Resilience is defined as “the intrinsic ability of a system to adjust its functioning prior to, during, or following changes and disturbances, so that it can sustain required operations under both expected and unexpected conditions” (Woods & Hollnagel, 2006, p. xxxvi). If there was ever an industry that has demonstrated this ability, it is the aviation industry. As has been evident in recent events ranging from the 737 MAX debacle to the COVID-19 pandemic, the aviation industry is incredibly sensitive to a broad array of disturbances ranging from those that are aviation-specific such as accidents that wreak havoc on consumer perceptions, to economic and environmental circumstances that can bring air travel to a screeching halt. The industry has continually demonstrated the ability to adjust and sustain operations after unexpected events, such as September 11 (Blunk et al., 2006) and the major recession in 2008 (Franke & John, 2011). Although less obvious, there is also evidence that aviation has proactively adjusted its functioning prior to disturbances to maintain safe and effective operations. The aviation industry has improved both reliability and safety in the midst of increasing complexity of the aircraft, economic challenges, and aviation systems that are dependent on a range of different organizations to succeed (Høyland & Aase, 2008). It has been proposed that resilience is a characteristic of system performance, not the system itself (Hollnagel, 2011), and therefore it is fitting to examine the aspects of aviation that enable it to demonstrate resilient performance. This chapter presents a discussion of resilient performance in aviation, including what resilient performance looks like in aviation, how it is currently achieved, and methods to further advance resilient performance in the future.

1 What is Resilient Performance in Aviation?

At the heart of aviation’s ability to demonstrate resilient performance is the performers on which the industry relies most heavily: aircraft pilots. Pilots are considered the fundamental safety component when aircraft systems do not operate as expected, and the assumption is that pilots will be able to anticipate and recover after encountering a problem for which the aircraft systems were not designed (NTSB, 2019). Prior to the advent of computers and automation, the type of unexpected events that pilots encountered were often the result of gaps in our knowledge of the physical world, such as the unknown effects of supersonic flow over a wing (NASA, 2008) or some aspect of weather such as a microburst event (Caracena et al., 1986), or limitations of our ability to perceive and comprehend relevant cues from the environment (e.g., the horizon). The increase in automation has fundamentally changed the piloting task. Once a correspondence task, in which pilots experienced cues and determined how they correspond to previous experiences in order to gain situational awareness, the piloting task is now a coherence task, in which pilots consume information provided by automated systems to gain this understanding (Mosier & Fischer, 2010). This has resulted in a change in the type of unexpected events for which pilots must anticipate and be prepared to respond. For example, the Boeing 737 MAX accidents in which flawed data from an angle of attack sensor led the flight control computers to determine that the aircraft was at a dangerously high angle, resulted in the aircraft computers responding in a way that was unexpected and for which the pilots had not been trained (FAA, 2019). There are, however, unexpected events such as these, from which pilots managed to recover. For example, in 2012, an EVA Air Airbus A330 experienced an un-commanded pitch down due to iced-over angle of attack vanes. The pilot recovered “with only seconds to spare” by turning off all three air data reference systems, a procedure that was not trained and had never been performed before by anyone (Lambregts, 2013, p. 1368). What is it that differentiated the outcome of these events? It was the pilots’ ability to leverage their experience and problem-solve, in order to respond to, and recover from, an unexpected event.

Hale and Heijer (2006) define resilience as the ability not only to recover from an adverse event, but also the ability to anticipate and adjust in order to prevent adverse events. With respect to aviation, this hinges on pilots having the knowledge, skills, abilities, and resources to anticipate unexpected events such as those discussed previously, so that they can make an effective decision regarding how to prevent and/or respond. These are often events for which they have not received training or procedures. It also requires that the systems, and team members available to support pilots in the larger aviation system, are able to anticipate and respond to the changing needs of the pilots. Carroll et al. (2012) propose a model for resilient decision making that is both in-line with Hale and Heijer’s (2006) definition and can be adapted to shed light on resilient performance in aviation. Carroll et al. propose that resilience, what we refer to herein as resilient performance, consists of two components: (a) an initial phase characterized by the need to adapt performance to prevent or minimize the impact of the adverse event, and (b) a second phase characterized by recovery from the adverse event. The first phase, in which there is the need to adapt, determines the level of performance decrements from which the performer must recover in the second phase (See Fig. 1). When individuals are highly adaptable and effectively adjust performance, performance decrements are minimized and the performer has less ground to make up in the recovery phase, if any at all. When performers successfully anticipate an unexpected event and effectively adjust performance, they are able to maintain performance and sustain required operations. Carroll et al.’s model is based on the pathway model of human resilience and findings that human response to a significantly stressful event can range from succumbing to the stressor and performance falling apart, to surviving with degraded performance, to fully recovering, or even thriving (Carver, 1998; Bananno & Mancini, 2012). This model served as a basis for development of a resilience classification algorithm to quantify individual resilience to acute stress, and researchers were able to identify which trajectory a performer was most likely to follow based on baseline physiological and self-report measures (Winslow et al., 2015).

Fig. 1
figure 1

Model of resilient performance pathways (Adapted from Carroll et al., 2012)

Full size image

Although different in many ways, there is similarity in an individual performer’s response to an acute stressor and an unexpected event. In both cases, the more adaptable an individual is, and the better able the individual is to anticipate, cope, and recover, the more likely their performance trajectory is to realign with baseline levels of performance and state. This is the goal of a system in Woods and Hollnagel’s (2006) definition: “to sustain required operations under both expected and unexpected conditions” (p. xxxvi). This model also incorporates a trajectory that aligns with a later definition of resilient performance that incorporates adjusting, not only to changes and disturbances, but also to opportunities (Hollnagel, 2015). In this trajectory, a performer or system capitalizes on an unexpected opportunity to boost or advance performance levels.

What influences which trajectory will eventually result? Hollnagel (2011) proposes that there are four key processes that enable resilient performance and they include the ability to: (a) monitor information relevant to system performance and the surrounding environment, (b) anticipate potential disruptions, demands and opportunities, (c) respond to disturbances and opportunities by adjusting performance, and (d) learn how future performance should be adjusted based on observations and experiences. These processes, and the degree to which a performer or system is set up to accomplish these processes, will differentiate whether a performer can maintain system functioning, recover or thrive, or succumb to the disturbance resulting in performance suffering. An example of this model playing out in an aviation context can be seen in the previous example of the EVA Airbus A330 incident. The A330 has fly-by-wire flight controls that feature a system utilizing the angle of attack sensors that will automatically prevent an aerodynamic stall by lowering the aircraft nose. In this incident, icing led to the angle of attack sensors incorrectly indicating a stall and the automatic system continuing to lower the nose without improvement. The pilots quickly adapted to the situation, by shutting down all three air data reference computers, which forced the computers to change to a degraded mode that deactivated the stall prevention system (Kaminski-Morrow, 2019). This was not a process for which the pilots had a procedure or training. The pilots, based on their understanding of the aircraft systems, and the monitoring of the system performance and relevant environmental cues (e.g., out the window view) successfully determined that the stall indication was false. This allowed them to respond to the disturbance by adjusting their performance. The industry, having learned from this, added the procedure to required training for the A330.

2 How is Resilient Performance Currently Developed in Aviation?

Although it has been a trial by fire, over the last several decades, the aviation industry has built up a hefty safety management system designed to facilitate resilient performance. The key to this has been the utilization of data-driven approaches that allow the industry to monitor unexpected events and disturbances, and trends in performance that allow the industry to anticipate future disturbances. The industry has been able to learn from this data in order to shape pilot training and procedures in very effective ways, in order to prepare pilots to know how to respond to and anticipate unexpected events and maintain effective performance.

The aviation industry collects vast amounts of data related to flight performance and safety, from a range of sources that are both reactive in nature (e.g., accident analyses, safety reporting systems), and proactive in nature (e.g., system data and performance monitoring programs; Congress, 1988). The first large-scale attempt to capture this data was with the Aviation Safety Reporting System (ASRS), developed by NASA under the leadership of Charles Billings (Billings et al., 1976). ASRS allows pilots to voluntarily report incidents or safety concerns, while being protected against any punitive action associated with the event. The ASRS reports are available via a searchable database, which researchers and safety professionals can utilize to identify situations in which latent hazards exist and/or near-accidents have occurred. Similar internal company-specific flight safety reporting programs, such as the Aviation Safety Action Program (ASAP), are also widely utilized within aviation to capture additional safety data that can be accessed and utilized in analysis (Cusick et al., 2017). The Federal Aviation Administration’s (FAA) Aircraft and Flight Operations Quality Assurance (FOQA) program captures quantitative data directly from the aircraft sensors such as airspeeds, altitudes, descent rates, accelerations, headings, and flight control positions (FAA, 2007). FOQA allows airlines to identify trends and safety events not otherwise reported. Additionally, the Line Oriented Safety Audit (LOSA) program involves the use of trained observers who ride in the cockpit and record their observations during flights to identify trends in how pilots apply procedures on the flight deck and areas in which deviations occur (Cusick et al., 2017).

This multifaceted approach to data monitoring provides the aviation industry with an enormous amount of rich data about the types of events, expected and unexpected, for which performers need to be prepared to anticipate and equipped to respond. Information from these databases is extracted and analyzed in a range of different ways to identify risks or trends such as pilots extending flaps at too high of a speed, risky, or ineffective approaches, or unsafe aircraft-loading policies (Cusick et al., 2017; FAA, 2018). Based on these trends, aircraft manufacturers, regulatory agencies, and airlines can work to put mitigations in place, such as the redesign of systems, policies, procedures, and training, to prepare aviation performers to adjust functioning in anticipation of, or in response to, future disturbances (International Civil Aviation Organization, 2013). For example, not long after implementing an ASAP program, one major U.S. airline discovered a large number of reported altitude deviations due to communication procedures, and after training the pilots on a new communication procedure, the problem disappeared (National Business Aviation Association, 2019). In another example, a problem in the airport approach procedure for the Orlando International Airport was forcing pilots to be too high on approach, resulting in unstable approaches and long landings; the crossing altitude was changed for part of the arrival alleviating the problem (FAA, 2007). In another example, ASAP reports revealed a risk of a possible runway overrun during takeoff at San Francisco International Airport, and a Safety Alert for Operators was issued to mitigate the risk, resulting in airlines modifying their training and procedures (National Business Aviation Association, 2019).

Monitoring relevant information sources and learning both from unexpected events and general performance trends are powerful tools that enable resilient performance. Within the aviation industry, resilient performance has been achieved by developing programs and processes that facilitate: (a) the monitoring of relevant events and data, (b) the analysis of this data in order to learn from the events and data, (c) review of procedures and policies related to events and performance trends in order to anticipate future issues, and (d) the adapting of training and safety programs and policies to prepare performers to respond to future events and states (International Air Transport Association, 2013).

3 Advancing Resilient Performance in Aviation

While this data-driven approach has proven successful at facilitating resilient performance in aviation, there is always an opportunity for advancement. The key to achieving this is moving beyond the data. There is a need to not only update training and procedures to prepare pilots for the unexpected events that can now be anticipated due to past experiences. We must develop the ability of our pilots to have the foresight and flexibility to adjust performance in the face of a truly unanticipated event, for which there is no training, procedures, or any expectation; and to be able to anticipate the potential for such an event and adapt to prevent occurrence. We need to integrate, into the aviation industry’s safety management approach, training and procedures that specifically enable an aviator’s ability to anticipate, adapt, and recover from a range of completely unexpected events. Leveraging Woods and Hollnagel’s (2006) definition of resilience as a goal, and Carroll et al.’s (2012) model of resilience as a framework, there is an opportunity to reinforce the abilities necessary to achieve resilient performance in pilots, and the aviation industry at large. Here, we provide a few ways in which such an approach could be implemented.

With respect to the first phase in Carroll et al.’s model in which performers must adapt, there is an opportunity to bolster pilots’ ability to utilize inductive reasoning by incorporating training that focuses more heavily on problem-solving within ill-defined events. Currently, pilot training is primarily focused on procedures – normal procedures, emergencies procedures, checklists, and protocols (Rapoport & Malmquist, 2019). Procedures are key for ensuring safe and consistent operations across a broad range of situations. Thus, pilot training is heavily focused on honing pilot performance within the rule-based and skill-based modes of Rasmussen’s model of operator performance (Rasmussen, 1983). To achieve this, pilots repeatedly practice the application of procedures, or rules, and the performance of psychomotor skills necessary to develop incredibly reliable performance under normal, and abnormal but predicable (e.g., emergency), performance conditions. As a result, pilots develop keen skills in detecting, troubleshooting and responding to predictable situations. However, resilient performance maintains safe operations not only under nominal and standard, off-nominal conditions, but also when something totally unpredictable occurs. This situation places the performer in a knowledge-based mode of performance which requires a high degree of problem-solving and inductive-reasoning skills. Current pilot training does not focus on this ill-defined and unbounded performance domain. While some pilots have a natural aptitude and seek to develop these skills on their own accord, there is currently not a standard training regime aimed at ensuring all pilots are proficient in this performance mode (Rapoport & Malmquist, 2019). A key part of this is ensuring pilots have accurate mental models of their systems and how situations unfold (Rasmussen, 1983). With the complex automation in modern aircraft, pilots often do not possess a comprehensive understanding of how these systems work, and therefore have limited ability to anticipate unexpected events and disturbances. For example, a lack of understanding about the various flight control system modes, and how these influence the relationship between a pilot input and a control surface or throttle movement, were causal in multiple recent aircraft accidents, including Air France 447, American Airlines 587, and Asiana Airlines 214 (Rapoport & Malmquist, 2019). In order for pilots to know what system and environmental information to monitor, and how to anticipate and respond to unexpected system disturbances, it is necessary for pilots to have a thorough understanding of how their systems work. Further, pilots must also be given the opportunity to practice monitoring, anticipating, responding to, and learning from completely unexpected events.

One way to achieve this is to incorporate training scenarios that center around low-probability system failures/events, for which there is not a procedure or checklist. Currently, training focuses on failures with the highest probability of occurrence, and emergency/abnormal events such as engine failures that have the highest levels of risk associated. Pilots learn the application of checklists and procedures in these situations and practice them in the simulator to hone associated skills. Such skills are often trained to the point of automaticity, and pilots become quite good at operating in this skill-based mode. If a broad range of low probability failures could be integrated into the training regime, pilots would be provided an opportunity to practice the four abilities that Hollnagel (2011) proposes are necessary for resilient performance. Specifically, pilots could be given the opportunity to (a) monitor relevant system data and environmental cues, in order to detect unexpected anomalies in this data, (b) anticipate what this could mean for operational functioning, (c) respond to unexpected events by utilizing inductive reasoning and problem-solving skills to determine how to adjust performance to cope with the failure, and (d) learn from these events via a facilitated debrief. These training scenarios could be administered in a high-fidelity simulator to support the entire problem-solving process, including detection of relevant multimodal cues, recognition of what they mean for system performance, and the inductive reasoning which must ensue to make sense of the current situation and path forward. However, the later stages of recognition and problem-solving could be easily practiced in less-expensive, lower fidelity simulations such as Tactical Decision Games (TDGs).

TDGs are a technique utilized by the military to rapidly and inexpensively expose trainees to numerous situations (Crichton et al., 2000). They provide the opportunity to make decisions and receive feedback on the course of action chosen, in order to build up the experience base from which they can draw during actual performance. Such a technique could be leveraged to increase a pilot’s experience base, and to provide opportunities to practice inductive reasoning and problem-solving. For example, a TDG scenario for pilots might include a verbal description of an en route situation, followed by a verbal description and/or graphical representation via a handout or PowerPoint slide representing a sudden change in the aircraft state as indicated by the flight deck displays, instruments, and other multimodal cues. The pilot(s) could be given time to ponder the situation, determine what failure(s) have most likely occurred, and select the best course of action. An instructor could then facilitate a structured discussion regarding the inductive reasoning process that the pilot(s) utilized and provide guidance on honing this process. Such an approach could be utilized in a group setting in which pilots are given the opportunity to problem-solve individually, and then participate in a group discussion. This technique could continue with additional scenarios, in which pilots could be given decreasing amounts of time to respond, with the goal of increasing the efficiency of the inductive reasoning processes they perform. If pilots can be trained to more effectively adapt to an unexpected situation or failure, then performance decrements might be minimized, thereby minimizing the recovery required to regain baseline performance.

With respect to bolstering the recovery phase, there is an opportunity to prepare pilots to respond more effectively under stress. Pilots must be trained to manage their internal systems, in addition to the external system of which they are a part. This includes monitoring, recognizing, responding to, and recovering from the negative psychological, physiological, and performance impacts resulting from unanticipated events. Unanticipated events often cause a stress response within a performer and although individual differences exist, research has shown clear patterns regarding the impact that stress has on a performer’s psychological, psychological, and decision-making response (McNeil & Morgan, 2010). This is seen in landmark accidents such as United 173 in which the pilots let the aircraft run out of fuel while troubleshooting a landing gear problem (NTSB, 1978). Such attentional narrowing is known to result as a response to stress (Staal, 2004), and pilots must be trained to anticipate and compensate for these decrements. The military has recognized the need to prepare individuals to perform under stress, and has responded by developing targeted stress training. For example, the Infantry Immersion Trainer provides warfighters an opportunity to make decisions under highly realistic stressors prior to deployment (Muller et al., 2008). By providing performers the opportunity to experience a realistic stress response, performers can learn to recognize what happens to their physiology and decision processes and develop mechanisms for coping with these challenges. The aviation industry has not integrated this approach into their training regime. Although pilots practice performing under time constraints and the moderate stress of a challenging check ride, they do not currently have the opportunity to respond to a critical and completely novel situation on the flight deck while their heart is pounding and their chest is tight. Many pilots will be required to perform under these conditions at some point in their career. As such, it is critical that a pilot is able to effectively maintain operational functioning under these conditions.

One way to achieve this is by incorporating training approaches that induce significant levels of stress and require pilots to problem-solve and make decisions under these circumstances. There are studies which have shown the efficacy of stress training techniques in pilot training (McClernon et al., 2011); however, it is challenging to induce high levels of stress in a training setting. The use of stress induction techniques such as social evaluative stressors has been shown to result in significant stress response during simulation training exercises, with participants from relevant samples such as the military (Carroll et al., 2014). Specifically, Carroll et al. (2014) designed a military analogue to the Trier Social Stress Test, a highly validated stress induction technique that incorporates elements of anticipation, public speaking, and mental arithmetic (Kirschbaum et al., 1993). These three elements were operationalized based on current military training practices, making it feasible to integrate into current military training approaches. Such an approach could be implemented within pilot training, utilizing some portion of their current simulation training curriculum. For example, in the anticipation phase, pilots could be given a very limited amount of time to prepare for a flight with much more complex requirements than they are accustomed. The pilots could then be asked to brief their plan to instructor pilot(s) who will be assessing the plan, and who maintain flat affect, eye contact, and put their plan under fire. Pilots could then execute the simulation scenarios for which they have planned, encountering unpredictable and novel events for which they have no procedure or training. This could be coupled with training that provides pilots knowledge of stress impacts and coping strategies that can be utilized to mitigate the effects of stress. Such an approach could help train pilots to both recognize their stress response and learn to cope with this response in order to maintain performance. This could result in pilots being better able to recover, psychologically, physically, and with respect to performance, from system disturbances that are experienced as a result of a completely unexpected event or failure.

4 Conclusion

This chapter illustrates the great strides that the aviation industry has taken to develop resilient performers. By utilizing data-driven approaches to learn from past events, the aviation industry has continually learned from past events and adjusted training and procedures to ensure that pilots can adapt to, and recover from, a range of unexpected events and disturbances. The aviation industry has the opportunity to further advance the resilient performance of pilots by incorporating training approaches aimed to bolster a pilot’s ability to problem-solve in the face of completely unexpected events, and to cope with the impact that a truly stressful situation has on their performance and state. Such approaches provide the opportunity to further advance resilient performance in aviation, leading to increased safety in the skies.