Air Safety Through Investigation JANUARY-MARCH 2020 Journal of the International Society of Air Safety Investigators

Examples from Airmanship 2.0: Flying Over Flying Over The Paradox Kapustin Scholar Airbus: Black Innovating Human Conflict Zones: Conflict Zones: of Intuition: Essay—Air Safety Swan Events Factors Forensics Follow-up The Way Forward Training Pilots for Cybersecurity: page 4 page 8 Recommendations from MH17 Unexpected Events Why Cybersecurity from MH17 page 20 page 22 Is a Threat for Air page 18 Safety page 25 CONTENTS Air Safety Through Investigation Journal of the International Society of Air Safety Investigators FEATURES Volume 53, Number 1 Publisher Frank Del Gandio 4 Examples from Airbus: Black Swan Events Editorial Advisor Richard B. Stone By Stéphane Cote, Director of Flight Safety, Accident Investigator, Airbus—The author Editor J. Gary DiNunno defines and provides examples of black swan events and discusses lessons learned that Design Editor Jesica Ferry could be incorporated into preevent training or might assist crews to mitigate the problem. Associate Editor Susan Fager 8 Airmanship 2.0: Innovating Human Factors Forensics ISASI Forum (ISSN 1088-8128) is published quar- terly by the International Society of Air Safety By Frederik Mohrmann, Aerospace Engineer and Aviation Training Expert, Netherlands Investigators. Opinions expressed by authors do Aerospace Center and 2012 Rudolph Kapustin Scholar; and John Stoop, Aerospace Engi- not necessarily represent official ISASI position neer, Safety Investigator, and Professor of Forensic Engineering and Safety Investigation or policy. at Lund University, Sweden, and Deft University of Technology and Amsterdam Universi- ty of Applied Sciences, the Netherlands—The authors present new methods to investigate Editorial Offices: Park Center, 107 East Holly Ave- human factors forensics in air accidents and events and suggest the need for a new human nue, Suite 11, Sterling, VA 20164-5405. Telephone factors model and possible countermeasures. 703-430-9668. Fax 703-430-4970. E-mail address, [email protected]; for editor, jgdassociates@ 18 Flying Over Conflict Zones: Follow-up Recommendations from MH17 starpower.net. Internet website: www.isasi.org. ISASI Forum is not responsible for unsolicited By Marieke van Hijum, Senior Investigator, Dutch Safety Board—The author describes the manuscripts, photographs, or other materials. Dutch Safety Board’s follow-up investigation of the MH17 disaster and the global effort to Unsolicited materials will be returned only if improve management of the risks associated with flying over conflict zones. submitted with a self-addressed, stamped enve- lope. ISASI Forum reserves the right to reject, 20 Flying Over Conflict Zones: The Way Forward from MH17 delete, summarize, or edit for space con- By Kas Beumkes, Senior Policy Advisor, Aviation Safety and Security Division, Civil Avia- siderations any submitted article. To facilitate tion Directorate, Ministry of Infrastructure and Water Management, the Netherlands—The editorial production processes, American Eng- lish spelling of words is used. author discusses actions of the Dutch Safety Board and the Dutch government since the board issued its final MH17 accident report on Oct. 13, 2015. Copyright © 2020—International Society of Air Safety Investigators, all rights reserved. Publica- 22 The Paradox of Intuition: Training Pilots for Unexpected Events tion in any form is prohibited without permis- By Laurie Earl, Coventry University, the UK, and Jim Sheffield, Victoria University, New sion. ISASI Forum registered U.S. Patent and Zealand—The authors examine how intuition influences decision-making and explore how T.M. Office. Opinions expressed by authors do not necessarily represent official ISASI position pilots make decisions in complex situations when they can’t rely on procedures. or policy. Permission to reprint is available upon application to the editorial offices. 25 Kapustin Scholar Essay—Air Safety Cybersecurity: Why Cybersecurity Is a Threat for Air Safety Publisher’s Editorial Profile: ISASI Forum is print- By Nur Amalina Jumary, 2019 Kapustin Scholarship Recipient, University of New South ed in the United States and published for profes- Wales, Australia—The author discusses the growth of digital data communications in avia- sional air safety investigators who are members tion and the subsequent threat to air safety from vulnerable information security and the lack of the International Society of Air Safety Inves- tigators. Editorial content emphasizes accident of common cybersecurity standards. investigation findings, investigative techniques and experiences, regulatory issues, industry ac- cident prevention developments, and ISASI and member involvement and information.

DEPARTMENTS Subscriptions: A subscription to members is pro- 2 Contents vided as a portion of dues. Rate for nonmem- 3 President’s View bers (domestic and Canada) is US$28; Rate for nonmember international is US$30. Rate for all 28 News Roundup libraries and schools is US$24. For subscription 30 ISASI Information information, call 703-430-9668. Additional or 32 MENASASI Holds Seminar in Abu Dhabi replacement ISASI Forum issues: Domestic and Canada US$4; international member US$4; do- mestic and Canada nonmember US$6; interna- ABOUT THE COVER tional nonmember US$8. 2019 Kapustin Scholarship winners meet Andre Kulpers, a Dutch physician and European Space Agency astronaut, following his ISASI 2019 keynote address. Shown, from left, are Elise Vondra, Alex Hall, Kulpers, Nur Amalina Jumary, and Stacey Jackson. INCORPORATED AUGUST 31, 1964 2 • January-March 2020 ISASI Forum PRESIDENT’S VIEW

Participants of ISASI’s 55th Reachout Workshop gather in Athens, Greece, on January 7-10. ATHENS REACHOUT WORKSHOP

recently had the opportunity to participate in the 55th ISASI Orange2fly, Sky Express, Superior Air, Swiftair Hellas, Athens In- Reachout Workshop, which was held at the Eleftherios ternational Airport, Goldair Handling, Skyserv Aero, Swissport, Venizelos International Airport in Athens, Greece, from Janu- Egnatia Aviation, Global Aviation Academy, JetStream Aviation I ary 7–10. The workshop was hosted by the Greek Air Accident Academy, TAE Aviation Academy, the Hellenic Civil Aviation Investigation and Aviation Safety Board (AAIASB) and focused Authority, Fraport Greece, the University of Patras, other aca- on accident investigation and aviation safety. Caj Frostell, ISASI demia, and the Hellenic Air Force, Army, Navy, Coast Guard, fire international councilor, and I conducted the training session. service, and police. Antonios Athanasiou, AAIASB chair, opened the workshop. The workshop provided ISASI instructors with a delightful In addition, Capt. Akrivos Tsolakis gave a moving speech about opportunity to connect with AAIASB board members, as well Greece and ISASI. Tsolakis was the recipient of the Jerome F. as former AAIASB investigators Dr. Nikos Pouliezos and John Lederer Award at ISASI 2019 in The Hague, the Netherlands Papadopoulos. There were 64 participants representing the AAIASB, Aegean ISASI is appreciative of the sponsors’ support that made it Airlines, Olympic Air, Air Intersalonica, Air Mediterranean, possible to organize the workshop. The sponsors that funded Bluebird Airways, Ellinair S.A., Gainjet Aviation S.A., Helistar, the seminar included Aegean Airlines, Olympic Air, Athens I-Fly, Life Line Aviation, Lumiwings, Olympus Airways, International Airport, and Sofitel Hotel. ISASI has conducted Reachout Workshops since 2001, which provide subject-orientated training to individuals, government officials, and organizations responsible for aspects of air safety in regions where substantial gains for accident prevention may occur. To date, nearly 2,950 individuals have attended. The program is designed to assist aviation professionals who may not be able to attend formal training due to monetary or travel restrictions. Senior ISASI members who are requested to attend as instructors volunteer their time and expertise and Workshop attendees include, from left, Odysseas Paxinos, doc- do not receive compensation. tor-consultant of the Greek Air Accident Investigation and Aviation The host organization provides Safety Board (AAIASB); Kimon Avgerinos, Jetstream Flight Academy travel, food, and lodging head of training; Caj Frostell, ISASI international councilor; Frank Del Gandio, ISASI president; Antonios Athanasiou, AAIASB chair; expenses for these ISASI Frank Del Gandio and Grigorios Flessas, AAIASB member. participants. ISASI President January-March 2020 ISASI Forum • 3 Examples from Airbus: Black Swan Events By Stéphane Cote, Director of Flight Safety, Accident Investigator, Airbus

(Adapted with permission from the author’s technical paper The Paradox of Intuition—Black Swan Events: Examples from Airbus History presented during ISASI 2019, Sept. 3–5, 2019, in The Hague, the Netherlands. The theme for ISASI 2019 was “Future Safety: Has the Past Become Irrelevant?” The full presentation can be found on the ISASI website at www.isasi.org in the Library tab under Technical Presentations.—Editor)

hat defines a black swan the captain’s sidestick event? Black swan events being inverted in roll. are characteristically The issue remained Wextremely hard to predict undetected during or rare and beyond the realm of normal maintenance and expectations. In ancient Greece, it was the preflight control assumed a black swan could not exist… check. At takeoff, the until it was unexpectedly discovered in captain (PF) applied the wild much later. a lateral sidestick input to the right, but “Houston, we have a problem” the aircraft banked to the left. The first The Apollo 13 mission is a typical officer promptly took example of a black swan event in the over aircraft control, aerospace industry. The objective of this without the captain’s mission was to land on the moon; but expressed demand. following an unexpected failure leading Postevent, AMM to the loss of the primary oxygen in the improvements were Figure 1. Crossed roll controls, A320 (2001) service module, the mission had to be introduced regarding aborted. Direct return to Earth was not onds. Subsequently all flight controls were lost, and slats flight control system possible, so the lunar module was used and flaps were frozen at their current position. In addition, maintenance, and the as a lifeboat while going around the a significant amount of the left wing surface was missing, flight control check moon. During the investigation into this a fire had started, and the associated fuel tank was emp- procedure was modi- event, NASA highlighted the effective- tying. However, both engines were still running. The crew fied. The main lessons ness of crew training, especially in con- managed to learn how to control the aircraft pitch and roll from this event are junction with ground personnel. Many using only thrust. The main lessons learned here are the the importance of a lessons were learned from this accident, remarkable airmanship and team work of this flight crew, flat cockpit hierarchy, and all Apollo spacecraft were modified first officer empow- to incorporate safety enhancements. erment, and crew resource management Airbus black swan events: some (CRM). examples Total loss of hydrau- We will now review the black swan lics, A300 (2003). This events that occurred in Airbus histo- event was caused by ry. For each event, we will detail the a terrorist act. The lessons learned and the product safety left wing was hit by enhancements that were subsequently a missile during the developed. initial climb (around Crossed roll controls, A320 (2001). The 8,000 feet) (see Figure root cause of this event was that input 2). This resulted in wires from one flight control computer the loss of all three (ELAC) had been inverted during main- hydraulic systems in tenance (see Figure 1). This resulted in approximately 20 sec- Figure 2. Total loss of hydraulics, A300 (2003)

4 • January-March 2020 ISASI Forum Regarding the structural aspects: Airbus determined that rudders need a health check in- spection program, even when they are designed to be damage-tolerant. Emergency water landing, A320 (2009). This aircraft (see Figure 4) encountered a flock of birds after takeoff, resulting Figure 3. Rudder loss, A310 (2005) in multiple bird strikes impact- which demonstrated that flying with only engines was possible ing both engines in the current aircraft configuration. This also showed that with subsequent on some occasions you may have to learn as you go, as some significant loss of situations are unique and cannot be trained for in advance. thrust on both en- Finally, this event highlighted the importance of learning from gines. The APU was previous events, as this crew had knowledge of the Sioux City, proactively started Iowa, U.S.A., accident in which all hydraulic systems had also by the crew, which been lost. allowed retention Rudder loss, A310 (2005) . During this event, the rudder was of normal law lost due to weakening of its structure (composite sandwich and thus all flight disbonding leading to reduced torsional stiffness) (see Figure envelope protec- 3). The flight was normal until the cruise, when sudden vibra- tions. The landing tions and a loud noise occurred and Dutch-roll oscillations strategy had to be started. The Dutch roll decreased and stopped when descend- determined with ing. On the ground, a major part of the rudder was found miss- limited or no time ing from the aircraft. The product enhancements that were to prepare. The developed following this event focused on reinforcing inspec- flight crew focused tions and enhancing the design of sandwich rudders. Technol- on the essential ogy and design evolution (monolithic rudders) were intro- task of flying the duced on new programs. Two important lessons were learned aircraft given the from this event: the importance of flight crew academic emergency. The knowledge—in this occurrence, the crewmembers knew from aircraft was flown their upset and recovery training (UPRT) that they needed to occasionally within “slow down and go down” if faced with a Dutch roll in flight. the alpha protec- tion range, until an emergency water landing was per- formed. Following this event, a new QRH procedure “Emer Landing– All Eng Failure” was developed, new engine bird strike certification requirements were issued, and an APU autostart function was introduced on the A350. The Stéphane Cote Figure 4. Emergency water landing, A320 (2009) lessons learned

January-March 2020 ISASI Forum • 5 phase out SAP from fuel filters (deadline January 2020). Uncontained engine disc failure, A380 (2010). This A380 aircraft experienced an intermediate pressure turbine (IPT) disc failure to Engine 2 during climb. The airframe was impact- ed by disc debris, resulting in multiple structure and systems Figure 5. Fuel contamination, A330 (2010) damage (see Figure 6). An in-flight turn from this event were decision-making may be time-criti- back was performed, cal—in this case, due to the proximity with the ground. The during which nu- importance (again) of appropriate task sharing and CRM: merous ECAM alerts the captain flew the airplane and the first officer managed had to be processed. the engines. The need for flight crew knowledge of the A safe landing was systems, such as the decision to start the APU, ensured that performed, followed the flight envelope protections remained available through- by a controlled dis- out the event. embarkation. Several Fuel contamination, A330 (2010). During the descent, product enhance- approach, and landing, this aircraft encountered a loss of ments were developed thrust control affecting both engines. The investigation following this event: determined that the root cause was fuel contamination • IPTOS function: (see Figure 5), which was traced back to the refuel dispens- automatic engine er (truck). As a result of the contamination, both engines’ shutdown in case fuel-metering valves were blocked. Engine 1 remained at of IPT overspeed. approximately 70% N1 and Engine 2 at sub-idle. The fuel • Enhanced engine contaminants were composed of super absorbent polymer design and manu- (SAP) combined with salt and water. An emergency landing facturing process. was made (ground speed approximately 240 knots, Flaps 1). • ECAM enhance- After the event, new operational guidance (a QRH proce- ment, equivalent dure) was developed to assist flight crews. At the industry to scroller intro- level, it confirmed that fuel uplift quality was critical as it duced on A350s. may affect several or all engines. Therefore, the Internation- • Additional fuel al Air Transport Association’s Fuel Working Groups were shutoff valve formed. This resulted, as a lesson learned, in the decision to wiring routing precautions on new programs. • OIS-optimized landing distance calculation based on actual aircraft capability. In terms of lessons learned, the inves- tigation confirmed that such events are best managed with effective work sharing consistent with the cockpit design, in this case two crew- Figure 6. Uncontained engine disc failure, A380 (2010) members. The aircraft 6 • January-March 2020 ISASI Forum limited the startle effect at the AP disconnection, The event also highlighted the need for aircraft systems knowledge: the crew was aware of the systems that use AOA information, which allowed the crew to take immediate and effective action. Loss of right-hand windshield in flight, A319 (2018). Forty minutes after takeoff, while in cruise (FL321), the right-hand windshield of this A319 separat- ed (see Figure 8). An immediate descent to a lower altitude was conducted, followed by a Figure 7. Angle-of-Attack (AOA) probe blockage, A330 (2012) diversion to the nearest airport proved to be resilient to the uncontained engine fail- (Chengdu, China), where an un- ure. It maintained the autopilot and the flight envelope eventful landing was performed. protections due to system redundancies. In addition, The first officer and one cabin the ECAM functioned, even if operating beyond its crewmember suffered minor in- design envelope. The flight warning system managed to juries. An official International process an unforeseen high number of failures. Civil Aviation Organization An- nex 13 investigation, led by the Angle-of-Attack (AOA) probe blockage, A330 (2012). Civil Aviation Administration This A330 experienced a blockage of all three AOA of China (CAAC), is currently probes (see Figure 7). They were fitted with a new con- ongoing. An update will be pro- figuration known as the conic plates. The three AOAs vided in coordination with the became blocked during climb (approximately FL100). CAAC and the French BEA. When reaching FL310, the AP disconnected and the high AOA protection was unduly triggered, resulting in a commanded pitch down. The flight crew switched Conclusion all three ADRs off and stabilized the aircraft at FL300. Black swan events are part of A diversion was then performed with the three ADRs the aviation industry; and as switched back on. As a result of the event unpredictable as they are, these • the conic plate configuration was removed, exceptional events will happen • enhanced AOA monitoring by the flight control sys- in the future. Industry safety tem was introduced, and efforts (design precautions, SOPs, crew training, etc.) have • development of new AOA probes was initiated. allowed minimizing the impacts In terms of lessons learned, this event shows the of such events. When relevant, importance of the flight crew’s continuous system Airbus will develop product monitoring: the crew detected an unusual characteris- enhancements (design, main- tic speeds display on the PFD during the climb, which tenance, procedures, etc.) after such events. To sum up, the main lessons learned from these events are the following: • Respecting the golden rules remains applicable. • All trained pilot compe- tencies (education and training) are key and will be needed. • All available resources shall best be used. • Capability to think outside the box may be required, taking the best of the Figure 8. Loss of right-hand windshield in flight, A319 (2018) available procedures. January-March 2020 ISASI Forum • 7 Airmanship 2.0: Innovating Human Factors Forensics Frederik Mohrmann John Stoop By Frederik Mohrmann, Aerospace Engineer and Aviation Training Expert, Netherlands Aerospace Center and 2012 Rudolph Kapustin Scholar; and John Stoop, Aerospace Engineer, Safety Investigator, and Professor of Forensic Engineering and Safety Investigation at Lund University, Sweden, and Deft University of Technology and Amsterdam University of Applied Sciences, the Netherlands (Adapted with permission from the authors’ technical paper Airmanship 2.0: Innovating Aviation HF Forensics to Necessarily Proactive Role presented during ISASI 2019, Sept. 3–5, 2019, in The Hague, the Netherlands. The theme for ISASI 2019 was “Future Safety: Has the Past Become Irrelevant?” The full presentation can be found on the ISASI website at www.isasi.org in the Library tab under Technical Presentations.—Editor) ost of us are not To boot, the industry has put developing effective counter- these are not minor events in surprised that the pressure on all three fields: pi- measures, these projects have unforgiving circumstances far aviation sector is lot demand driving down train- also developed new methods of beyond our wildest dreams, Mexperiencing a shift ing efforts, fatigue on the rise forensic investigation of such caught in a flock of black swans in accident modes and causal due to circadian irregularity scenarios. or other unknown bird. A few factors. This illustrates itself and extended work hours, and This contribution will telling examples follow. in the very recent examples of more reliable systems induc- present several practical the fatal B-737 MAX accidents ing automation complacency, forensic methods used in these Air France 2009 in 2018 and 2019 (still pending which exacerbates startle and proactive, simulated inves- During a flight from Rio de completed investigations) and surprise potential. tigations collected over the Janeiro, Brazil, to Paris, France, less recent but equally notable As such, the current linear, past years, supplementing a an Air France A330 experi- incidents such as an Emirates Taylorist human factors (HF) new, future-proof HF investi- enced icing on the pitot tubes, B-777 go-around accident in investigation techniques, often gation model. Both investiga- resulting in inaccurate air data. 2016, AirAsia’s loss of an A320 focused on error and non- tive methods as well as new The autopilot disconnected in 2014, UPS A300 Flight 1354 compliance, are not suitable cornerstones of human-ma- promptly, with the aircraft in 2013, Qantas A380 Flight to capture the new dynamics chine interaction and human control law switching from QF32 in 2010, and, last but not of human performance that effectiveness will be presented. normal law to an alternate law, least, Air France A330 Flight present themselves in this Some insight into developed followed by the autothrust sys- 447 in 2009. There are other era of an ever more complex mitigating methods will also be tem disengaging. The first and less known but equally trou- aviation system. In order to presented as positive outcomes second officers who were on bling cases in which modern, duty during this event were un- understand and mitigate these of these proactive investiga- well-equipped aircraft flown able to maintain control of the new emergent system behav- tions. Hopefully, this may help by air crews trained to legally aircraft, which was operating iors, HF forensics requires a investigators identify the more required standards still result at an altitude where overspeed subtle emerging behaviors of in deadly accidents. shift in attitude, complement- and stall speeds approach this increasingly complex sys- Pending of course the ing existing error analysis with each other—in addition to a tem before a new accident has outcome of the -737 MAX more in-depth pilot accounts, total lack of airspeed infor- to be its herald. investigations, many recent experiences, and reasoning. mation and a control law that accidents and incidents show a More than the cockpit micro- is seldom used. The resulting shift in accident causal factors. phone can record, HF forensics Introduction: outliers or trends? prolonged stall in a dark and At the heart lies the overar- must shift to more proactive The 2019 worldwide commer- clouded surrounding was not ching theme that increasing methods of investigation to cial air transport system is one detected as such and resulted complexity of air operations capture this. of the highest performing sys- in the aircraft crashing into the introduces new emergent Recent research projects at tems in the history of human- ocean. system behavior not always an- the Netherlands Aerospace kind. It is almost unfathomable ticipatable and preventable by Center (NLR) have investigat- how we can transport 4.1 bil- Qantas 2010 design. As such, maintaining a ed these new HF, including lion passengers (2017 figures) After departing Singapore resilient air transport system investigating the effects of at an accident rate of one per Changi Airport, a Qantas demands more cognitively fatigue, startle/surprise in 6.7 million flights, with zero ac- Airbus 380 experienced an flexible and adaptable flight modern, complex incident and cidents in 2017 for Internation- uncontained engine failure of crews. However, these new accident modalities, as well al Air Transport Association the Number 2 engine, with a higher-order competencies are as evaluating the potential of (IATA) members. We speak of separated fan blade damaging in turn more strongly affected countermeasures such as star- a nonplus-ultra-safe system multiple hydraulic, electric, by fatigue and startle/surprise tle effect management training, approaching the mythical 10-7 and structural systems along factors, accounting for the mindfulness training, and new accident rate, a theoretical the left wing spar. This resulted increased attention that these complexity-oriented prob- safety performance limit. And in the malfunction of flight two phenomena are receiving. lem-solving strategies. Besides yet we still have accidents, and control systems, engine control 8 • January-March 2020 ISASI Forum systems, and fuel control sys- function of the rudder traveler ed in fatal loss of control. these accidents are categorized tems, along with an incredible limiter unit (RLTU) 23 times into basic accident categories 53 ECAM failure messages. This in the previous year, later at- B-737 MAX 2018/2019 (with controlled flight into ter- flight featured five flightcrew tributed to a cracked soldered Two accidents only months rain leading the list) and with members, as both a line and connection. During this flight, apart involving a Lion Air B-737 a pilot’s negative contribution instructor check were being the system presented an RTLU MAX and an Ethiopian Airlines to a situation assessed as “pilot performed on this flight. After failure four times. Normal pro- -737 MAX both featured similar error” with the occasional or- two and a half hours of diag- cedures require resetting the malfunctions of the maneuver- ganizational culture issue at its nosing the state and ability of RTLU, yet this time the captain ing characteristics augmen- flank. As a result, our industry the aircraft, the crew managed elected to reset the two flight tation system (MCAS), which has been quite focused on how to land the aircraft successfully augmentation computers, uses an angle-of-attack sensor to prevent controlled flight into in Singapore with one engine which removed flight control to prevent impending aircraft terrain, developing advisory still operating near max thrust, augmentation and placed stall by providing inputs into circulars, updated upset recov- with limited hydraulic brak- the aircraft in alternate law the flight control augmenta- ery and flight envelop systems, ing available, failed antiskid, (manual control). Shortly after, tion system. In both events, and adapted flight manuals. However, are we as an and only a half hour until the the aircraft entered a stall. The the MCAS provided multiple industry truly convinced that lateral fuel imbalance would accident report noted, “[The and strong nose-down control we have found the root of the no longer permit controlled pilots] would have to rely on inputs as the aircraft were problem as we Band-Aid our flight. The ability of the flight manual flying skills that are of- climbing out after takeoff. operations in the wake of these crew to abstract the aircraft ten stretched during a sudden The MCAS was a new system accidents? Or have we reached state, override system proce- airborne emergency.” modification introduced into a point in which we realize we dure requirements, and distill the -737 MAX without explicit are only treating the symptoms a unique landing performance West Air Sweden 2016 training for the pilots. MCAS strategy was critical to the of a larger issue at hand? W. During an uneventful night controls pitch using automatic Vincente proposes a possible prevention of an accident on flight over Sweden, a West elevator trim controls, and a par with Tenerife. explanation of these accidents Air Sweden Canadair CRJ200 failure of the system should as presumptive anomalies: experienced a midflight loss be treated as an elevator pitch “Presumptive anomalies occur Asiana 2013 of control resulting in a crash trim runaway/failure. However, in technology, not when the While landing at San Fran- near Lake Akkajaure. During the failure of the MCAS was not conventional system fails in cisco International Airport, cruise with the autoflight sys- part of the conversion training an absolute or objective sense, an Asiana B-777 performing tem engaged, the left primary to the -737 MAX, and as such but when assumptions derived an autolanding failed to flight display (PFD) showed a provided the flight crews with from science indicated either maintain sufficient airspeed rapid increase in pitch attitude, a failure for which they were that under some future condi- during the approach and as which was due to a failure of not immediately proficient. tions the conventional system a result descended below the one of the attitude reference The Lion Air aircraft experi- will fail (or function badly) or glideslope. This resulted in the systems. This increase in pitch enced an MCAS failure on the that a radically different system aircraft touching down on the disengaged the autopilot previous flight, resulting in an will do a much better job.” seawall just prior to the runway system that was coupled to extreme flight profile that was We should consider the threshold. The reason for the the captain’s left-hand instru- only resolved after a third pilot possibility that the industry reduction in airspeed was the ments, requiring the captain suggested the stabilizer trim is experiencing presumptive runaway procedure, although disengagement of the auto- to take immediate manual anomalies in the pilot-auto- there were no indications thrust system, with the low- control of the flight. mation sociotechnical system, that this was the problem. thrust settings used in a higher The PFD initially provided an which still operates as “de- Unfortunately, the next flight section of the approach when indication of a pitch mismatch; signed” (trained) but that the experienced the same problem the aircraft was above glide- however, this was removed conditions in which this design slope, being held until seconds but was not able to resolve the works has changed. We may when a declutter mode of the problem in time. The investi- before the impact when the PFD was activated as the incor- not know yet for sure, but we crew made a late attempt to re- gations are still ongoing, yet cannot afford to make such rectly indicated pitch exceed- the incidents show a similarity cover engine thrust. The reason global assumptions. If we are ed, additionally prompting the to the previous four accident for an incorrect autothrust set- not willing to assess whether captain for a nose-down con- examples. As a result of these ting was related to the crew’s our operational paradigm has trol action. The captain obliged accidents, the -737 MAX has insufficient understanding of reached its limits, we will not immediately, not having any been grounded worldwide be able to improve perfor- the complex autothrust modes strong outside references. pending investigation. mance. As a result, as the com- and their (dis)engagement However, as the flight was There are plenty more exam- mercial air transport industry conditions. still straight and level, the air- ples that the last 10 years can grows at a rate of 6–7 percent craft entered an uncontrolled provide, with similar accounts a year, so will the number of AirAsia 2014 dive, resulting in impact with where the existing sociotech- global accidents if the accident During a flight from Surabaya, the ground less than two min- nical system design of our rate stagnates around one ac- Java, to Singapore, the pilots of utes later. The crew’s inability cockpit operations still lead cident per 4–6 million flights. If an AirAsia Airbus 320 lost con- to detect the pitch mismatch, to a sometimes fatal accident the number of flights increases trol of the aircraft and crashed the system’s rapid degradation or some lesser undesired state by 6 percent and the accident into the sea. This specific of information to detect it, and from which we still managed rate in 2019 is one accident aircraft experienced a mal- the crew’s rapid actions result- to recover. Currently, most of per 5 million flights, we will January-March 2020 ISASI Forum • 9 have 22 accidents in 2036, up The limits of our current HF model exceedances, and incorrect serve as a very rigid reference from eight accidents in 2018. In the beginning, becoming a failure management slowly against which actions of a pilot This means we will read about pilot placed oneself right up receded into the past. Basic can be benchmarked. The early a major accident worldwide there with the most daring, and recurrent flight training days of HF forensics were quick every two weeks, which will courageous, and progressive steered toward conditioning to denounce aberrant pilot not answer for the public, espe- people of the time. Flying was a new and old pilots in their behavior into several broad cially in this age of information considerably dangerous under- predictability and compliance, categories: wilful noncompli- exchange and social media taking that required pilots to for example, with the concept ance and human error, the lat- amplifying the public outcry have a more daring, innovative, of “checks” being hard coded in ter being subjugated to further against such accidents. This and can-do mentality to weath- pilot development. categorization in subsequent industry cannot afford such er the technical uncertainties The promise of predictability decades, including slips, lapses, stagnation and must be willing and atmospheric conditions rooted itself very deep within various forms of complacency, to examine its limits to induce only partially understood our cockpit design philoso- decision errors, perception effective innovation in safety. and other challenges such as phies—so much so that in the errors, crew interaction errors, At the forefront of this physiological limits, limited 1980s and 1990s, the natural and more recently organiza- assumption testing stands the infrastructure, and a rapidly variance in pilot behavior tional cultures and processes. aviation safety investigator, a changing industry. was regularly and rigidly held The Human Factors Analysis professional who has learned However, as the industry accountable against the pre- and Classification System to eat assumptions for break- developed, flight operations scribed task sets and behaviors provides sufficient examples fast. However, in order to chal- were increasing more predicta- pilots were trained and told to that illustrate the current lenge an existing paradigm, the ble, and at a fundamental level do. This “deviant behavior” was scope of investigation, but the the “pilot” role in the system labeled as “pilot error.” Driven investigator must have investi- same determinist base can be (usually fulfilled by an actual to reduce the influence that gative tools from a contrasting observed in the International human being) was subjected such pilot behavior variance paradigm to gain perspective. Civil Aviation Organization to rigorous “Taylorization,” had on safety, third- and Put anecdotally: “If all you have (ICAO) Annex 13 investigation stemming from the work-prin- fourth-generation commercial is a hammer, everything looks guidance, which lacks a large ciples of Frederick Taylor: aircraft heralded new cockpit like a nail.”—Abraham Maslow set of classifications of physio- Put in context, if all you have efficiency-driven principles technologies such as integrat- developed during the Indus- ed systems, fly-by-wire systems, logical, behavioral, and social is a human-error bandage, factors that can be found in everything looks like human trial Revolution. Operational centralized failure manage- features such as checklists, ment, etc., to offload more and a growing number of recent error. This paper wishes to accidents (by way of reference empower safety investigators standard operating procedures, more tasks from the pilot and compliance checks, prescribed shift them toward increasing- those in the introduction of with a new perspective on the this paper). As an illustrative human-machine paradigm training programs, and sim/ ly more capable mechanical line checks are all manifesta- system elements. example, within the European and give insight into tools and tions of the industry’s thor- As a result, the pilot’s role ECCAIRS accident database, it methods that may facilitate oughness in prescribing oper- slowly shifted from directly is not possible to search for innovation in HF forensics. ations. And for good reason: executing the flight to oversee- accidents that may have In 2012, BEA director Jean- surprise startle effects the adventurous, authoritative, ing systems that would execute or as a Paul Troadec reflected on the contributory factor while that and risk-defying attitude that and coordinate with other investigation of the well-known very topic is taking center was necessary in the early days operational stakeholders (ATC, Air France Flight 447, indicat- stage in safety discussions, of aviation (up until the 1950s) aircraft, company, ground han- ing the possible limits of the with the European Union was no longer conducive to the dling, passengers, etc.) and to current HF forensic methods: Aviation Safety Agency (EASA) operations that were by then serving as a flexible system ele- “This accident has also taught prescribing startle or surprise readily predictable, regulatable, ment that offered redundancy us that hypotheses used for management training in the and in need of consistent pilot for most if not all tasks execut- safety analyses are not always near future. performance. ed by automation. Offloading relevant, that procedures During the era of compara- The human operator moved to automated system elements are not always applied, and bly predicable operations in the from an “aviator” role toward was further promulgated as that warnings are not always 1980s, the existing HF forensic a very useful element in our our industry felt more and perceived. Only an improve- approach seemed reasonable. cockpit system, as he or she more confident in an operation ment in the quality of feedback However, several concurrent could be programmed for a we could carefully map out, will make it possible to detect developments in the cock- multitude of tasks that could plan, and prescribe: the ulti- any weaknesses in the safety pit operational domain will not be automated at the time. mate determinist system. model.” However, slowly but surely the challenge the existing cockpit Observing this from a broad- human pilot was sought to be- operational paradigm at its er perspective, the major im- have as a mechanical element, Determinism at the core of our determinist, Taylorist roots, plication of innovating the way but one you could talk to and HF forensics and with it the validity of the we investigate our operational give more complex tasks than Our basic model of the human current scope of HF forensics. paradigm is that investigators the mechanics of the time. operator in the cockpit serves are reempowered in a proac- All this drastically improved as a foundation of our HF The changing nature of our tive role to provide direction aviation safety as accidents forensics. The thoroughly aviation system today for a whole new level of safety caused by ego-driven attitudes, prescribed tasks and behaviors Per 2019 statistics, the world- performance of our industry. slips and lapses, aircraft limit for the pilots in our operations wide commercial air transport 10 • January-March 2020 ISASI Forum system is one of the highest tem elements, their functions, lists to be executed. Similarly, and react to many more cues performing systems in the various modes of interactions, digital checklists can detect the and calculate actions to many history of humankind. This and multiplicity of contexts in state of several aircraft system more situations, perhaps even becomes clear when we ob- which they must operate have configurations and indicate imitate some form of artificial serve just a few of the several all increased. At the ultimate whether checklist items are intelligence. key figures IATA provides in its executive tip of these opera- completed (e.g., “No Blue” call- 2018 annual review: tions is that our aircraft-pilot out during Airbus approaches). Evolutions in the piloting profession • 4.1 billion passengers systems are sought to provide System integration is also The industry developments transported, extremely high performance, heavily present in the flight have also resulted in several • 41.8 million flights (1.3 reliably 365 days a year, and in management system (FMS), notable shifts in the piloting takeoffs per second, every various conditions (weather, which can be directly provided profession. Boeing predicts minute, every hour, every routes, passengers, airports, a flight plan from an operator’s that the next 20 years will re- day), cultures, etc.). Within the cock- flight planning department via quire no less than 804,000 new • 1 accident per 6.7 million pit operations domain, this a wireless connection at the pilots. At the same time, pilot flights (worldwide, zero for has resulted in several notable gate. The FMS is then able to salary has dropped by half in IATA members), evolutions in technology, the automatically calculate weight, some cases, and in the U.S. the human operator, and the inter- balance, and takeoff perfor- • Pushing toward carbon first 1,500 flight hours often pay face between the two. mance and execute the entire neutral growth after 2020, even less than that, with sala- flight navigation via integra- • Load factor exceeding 80%, ries of US$20,000 not uncom- Evolutions in cockpit technology tion with the autoflight system. and mon at the start of a career. The above complexity has ab- The respective autonomy has Furthermore, flight training • 6.7% increase in available solutely manifested itself in the increased as well, with many costs have risen proportional seat kilometers. design of aircraft and aircraft systems operating without to oil prices, and state- or air- In short, this industry is fly- systems. With aircraft designs direct crew intervention. line-funded training programs ing more people further, faster, pushed to reduce carbon emis- A clear example is flight are becoming replaced with cheaper, safer, and for a lower sions, to fly more economically, envelope protection and PFD loans and pay-to-fly schemes. carbon footprint per passenger and to fly within practically any declutter modes, which auto- In addition to this, pilot than ever before, and it’s grow- and all weather conditions, it is matically engage in primary training efforts have also been ing—fast. All this busyness has no surprise that the systems to flight control tasks. Another diminished. Prescriptive, to contain itself (for the time achieve this optimization have is the previously mentioned tightly controlled training being) within the same plane- grown in number, integration, FMS, which flies along a pre- syllabi for both ab-initio and tary constraints below 45,000 and autonomy. The introduc- approved flight path without recurrent training have, with a feet and the earth’s surface tion of such systems includes the crew having to reselect few exceptions, been reduced at zero feet. Furthermore, it flight envelop protection and navigation beacons or points. to the bare legal minimum. must operate within our social active upset recovery technol- Further autonomy also lies Aircraft familiarization has constraints of expanding cities ogy (e.g., MCAS), GPS-based outside of aircraft systems, made way for simulator and and increased quality of life navigation, automatic fuel-CG for example, by automatic line training; ab-initio training with lower emissions and noise balancing systems, automated approval of Atlantic crossings has made way for multipilot li- pollution requirements—not cabin atmosphere regulation, with automated flightpath cense training (MPL), reducing to mention the internal market automated engine startup, management systems on the single-engine piston flying time constraints in which sharp electrical pumps replacing me- ground, and in the future free- from 200 to 120 hours, training competition among regions, chanical pumps—not to men- flight operations with aircraft directly toward a right seat in manufacturers, airports, and tion the advent of paperless autonomously interacting to an A320 or B-737. Recurrent airlines constantly drive the cockpits and the use of tablet manage the clearance between training features a preset list of financial efficiency of our- op devices as digital kneeboards. each other continuously. The topics to train, and the license erations to be better than the The increasing number of promise of consistent perfor- proficiency check has become day before. These natural and systems also features an in- mance from automation has a memorized activity for most manmade industry constraints creased integration of systems never before seemed so appe- pilots. require the aviation system to such as EICAS/ECAM fault tizing in aircraft development Lastly, the (r)evolution in air- grow in efficiency, and not just management systems, which as systems become “smarter” line networks has its effect on by scale. directly invoke QRH check- and can be programmed to act the fitness of pilots. Routes are And yet we all know this already; it’s nothing new under the sun for those working in this industry. As a result, to perform at this level the Figure 1. A aviation system features levels broad over- of complexity that are both view of pilot impressive as well as daunt- tasks. Light blue has ing. In contrast to the aviation been mostly system of 40 years ago, it has automated. developed tremendously. Taken Dark blue is from a basic systems perspec- particularly tive, the sheer amount of sys- challenging.

January-March 2020 ISASI Forum • 11 extended to 12–15 hour flights Evolutions in the pilot-technology Table 1. Levels of Automation (which even passengers find interaction exhausting), busier airports The above-mentioned de- extend their opening times, velopments in technology, and low-cost operations make training, and operations have use of the less-popular 2:30 a profound impact on the way a.m. slots, with many airlines that humans and automated reducing the crew turnaround systems interact in the cockpit. times to a minimum—some- It may already be clear that the times requiring them to red- designed interaction between eye back instead of remaining pilot and automation is shifting at an outstation. Pilot fatigue is from a pilot-centric design to on the rise; fortunately though, an automation-centric design. awareness of the risks of fa- Many tasks previously ap- tigue are being realized by, for pointed to the pilot have been example, the implementation transferred to automation, and of fatigue risk management as automation has a higher systems (FRMS) and regula- level of autonomy, it in turn tors becoming increasingly requires more time to commu- automation bias as pilots of automation to reduce concerned about flight crew nicate with the pilot as another are less engaged and less pilots’ task and competen- fitness to fly. Figure 1 (see page crewmember, much like the familiar with the working cy requirements. 11) provides a crude overview human-machine teaming con- (or failure) of the system. • A broader set of users of pilot tasks, where flying and cept proposed by Sheridan’s 10 • Increased integration of from various cultures/ navigating have greatly been levels of automation (see Table automated. Dark blue shades system induces automa- operations also drives an 1). “Implementation” was one tion bias as pilots cannot increased level of auton- represent recent areas of con- of the first tasks to be offload- cern and research. match the system’s ability omy of systems to reduce ed to automation around the to assimilate information risk of translation errors. Figure 1 illustrates that 1950s (autopilots), “Generate” many of the familiar pilot sources and tend to defer • A decay in knowledge and has shifted since 1980s, “Select” to it. responsibilities of “aviate-navi- since the 1990, with “Monitor” experience (also due to reliable systems and repet- gate-communicate(-manage)” for the pilot in the most recent • Increased system reliability itive operations) stimulates have reversed themselves to years, floating somewhere induces experience decay “manage-communicate-(nav- automated failure manage- between levels seven to nine. as pilots do not experience igate-aviate).” In any case, a ment. However, this shift from system failures or limits of- low-paying job with financial human to automation also ten enough. It also induces • Reduction of type training stress and operating well catalyzes itself, which may reduced monitoring/ conversion costs and crew outside a responsible circa- complacency as the lack of flexibility stimulates com- dian rhythm, among other best be illustrated in how the changes in technology and the need for monitoring is mon cockpit philosophies stressors, including cultural experienced. (e.g., flying an A320 and diversity in the cockpit, forced pilots affect each other. How an increased level of How changes in pilot train- A380 is much the same living at airline hubs, and no cockpit operation). career guarantees, illustrate a automation affects the pilot: ing/role affect technology: profession that puts increasing • Increased autonomy of • The drive to reduce train- The self-catalyzation that is strain on the human as a living, systems induces effects of ing overhead costs implic- most apparent is the reduc- breathing being. knowledge decay as well as itly supports higher levels tion/decay of crew knowledge,

Figure 2a. Figure 2b. Figure 2c

12 • January-March 2020 ISASI Forum experience, and cognitive sensitivity), as is illustrated by flexibility, which has driven the smaller circle in Figure 2b. the expansion of automated, Combining these two devel- integrated, and autonomous opments in Figure 2c shows the systems even for once-ba- ability gap that occurs when sic pilot tasks such as speed both effects are combined. As management, navigation, Vincente stated earlier, this is and fuel management. This in how the presumptive anoma- turn results in pilots who are lies of loss of control may arise even more disengaged in such in our operations. system activities and lack even Analyzing several notable more knowledge and ability accidents of the past decade to manage undesired system reveals several factors that may states. contribute to a flight crew’s Figure 3. Contributory HF of accidents of the past decade. inability to manage a situation. Different ingredients, same Figure 3 provides a possible However, there is an even particular we do not for the recipe (for disaster) organization of these factors. more important reason to growing complexity of our op- investigate and understand erational system. Flying a com- As noted, today’s cockpit oper- These factors have been repro- these “new” HF. Paradoxical- plex commercial jet aircraft in ation deals with very different duced in recent research activi- ly, the very complexity and 2019 cannot be examined the human elements and very dif- ties at the NLR. Several notable dynamics of our operational same way a game of chess can ferent (and more) automated research initiatives such as the system has become the Achil- be examined. elements than several dec- EU FP7 project MAN4GEN, a les heel of the system itself. Yet From a philosophical ades ago. However, the basic CAA UK investigation into pilot as it stands, the complexity of standpoint, when one cannot recipe for a flight operation has fatigue performance, an our flight operations is here predetermine the correct remained unchanged. The op- EASA-contracted global to stay and will most likely course of action in every and eration is prescribed, trained, pilot fatigue data study, an only increase—and with it the all situations, there must be an and coded (as applicable) and EASA-contracted startle and proportion of the total opera- alternative strategy to main- executed to be as consistent surprise management collabo- tional system behavior that we tain sufficient safety perfor- and predicable as can be—and ration with KLM, research into either do not understand or mance in those situations that corrected against the operation performance-based train- did not intend explicitly. Being lack an explicit manual. Such as designed. ing such as evidence-based able to maintain performance an alternative strategy relies on So in theory, we should have training, and Horizon 2020’s within such “opaque” systems a learning element within the no accidents caused by human FutureSky Safety: Human Per- requires pilots to be a dynamic system, capable of detaching or automated system elements. formance Envelope project are element in the system, capable itself from hard-coded actions, But why then do we have just some of the R&D efforts of coping with a situation not and adjusts its behavior to accidents that involve these that support the factors in explicitly anticipated or trained cope with the situation. Such system elements? In a concep- Figure 3. before. A great example of this a learning element requires tual sense, both the context The above-mentioned can be found in the case of creativity, heuristic strategies, and the pilots have changed, factors particularly manifest Qantas Flight QF32. However, assumption testing, and an and the combination leads to a themselves in operators that this dynamic behavior cannot ability to resolve a set of situa- greater inability to manage the are out of the loop in a system that is not fully understood by be prescribed or investigated tional variables to an effective situation. the pilot, or perhaps even by from the determinist, Tay- new understanding of the Figure 2a shows a circle that the system and operational lorist vantage of the previous system. Coincidentally, these indicates a space in which the designers themselves. Both de- decades. That recipe does not are precisely the competencies current operational concept velopments (pilot out the loop longer hold. in which human beings have assumes a pilot can manage a and increased complexity) are, historically excelled. Our cogni- complex failure. However, we ironically, the effect of attempts tive evolution is clear evidence still observe accidents within When determinism has reached to prevent “human error” by its limits thereof. As such, the human this space, but how is this design. pilot may be able to provide the possible? Figure 2a shows that The term error implies a known Unfortunately, the limita- reference of nonerror. As such, dynamic behavior we seek. some accidents seem to be a tion of existing HF forensics Our determinist pilot model “manageable” complex failure, for anything to be classified as prevents the industry from a “decision error,” for example, was designed for another age but in fact are well outside of observing these HF as a nat- we must have a clearly defined of aviation and has at best been the designed (trained) ability of ural effect of evolution of our reference for a correct decision innovated most recently in the the pilot (for example, the Qan- cockpit operations, and many in that specific moment and 1980s and 1990s and at worst tas Flight QF32 or the B-737 of these are bluntly labeled as context. It would be incredible still reflects the man-machine MAX accidents) and require human error, reinforcing the if we have explicitly designed task division of the 1960s. The more competent pilots we industry’s efforts to reduce and prescribed the correct past 10 years provide a wealth assume we have, indicated by the pilot’s room for error; the decision for all situations, of evidence to suggest that this the yellow line. Furthermore, whole catalyzation repeats and precisely therein lies the pilot model is no longer suffi- the ability of a pilot to manage itself, worsening the problem: great deceit of the determinist cient to manage the set of new complex situations has also a good reason to evolve HF system—we do not have such operational challenges that been reduced (fatigue, startle forensics methodologies. a universal reference, and in this day and age of complexity

January-March 2020 ISASI Forum • 13 bring with it. We have exceed- that same human being can Resilient behaviors rely heav- prescribed action that assumes ed its design limits. The basic provide the very creativity, ily on a human pilot’s ability to an ambiguous situation is premise of a predictable opera- flexibility, and problem-solving (1) appreciate the possibility of simpler than it is. Essentially tional system is no longer valid. ability you need when the situ- a given situation to lie beyond this applies the well-known Of course, we must not throw ation becomes opaque: it is one any prescribed solution (i.e., an fail-safe principle to airman- out the baby with the bathwa- and the same operator. opaque situation), (2) to detect ship and embeds it into the ter, but we must ascertain that Qantas Flight QF32, United this is the case, and (3) be basic philosophy driving pilot there may be a time and place Flight 232, and the DHL A300 competent in the ad hoc devel- development. for a prescribed human oper- that landed in Baghdad after opment of an effective solu- Besides a difference in pilot ator, and a time and place for being struck by a surface-to-air tion using heuristics, option behavior, the two paradigms a new, more dynamic, resilient missile are all prime examples generation and an improved also have different optimal role understanding of the aircraft divisions between the pilot and its state. The cognitive and the automation. Table 3 construct of “fluid intelligence” illustrates how these divisions (the ability to arrange variables could differ. into a coherent mental model) Table 3 illustrates how the lies at the core of these new two paradigms seemingly behaviors. Such abilities in turn oppose each other directly. To rely more heavily on a higher some extent this is true, and cognitive function of the pilot. combining the two poses a Unfortunately, these functions significant challenge. This is are often the first to leave a hu- because changes must be made man when he or she becomes in several key areas: pilot selec- fatigued, startled/surprised, or tion and training, automation emotionally distressed. The au- interface design, procedures Figure 4. Operational areas and their resolution strategies. and problem-solving strategies human operator model. will all be subject to varying amounts of change for Airman- ship 2.0 to become a reality. Introducing Airmanship 2.0 Yet for accident investiga- The increase in complexity tors, this perspective on a new requires a form of dynamic be- resilience-oriented operational havior in the cockpit operation paradigm can help restructure paradigm, and the human pilot HF forensics for the accidents is a good candidate to deliver and incidents now. In this way, this new dynamic capability. the HF investigator becomes If we accept that complexity equipped with investigative is here to stay, the investiga- tools sensitive to HF that are tor should understand which the actual drivers of success behavior helps to conquer this. Table 2. Comparison of determinist and resilient operational paradigms and failure in today’s opaque This chapter illustrates how situations, extending the this may be achieved by recon- of a human asset in the cockpit. thors of this paper propose to already existing tools for trans- ditioning the human pilot for a However, it is most likely that extend the airmanship model parent situations. new role in the cockpit. human pilots have diverted by three core behavioral princi- from prescribed actions in ples of resilient behavior: Figure 4 provides a sche- Evolutions, HF, and forensics many other cases to prevent matic of the mix of operational 1. Humbleness to opacity of The Airmanship 2.0 concept an event from snowballing into operations, conditions that commercial provides a framework to ex- flight operations can fly into an accident. Actual actions 2. Emotional self-control, may be different from intended pand the HF forensic toolset to and which resolution strategies and effectively investigate oper- are most appropriate where. actions. Yet such everyday crew flexibility is not consistently 3. Adaptive mental models. ations in opaque situations. Figure 4 clearly shows that a captured in investigative data- The adaption of Tony Kern’s The tools and methods are new cockpit operational para- bases, despite already existing airmanship model (see Figure derived primarily from NLR digm should feature both de- as necessary redundancy to 5) would be as follows (see engagements and research ac- terminist (Taylorist) elements, prescribed operations. These Figure 6): tivities previously mentioned. but should also provide flexi- “silent heroes” are the focus of The most important concept These tools and methods are bility to act when the situation Safety II learning in which we in this change is that pillars not completely polished and has become “opaque”: unpre- learn from positive examples such as discipline, proficiency, ready-to-use but rather serve dictable, ambiguous, complex. as well. and knowledge, which are as- to inspire subsequent adoption In transparent, prescribed A resilience-based paradigm pects of a determinist behavior, efforts. These are the following operations, operator creativity, values and flags different pilot are nested within a shell of re- six tools and methods, which heuristics, and noncompliance behaviors than a determin- silient behavior. In other words, can be retraced back to Figure are labeled as human error ism-based paradigm. Table 2 it is safer to question a known 3: (unwanted deviation from a offers a comparison between situation and upon realizing • Behavioral quantification known reference). In contrast, the two. it is a normal transition to a technique,

14 • January-March 2020 ISASI Forum and the switching frequency are NOTECHS and the ICAO between phases lend them- core competency framework, selves to statistical analyses both stemming from resilience of these behaviors to identify training applications aimed at behavioral trends in the crew’s preparing crews precisely for complex problem-solving be- the opaque operations that havior that were improving or need them. The value of com- deteriorating the safety of the petencies lies in the fact that simulated flight. they prescribe effective crew action at a higher abstraction Figure 5. Tony Kern’s airmanship model. Figure 6. The Airmanship 2.0 model. Desired flight crew performance level (with observable behav- • Desired flight crew perfor- D.D. Woods. ECOM stems (DFCP) technique: This tech- nique was first developed iors as detailed examples of a mance technique, from cognitive system engi- competency), which contrasts neering and is a method that in the MAN4GEN project • Competency-based assess- but has been used in several with the much more narrowly ment, could map out and categorize constrained frameworks of crew cognitive processes. In subsequent projects, includ- • Startle and surprise man- procedures, standard operating the MAN4GEN project, this ing startle and surprise and agement, procedures, and checklists. method was adopted to “code” mindfulness-related simula- tor evaluations. The method A list of the ICAO core com- • Complex failure manage- cognitive behavior of crews petencies is presented, as well ment, and as they resolved complex, was codeveloped by NLR and Boeing R&D to create a per- as an example of observable • Fatigue management. ambiguous flight scenarios in a formance benchmark that was behaviors for the “Problem fourth-generation aircraft sim- Solving and Decision-Making” ulator. Furthermore, the same suited to the specific, ambigu- HF forensic concepts for resilient ous scenarios that were used competency (see Table 4, page methodology was adapted to 16). operations in these studies. The method assess a complex failure-man- • Application of Procedures Behavioral quantification tech- agement technique as one of essentially walks through nique: Within opaque systems, the scenario as designed and • Flight Path Management– the outputs of the MAN4GEN Manual variance in crew behavior is project. indicates all crew actions that inherent to maintaining safety Crew behaviors and remarks are safety-enhancing in this • Flight Path Management– performance. As such, in order were categorized based on specific scenario. This method Automatic to detect behavioral trends that their association with a possi- allows the equivalent valuing of • Situational Awareness are beneficial or detrimental, different solutions to the same ble phase of the management • Workload Management it is important to be able to technique. This “plotting” was scenario. The DFCP is popu- • Leadership and Teamwork compare different situations subsequently followed by an lated with observations from and actions at a behavioral exercise that clustered behav- audio, video, and flight data • Communication trend level, detaching it from ior observations per phase, recordings and is not based on • Problem Solving and Deci- the context of the situation. depending on the time-separa- interview or crew recollections sion-Making For example, this would permit as it focuses on actions, not tion between the observations. • Knowledge (added by comparing complex fail- perceptions. An excerpt from The final analysis step consist- EASA during implementa- ure-management techniques a DFCP from the MAN4GEN ed of analyzing the division tion in EASA regulations) across airlines, aircraft types, of a crew’s attention between project is shown in Figure 7 Competency assessment and failure types. different phases as behaviors (see page 16). This technique is based overlapped and switched The DFCP method may seem is also the basis of evi- on the Extended Contextual between phases. The resulting like a determinist approach, dence-based training (EBT), Control Model (ECOM) first quantification of time spent on but rather it is sensitive to the a new form of training that proposed by E. Hollnagel and phases, the order of execution, specifics of a situation (in the challenges flight crews with case of accident investigation) unfamiliar scenarios to assess and therefore is able to value and train at a competency level behavior that may deviate from instead of only using repetitive standards or procedures as task-reinforcement training. long as it contributes to safety The ab-initio version appli- in that situation. The DFCP was cation of competency-based used in conjunction with the training is the MPL. The appli- ECOM behavioral assessment cation of these new training method, which was employed frameworks for investigation in the MAN4GEN project, to is that a framework such as compare many crews flying the ICAO’s list core competencies same simulator scenario. and behavioral markers pro- Competency-based assessment: vides a ready-to-use behavioral Another framework for ob- observation system that can serving flight crew behavior in be used as a performance opaque operations are com- reference for situations beyond Table 3. Comparison of determinist and resilience optimal role divisions in petency-based assessments. the prescribed, transparent the cockpit Two common frameworks operation.

January-March 2020 ISASI Forum • 15 NLR has used ICAO’s core competencies as a perfor- mance indicator to compare crews in the FutureSky Safety project “Human Performance Envelope,” in which the re- search was also focused on the reliability of such behavioral assessment techniques. This research is being continued to support the standardization of instructor rating behavior within EBT programs. As such, similar reliability efforts should be made if competency assess- ments are to be determined during incident/accident Figure 7. The DFCP excerpt from the MAN4GEN project. investigations. pathetic stress reaction to precisely these competencies imminent terrain impact, loss Startle and surprise manage- reengage the neocortex in a complex, opaque scenario. of aircraft control). However, ment: One of the most salient with breathing exercises, Initial evidence shows promise it should be noted that most cues of an opaque situation is physical awareness (e.g., that the following mindfulness situations present at least 30 a cognitive mismatch (expec- feel one’s back against training results would improve seconds to a minute for effec- tations do not match reality), the seat), and checking pilot abilities to cope with tive self-regulatory actions. The which is experienced as a “sur- colleagues. opaque operations: EASA study scenario taught prise.” In contrast, a “startle” is 2. Observe: Rebuild a (new) • Improved emotional regu- pilots that even a decompres- a purely physiological reaction lation, sion permits a thorough ROC of the sympathetic nervous sys- mental model by actively and consciously taking • Improved nonjudgement, execution before donning tem in which the body immedi- emergency oxygen equipment. ately reacts to intense sensory in information about the • Improved observing (at- inputs (e.g., a loud bang or situation/aircraft state, tention), Complex failure management: flash). Although different in without judgement. Basic • Improved open awareness Complementing startle and their nature, both surprise and observation (“here and (monitoring more sensory surprise management in startle have the same effect: now”). info/emotions/thought), opaque situations, NLR has an emotional reaction in the 3. Confirm: Discuss a possi- and also researched, operation- limbic brain (e.g., fear), a stress alized, and validated the ble situation/aircraft state • Improved cognitive flexi- reaction initiating from the effectiveness of complex fail- and generate options of bility (task/situation/con- amygdala, and a degradation of ure-management strategy in moving forward in the cept switching). cognitive ability in the neo- newly understood situa- the MAN4GEN project. Based These behaviors show cortex. As opaque situations tion. on behavioral differences be- become more frequent (also distinct similarity with the el- tween high- and low-perform- due to pilots’ unfamiliarity with The Relax-Observe-Confirm ements of ROC, and both may ing flight crews observed in an increasingly rare nonnormal (ROC) was trained and be useful references to assess opaque flight situation with a operations), startle and sur- assessed with NLR and KLM a pilot’s ability to effectively complex, ambiguous failure, prise have been in the spotlight and deemed by many pilots to (re)engage his or her ability to the MAN4GEN project distilled in aviation safety, HF, and train- be effective. Not only the proce- observe, adjust understand- a basic three-step operational ing arenas. dure, but also the basic aware- ing (cognitive engagement), philosophy to manage such As an EASA research initi- ness of the cognitive decay and suppress overreaction situations. High-performing ative, NLR, in collaboration that occurs during a startling and jumping to conclusions. crews differed from low-per- or surprising event has made with KLM, has performed Of course, the above-men- forming crews in that they flight crews more effective in extensive research into startle tioned self-control behaviors 1. Managed time criticality, coping with them. and surprise, and in particular are second to managing any so that the crew has time Another related study was which management strategies dire threats (e.g., aircraft stall, to contracted by a U.S. airline may be effective. The research investigating the benefits of indicates that a startle or sur- mindfulness training for pilots. prise reaction is not prevent- This study trained a group of able; however, its effect on the pilots in mindful behavior and operator’s performance can be compared their DFCP perfor- significantly reduced with the mance against a control group effective management strate- of pilots. The study hypothe- gy consisting of the following sized an improvement in sev- three steps: eral ICAO core competencies 1. Relax: Counter the sym- as well as startle and surprise management and assesses Table 4. Example of a competency with observable behaviors 16 • January-March 2020 ISASI Forum 2. Manage uncertainty, such within opaque situations. The vations in training cases. “Your that the crew can fundamental requirement of 2. As resilient operations 3. Plan for contingencies and cognitive functioning of the require dynamic pilot be- assumptions changes. crew to operate in opaque havior to maintain perfor- systems infers that all factors These three steps echo a mance in opaque systems, that affect this functioning are your basic humbleness that pilots investigation into “normal” are pertinent for these resil- have with respect to the opaci- operations should be ience-based operations, as is windows on the ty of the situation and to jump conducted as equivalently also the case with startle and to conclusions as other crews as “incident” operations. surprise. world. Scrub did. A subsequent operation- This has to do with the Research at NLR confirms alization of this philosophy led fact that, particularly as that fatigue is still a difficult to them off every to a six-step process in which opaque operations become quantify/measure factor, due to evaluation crews were trained more commonplace, crew the huge individual variation in once in a while and supported with a quick abilities (either learned sensitivity to fatigue-inducing reference card (see appendix or instinct/experience factors, as well as the variation or the light A with the full article text on based) to resolve opaque of the effect that fatigue has ISASI’s website). The basic six situations can readily be on performance. However, one steps are learned from. By increas- won’t come in.” thing is certain, the number of 1. Stabilize Flight Path, ing the contrast between factors that are becoming rele- behavior that worked and 2. Immediate Threats, —Isaac Asimov vant to assessing the presence behavior that didn’t work, 3. Short-Term Plan, of fatigue has grown. ICAO effective behavioral pat- performance beyond our deter- Document 9966–Appendix B terns within opaque opera- 4. Identify Situation, minist transparent operations, provides a good list of factors tions become sharper and 5. Appropriate Actions, and we may be able to intervene to consider when investigating more robust and can be 6. Long-Term Plan. fatigue. Other documenta- effectively based on proactive, more readily consolidated performance-based investiga- Validation simulator exer- tion, guidelines, and research into proposed strategies. underpinning FRMS are a good tion rather than reactive fault cises showed that using ECOM This day and age of aviation source of rough investigative finding. and DFCP analysis techniques, can provide HF investigators checklists for fatigue. As with crews that behaved according precisely this wealth of infor- startle and surprise, it is im- The future investigator as driver to these trained guidelines mation. The advent of EBT and for global safety improvement outperformed crews that did portant to realize the leverage MPL training that of compe- fatigue has on these operations In the past, safety investiga- not act accordingly. Not only tency building using opaque and may warrant investigation tions have served as problem the execution of all aspects of scenarios can be an incredible providers for knowledge-de- even if there are no clear tell- source of information about the strategy, but also the cor- tale signs of fatigue as the main ficiency identification and rect order of the strategy was crew (in)effective strategies in knowledge development. causal factor to an incident or opaque situations. Preceding related to better performance. accident. Referring to the quote of Vin- EBT, A(T)QP programs also centi at the beginning of this The above-mentioned strate- feature line-oriented evalu- gy is clearly a more cognitive paper, we may state that by The changing nature of HF forensics ation sessions in which the embracing empirical findings, process, and as such should in The previously discussed same HF investigation can most cases succeed the startle as investigators we materialize management methods have take place. Further adaptions the notion of serendipity: dis- and mindfulness behaviors implications for the nature and of LOSA, airline internal closing by accident something that are responsible for restor- arena of HF forensics. Funda- investigations, ASRS/volun- that has not been observed ing the pilot’s cognitive ability mentally, effective HF forensic tary incident databases and before. New concepts such before engaging in problem investigation of the risks of regulatory audits to include as Airmanship 2.0 may do a solving. opaque systems requires two competency-level assessments much better job where con- As such, investigators may major shifts: as well as sensitivity to surprise ventional concepts have been be able to refer to the above 1. As human performance in and fatigue may contribute to stretched to their limits. problem-solving philosophy, such opaque operations is a very large body of data from We have proposed that inves- detailed strategy, and reference greatly affected by subtler which effective behavioral tigators should shift their focus card (see Appendix A with higher cognitive and psy- strategies in opaque situations to proactive investigation, the full article text on ISASI’s chophysiological factors, may be distilled. but we also propose an even website) to structure behav- investigations should shift At KLM, a novel approach greater change in perspective ioral analysis of crews facing from reactive “black hole to learning from operational that the investigator may take. similarly opaque, complex in the ground” investiga- experience is an initiative Considering the real possibility failure management. tion to proactive investiga- called Flight Story in which the that the existing determinist tions of incidents, normal airline facilitates crews’ sharing operational paradigm has Fatigue management: The last operations, and simulated their notable experiences with limits and that these limits may HF to be briefly addressed is flights (e.g., training). This colleagues to improve safety have been exceeded, it chal- fatigue. Fatigue is not a new provides pilot self-reflec- by positive examples instead of lenges investigators to not only factor in HF forensics; however, tions, cross-examination of only accidents. investigate accidents against it may arguably be posed as a crews, debriefing informa- By increasing our sensitivity threat with increased leverage tion, and instructor obser- to the factors that determine (Continued on page 30) January-March 2020 ISASI Forum • 17 Flying Over Conflict Zones:

By Marieke van Hijum, Senior n July 17, 2014, 298 people lost their accident investigation. From 2014 to 2015, Investigator, Dutch Safety Board lives when the Malaysia Airlines the Dutch Safety Board carried out its airplane they were in crashed near investigation into the crash of Flight MH17 (Adapted with permission from OHrabove, Ukraine. The disintegra- in accordance with Annex 13 of the Con- the author’s technical paper Flying tion of the airplane during the flight was vention on International Civil Aviation, Over Conflict Zones: Follow-up the result of the detonation of a warhead which sets out the international regula- Recommendations MH17 Crash above the left-hand side of the cockpit. tions on independent accident investiga- Investigation presented during ISASI The airplane crashed over the eastern part tion. Although this annex is intended for 2019, Sept. 3–5, 2019, in The Hague, the of Ukraine, an area in which an armed investigations aimed at increasing civil Netherlands. The theme for ISASI 2019 conflict arose in April 2014. Initially, the aviation safety, it was also possible to carry was “Future Safety: Has the Past Become conflict mostly took place on the ground; out an investigation within that framework Irrelevant?” The full presentation can be but from the end of April 2014, it expanded in which the essence of the risk was more found on the ISASI website at www.isasi. into the airspace. The crash of Flight MH17 about security. This follow-up investiga- org in the Library tab under Technical immediately raised the question why the tion confirms that entities that conduct Presentations.—Editor) airplane was flying over an area where independent investigations on aviation there was an ongoing armed conflict. accidents can also contribute to improving The MH17 crash report published by safety in the context of security risks. the Dutch Safety Board in October 2015 responded to this question and explained the decision-making process with regard Developments after the crash of Flight to flying over conflict zones at the time. MH17 The report contained 11 recommendations On a global level, ICAO launched various for better management of the risks associ- initiatives aimed at better management of ated with flying over conflict zones. Due to the risks associated with flying over con- the global importance of the recommenda- flict zones. These initiatives have includ- tions, they were addressed to the Interna- ed amending standards, recommended tional Civil Aviation Organization (ICAO), working methods, and manuals (hence- the International Air Transport Associa- forth referred to as ICAO documents) in tion (IATA), all states, and all airlines. order to embed and promote the sharing This paper presents the main results of the follow-up investigation. The Dutch of threat information and the performance Safety Board published the report on the of risk assessments. Some of the proposed follow-up investigation in February 2019. amendments have now been implement- ed, while others are yet to be carried out. This is a long-term process due to the Follow-up investigation involvement of 192 ICAO member states In all its investigations, the Dutch Safety with differing views and interests. The first Board evaluates how organizations have steps toward amending the ICAO docu- implemented its recommendations. Given ments were taken in 2014, but it will take the size of the disaster and the great value until at least 2020 for all of the foreseen the safety board attaches to the formulat- amendments to be implemented. ed recommendations, the board started Another important ICAO initiative is the an investigation into the follow-up to the publication of a manual offering support to recommendations regarding flying over states, airlines, and other parties con- conflict zones in the beginning of 2018. cerned in the performance of risk assess- The investigation focused on whether ments with regard to flying over and near the 11 recommendations from 2015 were conflict areas. Since it is not possible to followed up and whether the parties con- provide a thorough explanation in interna- cerned were successful in eliminating the safety shortcomings underlying the rec- tional standards of how the risk assess- ommendations. The Dutch Safety Board ments should be performed, the publica- stresses that this follow-up investigation tion of a manual containing guidelines for only serves as a recap to the recommenda- performing risk assessments is a valuable tions and therefore does not address the initiative. There is no obligation attached cause and circumstances of the crash of to the manual. ICAO has indicated that Flight MH17. it will provide workshops and presenta- The subject of flying over conflict zones tions in order to bring the manual to the Marieke van Hijum is not an obvious subject for an aviation attention of those concerned. Through the

18 • January-March 2020 ISASI Forum Follow-up Recommendations from MH17 publication and dissemination of the man- gathering information about the risks that sufficient in order to perform an adequate ual, ICAO is helping to increase the quality conflict areas pose to civil aviation than risk assessment. There are also obstacles in and harmonization of the implementation they did at the time of the crash of Flight relation to sharing nonpublic information. of risk assessments for flying over conflict MH17. They also have access to more and Conditions for exchanging threat informa- areas by states and airlines. generally better threat information. Risk tion include a proper information network Although none of the Dutch Safety assessments are performed in a more and mutual trust. For access to relevant Board’s recommendations are addressed structured manner, and some airlines information, a good relationship and to EU institutions, in response to the explicitly state that they take uncertainties mutual communication between airlines crash of Flight MH17, the European Union and risk-increasing factors into considera- and the intelligence services of the state Aviation Safety Agency (EASA) and the Eu- tion as part of the risk assessment process. in which the airline is based are essential. ropean Commission have launched initi- Furthermore, there is evidence to suggest However, these are not a given everywhere atives aimed at better management of the that, if there are doubts about the safety in the world. risks associated with flying over conflict of a flight route, airlines are more inclined The mechanisms that have been created zones. EU member states now exchange not to fly. IATA has made risk assessment for the purposes of sharing threat infor- relevant intelligence information in order relating to flying over conflict areas part mation and risk classifications are better to arrive at a joint assessment of the risks of its prescribed management systems suited to tackling long-term conflicts associated with flying over conflict zones. in order to manage the risks for aviation. than to tackling new conflicts or sudden The advantage of this cooperation is that Airlines that are members of IATA are escalations of existing conflicts. Informa- intelligence information and risk analysis periodically tested on their implementa- tion sharing about abrupt changes in the capabilities of both larger and smaller tion of these systems. However, the results threat level occurs on an ad hoc basis and states are combined. If the outcome of the of these audits are not published, meaning through informal networks. As a result, assessment is that the risk for a certain that the extent to and manner in which it is not guaranteed that airlines can area is considered “high,” EASA publish- airlines have given the risks of flying over timely access accurate information about es a Conflict Zone Information Bulletin. conflict areas a place in their management new threats and adjust their flight paths These bulletins are not only used within systems is unclear. accordingly. the EU, but also as an informationby states The Dutch Safety Board considers public and airlines based outside of Europe. This accountability for flight routes chosen to European initiative thus contributes to a Areas of attention for the years to come be the final link in keeping airlines focused better global understanding of the risks. This follow-up investigation has also with respect to their responsibility for Various states (such as the United States, shown that not all of the amendments performing thorough risk assessments for the UK, France, and Germany) also publish proposed by the Dutch Safety Board have flying over conflict areas. However, airlines information about conflict zones across been implemented. The full assurance do not or hardly account publicly for their the world, for example in the form of a provided by ICAO standards has not chosen flight routes, and this is not being notice to airmen (NOTAM). NOTAMs also yet been achieved (status Dutch Safety encouraged by IATA either. serve as important information sources for Throughout history, safety and secu- Board report published in February 2019). states and airlines around the world. rity have been separate worlds—worlds On a national level, several states have Moreover, these amendments will need to with their own laws and regulations, for taken initiatives that contribute to better be incorporated into the states’ national which the responsibilities were assigned management of the risks related to flying legislation. to various parties and departments within over conflict zones. In the Netherlands, an In the past years, no or minimal changes organizations. However, as the crash of agreement has been drawn up regarding have been made to the airspace manage- Flight MH17 shows, safety and security are the sharing of threat information for civil ment by states involved in armed conflicts intertwined. To manage the risks related to aviation. The Netherlands has translated in their territory. The board realizes that flying over conflict zones and other risks at the text of the agreement into English and states involved in an armed conflict will the interface of safety and security as good made this translation available to serve as possible, closer cooperation between as an example to other countries inside have difficulty when it comes to guarding both worlds is necessary. and outside Europe, as well as to ICAO. In the safety of their airspace. This indeed This follow-up investigation has shown addition, the Netherlands has taken the turns out to be the case in practice. With that over the past few years, important lead in initiating amendments to the ICAO the exception of Ukraine, states have steps have been taken with the aim of documents. To support the ICAO Secre- not implemented airspace restrictions better management of the risks associated tariat in effecting the work program, the related to the overflying of conflict zones. with flying over conflict areas. It is Netherlands has seconded a senior safety Although ICAO is in a position, as an in- important that the amendments already expert at ICAO for a two-year period (2017 tergovernmental organization, to urge and implemented are perpetuated and that and 2018). This way, the Netherlands, in parties take the announced follow-up support states to safeguard the safety of collaboration with various other countries, steps. Vital to this is the willingness of contributes to ensuring that the subject of their airspace, ICAO is not doing so. parties to actively inform each other about flying over conflict zones remains on the Another area of attention is that airlines threats and potential threats in order to international agenda. are indicating that the level of detail of protect civilians and passengers across the Airlines now play a more active role in the information available is not always world.

January-March 2020 ISASI Forum • 19 Flying Over Conflict Zones:

By Kas Beumkes, Senior n Oct. 13, 2015, the Dutch Safety sector. The board notes that not all of the Policy Advisor, Aviation Safety Board published the final report intended changes have been realized yet and Security Division, Civil on MH17 following the crash of and concludes that permanent attention Malaysia Airlines Flight MH17 is needed to maintain the course that has Aviation Directorate, Ministry O on July 17, 2014. This report contained been taken and sees the following three of Infrastructure and Water 11 recommendations aimed at better focal points: Management, the Netherlands controlling the risks associated with • Practice shows that states in which flying over and near conflict areas. These there is an ongoing armed conflict recommendations have been addressed will not implement restrictions for to the International Civil Aviation Or- their airspace on their own initiative. ganization (ICAO), the International Air States involved in an armed conflict Transport Association (IATA), states, and will have difficulty when it comes to airlines. guarding the safety of their airspace. The Dutch Cabinet sent its response to Although ICAO, as an intergovern- mental organization, is in this posi- the Dutch Safety Board on Dec. 8, 2015, tion, ICAO does not take an active (Parliamentary Papers II 2015-2016, 33 role in urging states to ensure the 997, No. 56), in which the recommenda- safety of their airspace and to support tions are endorsed. The recommenda- them in this. tions logically have a strong international • Information sharing in rapidly esca- component. As a result, the follow-up of lating conflict situations occurs ad the recommendations depends on the co- hoc and through informal networks. operation between and the joint approach In this way, states and airlines do of all international partners involved. not ensure that threat information The Netherlands is actively promoting is shared timely and that airlines are this. The Dutch Parliament was periodi- in the position to take measures. To cally and extensively informed about the ensure access to relevant informa- progress of the follow-up of the recom- tion, it is essential to maintain a good mendations via debates and answers to relationship and reciprocal com- parliamentary questions and letters. munication between an airline and the intelligence services of the state where the airline is established. Follow-up investigation • The public accountability of chosen The Dutch Safety Board launched a flight routes by airlines is the final follow-up investigation in 2018 to gain link in keeping airlines attentive to insight into whether risk management for their responsibility for performing flying over conflict areas has improved thorough risk assessments related since the crash of Flight MH17 and to gain to flying over or near conflict zones. insight into the extent to which interna- Airlines account only little or not at tional organizations, states, and airlines all for their chosen flight routes. IATA have followed the recommendations and does not stimulate this either. have addressed the underlying safety deficiencies. (Adapted with permission from the In the follow-up investigation, the Response to the follow-up author’s technical paper Flying Over Conflict Zones: The Way Forward Dutch Safety Board finds that since the investigation from MH17 presented during ISASI crash of Flight MH17, various parties The Dutch government agrees with the 2019, Sept. 3–5, 2019, in The Hague, the have taken important steps to better findings of the Dutch Safety Board that Netherlands. The theme for ISASI 2019 manage the risks associated with flying not all intended changes have been real- was “Future Safety: Has the Past Become over and near conflict areas. The chang- ized, that it is important to consolidate Irrelevant?” The full presentation can be es introduced have also led to a better the changes already implemented, and found on the ISASI website at www.isasi. control of these risks, and the related risk that the parties are taking the announced org in the Library tab under Technical management has been given a concrete next steps. It is essential here that the fol- Presentations.—Editor) place in the safety thinking of the aviation low-up of the recommendations depends 20 • January-March 2020 ISASI Forum The Way Forward from MH17

on the cooperation between and the joint from within and outside Europe; Appen- the passenger can request informa- approach of all the international partners dix A, page 75 [editorial note: page 69 in tion about the flight route from the involved. In addition, it is important that the English version] under Surveys). ICAO airline. The Civil Aviation Directorate parties willingly and actively inform each has 192 member states, and IATA has will continue to plead with IATA to other about possible threats to protect around 290 members from 120 countries. address this on a wider scale. citizens and passengers worldwide. Regarding the three focal points men- • The Dutch government will continue From the 11 recommendations of tioned by the Dutch Safety Board, the to work nationally, in European, and the Dutch Safety Board, addressed to following is noted: internationally with the parties ICAO (six), IATA (four), states (two), and • States involved in an armed conflict involved to better manage the risks airlines (one), one recommendation is may have difficulty monitoring safety associated with flying over and near assessed as “adequate,” six as “partially in their airspace. Since in these coun- conflict areas. The focal points of the adequate,” and four as “inadequate” (see tries the authority of the national Dutch Safety Board are part of this Appendix D of the follow-up investiga- government is often weak or factually commitment. tion). The cause of the number of partial- absent, the Netherlands has promot- ly/inadequately appreciated recommen- ed at ICAO and IATA that other coun- dations (10 out of 11) can be explained tries and airlines seek cooperation on by the fact that the proposals as such a regional scale to share information. have already been prepared and are well A more practical effect is expected from this than relying on the informa- advanced but have not yet been fully com- tion from the aforementioned states. pleted. The development of proposals by The new ICAO manual Doc. 10084 international organizations takes a lot of describes examples of good practices time because these organizations, in par- on cooperation on a regional scale. ticular ICAO, must recommend proposals to tackle regulatory actions—first of all • In the field of information sharing and risk assessment, the Nether- with the member states to be prepared, lands remains actively committed to discussed, and then supported by a large the completion of the international majority. This takes place through struc- actions that are necessary to comply tured consultation, whereby the imple- with the recommendations. At the mentation of change proposals is sched- national level, the Netherlands has uled at fixed times of the year to limit the signed an agreement with govern- administrative burden for the member ment services and airlines for sharing states. As a result, according to the Dutch civil aviation threat information Safety Board, it will certainly take until that is functioning satisfactory (see 2020 before all the changes that are now evaluations, Parliamentary Papers II envisaged have been implemented. 2016-2017, 24 804, No. 95 and Par- The four recommendations with liamentary Papers II 2017-2018, 24 “inadequate” assessment are diverse in 804, No. 97). The third evaluation has nature, and progress depends primarily taken place. The Civil Aviation Direc- on the commitment of the international torate from the Ministry of Infrastruc- ture and Water Management will world community of states, IATA, and the continue to explain the functioning of wide variety of airlines worldwide. This the agreement, which is included as a process often leads to globally formulated good practice in the aforementioned proposals, which means that it is not to ICAO manual Doc. 10084, in various be expected that all recommendations in workshops on a European and inter- the future can be assessed entirely satis- national scale. factory to the wishes of the Dutch Safety • In order to provide public account- Board. In addition, the Dutch Safety ability for the chosen flight route as Board indicates that only a very limited the final link for airlines, the Dutch part of the target group has been sur- Safety Board finds that, unlike most veyed and draws its conclusions based on airlines worldwide, the major Dutch this (12 national civil aviation authorities airlines post their flight routes on and 36 airlines from 18 different countries their websites. It also states that Kas Beumkes January-March 2020 ISASI Forum • 21 The Paradox of Intuition: Training Pilots for Unexpected Events By Laurie Earl, Coventry University, the UK, and Jim Sheffield, Victoria University, New Zealand (Adapted with permission from the authors’ technical paper The Paradox of Intuition—A Neuroscience Approach to Training Pilots for Unexpected Events presented during ISASI 2019, Sept. 3–5, 2019, in The Hague, the Netherlands. The theme for ISASI 2019 was “Future Safety: Has the Past Become Irrelevant?” The full presentation can be found on the ISASI website at www.isasi.org in the Library tab Laurie Earl Jim Sheffield under Technical Presentations.—Editor) n Jan, 15, 2009, US Airways Flight happened before so for which the crew 1549 hit geese shortly after takeoff couldn’t be trained. from LaGuardia Airport in New This paper explores how pilots make OYork City, N.Y., U.S.A. Both engines decisions in complex situations when lost power, and the crew quickly decided they can’t rely on procedures and where that the best action was an emergency generating multiple options doesn’t landing in the Hudson River. In testimony always make sense. Primarily we examine before the U.S. National Transportation how intuition influences decision-making Safety Board, Capt. Chesley Sullenberger and why tacit knowledge plays a more im- maintained that there had been no time portant part than originally thought. Tac- to bring the plane to any airport and that it knowledge is that piece of the iceberg attempting to do so would likely have that’s below the surface—we don’t notice killed those on board and more on the it, and we can’t easily describe it. In other ground. Exactly 3 minutes and 28 seconds words, it’s how we think and decide in the had elapsed from the time of the bird world of shadows, the world of ambiguity. strike to landing on the water—the crew We consider how hidden impulses had made a split-second decision in a affect judgement and the influence of highly volatile moment. The NTSB ulti- experience and knowledge on decisions mately ruled that Sullenberger had made made under extreme circumstances. the correct decision. This discourse examines how the expert As technology moved from analogous has built up a repertoire of patterns cockpits to fly-by-wire technology, the that aren’t based on facts or rules or aviation industry began to see many more procedures. Instead they’re built on all such black swan events, a term coined in the events and experiences they’ve lived 2007 to explain events that were unusual, through and heard about. This is the basis that surprised the crew, or that had never for intuition.

22 • January-March 2020 ISASI Forum The paradox of intuition is that emo- tional response can occur, particularly in for his available options. In turn, these tion (“gut feelings”) must inform reason those with less experience. The ability to options might inform future strategies, (cognition), and reason must inform control the conversation between what and, in keeping his cool, he was further emotion (giving a rational response). We we feel and what we think sits at the developing his resilient habits. explore this paradox through the lens crucial intersection between these two In the same way, de Crespigney, after via a research framework (the dual-pro- different ways of thinking in the form of seeing an overwhelming amount of error cess model) that plays an important the anterior cingulate cortex—the trigger messages come up, started to think about integrating role in the current behav- between them. what they had rather than what they ioral decision-making literature (see Making decisions in dangerous circum- didn’t have working. He wrote, “Invert the Figure 1). While the terminology and stances requires the intuitive brain to logic—if you’re overwhelmed by what’s application domains of the dual-process size up the situation and form the initial going wrong, turn the problem on its and dual-systems models vary, there is impulse about what to do. The analytical head. Go simple, be creative, and work consensus on core concepts. Research brain then can be used to process the with what you have, not what you’ve lost.” suggests that “Our preferred theoretical mental simulations to see if the option Currently the International Civil approach is one in which rapid autono- will work. Pilots often refer to the skill to Aviation Organization (ICAO) has listed mous processes (Type 1) are assumed to think during a crisis as creating a “deliber- LOC-I as one of the top three safety yield default responses unless intervened ate calm,” which blends intuitive pattern priorities due to a number of events on by distinctive higher-order reasoning matching with analytical thinking. involving inappropriate decision-making processes (Type 2). What defines the dif- and implemented new regulations that ference is that Type 2 processing supports “Deep in crisis mode, it’s easy to include recommendations to incorporate hypothetical thinking and loads heavily feel overwhelmed. It’s common to startle and surprise in training programs on working memory.” to prepare flight crews for unexpected In a similar model, studies describe a feel you have no options and no events. Previously airlines have practiced neuroscience approach in a conceptual time. You actually have more of human factors and joint cabin crew/flight model to understanding the cognitive both than you realize. It’s just a crew scenario-based training; simulated process. A pilot perceives stimuli, inter- matter of knowing how to create exercises, for example, engine failure after prets this, assesses the situation (apprais- time and free up your mind.” takeoff; and debriefing. They’ve examined al), and selects and executes actions. —Capt. Richard de Crespigney some research and studies on training Criticisms of the dual-processing meth- from past events as well as human factors odology point to the vagueness of their Analytical thinking occurs in the pre- technical design innovations such as definition and the lack of coherence and frontal cortex of the brain. It’s where cal- Airbus inhibiting distracting and unnec- consistency in their approach but demon- culations are computed, logical sequenc- essary alarms on takeoff till the aircraft strate that there is a clear empirical basis es processed, and rational thinking takes reaches 1,500 feet. What’s missing is for dual-processing distinction in the place. This part of the brain also can turn realistic or challenging scenarios, such as fields of reasoning and decision-making. off impulses, which is what Sullenberger startle, managing startle, and unexpected What’s apparent is that by using this did when he decided not to act on his first events training using metacognition. methodology pilots can be trained in ef- thought—to return to LaGuardia—but fective decision-making from a neurosci- decided instead to land in the Hudson “By exposing ourselves to difficult ence perspective. In other words, they can River. situations and undergoing diffi- be trained to understand what’s happen- Along with understanding context and cult training, we can protect our- ing in their brains and discovering, recog- noticing information, cues, and data in nizing, and planning for adverse events. the environment or the lack of certain selves from being startled when Currently, we’re intent on reducing errors cues, an expert often also has the ability others around us are.” and less intent on building expertise. to tune out unnecessary information. —Capt. Richard de Crespigney. So what exactly happens in the brain Sometimes leaders can successfully em- when we’re faced with an unexpected ploy cognitive shortcuts by utilizing heu- We’ve now learned, through the psy- event for which we have no processes ristics, or rules of thumb. Often referred chological practice of cognitive behavioral or structure to respond? The startle/ to as “resilience,” experienced flight crews therapy, that such “thought management” surprise effect testifies that “Surprise is understand implicitly the response to an skills are genuinely teachable. By using an emotional and cognitive response to event. Furthermore, thinking resiliently metacognition (thinking about thinking), unexpected events that are difficult to encourages us to consider how we might we can tailor the thought processes at explain, such as subtle technical failures turn a problem into an opportunity. hand and train better decision-making or automation surprises that are baffling. Marcus Aurelius said: “What stands and the control of our emotional re- Surprise could impair the crew’s trouble- in the way becomes the way.” What he sponse. One perspective is that we’re real- shooting capabilities.” meant by this was that any obstacle can ly teaching people to align their assump- The emotional response that hap- be used as an opportunity for creative tions and thoughts with reality. So for pens in the amygdala is stronger than problem solving. So when attacked by su- example, if a storm damages our roof, we the rational response that occurs in the perior forces at unexpected locations, Au- can get angry and think “why me?” or we dorsolateral prefrontal cortex. Therefore a relius didn’t resort to anger or panic, but can rationally assume that “well, this was “knee-jerk reaction” based on the emo- instead he undertook a creative search likely to happen to someone, so why not January-March 2020 ISASI Forum • 23 me?” The assumption that bad events can become more accurate and more fixed happen to us, not just to someone else, in memory, which allows one to easier helps us avoid an irrational and unhelpful relate new situations to those that have anger response. previously been encountered and to Barriers in the way of self-control in make decisions in a quick manner. To decision-making can include cognitive some extent, this is practiced already; overload or underload due to the active but by repetition and recognizing such nature of the brain. This may be par- situations, pilots can apply learned cop- ticularly problematic when pilots aren’t ing strategies, such as taking a moment mentally prepared, for example, after a to “breathe” and reflect or returning to long period of automated flight. Loss of more transparent and understandable configurations or autopilot modes. a fitting frame may lead to a complete “loss of grip” on the situation, as there is no frame in place to guide perception, ap- Variable training. praisal, and action. Other barriers include Researchers and aviation safety organi- emotional or physical exhaustion, stress zations emphasize the need for training and fatigue, and ego depletion. with a variety of situations or scenarios. The dual-process model domain Training variability can be applied to can apply to aviation, the military, and reduce predictability so as to stimulate health. Dual-process theory supports sense-making activities and to improve simplified models that can be readily reframing skills. Training variability is taught to learners across a wide range also thought to increase the number of disciplines. In particular, an under- and elaborateness of available frames. standing of the model allows for more Experiencing examples of a concept focused metacognition, i.e., the deci- in a variety of situations may improve sion-makers can identify which system one’s understanding of the concept, fa- they’re currently using and determine the cilitating the transfer of the knowledge appropriateness and the relative benefits and skills to new situations. In contrast, of remaining in that mode versus switch- one-sided training of a small number of ing to the other. The dual-process model situations or (combinations of) failures complements more detailed approaches may increase the risk of an inappropri- such as neuroergonomics. This is based ate selection of these frames in stressful on associative processes in intuitive situations (current training). judgment and neurological processes (i.e., emotion vs. reason) that are experi- Practical training. enced by decision-makers in naturalistic Literature indicates that theoretical settings. training should be enhanced with Training based on the dual-process practical experience and feedback on model may include decision scenarios performance so that the frame-related presented in the form of “serious” video knowledge is linked to other knowl- games and checklists. “Metacognitive edge, environmental cues, and actions. moments” embedded in complex decision Scenario-based training is based on processes serve as the occasion both for the concept that knowledge can’t be possible transitions between System 1 fully understood independent from its and System 2 and for critical reflection context. Practical training may also on how cognitive biases may reduce be used in combination with exposure situational awareness. Metacognition is to a manageable amount of stress or a cognitive bias-awareness strategy that startle to make skills more robust to pilots can be trained to use to deliberately the effects of stress. detach themselves from the immediate Essentially this paper explores how flight context, which allows them to the human mind makes decisions and reflect upon the thinking process and how to make those decisions better in a switch perspectives as required. complex aviation environment in One of the factors that facilitate pilot which accidents are becoming less performance in surprising situations predictable. We explore why these is domain expertise, or accumulated intuitive decisions are sometimes knowledge and skills through practice wrong, but often right. One researcher and experience. By applying and test- argues, “There is a thin line between a ing hypotheses based on frames in a good decision and a bad decision.” This large number of situations, these frames paper is about that line.

24 • January-March 2020 ISASI Forum ISASI Kapustin Scholarship Essay The following essay is the second of four from the 2019 Kapustin scholarship Air Safety Cybersecurity: winners that were presented during ISASI 2019. The number of scholars selected each year depends upon the amount of Why Cybersecurity Is a money ISASI members donate annually to the scholarship fund. Details about Threat for Air Safety scholarship applications and additional information can be found on the ISASI By Nur Amalina Jumary, 2019 Kapustin Scholarship Recipient, website at www.isasi.org. Application and essay deadlines are mid-April of each University of New South Wales, Australia year.—Editor Aviation a “System of Systems” cate with numerous networks around the Aviation today uses complex, integrated globe, all with varying degrees of security. systems of information and communi- At present, there are no common cyber cation technology to facilitate its daily standards for aviation systems (AIAA, global operations. At the 13th Air Naviga- 2013), which means the risks present in tion Conference of the International Civil data communication, such as the transfer Aviation Organization (ICAO) in 2018, of flight and system data using wireless aviation was conceptualized as a “system technology or maintenance and diagnos- of systems.” This concept is defined as a tic functions that are performed remotely, collection of different sets of systems con- are yet to be effectively managed. sisting of people, products, and processes The threat to air safety as a result of required for the completion of tasks, none vulnerable information security is far of which are dispensable. Such a system from novel. In 2006, the U.S. Federal has been enabled by digital technology. Aviation Administration (FAA) was forced Digitalization automates processes by to shut down a portion of its air traffic connecting digital technology, informa- control (ATC) systems after a cyberattack tion, and people. The digitalization of avi- caused disruption in its mission support ation has allowed for an increased level functions. An audit of the FAA’s air traffic of operational efficiency and the means control cybersecurity protection meas- to keep up with increasing commercial ures found that the use of commercial demands of international air travel. software and Internet protocol technol- Despite optimizing operations, digitaliza- ogies in a bid to modernize operations tion has introduced new vulnerabilities put the system at a high security risk as to the industry, namely in the domain of operations were not properly secured to information security or cybersecurity. The prevent unauthorized access. An inspec- interconnectedness of the systems means tor general report presented to the FAA an increased level of interaction with dif- by the U.S Department of Transportation ferent information systems, beyond what warned that it is a matter of time before the industry has traditionally defined as attacks to ATC systems would do serious its security parameter (Boeing, 2012), harm to ATC operations (Baldor, 2009). which leaves it at risk for new security The reliance of aircraft in communicating threats that may potentially become a with ATC is a vital aspect of air safety, concern for air safety. thus any threats that could potentially compromise the system’s integrity should be properly identified and managed. Information Security in Aviation Although there is yet to be a serious cy- Innovations in the design and manu- bersecurity incident or accident relating facturing process have brought about to ATC more than a decade since the inci- “E-enabled” aircraft that are built with dent discussed earlier, in 2015 a security onboard information and communi- expert in the United States was detained cations technology that communicate after allegedly hacking into the in-flight with external networks to exchange entertainment system on a United Air- data during flight, while on the ground, line’s Boeing 737-800 and on one occasion or anywhere in the world (ALPA, 2017). had successfully overwritten a code to is- E-enabled systems present on widely used sue a “climb” command. In 2017, another commercial aircraft like the Airbus 380 cybersecurity expert working with the and the Boeing 787 Dreamliner communi- U.S. Department of Homeland Security Nur Amalina Jumary January-March 2020 ISASI Forum • 25 ISASI Kapustin successfully hacked into a parked Boeing occurrence data to identify and quantify Scholarship Essay 757 through radio frequency communica- the threats due to lapse in information tions (Flight Safety Australia, 2017). The security. This allows investigators to put recurrence of a cyberattack indicates that forth recommendations to improve air there has not been enough progress made safety cybersecurity. by the aviation community or support from governments to expand the notion Training challenges due to the need for an of safety as the industry has known it to enhanced skill set encompass systems onboard and on the Another challenge that air safety investi- ground with strong information security. gators face is the need to undergo further The FAA has taken initiatives to improve training in order to acquire the relevant information security by tasking its Avia- skills to identify cybersecurity breaches. tion Rulemaking Advisory Committee to Air safety investigators have a high level provide cybersecurity recommendations, of technical skill and knowledge in the which included testing and updating aviation domain (Braithwaite & Nixon, cybersecurity protections (FAA, 2016). 2018), but an investigation is a complex On the legislative level, the Cyber AIR Act task that draws upon a broad range of was reintroduced in Congress in 2017 but skills. The product security director of has yet to be enacted (GovTrack, 2017). Airbus Americas revealed that Airbus The aviation industry is cognizant of the had not equipped their aircraft with threats and the consequences of a lax any cybersecurity information as pilots information security system, but reforms surveyed by the manufacturer preferred and changes are made at a rate much too not to be informed of such threats during slow for the industry to have any regula- flight (ALPA, 2017), possibly due to the tory or legislative framework to effectively perceived increase in workload. In the manage the safety risks that have been event of a total hull loss, the flight data identified. recordings may not reveal accurately the state of events that led to the accident if there was an external presence that was Challenges for Investigators able to overwrite the pilots’ inputs. While Adopting a generative attitude to air there is value in having investigators investigation know what they are looking for in regards Air safety investigators are responsible for to causes of incidents or accidents, there providing recommendations to improve is equal value in having investigators be air safety after ascertaining causes of aware of what they do not know given a aviation accidents or incidents with the novel situation. aim to prevent similar occurrences in the An important facet of training that has future. Inherent to this investigation phi- to be acknowledged is the limitation of losophy is the use of a proactive systems training itself. It is highly misleading to safety approach to air safety (Dempsey, expect investigators to have expertise 1999), even though practically investi- in all aspects of aviation ranging from gators are carrying out investigations human factors to aircraft systems and postevent. With the security threats and cybersecurity. Subject-matter experts are hazards that surround cybersecurity and used in the industry exactly because it is safe air transport, this approach is not unreasonable to expect investigators to enough, as investigators have to launch have both depth and breadth of knowl- into a retrospective investigation driven edge in all areas of aviation, especially by data collected through research. To in its fast-changing nature. Airbus also date, there has not been a major occur- faces a challenge of finding talent that rence that has significantly compromised has dual-expertise in aircraft design and air safety as a result of a cybersecurity cybersecurity (ALPA, 2017), and investi- attack. However, this lack of precedence gation bureaus face a similar challenge is compensated by a vast collection of with their investigators. In the area of occurrences captured through the man- cybersecurity, the call to equip investiga- datory occurrence (incidence) reporting tors with an enhanced skill set is part of a systems established by ICAO Annex 13. “total system” approach. This will ensure The challenge for investigators is to adopt that aviation evolves in tandem with a generative attitude (Hudson, 2001) the systems that comprise it in order to where they would access and review large establish a cybersecurity culture in which volumes of data and proactively review cyberthreats are recognized and commu-

26 • January-March 2020 ISASI Forum nicated, and importantly in which the risks are managed effectively.

Integrating Information/Cybersecurity Management and Safety Management Systems A strategic way in moving forward is to adopt a proven methodology, one the avia- tion industry has used in the past. Aviation has benefited from implementing a robust, systematic approach to managing safety. The way the industry involves organization- al structures, policies, and procedures and accountabilities to control safety risks in operations has been studied and replicated in other industries like health care (Kapur, Parand, Soukup, Reader & Sevdalis, 2016), and even cybersecurity at its nascent stage (Seawright, 2018). Having an “information/ References cybersecurity management system” integrat- ed to the current safety management system (SMS) would allow the industry to continue Air Line Pilots Association. (2017). Cybersecurity Concerns in Today’s Aviation Environment. Re- trieved on March 21, 2019, from https://www.youtube.com/watch?v=V7SDoHW4vCI&t=3866s. managing threats that have been previous- ly identified as well as new ones that arise American Institute of Aeronautics and Astronautics. (August 2013). A Framework for Aviation Cyber- through innovation in aviation. The advent security. Paper presented at the AIAA Aviation Technology, Integration, and Operations (ATIO) of this digital era of aviation brings with it Conference, Los Angeles, CA: American Institute of Aeronautics and Astronautics. new hazards and threats, all of which do Baldor, L. (May 6, 2009). Audit: Air traffic systems vulnerable to attack. The Associated Press. not appear to be fully realized. Thus, having an information/cybersecurity management Boeing. (2012). Aero QTR_03.12. Securing Airline Information on the Ground and in the Air. Retrieved system that responds to the new vulnerabil- on March 21, 2019, from https://www.boeing.com/commercial/aeromagazine/articles/2012_ ities the industry faces integrated with the q3/5/. existing SMS would be an effective approach Dempsey, P. (2010). Independence of Aviation Safety Investigation Authorities: Keeping the Foxes in managing safety risks. from the Henhouse. Journal of Air Law and Commerce. 75(1), 2223-2282. In summary, there is a general consensus in the industry that a harmonized approach European Union Aviation Safety Agency. (2019). Aircraft Cybersecurity. Retrieved on March 21, is the most effective way to manage the 2019, from https://www.easa.europa.eu/sites/default/files/dfu/NPA%202019-01.pdf. threats relating to information security in Federal Aviation Administration. (2016). A Report from the Aviation Rulemaking Advisory Com- aviation (Boeing, 2012). Individual organiza- mittee (ARAC) Aircraft System Information Security / Protection (ASISP) working group to the tions like the European Union Aviation Washington, DC: Author. Safety Agency have made amendments to make it mandatory for manufacturers that Flight Safety Australia. (Nov. 14, 2017). Government officials hack airliner. Retrieved on March 22, are seeking certifications to provide evi- 2019, from https://www.flightsafetyaustralia.com/2017/11/government-officials-hack-airliner/. dence that threats leading to unauthorized GovTrack. (2017). S. 679 (115th): Cyber AIR Act. Retrieved on March 24, 2019, from https://www. access of electronic information or systems govtrack.us/congress/bills/115/s679. are addressed (2019). Similarly, Boeing is establishing a Cyber Technical Center to Hudson, P. (2001). Safety management and safety culture the long, hard and winding road. Occupa- support the cybersecurity needs of its tional Health and Safety Management Systems: Proceedings from the First National Conference (pp.3 – 22), Sydney, AUS: University of Western Sydney. customers (2012). Efforts made by individual agencies are important, but synchronizing International Civil Aviation Organization. (2018). Considerations About Cybersecurity in Aviation. these individual efforts to establish a strong Retrieved on March 21, 2019, from https://www.icao.int/Meetings/anconf13/Documents/WP/ cybersecurity culture would effectively wp_160_en.pdf. manage information security concerns, Kapur, N., Parand, A., Soukup, T., Reader, T., and Sevdalis, N. (2016). Aviation and healthcare: a thereby maintaining air safety. Central to comparative review with implications for patient safety. Journal of the Royal Society of Medicine this system safety approach is providing the Open, 7(1), 1-10. necessary education for investigators to gain the knowledge to identify and recognize Nixon, J., and Braithwaite, G. (2018). What do aircraft accident investigators do and what makes threats that are contemporary to the them good at it? Developing a competency framework for investigators using grounded theory. Safety Science, 103, 153-161. industry, and subsequently the proper trainings for them to acquire skills to Seawright, S. (2018, Aug 14). Applying Aviation Safety Practices to Cybersecurity. Retrieved on provide recommendations to improve air March 21, 2019, from https://connectedaviationtoday.com/applying-aviation-safety-practices-cy- safety. bersecurity/.

January-March 2020 ISASI Forum • 27 NEWS ROUNDUP

Call for Papers to ISASI 2020 in Montréal, Qué., Kapustin Memorial Scholarship Applications September 1–3 Due April 15 With “20/20 Vision for the Future” as the ISASI seminar theme, Applications for the 2020 ISASI Rudolph Kapustin Memorial the ISASI 2020 Committee is inviting interested individuals to Scholarship must be submitted on or before April 15, 2020, submit abstracts for papers that address the future of aircraft according to ISASI Secretary Chad Balentine, who serves as the accident investigation. Presentation topics that support the Scholarship Committee chair. He noted that this worthy theme may include but are not limited to program is designed to encourage and assist college-level • Recent accident/incident investigations of interest. students interested in the field of aviation safety and aircraft • Novel investigation techniques for aircraft, helicopter, and occurrence investigation. ISASI funds the Rudolf Kapustin drone accidents. Memorial Scholarship through donations and will provide an annual allocation of funds for the scholarship if funds are • Data investigation methods, techniques. and future devel- available. Applicants must be enrolled as full-time students in opments. an ISASI-recognized education program, which includes courses • Airport investigation methods and techniques. in aircraft engineering and/or operations, aviation psychology, • Future investigator selection criteria and training needs. aviation safety, and/or aircraft occurrence investigation, etc. • Future of aircraft data capture and retrieval and protection Applicants must have major or minor subjects that focus on of safety information. aviation safety/investigation. A student who has received the annual ISASI Rudolf Kapustin Memorial Scholarship is not • Future developments in underwater wreckage recovery, and eligible to reapply. Students who wish to apply should go to • Future evolution of family assistance. https://www.isasi.org/Documents/Forms/Rudolf%20Kapus- We are also interested in papers that address the challenges tin%20Memorial%20Scholarship%202020.pdf for guidelines and surrounding the recent B-737 MAX accidents. While it is not the application form. our intent to discuss the accidents themselves, we are hoping to generate thought and discussion on the effect the accidents ISASI Officer Nomination Announcement have had on the industry as a whole and on the traveling public. Presentations must be in English and should be 25 minutes long. The 2020 International Council election will take place between There will be an additional five minutes for questions at the end July 1 and Aug. 21, 2020, and the results will be announced at the of each presentation. ISASI annual seminar. Nominations will be accepted from May 1 Abstracts should include the author’s current résumé (1 page until June 25, 2020. The ISASI officer positions available for only) and be sent to [email protected]. nominations are ISASI president, vice president, secretary, Important dates: treasurer, international councilor, and U.S. councilor. Please March 20, 2020—Last date for receipt of abstracts. e-mail any nominations to [email protected]. All persons nominat- May 8, 2020—Presenters informed of acceptance and provided ed must be members in good standing. If there are any questions, with additional instructions. please contact Troy Jackson at [email protected]. May 22, 2020—Draft program for the 2019 seminar technical program will be published. ISASI–ICAO Working Group Prepares for New Meetings July 10, 2020—Last date for receipt of completed paper and PowerPoint presentation. ISASI Vice President Ron Schleede reported on two updates for Any papers not received by the deadline will be removed from the ISASI–ICAO (International Civil Aviation Organization) Work- the program and replaced by another speaker. If you have ing Group: questions related to the paper topics or any other inquiries • ISASI will be participating in the sixth meeting of the ICAO about the program, please contact the ISASI 2020 program chair Accident Investigation and Prevention (AIGP) meeting at [email protected]. (AIGP/6) on May 11–15, 2020, in Montréal, Qué., Canada. Bob MacIntosh, ISASI treasurer, and Mark Clitsome, former director of investigations–Transportation Safety Board of Deadline for 2020 Lederer Award Nominations Is May 31 Canada and former chair of the AIGP, will represent ISASI. The Society’s efforts at the previous AIG Panel meetings Nominations from ISASI members in good standing for the assisted with the development of significant updates to esteemed Jerome F. Lederer Award are open until May 31, 2020. ICAO standards and recommended practices and guidance The annual award recognizes outstanding contributions from materials. Our participation is deeply appreciated because any individual or group to technical excellence in accident of the extensive experience and expertise of our members. investigation. Each nominee is eligible for consideration for • The ISASI–ICAO Working Group is preparing a letter in three years if not selected, and the ISASI member can renomi- response to a state letter from ICAO regarding the third nate that person or group for a second three-year period. For High Level Safety Conference to be held in Montreal in more information go to http://www.isasi.org/Awards/Jer- June 2021. We are accepting an invitation to attend and ryLedererAwardNominationForm.aspx. contribute.

28 • January-March 2020 ISASI Forum NEWS ROUNDUP

ESASI Sets 2020 Meeting in Budapest, Hungary In Memoriam Steve Hull, secretary of the European Society of Air Safety Investiga- Robert “Bob” Charles Matthews, age 73, unexpectedly tors (ESASI), reported that the European Society’s Executive Com- passed away on Sunday, Dec. 15, 2019, at INOVA Fairfax mittee announced that registration for ESASI 2020 is now open. The Hospital in Virginia, U.S.A. He was born on July 12, 1946, in ESASI 2020 meeting will take place in Budapest, Hungary, on June Melrose, Massachusetts, to James and Theresa Matthews. 3–4, 2020, with the theme “Maintaining the Momentum.” Bob taught fourth and sixth grades in Portsmouth, The meeting will consist of a one-day seminar to share experi- New Hampshire. After the 1973 school year concluded, ence, best practices, and future developments, followed by a he moved to Virginia to pursue a lifelong career with the workshop on “the dissemination of information from a safety federal government. While working, he achieved his Ph.D. investigation.” in policy analysis and political economy from Virginia Tech For more information, please go to https://esasi.eu/esasi-2020. in 1986. He continued teaching, and even taught business The ESASI Executive Committee looks forward to meeting you in government relationship part time at the University of Budapest. Maryland as an adjunct assistant professor from 1987 through 2002. MENASASI Board Meets in Abu Dhabi Bob’s main career was with the U.S. Federal Aviation Administration (FAA). He began working with the FAA in Following the first day’s presentations during the Middle East 1989. He was the senior safety analyst in the FAA’s Office of Northern Africa Society’s (MENASASI) sixth seminar in Abu Accident Investigation and Prevention where he became Dhabi, United Arab Emirates (see page 32), MENASASI conduct- known worldwide as a “walking encyclopedia” for accident ed a board meeting. The officers and board members brought investigation reports. In 2009, he was a member of the new members to represent other countries in the Middle East Commercial Aviation Safety Team (CAST) that received the North Africa (MENA) region, which has 22 countries in the area. Collier Award administered by the U.S. National Aeronau- The board had in-depth discussions regarding increasing mem- tic Association. The award is presented to those who have bership, how to hold similar seminars in other MENA countries, contributed “the greatest achievement” in aviation. In 2011, and how to raise funds. he received the FAA’s Champion of Safety Award. One year Khalid Al Raisi, who was appointed the acting MENASASI later, he and his work colleague, Frank Del Gandio, retired. president following the retirement last year of Ismaeil Mohammed Bob then took on the role of an aviation consultant-an- Al Hosani, was elected and approved as the new president. Ismaeil alyst, providing analysis of airline and general aviation Mohammed Al Hosani was the first president and founder of accidents and accident trends. His professional experience MENASASI. included nine years in national transportation legislation with the U.S. Department of Transportation, two years as a consultant with the Organization of Economic Cooperation and Development in Paris, France, and several years as an aviation analyst for the Office of the Secretary at the U.S. Department of Transportation Del Gandio, ISASI president, said, “Bob was an ‘analyst extraordinaire,’ a longtime member of ISASI, and a frequent presenter at our seminars. In his position at the FAA, he reviewed all significant safety rules and FAA initiatives. In addition, he conducted analysis on a broad range of airline and general aviation accidents and related safety issues both domestically and internationally. Bob leaves his wife, Barbara; daughter, Tara; her husband Tom; and three grandchildren.” MENASASI board members conduct a business meeting during which Khalid Al Raisi, center, is elected MENASASI president.

MARC Plans Annual Spring Meeting

Mid-Atlantic Regional Chapter (MARC) President Frank Hilldrup reported that the annual spring meeting and dinner is set for April 30, 2020, from 6:00 to 9:30 p.m. at the Crowne Plaza/Dulles Airport hotel in Herndon, Virginia, U.S.A. The guest speaker will be Capt. Craig Hoskins, vice president, safety, security, and technical affairs, Airbus America, Inc. Bob Matthews

January-March 2020 ISASI Forum • 29 Airmanship 2.0: Innovating Human Factors Forensics ISASI INFORMATION (Continued from page 17) OFFICERS the existing paradigm, but also to consider should enable the industry to guard itself President, Frank Del Gandio other operational paradigms entirely. against blind spots in our investigation of ([email protected]) This shift positions the investigator in our industry. Executive Advisor, Richard Stone a role that challenges our industry safety As Isaac Asimov once put it: “Your ([email protected]) Vice President, Ron Schleede assumptions at its very roots. This does assumptions are your windows on the ([email protected]) not necessarily imply that the paradigm world. Scrub them off every once in a while Secretary, Chad Balentine should be doubted at every corner, but it or the light won’t come in.” ([email protected]) Treasurer, Robert MacIntosh, Jr. ([email protected]) COUNCILORS Australian, Richard Sellers MOVING? NEW E-MAIL ACCOUNT? ([email protected]) Canadian, Barbara Dunn ([email protected]) European, Rob Carter Member Number ([email protected]) International, Caj Frostell ______([email protected]) New Zealand, Alister Buckingham ([email protected]) Fax this form to 703-430-4970 , or mail to Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected]) ISASI, Park Center United States, Toby Carroll ([email protected]) 107 E. Holly Avenue, Suite 11 NATIONAL AND REGIONAL SOCIETY PRESIDENTS Sterling, VA USA 20164-5405 AsiaSASI, Chan Wing Keong ([email protected]) Old Address (or attach label) Australian, Richard Sellers ([email protected]) Canadian, Barbara Dunn ([email protected]) Name ______European, Olivier Ferrante ([email protected]) Korean, Dr. Tachwan Cho (contact: Dr. Jenny Address ______Yoo—[email protected]) Latin American, Daniel Barafani, PTE City ______([email protected]) Middle East North Africa, Khalid Al Raisi ([email protected]) State/Prov. ______New Zealand, Graham Streatfield ([email protected]) Pakistan, Wg. Cdr. (Ret.) Naseem Syed Zip ______Ahmed ([email protected]) Russian, Vsvolod E. Overharov Country ______([email protected]) United States, Toby Carroll ([email protected]) New Address* UNITED STATES REGIONAL Name ______CHAPTER PRESIDENTS Alaska, Craig Bledsoe Address ______([email protected]) Arizona, Bill Waldock ([email protected]) Dallas-Ft. Worth, Erin Carroll City ______([email protected]) Great Lakes, Matthew Kenner ([email protected]) State/Prov. ______Mid-Atlantic, Frank Hilldrup ([email protected]) Zip ______Northeast, Steve Demko ([email protected]) Northern California, Kevin Darcy Country ______([email protected]) Pacific Northwest, (Acting) John Purvis ([email protected]) E-mail ______Rocky Mountain, David Harper ([email protected]) *Do not forget to change employment and e-mail address. Southeastern, Robert Rendzio ([email protected]) 30 • January-March 2020 ISASI Forum ISASI INFORMATION

Southern California, Thomas Anthony Air Canada Pilots Association de Aviación ([email protected]) Air Line Pilots Association Gulfstream Aerospace Corporation Airbus Hall & Associates LLC Airclaims Limited Hawaiian Airlines COMMITTEE CHAIRMEN Air New Zealand HNZ New Zealand Limited Audit, Roger Cox Airways New Zealand Hogreen Air ([email protected]) All Nippon Airways Co., Ltd. (ANA) Honeywell Aerospace Hong Kong Airline Pilots Association Award, Gale E. Braden ([email protected]) Allianz Allied Pilots Association Human Factors Training Solutions Pty. Ltd Ballot Certification, Tom McCarthy Aloft Aviation Consulting Independent Pilots Association ([email protected]) Aramco Associated Company Insitu, Inc. Board of Fellows, Curt Lewis ([email protected]) Asiana Airlines Interstate Aviation Committee Bylaws, Darren T. Gaines Asociación Nicaragüense de Investigación de Irish Air Corps Accidentes Irish Aviation Authority ([email protected]) Japan Transport Safety Board Code of Ethics, Jeff Edwards ([email protected]) ASPA de Mexico ASSET Aviation International Pty. Ltd. Jones Day Membership, Ron Schleede ([email protected]) Association of Professional Flight Attendants Junta du Investiación de Accidentes Aviación Mentoring Program, Anthony Brickhouse Australian and International Pilots’ Association Civil (JIAAC) ([email protected]) (AIPA) KLM Royal Dutch Airlines Nominating, Troy Jackson Australian Transport Safety Bureau Korean Air Korea Aviation & Railway Accident ([email protected]) Aviation Accident and Incident Investigation Division/Ministry of Infrastructure, Rwanda Investigation Board Reachout, Glenn Jones ([email protected]) L-3 Aviation Recorders Scholarship Committee, Chad Balentine Aviation Investigation Bureau, Jeddah, Learjet/Bombardier Aerospace ­ Kingdom of Saudi Arabia Lion Mentari Airlines, PT ([email protected]) Avisure Seminar, Barbara Dunn ([email protected]) Lockheed Martin Aeronautics Company Azure Aero Ltd Middle East Airlines Becker Helicopters Pty. Ltd. Midwest University WORKING GROUP CHAIRMEN Bell Military Air Accident Investigation Branch Air Traffic Services, Darren T. Gaines (Chair) Bundesstelle fur Flugunfalluntersuchung (BFU) Military Aircraft Accident & Incident Bureau d’Enquêtes et d’Analyses (BEA) Investigation Board ([email protected]) CAE Flightscape Ladislav Mika (Co-Chair) ([email protected]) Ministry of Transport, Transport Safety Cathay Pacific Airways Limited Investigation Bureau, Singapore Airports, David Gleave ([email protected]) Centurion Aerospace Ltd. National Aerospace Laboratory, NLR Cabin Safety, Joann E. Matley Charles Taylor Aviation National Institute of Aviation Safety and ([email protected]) China Airlines Services Corporate Affairs, Erin Carroll Civil Aviation Authority, Macao, China National Transportation Safety Board Civil Aviation Department Headquarters ([email protected]) National Transportation Safety Committee- Civil Aviation Safety Authority Australia Indonesia (KNKT) Critical Incident Stress Management (CISM), Civil Aviation Safety Investigation and Analysis NAV CANADA David Rye--([email protected]) Center Netherlands Defence Safety Inspectorate Flight Recorder, Michael R. Poole Colegio Oficial de Pilotos de la Aviación Ocean Infinity ([email protected]) Comercial (COPAC) Pakistan Air Force-Institute of Air Safety General Aviation, Steve Sparks Commercial Aircraft Corporation of China Pakistan Airline Pilots’ Association (PALPA) ([email protected]) Cranfield Safety & Accident Investigation Pakistan International Airlines Corporation (PIA) Centre Papua New Guinea Accident Investigation Co-Chair, Doug Cavannah Curt Lewis & Associates, LLC Commission (PNG AIC) ([email protected]) Dassault Aviation Parker Aerospace Government Air Safety Facilitator, DDAAFS Petroleum Air Services Marcus Costa ([email protected]) Defence Science and Technology Organisation Phoenix International Inc. Human Factors, William Bramble (DSTO) Plane Sciences, Inc., Ottawa, Canada ([email protected]) Defense Conseil International (DCI/IFSA) Pratt & Whitney Delft University of Technology PT Merpati Nusantara Airlines Investigators Training & Education, Delta Air Lines, Inc. Qatar Airways Graham R. Braithwaite Directorate of Flight Safety (Canadian Forces) Rademan Aviation ([email protected]) Discovery Aur Defence Republic of Singapore Air Force (RSAF) Military Air Safety Investigator, James W. Roberts Dombroff Gilmore Jaques & French P.C. Rolls-Royce PLC ([email protected]) DRS C3 & Aviation Company, Avionics Line of Royal Danish Air Force, Tactical Air Command Business Royal Netherlands Air Force Promotion of ISASI, Daniel Barafani (Chair) Royal New Zealand Air Force ([email protected]) Dubai Air Wing Dubai Civil Aviation Authority RTI Group, LLC Unmanned Aerial Systems, Tom Farrier Dutch Airline Pilots Association Saudia Airlines-Safety ([email protected]) Dutch Safety Board Scandinavian Airlines System Eclipse Group, Inc. Sikorsky Aircraft Corporation CORPORATE MEMBERS Education and Training Center for Aviation Safety Singapore Airlines Limited AAIU, Ministry of Transport EL AL Israel Airlines Southern California Safety Institute Abakan Air Embraer-Empresa Brasileira de Aeronautica S.A. Southwest Airlines Company Embry-Riddle Aeronautical University Southwest Airlines Pilots’ Association Accident Investigation Board (AIB) Army Aviation Spanish Airline Pilots’ Association (SEPLA) Accident Investigation Board Norway Etihad Airways State of Israel Accident Investigation Bureau Nigeria EUROCONTROL Statens haverikommission Administration des Enquêtes Techniques European Aviation Safety Agency (EASA) Swiss Accident Investigation Board (SAIB) Adnan Zuhairy Engineering Consultancy EVA Airways Corporation Taiwan Transportation Safety Board (TTSB) Aegean Airlines Executive Development & Management Advisor The Air Group Aer Lingus Finnair Plc The Boeing Company Aero Republica Finnish Military Aviation Authority The Japanese Aviation Insurance Pool (JAIP) Aerovias De Mexico, S.A. De C.V. Flight Data Services Ltd. Transportation Safety Board of Canada Agenzia Nazionale Per La Sicurezza Del Volo Flight Data Systems Pty. Ltd. Turbomeca Air Accident Investigation Authority of Hong Kong Flight Safety Foundation Ukrainian National Bureau of Air Accidents and Air Accident Investigation Bureau of Mongolia Fugro Survey Middle East Ltd. Incidents of Civil Aircraft Air Accident Investigation Bureau of Singapore Gangseo-gu, Republic of Korea UND Aerospace Accident Investigation Committee of Thailand GE Aviation United Airlines Air Accident Investigation Unit-Ireland General Aviation Manufacturers Association United States Aircraft Insurance Group Air Accident Investigation Sector, GCAA, UAE German Military Aviation Authority, Directorate of University of Balamand/Balamand Institute of Air Accidents Investigation Branch-UK ­ Aviation Safety Federal Armed Forces Aeronautics Air Asia Group Global Aerospace, Inc. University of Southern California Air Astana JSC Grup Air Med S.A. Virgin Galactic Air Canada Grupo Regional de Investigación de Accidentes WestJet January-March 2020 ISASI Forum • 31 ISASI 107 E. Holly Ave., Suite 11 Sterling, VA 20164-5405 USA

INCORPORATED AUGUST 31, 1964 CHANGE SERVICE REQUESTED

MENASASI HOLDS SEMINAR IN ABU DHABI

Shown are participants of the sixth Middle East Northern Africa Society seminar at the Hilton Capital Grand Hotel in Abu Dhabi, United Arab Emirates.

The Middle East Northern Africa Society tive Implementation of Accident Investi- • Khallid Saud Al Humaidan, GCAA (MENASASI) held its sixth seminar at the gation Reports Policy and Regulation, UAE—Safety Hilton Capital Grand Hotel in Abu Dha- • Khalid Al Raisi, Acting MENASASI Systems: The First Line of Defense bi, United Arab Emirates, on Nov. 26–27, President—Accident Investigation in the • Shehab Hassan, Deputy Director, 2019. Acting Assistant General Director UAE Aircraft Accident Investigation Ad- Mohmmed Al Dossari opened the reginal ministration, Egypt—ME Investigator seminar, and Acting MENASASI President • Sundeep Gupta, Accident Investigator, Product Safety, Airbus—Airbus Support Training Challenges and the Benefits of Khalid Al Raisi followed. RAIO ISASI President Frank Del Gandio gave a to Investigations presentation on the evolution of ISASI and • Ibrahim Al Addasi, Chief Accident • Hans Meyer, Senior Air Accident aviation safety. There were another 18 other Investigator, GCAA-AAIS—Oxygen Investigator, AAIS, UAE—Controlled speakers who discussed past accident/ Generator Incident Investigation Ditching: A Helicopter Accident incidents and other safety-related issues, Investigation • Iain Frazer Bough, Senior Manager, including Emergency Response, Etihad • Anthony Wride, Captain, Etihad • Abdula Shabra, Human Factors Inves- Airways—Airline Special Assistance Airways—Are You Ready for This? tigator, AIB, Kingdom of Saudi Arabia Team • Salah Mudara, MENASASI Treasurer (KSA)—Who Hit the Cat? Investigation • Sebastien Barthe, Head of Information and Membership, Bahrain—Emergency Analysis Models and Communication, BEA—Postacci- Response • Edma Naddaf, President, Aviation and dent Communication • Ousamma C. Jadavel, American Corporate Psychology Consultancy, • Enor Hazim Fairaq, Performance En- University of Technology, Lebanon, and UAE—PTSD Risk for Investigators gineer, Aviation Investigation Bureau, Mohammad Aziz—On the Next • Mohammed Aziz, Coordinator of SQS, KSA—International Recorder Investiga- Generation of Air safety Persons: Some Middle East Airlines, Lebanon—Effec- tions Group Air Meeting 2019 Takeaways Reflections and Deliberations 32 • January-March 2020 ISASI Forum