3-9 visual approach, the assessment should include a major cross-section of all required tasks and their associated knowledge and skills for the maneuver.
The visual approach maneuver should start during the descent phase where the pilot can demonstrate proficiency in MFO during the arrival, approach, and landing while safely managing such things as approach planning, crew briefing, energy management, ATC communications, time management, task/workload management, and ATC-directed changes. This allows the assessment of a representative set of knowledge and skills that requires the pilot to show proficiency. Experience exercising the skills and developing and maintaining proficiency results in pilot confidence in their performance abilities.
3.3.4.1.3 In contrast, an operator cannot accurately assess overall proficiency in a manually flown visual approach by only requiring a pilot to manually fly a final approach maneuver (airplane fully configured at final approach fix (FAF) to touchdown). This only assesses pilot proficiency in flying a fully configured aircraft from the FAF to landing. It does not assess proficiency for the entire visual approach maneuver. It primarily checks for certain fundamental psychomotor abilities but does very little to verify proficiency in overall pilot knowledge, cognitive, psychomotor, and communication skills, and cognitive capacity to accomplish all tasks required to manually fly a visual approach in line operations.
3.3.4.1.4 It is beneficial for manually flown maneuvers (both normal and non-normal) to be trained and checked to a defined and logical end state consistent with what would happen during line operations, not just to an unrealistic intermediate stopping point. Scenarios that require manual flight, especially scenarios involving aircraft controllability and manual handling issues, should require pilots to continue all the way to a landing. In these situations, the pilots would exercise their skills and gain experience performing their complete set of fundamental flight skills, along with their knowledge and skills (cognitive, psychomotor, and communication) required for MFO, to safely land the airplane.
3.3.4.1.5 For example, consider a runaway trim scenario where the trim operation cannot be fixed, and the pilots are required to manually fly the airplane to a safe landing with the aircraft in a compromised state. The maneuver should start when the trim starts to run away and end when the aircraft lands. The pilots would need to take over manual aircraft control, identify the problem, accomplish any immediate action steps from memory, diagnose the problem, run appropriate checklists, coordinate with ATC, and manually fly the airplane for an approach and landing at a suitable airport. Stopping an assessment after the immediate action steps are completed or after the aircraft state is stabilized does not fully show proficiency in manually flying a runaway trim situation to a safe landing.
3-10
3.3.5 Intervention Strategies. Since situations will occur where intervention in the flightpath control is required, operators should include policies and procedures for pilots to follow when intervening in automated or manual control situations, and for resumption of flightpath control.9 These policies and procedures should apply to both pilot-to-machine intervention and pilot-to-pilot intervention and should include deviation parameters, required call-outs, and conditions for assuming control from the other pilot (e.g., a “two-challenge rule”). Operators should incorporate intervention strategy policies and procedures specific to FPM within their CRM training as well. Chapter 5, Pilot Monitoring (§ 121.544), further discusses topics related to intervention.
3.3.6 T ransfer of Control . There must always be a clear understanding of which pilot has control of the aircraft. Prior to flight, the pilots involved should conduct a briefing that includes reviewing the procedures for exchanging flight controls.
3.3.6.1 The FAA recommends a positive three-step process for exchanging flight controls between pilots:
1. When one pilot seeks to have the other pilot take control of the aircraft, the first pilot will say, “You have the flight controls.”
2. The second pilot acknowledges immediately by saying, “I have the flight controls.”
3. The first pilot again says, “You have the flight controls,” and visually confirms the exchange.
3.3.6.2 Pilots should follow this procedure during any exchange of flight controls, including any occurrence during the proficiency check. There must never be any doubt as to who is flying the aircraft.
3.3.6.3 Through analysis of accidents and incidents, situations are identified where both pilots ended up acting as the PF while monitoring was overlooked. This could happen when the PM takes over aircraft control from the PF during a critical moment, including takeoff and landing. Normally, it is easier for the PM to revert to PF than the PF to revert to PM instantly. One reason for this is that the PM may make a decision and take action to be the PF, while the PF may be startled, surprised, lost situation awareness, or trying to figure out why the PM took over, but not thinking about switching roles and being the PM.
However, there are also situations where the PM is given control by the PF unexpectedly, such as in the case of lost instrumentation or the PF’s seat sliding back during rotation. In any case, during any takeover or transfer of control, the new PF has to ensure control of the flightpath while the new PM immediately assumes the PM role and responsibilities, while both pilots maintain situation awareness.
3.3.6.4 The purpose of transfer of control training is to:
9 ACT ARC Recommendation 15-10, Guidance Material Addressing Intervention Strategies, August 8, 2015.
3-11
1. Develop proficiency in changing roles (PF to PM, PM to PF) during situations where transfer of control is necessary.
2. Initiate takeover to prevent the situation from becoming critical.
3. Highlight the importance of continuously maintaining aircraft control and monitoring through the takeover and that the pilots change roles as required.
4. Make pilots aware of vulnerabilities and common errors that can occur during transfer of control, either planned or unplanned, including how to mitigate, recognize, and recover from errors.
3.3.6.5 Transfer of control training should include at least the following scenarios:
• The Captain is acting as PM and is required to take over as PF and the F/O reverts to PM.
• The Captain is identified as PM in the briefing and inadvertently assumes PF on the takeoff role and the F/O reverts to PM.
• The F/O (PM) is required to take over as PF and the Captain (PF) reverts to PM immediately.
• The F/O (PM) decides to takeover and the Captain (PF) reverts to PM instantly.
• Unexpected system behavior or failure affecting the roles of PF and PM.
• Rejected takeoff.
• Unstable approaches.
• Decision-making processes.
• PF takeover from automated systems (expected and unexpected).
3.4 Instructor/Evaluator (I/E) Considerations. All I/Es should have the foundational knowledge and fundamental skill proficiency in cognitive, psychomotor, and communication areas recommended in this chapter for effective aircraft FPM and performing MFO. In addition, all I/Es should possess the knowledge and skills to instruct, assess, and evaluate the learning objectives and pilot proficiency for MFO as it relates to FPM, including the interlinking aspects of managing automated systems, PM, and energy management.
3.4.1 Instructors providing training on MFO must have a thorough understanding of FPM and MFO learning objectives.10 Operators should provide instructors training on the recommended strategies, including scenarios that can be used to incorporate these learning objectives.
10 Section 121.412.
3-2
3.4.2 Throughout all aspects of training and checking, the instructors and evaluators should maintain focus on FPM priority. They should be trained to deliver realistic training scenarios for exercising, building, and maintaining proficiency in MFO skills.
4-1 CHAPTER 4. MANAGING AUTOMATED SYSTEMS
4.1 General. There are many automated systems in modern airplanes, including autoflight systems (e.g., AP, AT, and FD), FMS, and envelope protection systems. Automated systems are implemented for different functions, including aircraft control, flight guidance, alerting systems, systems management, and many others. Pilots should be adequately trained and proficient with respect to those systems.11 This chapter focuses on automated systems that affect airplane control and guidance for FPM.
4.1.1 This chapter addresses the following major topics related to managing automated systems:
• Operational use of and training for automated systems in normal, rare normal,12 and non-normal operations. This includes appropriate engagement, disengagement, and combinations of these systems.
• Autoflight mode awareness.
• Prevention, recognition, and response to unintended autoflight states.13
• Prevention, recognition, and management of common errors in use of automated systems, including data entry errors.14
4.1.2 The following sections provide explanation and guidance for operations, operator policy, procedures, and training for each of these topics.
4.2 Operational Policy and Procedures for Managing Automated Systems. Effective operational use of automated systems in normal, rare normal, and non-normal operations for FPM requires the pilot to understand how the automated systems work, how to use/operate those systems, how to monitor them, and how to respond in case of failure or unintended system behavior.
4.2.1 To support effective use of automated systems for FPM, operators should provide flightcrews with:
11 Section 121.415(h).
12 The use of “rare normal” refers to environmental conditions that are experienced infrequently but considered to be operationally relevant. Examples may include significant winds/gusts, wind shear/microburst, severe turbulence, and asymmetric icing.
13 An “unintended autoflight state” means a situation in which any aspect of flight guidance or flight control automation is guiding or controlling the aircraft’s trajectory or energy in a manner contrary to that desired/intended by the pilot(s). This does not necessarily imply situations driven by system failures, flightcrew failures, or design deficiencies, as there are many possible causes for the mismatch between pilot intent an d the autoflight system state.
14 Flightcrews routinely input data and use automated systems properly to maintain the desired flightpath. However, industry studies note that input or usage errors occur and result in flightpath deviations, and one report sampling noted that “44% of…these errors went unnoticed by the pilots…” (International Air Transport Association (IATA), FMS Data Entry Error Prevention Best Practices, 1st Edition, 2015).
4-2
1. Operational policy with recommended strategies and procedures on the use of automated systems, including appropriate engagement, disengagement, re-engagement, and combinations of use of these systems.
2. Guidance and procedures for the use of the automated system or combination of systems, when to not use them, and which system or combinations are best suited to the different operational scenarios, including:
• Procedures and communications strategies to support autoflight mode awareness, and
• Flightcrew actions when an automated system does not respond or behave as expected or disengages unexpectedly. The objective is for pilots to develop an understanding of the automated system, its integration with other aircraft systems, and what might affect the automated systems’ ability to function as expected.
3. Integration of strategies for achieving autoflight mode awareness into SOPs.
Equipment and/or company culture may influence how the mode awareness procedures for flightcrews are designed. Therefore, the operator should create mode awareness procedures that reflect the equipment and how the company employs the equipage and should train/assess the procedures.
4. Policy and procedures for prevention, recognition and recovery from unintended autoflight states. Procedures should emphasize that the PF’s primary duty is to control the flightpath and the PM’s duty is to (1) monitor/ensure the flightpath, then (2) assist the PF by assessing any actual or potential deviations from the flightpath and helping to correct the autoflight settings as needed to restore desired behavior.
5. Policy and procedures for preventing, recognizing and managing common errors in use of automated systems, including data entry errors.
4.2.2 Strategies for using automated systems sometimes refer to levels of automation, defined as simple hierarchies of combinations of certain autoflight systems. While the concept of levels may be useful for communication, such a description assumes a linear hierarchy that is difficult to apply operationally. The various features of the autoflight system (AP, FD, AT, FMS, etc.), can be, and are, selected independently and in different combinations that do not lend themselves to simple hierarchical description. Therefore, operator’s policies should provide strategies for the pilot to use the appropriate combination of automated system features for the situation, without rigidly defining them in terms of levels, except for the highest (everything is on) or the lowest (everything is off). The strategies should provide flightcrews with the options that match the specific operationally relevant scenario, but also allow flexibility for those unusual operations that occur. Equipping flightcrews with such practical strategies may also equip them with the knowledge to select the appropriate combination of automated systems and modes (or none at all) for those unexpected events that require informed and timely decisions
(e.g. those events which may not be addressed in flightcrew checklists).
4.3 Training Considerations. As described above, effective operational use of automated systems requires the pilot to understand how the automated systems work, how to use/operate those systems, how to monitor them, and how to respond in case of failure or
4-3 uni ntended system behavior. In designing training programs, operators should develop specific learning objectives with associated training methodologies that address knowledge and skills for managing automated systems. Pilots must be trained on the operator’s policies and procedures for the use of automated systems in normal, rare normal, and non-normal operations, including appropriate engagement, disengagement, and combinations of these systems.15 Training these strategies should be scenario-based and operationally relevant.
4.3.1 Appropriate strategies on the use and application of the respective system(s) are situation-dependent, and operators should provide training on these strategies and procedures. The training should reflect actual events captured from the various data sources.
4.3.2 Operators should train flightcrews on the following topics:
4.3.2.1 Pilots should be able to correctly interpret the automated system’s engagement mode and whether the aircraft is responding as intended. If a system is not responding as intended, whoever detects an anomaly should communicate with other members of the flightcrew to ensure a shared understanding.
Should the system not engage as desired, engage into an undesired mode, or disengage unexpectedly, flightcrews should be capable of returning to the previous state or manually disengaging the system in accordance with established aircraft operating procedures. Subsequently, flightcrews should be capable of analyzing the anomaly and selecting alternative options and/or corrective actions.
4.3.2.2 Flightcrews should also receive training for operational situations in which it is not appropriate to engage an automated system, such as when known system failures/anomalies exist that may adversely affect aircraft control or when the aircraft is in an undesired state (e.g., upset). An exception when the undesired state is an upset is when the aircraft is specifically designed with a recovery system to facilitate an upset recovery. In this case, flightcrews should be thoroughly trained on the use of the recovery system and recognize if it is not operating as intended to quickly intervene and manually recover from the upset before conditions deteriorate.
4.3.2.3 Operators should train flightcrews on autoflight mode awareness. The pilot should be able to demonstrate the knowledge and skill to correctly select, interpret, and anticipate normal autoflight modes, and demonstrate appropriate remedial actions for inappropriate or unexpected modes. Learning objectives include but are not limited to:
15 Section 121.419(a)(2)(v).
4-4
• Correctly interpret individual flight mode annunciations (FMA) (e.g., AP, AT, and FD).
• Describe the respective mode’s impact on the related systems and aircraft operation.
• Identify autothrottle system mode annunciations and the effects on aircraft performance.
• Describe autothrottle system effects on related system operation.
• Identify pitch mode annunciations and their relationship to AT and FD
(i.e., demonstrate understanding of speed-on-pitch (speed controlled by varying the airplane pitch attitude) and speed-on-thrust (speed controlled by varying the engine thrust level)).
4.3.2.4 Managing automated system failures. This should include failures of other systems that affect the operation of automated systems, including sensor failures. Training on failures should consider operationally relevant situations and should include failures of items that provide input to the automated systems. Examples include situations where assessment is difficult; situations where recovery is difficult if not properly recognized; and conditions that do not have a checklist. For these training sessions, it is appropriate to note that it is not possible to train pilots in all possible malfunctions or failure scenarios, nor is it possible (or desirable) for line pilots to perform functions as test pilots. Pilots must be prepared to recognize the results of both complete and partial system failures (including sensor failures) and intervene appropriately.16
4.3.2.5 Operators should train flightcrews on how to manage automated systems after input errors (pilot- or system-generated). To reduce the likelihood of automated system input and usage errors, flightcrews should first be trained on what to look for, and then be given procedures, tools, and techniques to cross-check each other and the automated system in a combined effort to trap potential errors. The 2015 International Air Transport Association (IATA) FMS Data Entry Error Prevention Best Practices document lists some common error categories: mass/balance, flight plan, load/trim, navigation database, FMS limitations, configuration errors, data calculation, and data transcription. Instructors should offer methods for prioritizing the errors that are most likely to have significant negative consequences. Gross error checks (sometimes known as reasonableness checks, as discussed in Chapter 5) are important characteristics to instill, because such automated systems are correct in most cases, but sometimes wrong. Pilots should be trained to cross-check
16 Part 121 appendix E.
4-5 each other so errors with a potential for significant negative consequences are detected and mitigated. This training17 should include, but not be limited to:
• Strategies to detect and identify input or usage errors;18
• Training pilots on operationally relevant input and usage errors and their consequences;
• Methods for flightcrews to correct the input or usage error; and
• Methods to ensure the intended flightpath is maintained.19
4.4 Instructor/Evaluator (I/E) Considerations. I/Es should have a thorough understanding of FPM and associated automated systems, including but not limited to the AP, AT, and FD; FMS; and flight envelope protection. Operators should train their instructors on the recommended strategies and procedures for use of the automated systems and provide appropriate scenarios for the training topics.
4.4.1 Instructors should have a clear understanding of managing automated systems under failure conditions and accepted recovery techniques before training other crewmembers.
17 Training elements listed relate to ACT ARC Recommendation 17-8, Management of Automated Systems, recommendations 17-8(c) and (d).
18 Refer to ACT ARC Recommendation 15-11, Guidance Material Addressing Auto Flight Mode Training, for complementary recommended guidance.
19 Refer to ACT ARC Recommendation 15-10 and Recommendation 16-10, Flight Path Management Philosophy, Policy, and Procedures, for complementary recommended guidance.
5-1 CHAPTER 5. PILOT MONITORING (§ 121.544)
5.1 General. Flightpath monitoring involves comparing the actual flightpath to what is expected/desired. This requires pilots to observe and interpret flightpath data, aircraft configuration status, automated system modes, and onboard systems appropriate to the phase of flight any time the aircraft is in motion, including during taxi.
5.1.1 Several studies of crew performance, incidents, and accidents have identified inadequate monitoring and cross-checking as vulnerabilities for aviation safety. Effective monitoring and cross-checking can be the last barrier or line of defense against accidents because detecting an error or unsafe situation may break the chain of events leading to an accident. Conversely, when this layer of defense is absent, errors and unsafe situations may go undetected, potentially leading to adverse safety consequences. Therefore, it is required that operators establish operational policy and procedures on PM duties, and implement effective training for flightcrews and instructors on the task of monitoring (§ 121.544). This chapter describes effective monitoring, how to define and train PM duties, and integration of the task of monitoring into SOPs. Additionally, this section discusses special considerations for monitoring autoflight operations.
5.2 Operational Policy and Procedure Considerations. Operators should have documented policies and procedures to describe the duties of both the PF and PM and to support effective flightpath monitoring. These policies and procedures should state that the primary task of the flightcrew while the aircraft is in motion is FPM and emphasize the importance of vigilance to the flightpath.
5.2.1 In a two-pilot operation, one pilot is designated as PF and one pilot is designated as PM.
Each operator should explicitly define the duties of the PF and PM to include:
1. At any point in time during the flight, one pilot is the PF and one pilot is the PM.
2. The PF is responsible for managing, and the PF and PM are responsible for monitoring, the current and projected flightpath and energy of the aircraft at all times.
3. The PF is always engaged in flying the aircraft (even when the aircraft is under AP control) and avoids tasks or activities that distract from that engagement. If the PF needs to engage in activities that would distract from aircraft control, the PF should transfer aircraft control to the other pilot, and then assume the PM role.
4. Transfer of PF and PM roles should be done positively with verbal assignment and verbal acceptance to include a short brief of aircraft state.
5. The PM supports the PF at all times, staying abreast of aircraft state and ATC instructions and clearances.
5.2.2 To effectively monitor, the pilot should know what information to attend to and when. 20 The pilot should apply strategies to perceive flight deck indications and interpret their meaning for the current context and assimilate them into a mental model of airplane state
20 For effective monitoring of the flightpath, cognitive skills of perceiving, interpreting, and assimilating are integrated with pilot knowledge into an understanding of the flightpath and the airplane’s relation to it.
5-2 relative to the flightpath. The pilot actively compares their mental model of what is expected (or normal for the context) to the indications in the environment (e.g., flight instrument, mode annunciations) that are available. Therefore, the pilot needs to have sufficient knowledge to form an accurate mental model of the aircraft systems and performance, to know what information to acquire, and how to process it to formulate an accurate understanding of the current state of the aircraft flightpath. Differences between what is expected/desired and what is observed should trigger corrective action.
5.2.3 Effective flightpath monitoring also requires effective management of attention. If pilots become distracted or workload is high, attention may be insufficient. The management of attention is an important cognitive skill that requires effort. Because the modern flight deck has many visual displays and sources of information, pilot attention may be captured by interpreting aircraft system behavior or compelling, information-rich displays. Therefore, it is important that pilots are skilled at managing attention, information, and distractions to ensure flightpath remains the primary focus of the flightcrew.
5.2.4 The operator should implement the policies into SOPs to support monitoring and cross-checking functions, and appropriate interventions. If not designed appropriately, some SOPs may actually detract from effective monitoring. For example, one operator required a passenger address (PA) announcement when climbing and descending through 10,000 feet. This requirement had the unintended effect of “splitting the flight deck” at a time when frequency changes and new altitude clearances were likely. When the operator reviewed its procedures it realized that this procedure detracted from having both pilots “in the loop” at a critical point and consequently decided to eliminate it. Operators should review existing SOPs and modify those that can detract from monitoring.
5.2.5 Autoflight mode awareness is of particular importance because effective monitoring of autoflight modes is necessary for successful FPM. Below are some recommended strategies for effective monitoring of the autoflight modes that could be included in operator policies and procedures. The pilot should:
1. Stay in the loop by mentally flying the aircraft even when the AP or other pilot is flying the aircraft.
2. Monitor the flight instruments just as when the pilot is manually flying the aircraft.
3. Be diligent in monitoring all flightpath changes including pilot actions, system modes, and aircraft responses.
4. Always make monitoring of the flightpath a priority task when changes are being made.
5. Always check the FMA after a change has been selected on the autoflight mode control panel.
6. Check the FMAs and flight instruments after being distracted to regain full awareness of the flightpath state.
5-3
7. Maintain an awareness of the autoflight systems and modes selected by the crew or automatically initiated by the FMS (mode awareness) to effectively monitor the flightpath.
8. Maintain an awareness of the capabilities available in engaged autoflight modes to avoid mode confusion.
9. Effectively monitor systems and selected modes to ensure that the aircraft is on the desired flightpath.
5.2.6 Operator policies and procedures should adequately address the potential for intervention.21 Policies and procedures for expected interventions should be established, including:
• Deviation callouts, deviation parameters, required callouts, conditions for “takeover”
(e.g., “2-challenge rule”), automation management standards (e.g., “change mode of automation under the following conditions”), etc.
• Expected responses to callouts; conditions for takeover (e.g., subtle incapacitation, and/or no correction after two challenges); callouts and actions associated with a takeover of control of the aircraft; ensuring positive change of control; and the PF’s expected actions after a takeover.
• If the PF does not correct the flightpath deviation in a timely manner, the PM should intervene based on operator policy and procedures.
5.2.7 Operators should have policy and procedures that enable the flightcrew to verify and validate both the accuracy and applicability of automated system inputs and outputs by conducting reasonableness checks.22 Reasonableness checks allow flightcrews to detect and address potentially conflicting, ambiguous, inapplicable, or erroneous automated system inputs/outputs. These procedures should also specify how and when to perform reasonableness checks. These should integrate with existing procedures and training to guide the conduct of reasonableness checks of automated system inputs and outputs during the FPM planning activity for each phase of flight.
5.3 Training Considerations. In designing training programs, operators should develop specific learning objectives with associated training methodologies that address knowledge and skills for monitoring. Training should provide pilots with the knowledge and skills needed to satisfy the duties of PM, to effectively monitor the flightpath, to communicate with the other pilot(s) when there is a flightpath deviation, and to know when and how to intervene if necessary. Training should also include an understanding of the barriers to effective monitoring and how to mitigate them. Operators should train and check flightcrews on the following topics, including:
21 AC 120-71, Chapter 6, Pilot Monitoring.
22 A reasonableness check is any check that is carried out to verify that a result looks “reasonable” given other available knowledge and information.