Risk Management Handbook (FAA-H-8083-2A)
equipment limitations affect the amount of assistance they can provide. In larger operations, a dispatch or company operations
center can normally coordinate all communications and assistance.
Defenses Provided by the Pilot or Crew
Certain pilot behaviors defend against threats and errors.
Clear Communication and Briefings
Whether operating as a single pilot or as part of a crew, clear and concise communication is the foundation for sharing information
and conveying intentions. When communicating with ATC or during crew briefings, each pilot should agree on the plan of
action, ask for clarification, and question any inconsistency.
Effective Situational Awareness
Situational awareness may include knowing:
• Aircraft position
• Flight Path
• Status of other aircraft in the area
• Status of the environment
• Human factors in play
Planning for What Comes Next
Situational awareness allows the pilot to plan for what will happen next and to stay ahead of the aircraft. A forward-looking plan
also provides for early detection of any deviation from expectations.
Time Management
On the ground, the pilot has the option to stop the aircraft. Pilots can always resume taxi after addressing an issue. Once
airborne, budgeting time, prioritizing tasks, or slowing aircraft speed may allow sufficient time to complete tasks without error.
A pilot feeling rushed while being vectored for an approach can request a delay or a vector that gives more time for completing
checklists or configuring the aircraft.
Teamwork
Pilots may normally communicate with Flight Service and ATC. Some operators also have dispatchers available who track and
assist flights. These external contacts are part of a team and a resource that can provide in-flight assistance. However, in a critical
situation during any flight, declaring an emergency results in additional assistance and priority handling.
When the flight involves more than one pilot, crew resource management principles should be used. Typically, this allows one
pilot focus on flight path management while the second pilot monitors the flight and accomplishes other tasks. However, the
pilots should communicate their reasoning, intentions, and actions to allow for discussion, agreement, and verification.
Automation Management
Managing automation can reduce workload and improve situational awareness if understood and used properly. Automation
management will be discussed in greater detail in Chapter 7, Automation & Flight Path Management.
Flying Skills (The Last Resort)
Employing this defense becomes necessary after experiencing an undesired aircraft state that cannot be remedied with other
defenses alone. Ability to take full control of the aircraft and return to safe flying parameters is of critical importance.
Pilots should always train, remain current, remain proficient, improve knowledge, employ risk management, and be ready to
handle any situation that could occur. Effective risk management and threat and error management usually prevent occurrences
of an undesired aircraft state that may require a pilot to rely solely on flying skills as a defense.
Risk Management Handbook (FAA-H-8083-2A)
Proficiency
A pilot who remains proficient is better prepared to defend against threats, errors, and undesired aircraft states. This can be
depicted in the context of a Swiss cheese model. Each piece of Swiss cheese is a component of the defense against threats,
errors, and undesired aircraft states. [Figure 6-1] Each of the holes in the cheese is a weakness in those defenses. A greater level
of proficiency reduces the likelihood the holes will align.
Anticipate Recognize Recover
Threats
Errors
Undesired
aircraft
state
Incident/
Accident
Prevent Trap Mitigate
Figure 6-1. The Swiss cheese model.
Discipline
Discipline stems from good training and habit patterns. A disciplined pilot will perform a task in a similar manner each time
regardless of proficiency. For example, completing the preflight inspection of the aircraft by using and following the approved
checklist every time is a mark of discipline. Discipline also affects aeronautical decision-making. A disciplined pilot will be
guarded and inoculated against hazardous attitudes and operational pitfalls, as shown in Figure 6-2. In general, a disciplined
pilot will always do the right thing. Just like proficiency, discipline will lessen the likelihood that a threat or error will find a
path through the pilot defenses.
Figure 6-2. Operational Pitfalls and Hazardous Attitudes.
Chapter Summary
Defenses against threats and errors are either provided to the pilot or provided by the pilot. Pilots should perceive threats and
errors and respond appropriately. The response may require the use of an appropriate checklist or may require more complex
decision-making. A trained, proficient, and disciplined pilot uses appropriate threat and error management strategies to prevent
or recover from an undesired aircraft state.
Risk Management Handbook (FAA-H-8083-2A)
Risk Management Handbook (FAA-H-8083-2A)
Introduction
Automation systems provide an interface allowing the pilot to set a desired aircraft state. The system takes pilot input and
aircraft information into account, develops a logical solution, and acts to fulfill the programmed objectives without continuous
input from the pilot. When used properly, automation can reduce workload, enhance situational awareness, and allow the pilot to
focus more attention on the aircraft flight path. Aircraft automation designs range from basic control of one system to complex
integration of many systems.
At the start of the age of automation, engineers designed automation into individual systems. For example, a pilot might hold
a switch and monitor an indicator to obtain a desired flap setting in an aircraft equipped with electric flaps. Automation of this
system included a series of detents for the flap switch such that the pilot could select the desired flap setting. The system sensed
the input and automatically positioned the flaps as set by the pilot. This system reduced the time and attention needed to set
flaps.
With the advent of computers, networks, and conversion between analog and digital signals, it became possible to control many
functions at the same time. These systems, available for some time in transport category aircraft, are now widely available in
general aviation aircraft. This chapter discusses how the use of these systems can affect safety.
Some automation technologies include:
• Flight management systems that use a database to navigate and sequence through a series of waypoints, which
interface with an autopilot. [Figure 7-1]
• Aircraft pressurization systems that operate without pilot adjustment during flight.
• Automated fuel management systems that operate without pilot intervention during normal operations.
• Auto-throttles and digital engine controls.
• Avionics systems that load flight plan information from a database or from an outside source.
Figure 7-1. Autopilot interface.
Chapter 7: Automation & Flight Path
Management
Risk Management Handbook (FAA-H-8083-2A)
Reliance on Automation
The use of automation comes with certain cautions. Automation should reduce workload, but in some instances, it may create
more work, confusion, and contribute to errors. At other times, automation may lull pilots into complacency. Pilots who
consistently rely on an autopilot for flight path management may experience degraded ability to fly manually when required
to do so. For example, when flying in icing conditions, an automated system may make control inputs to compensate for ice
accumulation. However, if the system exceeds its limits, it could disconnect and leave the aircraft in an undesired state. A pilot
who has become unaccustomed to manual flight may not be prepared to handle the situation.
Reprogramming tasks that occur unexpectedly can trigger pilot errors, which may result in flight path deviations or other
undesired aircraft states. Pilots should anticipate the need to fly manually and be prepared to maintain the desired flight path
when manual control becomes necessary.
Pilots who use automation should train and practice for various scenarios in order to avoid becoming overly distracted when
making a programming change or correcting an error. Being startled or confused by a programming mistake or automation
malfunction occurs less often when the pilot has the capability for transition to manual flight. If the automation is not functioning
according to expectation, the pilot may reduce the level of automation, fly manually, and take time to resolve the condition.
Balancing Automated & Manual Flight
Pilots choose the level of flight path automation. Risk management strategies suggest using automation as an aid to manage
workload rather than to compensate for lack of proficiency. A balance of automated and manual flight that takes workload and
proficiency into consideration gives the pilot greater opportunity to monitor the flight path and aircraft state.
Choosing the appropriate level of automation for the task and adjusting as circumstances dictate is essential to effective use of
automation. One of the most common errors is failing to move to lower levels of automation suitable to a changing environment.
For example, a pilot may track an approach course adequately using manual control inputs. However, the pilot may also need to
listen to and record the Automatic Terminal Information Service (ATIS), retrieve and load an instrument approach procedure,
prepare for the instrument approach, and accomplish the appropriate checklists. These tasks will increase workload and divert
pilot attention from monitoring and controlling the flight path. If using an autopilot to track the approach, the automation
performs the control inputs and allows the pilot to complete other tasks quickly and efficiently.
Continuing the scenario above, the pilot loads the instrument approach and decides to remain on autopilot. However, after the
aircraft passes the initial approach fix, ATC cancels the approach clearance. ATC provides vectors and tells the pilot to expect
to hold. In this situation, the pilot may select basic autopilot modes that control heading and altitude in order to comply with the
assignment from ATC. The lower level of automation allows the pilot to program and configure the aircraft for an unexpected
change while keeping the flightpath and aircraft state under control.
Pilots may sometimes choose to disengage the automation and fly the aircraft manually to maintain proficiency.
Interacting with Automation
Regardless of the level of automation, pilots should consider the following series of steps: [Figure 7-2]
1. Anticipate – Understand the system well enough to know what should happen before pushing a button or turning a
knob.
2. Act – Execute button pushes and knob turns to implement the desired automation.
3. Verify – Ensure the aircraft or avionics performs as expected.
Risk Management Handbook (FAA-H-8083-2A)
Figure 7-2. Steps for interacting with automation
Understanding autopilot function and logic allows the pilot to anticipate, act, and verify the autopilot performs as expected.
Figure 7-3 shows a typical flight mode annunciator displayed on the primary flight display (PFD) of a general aviation integrated
flight deck. A pilot without adequate training may not anticipate that a change or disruption of the navigation source may reduce
the level of automation, and horizontal flight path control may default to wings level mode. If this should occur unexpectedly,
it could lead to increased workload, confusion, or result in an undesired aircraft state.
LOC HDG AP ALT 9000FT GS
Figure 7-3. Flight mode annunciators in green indicate the autopilot is engaged in heading “HDG” and altitude “ALT”
mode, maintaining 9,000 feet MSL. The white “LOC” and “GS” annunciators indicate approach mode is armed but not
engaged.
Failure to Anticipate, Act, & Verify
Automation offers increased safety with enhanced situational awareness. However, these systems make it possible for a pilot to
become complacent, unprepared, or lose situational awareness. If this occurs and an unexpected change in flight plan is needed,
workload and confusion may suddenly increase.
In a 1995 fatal accident in Colombia, a flight crew was unexpectedly cleared for an approach, lost situational awareness, and
crashed into mountainous terrain. The accident summary cites failure of the flight crew to revert to basic radio navigation at the
time when the FMS-assisted navigation became confusing and created an excessive workload in a critical phase of the flight.
The system flew on a programmed path into a mountain, resulting in many fatalities. A narrative of the accident is available here.
As part of a lack of situational awareness, the workload and confusion resulted in the crew failing to retract the aircraft speed
brakes when they became aware of the terrain ahead and after adding full thrust. This prevented the aircraft from climbing above
the slope of the mountain ahead.
Integrated Flight Path Automation Systems
Use of automation is an excellent risk control measure when flying in a variety of flight environments where the pilot has a high
workload. For example, autopilots are often very useful during complex single-pilot operations. While the use of automation
helps reduce risks associated with other hazards, a lack of proficiency with automation may become its own hazard and introduce
unique risks. While pilots often rely on the autopilot, they also need to be able to fly the aircraft manually within appropriate
standards.
Pilots should train and practice using automation under VFR with an appropriately qualified and knowledgeable flight instructor
before attempting IFR flight. In addition, using a flight simulation training device provides the opportunity to practice and
Risk Management Handbook (FAA-H-8083-2A)
repeat automation procedures with a simulated high workload. Through appropriate training and practice, pilots learn to operate
autopilot systems with ease and in a routine manner.
Knowledge of system limitations and operating restrictions is also important. Pilots should know emergency procedures pertaining
to disconnecting the autopilot as well as being able to locate appropriate checklists. Reviewing the system documentation and
aircraft flight manual supplements helps develop this knowledge.
Chapter Summary
The increased use of automated systems, autopilots, and integrated flight decks help pilots manage an aircraft’s flight path.
While an autopilot is engaged, a pilot’s attention should not disengage. Pilots need to maintain situational awareness and
appropriate focus on the progress of the flight at all times. Balancing the use of automation with manual flying skills is necessary
in case a particular situation requires pilot intervention. Using automation proficiently and at the appropriate level reduces risk
and helps prevent incidents and accidents.