DANA SCHULZE has been the director of the NTSB’s Office of Aviation Safety since July 2019. Prior to that, she served concurrently as the office’s acting director from November 2018 and as deputy director of the office since 2012. Schulze has been with the NTSB since 2002, when she joined the organization as an aircraft system safety engineer. During her time at the NTSB she also has served as a group chairman and investigator on several major domestic and international airline accident investigations. Prior to joining the NTSB, Schulze worked in staff engineering and engineering management positions in the commercial aerospace industry in roles related to design, system safety, reliability and quality.
On Twitter @NTSB
Q: What proactive steps can business aircraft operators take to enhance safety?
Even though business aviation is diverse – in terms of the nature of its operations, equipment types and other factors – all aircraft operators can ensure that some key actions are taken to help enhance safety, and the NTSB has made a number of applicable safety recommendations.
For example, the disciplined use of standard operating procedures (SOPs) is vital. Our investigations have repeatedly demonstrated that the lack of established SOPs, or the failure of pilots to consistently follow those that are in place, can quickly erode the safety margin in any operation and potentially lead to an accident. Heeding SOPs can help standardize crew coordination and communication and also protect against complacency and drift, thereby optimizing human performance.
The NTSB has recommended that aircraft operators should establish SOPs and ensure that their pilots adhere to them.
Operators also should adopt best practices for checklist execution, including the use of the challenge-verification-response format whenever possible.
In addition, pilots should use the same checklists in everyday operations as are used during training for normal, abnormal and emergency conditions.
There’s also an increasing recognition among business aircraft operators of the benefits of having a structured flight-data monitoring (FDM) program to provide greater insight into their operations.
“Our investigations have repeatedly demonstrated that the lack of SOPs or the failure of pilots to consistently follow those that are in place can quickly erode the safety margin in any operation.”
We’ve heard from operators, big and small, just how valuable an FDM program can be to ensure that SOPs are followed and that the checklists and training used to facilitate their implementation are truly effective.
In fact, perhaps one of the best steps an operator can take to enhance safety is to voluntarily implement a safety management system (SMS). A structured, deliberate focus on identifying hazards and proactively managing or eliminating them is the ultimate in proactive safety improvement.
Q: What lessons learned from manned aircraft accidents do you think will be applicable to unmanned aircraft systems (UAS) and urban air mobility (UAM) vehicles?
The NTSB has only investigated a few UAS accidents and incidents, beginning with a 2006 accident involving a Predator B UAS operated by U.S. Customs and Border Protection (CBP) near Nogales, AZ.
Although we don’t yet have a significant body of UAS-related findings to draw more systematic and broad conclusions, the NTSB has identified some lessons learned related to human-machine interface design, pilot training and overall safety risk management.
In the Nogales case, the NTSB found that the control console design, which involved dual functions assigned to a single lever, could cause an unsafe condition resulting from an unintended engine shutdown if proper procedures were not followed during an abnormal event. As a result, the NTSB recommended that CBP redesign the control interface.
Additionally, the NTSB also found that a comprehensive system safety assessment of the Predator had not been conducted prior to placing it into operation. As a result, the NTSB found that hazards arising from equipment malfunctions may not have been thoroughly evaluated and appropriate safety requirements and controls put in place. We recommended that CBP develop a safety plan to ensure that relevant hazards were identified and necessary actions taken to mitigate the corresponding safety risks.
The UAS market has dramatically evolved since the Nogales accident. Although current small UAS have not been involved in any serious accidents, we have had a number of incidents of reported fly-aways, the majority of which relate to pilot misunderstanding of automation modes, and a small number of midair collisions, all related to pilot procedures and actions. The main issues with automation in this class of drones largely relate to the pilot’s knowledge and the manufacturer’s documentation of the software and features.
In a related matter, the findings from the NTSB’s investigation of the Asiana Airlines Flight 214 accident in 2013 at San Francisco International Airport provide relevant lessons learned for any system that involves automation.
“Safety risk management, and safety assurance – two important and interactive components of an SMS – will also be critical to ensure safety as UAM concepts mature and vehicles deploy.”
In the Asiana accident, the NTSB found that, as a result of complexities in the Boeing 777 automatic flight control system and inadequacies in related training and documentation, the pilot flying the aircraft had an inaccurate understanding of how the autopilot, flight director system and autothrottle interacted to control airspeed, which led to his inadvertent deactivation of automatic airspeed control.
Similarly, in a recent UAS-involved incident, the NTSB found that the pilot did not fully understand how a particular command input would affect the UAS in flight. The pilot’s incorrect control inputs were due to insufficient knowledge of the flight manual procedures. So, here too, training to gain a full understanding of the human-machine interface will be key to UAS accident and incident avoidance.
So far, the NTSB has completed three UAM accident investigations. In all three cases, the UAMs involved were test platforms, and findings, not surprisingly, relate to technology growing pains.
As automation levels continue to increase in these types of vehicles and operations, the areas noted above are still likely to be important to ensuring that the aircraft designs safely accommodates failures (machine or human) and that procedures for recovery – whether involving full autonomy or a pilot-in-loop – need to be sufficient to ensure the safety of passengers and other aircraft.
Finally, safety risk management and safety assurance – two important and interactive components of an SMS – will also be critical to ensure safety as UAM concepts mature and vehicles deploy.
Q: How will autonomous operations of aircraft change the safety landscape?
That’s a good question. The industry is well on its way to figuring out how to achieve full flight autonomy. At some stage, the aeronautical decision-making that we are used to, while still in play, will be removed in place – and even in time – from the event at hand.
But the human will likely leave an indelible imprint. The NTSB very well may be investigating programming decisions made away from the accident itself, but no less traceable to the human.
So, industry will still need to deeply appreciate the capabilities and limitations of both the vehicle and people, while ensuring that both are optimized for the intended operating environment.
A solid systems safety approach in UAM vehicle design, along with robust SMS practices, should help ensure that autonomous operations can be deployed in a manner that doesn’t degrade or compromise safety.
International Business Aviation Council Ltd.