just my two german cents

Anonymous said...

Great article and spot on point particularly with "scarebuses". The pilot is second fiddle on these aircraft. You only have to look at the airbus A330 incident over Western Australia 2010 where the aircraft "decided" to power up and down alternately gaining and losing altitude with the crew going along for the ride. This was a computer malfunction and not pilot error. These airbus incidents should not be looked at in isolation.

jeff hathorn said...

I flew the 330 several years and had a similar INTIAL experience.The A/P & Auto thrust AUTOMATICALLY kicked off in addition to an abrupt nose up attitude due to an overspeed sensing. We were able to reengage both and to continue without anymore problem. Note: these auto systems were not available to recover until the ADC sensed NO MORE overspeed. I suspect that in the case of the Air France crash; overspeed was sensed due to ice in the sensors which lead to the nose up and disconnect of A/P& A/Thrust. The flt.path suggests that the sensing continued to be"overspeed" which perhaps did not allow the pilot to bring the nose down or reengage the A/P.

TGale said...

I think that a more PC headline for this would refer to "Human Error at Fault". After all it was a combination of aircraft design, systems design, training and standards of the airline, even the industry not just the individual pilots that failed the victims on this flight.
There are different levels of logic to the human brain function just as there are different levels of the Airbus FbW. For humans we have instinct, emotion and intellect and all the "fuzzy logic" in between. The more severe and immediate the threat, the more basic our reactions are going to be.

The human error in all this is not being able to reconcile the two sources of logic processing between man and machine.

Anonymous said...

Here is a crucial fact. In the USAF, the pilot is 70% more likely to be found to have been the primary cause of an accident if he dies than if he survives. It should be the same, of course, because whether the pilot's heart stops beating AFTER an accident has no bearing on the accident's cause. The real difference? In one case the pilot can defend himself and explain what happened. In the other he cannot. Airbus used to brag that a flight attendant could fly their airplanes. A design philosophy with that as its goal is founded on management's belief that they are superior to pilots, and it has produced airplanes that 1) can overrule a pilot and 2) fail to present him with crucial information. For example, some Airbuses do not servo their engine thrust settings back to the throttles, thus denying the pilot crucial information through his right hand (Paris airshow). You will never see that in a Boeing. Others drive an engine to idle thrust if it loses PT zero input and no throttle command (request?) can overrule the engine's computer (Hudson River). I have never seen a FODed engine that wouldn't produce SOME thrust, and maybe that thrust would enable the pilot to make it to a runway instead of a freaking river! But Airbus doesn't trust pilots only to use more than rated thrust in an emergency. And in an effort to minimize engine damage they force the airplane to crash. This kind of thing will continue to happen until Airbus starts trusting pilots.