Safety-II: Building safety capacity and aeronautical decision-making skills to commit better mistakes

Abstract

Problem: Why did the pilots do that? Human error is a reasonably common retrospective assignment of responsibility tied to undesirable aeronautical safety occurrences. Although retributive justice has long been accepted in aviation, its effectiveness in preventing recurrence is minimal. Airmen tend to decide based on their best knowledge with the available resources in intrinsically fallible systems in the ultra-safe high-risk aviation industry.

Method and Results: This paper sheds light on Safety as Capacity under the vanguardist Safety-II perspective and examines procedures as static tools incapable of sustaining safety. It discusses the prejudice in non-critical adherence to procedural compliance beyond creating bureaucratic work environments permissible to sanction workers against regulations. Disputing the safety gain in a retrospective analysis of mishaps, the paper instils the airmen as solution elements to sustain safety at the management of context, a fundamental aspect of Safety-II.

Impact on Industry: A systemic deficiency in civilian pilot training is exposed, and an independent organisational Safety Capacity assessment tool to air operations is provided. The main debate is the synergetic interaction between aircrew’s aeronautical decision-making skills and organisational Safety-II as safety capacity. The pilot’s preparedness to analyse, create and evaluate outside forecasted protocols in modern aviation environments is discussed. These dynamics are revised in their inter-reliability known as Safety as Capacity.

Nomenclature

AAR

Aircraft Accident Report

ADM

Aeronautical Decision-Making

AOC

Air Operator Certificate

APS-MCC

Airline Ready Multi-Crew Cooperation Course

ARC

Aviation Rulemaking Committee

ATC

Air Traffic Control

ATO

Air Training Organization

ATP

Airline Transport Pilot

ATPL

Airline Transport Pilot License

A-UPRT

Advanced Upset Prevention & Recovery Training

BEA

French Bureau of Enquiry and Analysis for Civil Aviation Safety

CAA

Civil Aviation Authority

CFIT

Controlled Flight into Terrain

CFR

United States Code of Federal Regulations

CPL

Commercial Pilot License

CVR

Cockpit Voice Recorder

EASA

European Union Aviation Safety Agency

ED

Executive Decision

ELP

English Language Proficiency

FAA

Federal Aviation Administration

FCL

Flight Crew Licensing

FNPT

Flight and Navigation Procedures Trainer

FO

First Officer

FOQ

First Officer Qualifications

FSTD

Flight Simulation Training Device

ICAO

International Civil Aviation Organization

IFALPA

The International Federation of Air Line Pilots Associations

INCR

Increase

IR

Instrument Rating

JOC

Jet Orientation Course

KSA

Knowledge, Skills, and Attitudes

LO

Learning Objectives

MCC

Multi-Crew Cooperation

MEP

Multi-Engine Piston

MIT

Massachusetts Institute of Technology

MPL

Multi-Crew Pilot License

NAA

National Aviation Authority

NR

Night Rating

NTSB

United States National Transportation Safety Board

PBN

Performance-Based Navigation

PFD

Primary Flight Display

PIC

Pilot in Command

PPL

Private Pilot License

SE

Single Engine

SIC

Second in Command

SOP

Standard Operating Procedures

TFT

Total Flight Time (in hours)

TTOT

Total Time on Type (in hours)

VREF

Reference Speed

1.0 Introduction

Why did the pilots do that? This is a fairly common retrospective view when the focus is on identifying an individual’s mishap. The so-called human error is evidenced in an aeronautical occurrence when the desired outcome is misaligned with the result in fact materialised.

In a retributive analysis (post-factum), there is an intrinsic attempt to find the broken link in the chain of events and therefore to correlate the upset (or unexpected outcome) to an alleged human error in terms of culpability under Safety-I optics.

Karl Weick’s insight [1] defines reliability, or simply safety, as a dynamic non-event.

The traditional parametrisation of safety, herein referred to as Old Safety and Safety-I, provoked modern scholars. However, whilst industry-accepted metrics tend to focus on the absence of accidents, contemporary specialists find it somewhat paradoxical to measure safety by its absence.

Safety is the ability for workers to be able to do work in a varying and unpredictable world (Conklin [2]).

Human error is no more than a label; it is a judgement. It is an attribution that we make, after the fact, about the behaviour of other people or about our own (Dekker [3]).

Accidents come from relationships, not broken parts (Bezman apud Dekker [4]).

In 2017, Dekker [3] delineated the contrast and transition between the old view and the new view of human error. The former sets human error as a separate category of behaviour to be feared and fought. It is the cause of trouble. Efforts target zero errors, zero injuries and zero accidents as achievable goals. The latter perceives human error as a symptom of deeper trouble, as an attribution, and a judgement made after the fact. The system’s improvement lays in enhancing resilience through the people and the organisation as a whole.

This work challenges the simplistic linear perspective to an undesirable occurrence in the dynamic and complex aeronautical context. A note of clarification is due to state the reason for reluctance in using the term accidents in this paper. Instead, occurrence was the word of choice, as it carries a neutral and unbiased connotation. The intention is to remove the judgemental aspect when looking at a consolidated scenario in order to preserve impartiality and the opportunity to pose relevant questions.

It is routine for flight crew members to adhere to SOPs (standard operating procedures) and comply with the regulations. However, to those who may feel resentful about being told what to do, FAA (Federal Aviation Administration) has named anti-authority as one type of hazardous behaviour and attempts to drive pilot’s attention to regarding the rules, regulations and procedures by the use of this antidote: Follow the rules. They are usually right (FAA [5]).

Workers leave home and show up for duty with the intention to execute a good job, comply with the regulatory and company directives and return home safely. If due care is taken and procedural compliance is adequate, why do accidents continue to happen? A typical response is frequently associated with human error, this being the failure to decide assertively or to take adequate and timely corrective actions.

In 2016, FAA [5] published a profiling chart including five traits of accident-prone pilots. The study suggests that these crews tend to have disdain towards rules; a high correlation between accidents on their flying records along with safety violations on their driving records; and a personality category that frequently fit into thrill and adventure-seeking. In addition, they are impulsive rather than methodical and disciplined, both in their information gathering and the speed and selection of actions to be taken. Also, they have a disregard for or tend to underutilise outside sources of information, including co-pilots, flight attendants, flight service personnel, flight instructors and ATC.

A retrospective analysis following an upset is often associated with the lack of attention, knowledge or conformity with what was expected from the crew. Despite its wide acceptance by technical management in the industry, the assignment of blame to the defiant agent turns out to be an immediate retributive tool. Retribution is a prominent constraint to the restoration of Safety as Capacity. In accordance with Conklin [2], punishment is unlikely to promote learning or system improvement.

Culpability is beyond the scope of this study. Therefore, the classification of error and violation is also set aside. For example, a hypothetical aircraft involved in a CFIT (controlled flight into terrain) occurrence generates the same prejudice to its occupants if the crew’s actions are rooted in a mistake or a violation. Thus, the irrelevance of the causal motive. This analysis emanates from the conception that the individual acts to the best of his knowledge with the available resources at a given time.

In light of that, air transport operators direct efforts to achieve corporate compliance, and its flight deck analogous, also known as procedural compliance. A critical analysis is due. In accordance with Cintra [6], human beings are tempted to reason within their own capability, including experience, exposure, technical background, emotions and more.

As a highly standardised industry, commercial aviation has embraced strict regulations since the ancient Greek history of Dedalus and Icarus in Crete. Rule challenging, but also interpretation drifts, have always been present. Paraphrasing Dekker’s idea of 2001 [7], there is a persistent notion in aviation that not following procedures can lead to unsafe situations and outcomes and that safety is a direct result of people following guidelines. Evidently, the industry responds with streamlined expectations for the crew. However, a perfect regulatory framework that encompasses all variability combinations in this context is unattainable.

Further mature analysis from Dekker [7], in his article Follow the Procedure or Survive, strict compliance derogates from practical safety. He acknowledges the discrepancy between the written procedures and actual practice. The ambiguity is at the impossibility to simultaneously follow the rules and get the job done in a complex dynamic operational environment. Beyond that, a mention to Rochlin, La Porte and Roberts [8] recalls that some of the safest complex dynamic aviation systems operations today refrain from using written procedures on some of their most challenging activities.

Though rules are rigid, safety assurance depends on the ability to interpret them with appropriate flexibility. Based on Klein [9] and Sanne [10], Dekker [7] reminds us that procedures are resources and don’t self-dictate coherent application. Decision-making and problem solving regarding appropriate rule application are cognitive activities that require substantial training. Deterministic outcomes to this process are indicative of failure to adapt or adaptation attempts that result in failure. Further to that, he defends that in order to progress in safety, organisations must monitor and understand the need for flexibility when making decisions and promoting ways to support this attribute.

If one watches a movie and learns the end of that story, it is relatively simple to picture the sequence of events that took place. However, it would not be possible to correctly conjecture the event sequence before watching the movie. The same happens in air operations.

Safety is not about having all the answers. It is about having the capacity to ask better questions and, in turn, focus on the actual problem. It demands training, exposure and practice.

Functional management of context incorporates a compassionate nature and the agent’s unbiased view at the moment in reference. Therefore, this study focuses on human performance (the positive outcome of human management of variability) rather than human error.

Conklin [2] defends that the only thing that stops you from getting the information is thinking you already know it. New Safety is the management of context. The improvement in operational conditions is more effective than the attempt to alter worker behaviour. It is essential to grasp this concept to absorb what is discussed here.

In an era when many accidents are attributed to human error, it is fundamental to understand why people do what they do.

This work is centred at the intersection of the flight crew’s ADM (aeronautical decision-making) skills and the actual Safety-II implemented in the operational environment. The interest lies in the synergetic interaction between the two domains depicted in Fig. 1.

Figure 1. Intersection between organisational Safety-II and flight crew ADM skills as safety capacity.

The overlap represents safety capacity in the management of context through the optics of human performance. In other words, the scope is at the systemic ability or potential to do Safety, Fail Safely and Adaptive Capacity as a result of the aforementioned interaction.

1.1 Safety Capacity (Safety as Capacity)

The foregoing discussion aims to instil a tangible understanding of safety as capacity. Some might be familiar with the correlate definitions of Adaptive Capacity, Safety Resilience, or Capacity to Fail Safety.

Safety Differently lead scholars, particularly Dr. Sidney Dekker and Dr. Todd Conklin, are changing the definition of safety by shifting the focus from who fails to the organisational system’s capacity to fail safely.

The Cambridge Dictionary defines capacity as “the amount that can be produced by something” and as “someone’s ability to do a particular thing.” In the context of Safety-II discussed herein, capacity is intertwined with the systemic ability to “do safety.” To better understand this concept, it is imperative to revise what capacities are required to be managed to sustain safe air operations.

In contrast to risk, capacity is manageable. An undesirable aviation safety occurrence consists of three phases: the context (manageable), the consequence (the event), and the retrospective. Reactive Safety is at the consequence. Safety Capacity is at the management of context.

In other words, Safety Capacity interest is at the system capacity to fail safely. The substantial change is from if it fails to when it fails. Moving away from the traditional perspective of extinguishing events, more assertive questions and solutions are directed to preparing the system response to the failure instead of attempting to avoid it. The consequence (event) can’t be managed, but the system’s response to failure, the context, certainly can.

In creating Safety Capacity, in the management of context, the organisation understands that the operations are not inherently safe and contain parts readily aligned to fail. Firstly, the continuous improvement efforts focus on the system, not the workers. People are at the solution’s core as safeguards and barriers to undesirable events. Conklin stated, “Workers don’t cause failures. Workers trigger latent conditions that lie dormant in the organisations waiting for this specific moment in time”, and Dekker complemented, “To understand safety, we must first understand our reaction to failure.”

Finally, according to Conklin, the safest organisation is the one that “fails often, fails softly, and fails effectively.” In other words, this entity has Safety Capacity, the capacity to fail safely. In such organisations, one single failure can’t lead to a catastrophic failure because the system has the capacity to absorb the consequences before such aggravation.

1.2 Objective

The main objective of this study is to analyse how the ADM training within the Part 141 ATPL training program in its overlap with the organisation’s actual implementation of the New Safety can sum and generate a synergetic moment in the form of Safety as Capacity by means of the optics of human performance.

1.3 Hypothesis

The construct uses the hypothesis that it is possible to enhance Safety as Capacity by the early stimulation and development of civilian cadet’s ADM skills within the existing training structure of an integrated or modular ATPL (Airline Transport Pilot License) Course of an ATO (Air Training Organisation).

1.4 Research question

Therefore, the research question is: Is it possible to enhance Safety as Capacity by developing ADM skills for cadets undergoing ATPL indoctrination courses?

1.5 Methodology

The research methodology is predominantly bibliographic and qualitative. It encompasses the analysis of best international practices in the modern commercial aviation industry published by credible stakeholders, associations and product manufacturers. Additionally, a cross-referenced investigation between the herein referenced key Civil Aviation Regulators and Civil Aviation Investigators in the Americas and Europe is presented. Finally, the human performance considerations are carved from a critical comparison between the literature of recognised scholars in the Americas, Europe and Oceania.

1.6 Byproduct

The expected byproduct is the proposition of a preliminary Organisational Safety Capacity Assessment Card to be a practical tool for cadet pilots undergoing training and possibly during their initial employment.

1.7 Objective and relevance

The aim is to identify in a neutral and independent manner the current level of operational Safety Capacity. This is done irrespectively of any documented ATO or AOC (Air Operator Certificate) holder approved manuals and free of third-party biased opinions. This is relevant because the reality of practical operations doesn’t necessarily match the CAA (Civil Aviation Authority) accepted manuals (work as imagined). In other words, real work practice is commonly different from the written guidance.

1.8 Benefit

The proposed benefit is to empower the crew with safety-enhancing autonomy. This tangible tool serves as a situational awareness instrument for the pilot and the organisation by directing attention to the broader safety-relevant aspects of the organisational environment rather than as a flight risk assessment device. Additionally, it assists the cadet to ask better questions and possibly generate a momentum of change towards a positive safety culture for pilots of all grades of experience.

2.0 The safety scholar’s perspective

This section identifies the contrast between different schools: Safety-I and Safety-II through cross-examination of the high-level specialist’s observation.

Retributive justice departs from what Safety as a dynamic non-event should be in a just culture environment (Weick [1]). The misalignment between the industry’s retributive safety model and actual safety is the reason why this study is born. When safety is referenced by the absence of errors and accidents, a convenient but incorrect datum is employed. Investigation parameters tend to be vicious to the fragile link, which is usually one or more human beings.

The idea of punishing or exonerating a specific agent who failed to comply with the regulation or procedure portrays itself as an ideal swift solution for managers. By doing so, it’s possible to remove the defective, non-compliant link. Heinrich [11] determined in the pyramid that follows that, by preventing accidents, the injuries will “take care of themselves” (Fig. 2). Zero accident equals to zero injuries.

Figure 2. The foundation of a major injury 1-29-300 (adapted from Heinrich [11]).

This retrospective is refutable. Contemporary safety scholars have shifted the attention from the reason processes go wrong to why they actually succeed most of the time. Human beings are the key factor for successful operations and are no longer the weak link. Thus paradoxically, safety has been measured by its absence. The sensitive change is now learning from what is actually functional.

Reducing a problem to a false simplicity by ignoring complicating factors is defined as simplism (Merriam-Webster [12]). Complicating factors are analogous to the complex dynamic of real-life interactions an individual faces when conducting every flight. Standard operational procedures, quality control and assurance have played an essential role in their integration with safety.

The enforcement of procedural adherence causes the line of commercial air transport undesirable occurrence statistics (accidents) to assume the shape of an asymptote over time. Asymptote is a straight line associated with a curve such that as a point moves along an infinite branch of the curve, the distance from the point to the line approaches zero and the slope of the curve at the point approaches the slope of the line (Merriam-Webster [13]). In other words, the line of occurrences in time approaches zero but never touches zero (Fig. 3). Mathematically, it’s a conventional limit-case.

Figure 3. Non-dimensional asymptotic line representative of undesirable occurrences vs time.

When zero accident is the main objective, simplifying is not the answer. Targeting the reduction of safety occurrences to a single cause, namely human error, is an open dismissal of growth and learning opportunities.

… simply writing off … accidents merely to (human) error is an overly simplistic, if not naive, approach…

… After all, it is well established that accidents cannot be attributed to a single cause, or in most instances, even a single individual (Heinrich, Pettersen and Roos, 1980, apud Shappell and Wiegmann [14]).

The increase in the number of regulations and procedures can’t bring the line of undesirable occurrences over time to zero.

Any commercial enterprise has profit at the heart of its reason to exist to accommodate a healthy lifespan and allow possible growth. Therefore, the onset of an occurrence causal of property damage or health injuries is directly opposed to the core goal of any business venture. Hence, this is why safety exists in the commercial environment.

Safety is the means to sustain the operation as a whole, as its deficiency impairs business continuity, public credibility and profitability. It works like the cement in a brick wall structure. The means to achieve is the pathway, the journey, not the final point.

Conklin [2] defends that a desirable operation, safety-wise, will have safety as high as it needs to be to remain profitable and as low as it needs to be to avoid property damages, health injuries and death.

Quantifying adverse events such as accidents is simpler than measuring the number of times a procedure was omitted or completed in a substandard manner by the flight crew without further prejudice to the successful completion of the mission.

Ideally, consequences of the deviation are contained by the system without catastrophically compromising the mission (fail with resiliency). However, it is natural to focus on the negatives. Reason [15] states that accidents are salient, and normalcy is not.

Safety-I scholars like Heinrich measured safety by the absence of accidents. Events that have already happened can be relatively easily translated into tangible metrics, charts and graphs. While the understanding of past events might appear as an opportunity to learn, at this point, the prejudice or harm has already taken place.

In 2000, Barnett and Wang [16] prepared a research report under the National Centre of Excellence in Aviation Operations Research. This MIT (Massachusetts Institute of Technology) study reveals that passengers are less prone to die in an airplane operated by a carrier with a higher number of reported hazards. The principle is opposed to the earlier dogmas and is grounded on the presence of factual data as a resource rather than a problem.

Enlightened by that, the retrospective segment of the line is set aside to perceive the benefits of acting proactively at the management of context. Undesirable occurrences happen at the management of Context (Fig. 4).

Figure 4. Parts of an event (based on Conklin [2]).

It is evident that the operational outcome comprising human deviations most often ends up with a safe completion and opportunities to learn. Erroring is intrinsic to human nature.

Error will still occur despite the fear of reprisal from the authority, management, or even an enhanced focus and alert to perform a given task. One flight operation is never identical to the previous one, even when the crew, routing, time of the day and aircraft remain the same. The interest here is to understand how to amplify Safety as Capacity at the management of context rather than in a retrospective fashion.

It is indeed a somewhat counter-intuitive idea to desire a high volume of safety events in an organisation when aiming for capacity. The motivation of this study lies in the transition from the abstruse of safety theorisation to the provision of a tangible assessment tool (card) to aid the cadet undergoing training.

Whilst grasping the historical concepts of safety and its definitions remains relevant, young cadets must be empowered with enough knowledge to independently conduct a practical safety capacity assessment of the system in which (s)he is engaged, to consciously deliberate the risk exposure (s)he is willing to accept. This learning exposure has to be triggered at the initial stages of flight instruction.

Despite the best training manuals, indoctrination programs and state-of-the-art (along with state-of-the-practice) equipment, accidents still happen and will continue happening in the future. Figure 5 depicts a gap between the work as imagined (the idealistic condition of a perfect world as described in the manuals, shown as the straight black line) and the work as it happens in real life (blue lines). Whilst good companies design the work as imagined based on the work as reality, there will always be drifts and tradeoffs.

Figure 5. Work as imagined versus real work (based on Conklin [17]).

This tradeoff is known as the management of variability (Conklin [2]). It comprises the grey area of uncertain interpretation, in which the onset of a complex set of events was naturally not depicted in the manuals. Still, despite that, the crew has to act upon it.

Commercial aviation (excluding general aviation) is an ultra-safe high-risk industry with less than one disastrous accident per ten million events (Cusick; Cortés; Rodrigues [18]). These statistics demonstrate that most of the time, the decisions facilitate a restoring moment from the real work towards work as imagined, which is a desirable outcome.

When the real work suffers a single failure and can remain functional, it has capacity for resilience, and the operation as a whole is not interrupted. However, when the real work (blue line) touches the hazard line (red line), the catastrophe occurs (yellow star) (refer to Fig. 5).

Since most of the time in the commercial aviation industry the decisions are made within the grey area to define a safe outcome and a singular dynamic interaction of variables, it is of fundamental relevance understand the management of context rather than the retrospective of an undesirable occurrence. Table 1 depicts the human performance impacts on safety capacity.

Table 1. Human performance impact on safety capacity (based on Conklin’s constructs of 2017 [2])

As we pointed out in 1994, human error is just a label. It is an attribution, something that people say about the presumed cause of something after the fact. It is not a well-defined category of human performance that we can count, tabulate and eliminate. Attributing errors to the actions of some person, team or organisation is fundamentally a social psychological process, not an objective, technical one. (Woods; Dekker; Cook et al. [19])

Vanguardist safety scholars are interested in human relationships rather than primarily the associated in resources other than human.

2.1 Aviation stakeholders – same goal, different approaches

2.1.1 The investigator’s perspective – National Transportation Safety Board (NTSB)

This section discusses the Civil Aviation Investigator’s perspective against the Civil Aviation Regulator’s view in light of the Colgan Air flight 3407 final investigation report. Beyond a brief review of this occurrence depicted in Table 2, the intention is to pave the way to understand the regulatory implications derived from the lessons learned.

Table 2. Fact sheet: Bombardier DHC-8-400, N200WQ occurrence (based on NTSB [20])

Among the twenty-five recommendations issued by the NTSB (National Transportation Safety Board) [20] to the FAA, a broad range of disciplines were evidenced. Those related to flight operational quality assurance programs, flight and duties, rest, fatigue management, weather reporting, use of personal portable electronic devices on the flight deck and others are acknowledged and valued.

For the scope of this paper, four strategies limited to pilot professionalism, pilot training, regulatory oversight and qualification requirements have been selected for further analysis. Table 3 depicts an overview of their contents.

Table 3. NTSB recommendations to the FAA: Bombardier DHC-8-400, N200WQ occurrence (based on NTSB [20]).

The investigator’s preoccupation with the quality of flight crew training in terms of knowledge, skills and attitude becomes evident. Moreover, a stringent regulatory oversight is recommended targeting those operators experiencing rapid expansion in size or complexity for possible compromises in the organisational management of change.

Rather than offering regulatory and procedural expansion, an alternative, sustainable approach would focus instead on organisational attitude towards safety and empowering the flight crew to assertively perform time-critical decision-making in dynamic, complex environments. This is the central point of Fig. 1 and this article.

2.1.2 The civil aviation regulator’s perspective – Federal Aviation Administration (FAA) and European Union Aviation Safety Agency (EASA)

Triggered by the family members of the Colgan Air 3407 victims, a lobbyist effort favoured the US Congress’s opportunity to sanction, followed by the former President Obama’s signature into law of the Airline Safety and Federal Aviation Administration Extension Act of 2010 [22]. Title II – Airline Safety and Pilot Training Improvement incorporate industry advancements such as the rulemaking proceedings to establish mandatory implementation of Flight Operations Quality Assurance Programs and Safety Management Systems for FAA CFR Part 121 operators. While these two programs have a profound impact on Safety as Capacity, this paper is solely interested in the training strategies as discussed herein.

The FAA Administrator chartered the First Officer Qualifications (FOQ) Aviation Rulemaking Committee (ARC) on the 16 July 2010, to develop recommendations regarding rulemaking on the flight experience and training requirements of a pilot before operating as a first officer in part 121 air carrier operations.

The FOQ ARC was composed of subject matter experts (SME) from nine organisations: the Regional Airline Association (RAA); Aviation Accreditation Board International (AABI); National Business Aviation Association (NBAA); National Air Disaster Alliance/Foundation (NADA/F); Aircraft Owners and Pilots Association (AOPA); Air Line Pilots Association, International (ALPA); The Coalition of Airline Pilots Associations (CAPA); Pilot Career Initiative (PCI); and Air Transport Association of America, Inc. (ATA).

In conclusion, the FOQ ARC members determined a knowledge and experience gap when comparing the training a pilot receives for a commercial pilot certificate to the competencies required of part 121 first officers (FAA [23]).

Section 206 of the Act discusses flight crew mentoring, professional development and leadership. The authority convenes the requirement to have air carriers establish or modify training programs to enhance flight crewmember professional development. It consists in establishing flight crewmember mentorship programs in which the carrier pairs highly experienced pilots with juniors to reinforce at a minimum the highest standards of technical performance, airmanship and professionalism to assist pilots in reaching their maximum potential as safe, seasoned and proficient flight crewmembers.

As to airmanship, Tony Kern, in his book Redefining Airmanship [24], indicates consistent aeronautical decision-making capacity as a critical element, as follows:

Airmanship is the consistent use of good judgment and well-developed skills to accomplish flight objectives. This consistency is founded on a cornerstone of uncompromising flight discipline and is developed through systematic skill acquisition and proficiency. A high state of situational awareness completes the airmanship picture and is obtained through knowledge of one’s self, aircraft, environment, team and risk.

Section 208 follows, with concerns to the Implementation of NTSB Flight Crewmember Training Recommendations. Altogether, they address mentoring, development, initial and recurrent qualifications within CFR Part 121 operators (airliners). Section 209’s interest is on the FAA Rulemaking on Training Programs.

Section 217 (Airline Transport Pilot Certification) demands FAA to conduct a rulemaking proceeding to alter the 14 CFR Part 61 regarding the issuance of ATP certificates and consider Part 135 and 121 expert’s assessment and recommendations. The proposed requirement sets the minimum of 1,500 flight hours and a sequence of associated sub-items to be satisfied to enable a pilot to operate in an airline environment. Attention is drawn to authority’s preoccupation to derive mechanisms to ensure the crewmember’s effective capability to perform in multi-crew operations, multi-engine aircraft, high-altitude, adverse weather and in a high-standardised context; all of them directly tied to pilot’s ADM capacity.

Aligned with the lessons learned with the Colgan Air flight 3407 and analogous occurrences, this sub-section discusses the regulatory impacts of the FAA AC 61-138 [23] and EASA’s ED Decision 2018/001/R [25]. The first publication alters the ATP licensing requirements within Title 14 of the Code of Federal Regulations (14 CFR) part 61, § 61, whilst the latter introduces the KSA Learning Objectives 100 within EASA’s oversight under Part FCL (Flight Crew Licensing). Both efforts are directed to provide better preparation; thus, a smoother transition from a commercial pilot license holder to the airline environment through base knowledge and practical exposition in a modern FSTD (Flight Simulation Training Device) mentored by an airline instructor.

The AC 61-138 [23] provides guidance and information to training providers and system users regarding FAA counterpart’s implementation, approval, structure and contents. These documented manifests corroborate the need to change perceived by the Civil Aviation Regulator and the Civil Aviation Accident Investigator linked to the ADM domain of Fig. 1.

In 2014, EASA identified that 50% of the newly qualified pilots holding a CPL, frozen ATPL, theoretical exams, ME/IR (Multi-Engine and Instrument Rating) and a standard MCC (Multi-Crew Cooperation course) fail at European operator initial assessments. The sample involved 3,500 candidates.

A First Officer engaged in a 14 CFR Part 121 operation (airline under FAA) requires an FAA ATP license, therefore 1,500 hours (and satisfaction of associated minima) to act as SIC. In the EASA environment, this requirement doesn’t exist, but there are other provisions.

Would this generate a safety handicap to European carriers? Once again, there is no simple answer. Different problems require different remedies. In other words, a tradeoff exists. A linear comparison is not possible because what works in North America might not be ideal for Europe and vice-versa. Table 4 depicts a comparative chart between the expected training pathways for an ATP cadet under FAA and EASA.

Table 4. Comparative chart: FAA 14 CFR Part 141 ATP vs EASA part FCL ATPL integrated training

Glossary. NAA: National Aviation Authority.

^*Variable.

^**Required by several operators, but optional to the NAA.

A note of clarification is due to register the indirect relationship between the level of proficiency in terms of flying hours or quality of the experience (proficiency versus experience). Civil Aviation Regulators determine the minimum practical experience required for a flight handling examination towards an initial license. Despite that, sole reliance on the number of flying hours has proven to be a parameter not solid enough to determine the preparedness and possession of an adequate skill set for a given flight crew prior to its operational assignment. It highlights the upcoming need to move from prescription-based to competence-based qualification.

The American regulator opted for a higher operational experience (in flying hours) prior to allowing a first officer to work in the capacity of SIC. As previously explained, this regulatory mark finds its origin at the Colgan Air 3407 spin-offs. Today’s minimum experience is 1,500 flying hours, as per Table 4.

Going through EASA’s positioning, the Agency opted for a different pathway. The European system carries a certain degree of traditionalism by stressing a profound theoretical foundation for its pilots, balancing a reduced practical flying experience requirement. Cadets opting for this route are required to complete a minimum of 850 hours of formal ground school through a CAA approved ATO. This training covers ∼15-18.000 exercises in preparation for the NAA exam sittings, in addition to the classes. ATOs are also required to confirm cadets’ readiness for the CAA exams through recorded school mock exams prior to the issuance of students’ recommendation to sit for official NAA exams.

On the practical side, a series of advanced training was added to the European cadet’s curricula, as shown in Table 4. A fine-tuning is required in an attempt to balance technical knowledge with practical experience. A European airliner can be served with a 200 hour SIC pilot, whilst an American vessel counts on a 1,500 SIC pilot. Which operation is safer?

While there is no precise answer for this question, a decisive pilot’s quality leading to a direct impact on safety has been identified and deemed special treatment. It’s the aeronautical decision-making skills in practical problem-solving.

In order to address this gap, ICAO Doc 9995 (Manual of Evidence-Based Training) [26] was used as guidance to develop the EASA KSA 100 (KSA: knowledge, skills, and attitudes) and its associated learning objectives (LO 100 01, 02, 03 and 04, depicted in Table 5) for CPL, ATPL and MPL (Multi-Crew Pilot License) applicants. This requirement is mandatory from 31 January 2022, as published on the EASA Executive Decision 2018/001/R [25]. It aims to develop the student pilot’s capability to think critically upon evaluation of variable circumstances.

Table 5. EASA KSA 100 learning objectives – knowledge, skills and attitudes

The sensitive change is the transition from passive to active learning. This is the European Civil Aviation Regulator’s perspective associated with the aeronautical decision-making domain of Fig. 1. One EASA European Industry Questionnaire received 97.3% feedback corroborating the industry’s desire to develop trainee’s KSA capabilities since the first day of training.

The ATO conducts KSA 100 assessments. They are related to all technical knowledge disciplines and preferably set in a scenario-based environment. Thus, it has a supplementary character to the fourteen written examinations conducted by the NAA.

Performance is determined by the number of times the competency behaviours have been observed during the exercise. The indicators are: how well, how often and how many. Grading ranges from one (very good) to five (very poor).

The Guidance Material for Instructor and Evaluation Training [27] published by IATA in 2021 introduces relevant information for the development of training programs by ATOs.

Learning objectives (LOs) are textual descriptions of what the student is expected to have acquired upon completion of a given training. Effectiveness and validations of LOs are measured against the practical relevance with current technologies and methodologies, applicability in context, depth of knowledge and adequacy of assessment mechanisms.

The clarity aspect of each module is relevant for all stakeholders. Satisfactory LOs delineate precisely what is expected from the student, allowing adequate preparation and reducing frustration. Transparency also serves as guidance for instructors and training providers seeking consistent delivery.

Unlike other technical knowledge subjects, KSA 100’s applicability is permeated and merged into all subjects throughout the training since day one. In practical terms, the indoctrination mindset shifts from the remembering level (being able to list, describe and recall) upwards to interpretation, evaluation, planning and creation.

According to Huitt [28], in 1948, a group of educators began working on classifying educational goals and objectives. The idea was to develop a classification system for three domains: cognitive, affective and psychomotor. In 1956, the work by Bloom, Englehart, Furst, Hill, & Krathwohl was known as Bloom’s Taxonomy of the Cognitive Domain [29]. Anderson et al. [30] refined this theory, steering towards the requirements of modern education. The EASA KSA 100 sits on the works discussed in this paragraph as graphically represented in Fig. 9.

Figure 9. Bloom’s Taxonomy of the Cognitive Domain in KSA 100 (based on Anderson et al. [30]).

In light of this, EASA has mandated the ATOs revise their training programs and expects continuous compliance regarding the incorporation of Area 100 KSA. In addition, the Agency envisions a tangible enhancement of key competencies by the pilots (capacity to analyse, evaluate and create).

By granting formal regulatory guidance, the authority forces training providers to introduce teaching mechanisms to assist cadets in improving aeronautical decision-making skills and problem-solving capabilities.

Contextualising, the National Civil Aviation Agency of Brazil (ANAC) defines competency-based training as the method focused on what the student must be able to do, rather than the old-fashion method based on what the student needs to learn (ANAC [31]).

Whilst regulatory marks have come into effect in Europe and North America, there is no published guidance for implementing mandatory MCC, APS-MCC (Airline Pilot Standards Multi-Crew Cooperation course) or KSA LOs for the commercial pilots granted initial licenses within the scope of ANAC. In addition to that, currently, there is no specific certification oversight for the MCC, JOC, and APS-MCC courses under this regulator (although an oversight exists for the ATO as a service provider).

2.2 Air France 447 – A European-case discussion based on contends from French Bureau of Enquiry and Analysis for Civil Aviation Safety

This emblematic accident within the European regulatory framework consubstantiates EASA’s interest in evidence-based training preceding the development of KSA 100. This abbreviated discussion contends lessons learned from flight 447, registration F-GZCP on the 1 June 2009 in the context of EASA KSA 100 02 – Problem-Solving & Decision-Making.

Departed from Rio de Janeiro – Galeão International Airport, Brazil (SBGL) to Paris a group of educators began – Charles de Gaulle Airport (LFPG), the occurrence claimed the lives of all onboard the Airbus A330-203, 12 crew, and 228 passengers.

The investigation concluded that a transient loss of airspeed indications in cruise flight due to a vulnerability of the pitot heads to ice crystal icing was inappropriately addressed by the flight crew, leading to a loss of control and subsequent controlled flight into the Atlantic.

In 2012, the French Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA – Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile) issued the final report to this event, which is the reliable source of information used to the present discussion (Rapport final, Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France. Vol AF 447 Rio de Janeiro – Paris [32]).

Extracted from section 1.17.1.5.4, a flight safety report done by the Air France (AF) internal commission following accidents and incidents of 2006 is discussed. After the AF accident of August 2005 in Toronto, the commission studied the airline’s occurrences between 1985 and 2006. The report identified the following topics relevant to this study:

1. i. The “situational awareness,” “decision-making,” & “crew synergy” causal factors were inseparable and constituted by far the most significant contributing factor

2. ii. Piloting abilities of long-haul and/or ab initio pilots are sometimes weak

3. iii. A loss of common sense and general aeronautical knowledge were highly noticeable

4. iv. Weaknesses in terms of representation and awareness of the situation during system failures (reality, seriousness, induced effects)

In conclusion, the commission registered that:

1. i. In analysing the main causal factors in serious events and fuel-related incidents, the commission observed that human factors (situational awareness, synergy, decision-making) were factors found in 8 out of 10 events, far ahead of those involving organisation, environment and technical factors), even if such factors should not be ignored as contributory

2. ii. Significant weaknesses in terms of training, real concrete appropriation and ability to evaluate, of these human factors, were observed in the flight crew population and indeed among all those whose actions and decisions had direct consequences on flight safety

In Section 5, “Changes Made Following the Accident,” 5.1.2 “Modifications of reference systems,” one of the two actions listed states the trend of efforts taken to improve ADM skills: “Deployment underway of a new decision-making method: the co-pilot speaks first, before the final decision of the captain (optimisation of decision-making, reinforcing the co-pilot’s responsibilities).”

Similarly, BEA criticised aspects of the simulator training the three co-pilots underwent for being technically limited and demonstrative in the pedagogical approach. In addition, the Agency rendered it inefficient to guarantee the pilot’s assimilation and maintenance of appropriate knowledge to possibly avoid, identify, and recover from challenging ADM scenarios, including those having intertwined Startle Effect components.

Furthermore, it reiterated the absence of effective flight path monitoring from both co-pilots, probably due to a lack of specific training, although it satisfied regulatory requirements. Finally, another criticism was drawn upon the training inadequacies in attracting crews’ attention to reconfiguration types and the particularities of handling escapes from flight envelope exceedances in the context of longitudinal stability, especially in complex modern airplane’s appropriateness of initial and recurrent training courses.

Consequently, the BEA documented the following recommendations:

1. i. FRAN-2012-021: that EASA introduce the surprise effect in training scenarios in order to train pilots to react to these phenomena and work under stress

2. ii. FRAN-2012-039: that EASA ensure the integration, in type rating and recurrent training programs, of exercises that take into account all of the reconfiguration laws. The objective sought is to make its recognition and understanding easier for crews, especially when dealing with the level of protection available and the possible differences in handling characteristics, including at the limits of the flight envelope

3. iii. FRAN-2012-041: that EASA define recurrent training program requirements to make sure, through practical exercises, that the theoretical knowledge, particularly on flight mechanics, is well understood

4. iv. FRAN-2012-042: that EASA review the requirements for initial, recurrent and type rating training for pilots in order to develop and maintain a capacity to manage crew resources when faced with the surprise generated by unexpected situations

5. v. That EASA review the content of check and training programs and make mandatory, in particular, the setting up of specific and regular exercises dedicated to manual aircraft handling of approach to stall and stall recovery, including at high altitude

6. vi. FRAN-2012-046: that EASA ensure the introduction into the training scenarios of the effects of surprise in order to train pilots to face these phenomena and to work in situations with a highly charged emotional factor

Ultimately, the investigations of both Air France 447 and Colgan Air 3407 indicate contributing factors converging to aeronautical decision-making training fragilities, including Startle Effect. BEA showed Startle Effect as a significant contributor to the flight path destabilisation of AF 447, as well as pointed out that the training delivered by the report’s date in this context are repetitive, evolve in well-known scenarios, and are incapable of generating the indispensable capacity to react to the unexpected or to the “fundamental surprise.”

The substantial problem in this short period of disorientation and psychomotor degradation is tied to a temporal lapse to recover, which directly impacts safety through the impairment of ADM and problem-solving capacity (safety capacity) in complex aviation tasks in modern highly automated aircraft.

2.3 Methods

The primary focus of this research is on to further understand the synergy between the two domains: aeronautical decision-making skills and organisational Safety-II implemented on the field. The study lies in the intersection of the two aforementioned domains and their potential to generate Safety as Capacity. The work is centred in providing practical guidance on corporate safety maturity assessment for a pilot with incipient operational exposure.

The research method selected is predominantly bibliographic and qualitative. In addition to the author’s practical exposure to some of the processes discussed, grounds for this study are mainly possible using the following resources:

1. 1. Safety scholar’s articles and books in the fields of human factors, error, just culture and risk management

2. 2. Field reports and aviation accident reports obtained from the NTSB

3. 3. US laws obtained from the U.S. Congress

4. 4. EU laws obtained from EASA

5. 5. Explanation notes obtained from EASA

6. 6. Regulatory framework obtained from EASA, FAA and ANAC

7. 7. Training implantation guidance obtained from IFALPA and IATA

8. 8. Aircraft information obtained from the manufacturer and NTSB

9. 9. Advisory circulars obtained from FAA

10. 10. General literature in the fields of education, cognitive domain and psychology

A historical comparison of safety, causality, culpability, just culture, retributive justice and restoration is drawn based on the safety scholar’s work.

The case study on the Colgan Air 3407 occurrence is based on the investigator’s publications and manufacturer’s information.

Regulatory implications derived from the aeronautical investigation are studied via regulatory cross-examination amongst the aforementioned regulators. Considerations on the field of education and psychology are carved mainly from articles published by reputable scholars, for instance, Huitt [28], Dekker [4,7,33], and Conklin [2]).

2.4 Results

This study began with the hypothesis that organisational safety capacity could be enhanced by developing ADM skills for cadets undergoing an ATPL course. The investigation was centred on the inter-reliability between the crew’s ADM skill and implemented Safety-II.

A breakdown in study areas is proposed to better understand this synergetic region.

A comparison is drawn between what has been historically accepted in terms of safety management in aviation and what the current industry pioneers believe in. The main takeaway is the vanguardist comprehension that the human being is a safety capacity resource and not a faulty component in the system. Therefore, attention is directed to the functional aspects of the processes and resources rather than the substandard points commonly considered.

Safety parametrisation is discussed as to the bias of measuring a resource by its absence. Beyond that, retributive justice is identified as a hazard. While restorative justice builds trust and transparency, retribution causes inhibition and system distrust.

Aiming to construct a practical analysis, the discrepancy between the work as described in the regulatory framework and its actual completion in the field is highlighted (work as imagined versus real work). The criticism here lies in the bureaucratisation of processes and a heavy focus on compliance. Practical safety is then dissociated from strict adherence to protocols.

Procedures are now understood as static resources, unable to dictate self-application. Currently, automation (let alone automation deployed in aviation) cannot provide the robustness, adaptative and innovative capabilities that skilled humans do in dynamic and complex operational environments.

Aeronautical decision-making skills and problem solving are substantial and skilful cognitive activities requiring technical and non-technical training. The 5-Factor model (FAA [5]) sheds light on the interactions leading to undesirable safety events. It reaffirms the difference between technical and soft skills expected from the pilots. While technical skills are teachable skill sets and professional knowledge, soft skills are interpersonal skills related to how people interact with one another. These two skills are intertwined and impact the assertiveness of ADM processes.

Accidents such as the Colgan Air 3407 provoked the civil aviation investigator’s interest in flight crew training objectives associated with these two fields. Through formal means, the civil aviation regulator was compelled to act upon the instructional framework for cadet pilots and propose solid guidance to address the flight crew’s capabilities in the areas of knowledge, skills and attitude.

2.5 Discussion – preliminary safety capacity assessment card

Streamlined with the EASA [25] propositions and the NTSB’s concern of 2010, this study identified a lack of knowledge associated with young cadets’ practical exposure to risk.

A dynamic, complex, high-risk operation shall not be steered based on empiricism or blind adherence to static procedures without assessing due applicability. An adequacy evaluation prior to rule application is necessary (Dekker [33]). The practical consequence of conducting an operation based on the best guess is a perfect recipe for catastrophe. KSA competencies are vital to any flight crew (Anderson et al. [30]).

The reality is that a young pilot (or instructor) will encounter countless doubts and unanswered questions when pursuing further practical experience. In the management of variability, this is an obvious hazard (Conklin [2]).

It would take great courage and character for a freshly graduated pilot, with only a few hundred hours of experience, a family to support, and 75,000 training debt, to voice concerns to a higher-ranking pilot, or director of operations, and refrain from engaging in the prescribed status quo behaviour despite being perceived as increasing risk. In many instances, that increased risk exposure might even pass unnoticed to the young crew.

Beyond what the limited experience has taught them, pilots are trained to believe in the system and its rules. Yet, given the unique nature of cause and effect, it is certain that a sequence of events will occur from time to time that is not explicitly addressed by promulgation. In some operations, the pilot might not even have someone knowledgeable to ask regarding an impending risk or uncertain procedure or organisation issue. Many fun rides take place in this gap. Some end well; others don’t.

A conflict of interest is inevitable. Individually, the pilot’s primary concern should be the safe conduction of the operations. In other words, keeping himself, the crew, and consequentially the passengers and people on the ground alive. On the other hand, a commercial enterprise has profitability at its heart. The commonality lies in the interest of a successful operation, this being the absence of injuries, loss of life and material damage.

The threat is: Ominous reality is that successful operation doesn’t always coincide with properly managed risk exposure. For example, a pilot might choose receive fuel that is only enough for the flight from departure to destination and another five extra minutes of reserve. Despite being a violation, it’s common practice for that operator. All colleagues have been doing the same procedure for years, and never an associated catastrophe happened. Veteran pilots ensure that new pilots adhere to the common practice. The company owner is also satisfied: Fuel consumption is lower than the competitors because dead weight (contingency fuel) is reduced. All pilots regard this as standard (albeit unwritten) procedure until disaster strikes.

In accordance with Conklin [2], accidents happen in the management of variability. However, practical operations significantly dissociate from approved manuals, procedures, best industry practices and even the law. This asymmetry leads to unsafe exposure. The herein proposition is an independent tool to assist civilian pilots in understanding the actual risks in the practical environment of operations.

This preliminary assessment card (Table 6) is neither a replacement nor a substitute for pre-flight risk assessments, manufacturer directives, regulatory guidance, quality tools or any approved materials. Instead, this aid has the sole purpose of stimulating the pilot to regard routine events that have potential implications in risk exposure that might lie outside of common interest or knowledge. It is therefore offered as a surprise reduction informational asset.

Table 6. Preliminary organizational safety capacity assessment card

2.6 Constraints

Organisational safety capacity is a promising area of academic study that could integrate the various disciplines pertaining to safety (i.e., psychology, economics, statistics). Availability of material related to cadet training was limited for this project. Several reputable industry references stress the airline’s needs in terms of human resources and relationships. However, only a fraction of those publications considers the gap to bridge between the non-airline pilot with a diverse background in their transition to a modern automated flight deck, highly standardised operation and its associated challenges. Brugnara [34] and Brugnara et al. [35] are two preeminent noteworthy publications, basilar contributions to consolidate the instant article.

3.0 Final considerations

Research question: Is it possible to enhance Safety as Capacity by developing ADM skills for cadets undergoing ATPL indoctrination courses?

Though retrospective justice has offered limited help in preventing new undesirable aeronautical occurrences, restoration favours a system based on trust. Within the scope of operational safety, assigning culpability to “transgressors” was found to be inefficient.

Humans are integral in the aviation industry, and deviating from the “script” is simply an attribute of human behaviour. The players involved in operational mishaps had also safely executed their jobs many times.

Organisational Safety-II is heavily dependent on the management-led culture. Better decision-making and more effective problem-solving skills have a direct impact on Safety as Capacity. An adaptive environment, where workers are treated fairly, with transparency, and rules are molded towards the actual job on the field, is conducive to more assertive decisions and improvement. Beyond that, less bureaucracy increases people’s consciousness of what is important and improves satisfaction in the workplace.

On the other hand, the cognitive capabilities required to complete successful decision-making processes have to be exercised, like any other skill. Regulators began to address this need by focusing on pilots’ knowledge, skills and attitudes right from the first day of flight school.

3.1 Response to the research question

Yes. It is possible to enhance Safety as Capacity by the synergetic inter-reliability between the implemented organisational Safety-II domain and the systemic instructional stimulation of Area KSA, which is oriented to strengthen ADM skills. As structural domains, both are required to be solid enough to sustain safety at the desired level of capacity.

3.2 Further research

Further research and experimentation are required to enhance the development of instructional mechanisms to empower low-experienced flight crew with the desired knowledge, skills and attitudes to conduct an independent and realistic risk assessment. Such studies could investigate forms to increase situational awareness and reduce non-deliberate unnecessary risk exposure in real-life operations. Clarification is demanded to separate Safety as Capacity beyond the static and per times unreasonableness rigidity of manuals and approximate a final outcome to critical thinking.

Similarly, the eminent problem in Startle Effect training must be integrated into the aeronautical educational system and industry to generate the essential capacity for pilots to react to the fundamental surprise (to the unexpected).

3.3 Main takeaway

Even though civilian cadets may choose a multitude of career pathways, real-life operations frequently differ from the statutory terms outside the airline environment. Admitting carriers tend to be closely aligned with the industry’s best practices, alignment is not always the case.

Unnecessary loss of life is irrefutable by the statistics. It’s the industry’s and Civil Aviation Authority’s moral obligation as a whole to ensure that civilian pilots are ready to independently identify imminent organisational hazards that can jeopardise life from the first day on the job.

It is no longer acceptable to approve manuals and, based on that, consider the job done. Real work differs from written publications. There are air operators worldwide lacking financial resources, adequate structure, appropriate experience, quality maintenance and definitely functional safety and quality guidance. Inexperienced and seasoned pilots who have paid the price for their organisation’s unsafe culture with their lives have also left us signposts pointing towards a better way. It’s time for the industry to act and pilots to learn when and why to say: No.