# Presentation: 150933

## The Limits of Expertise:The Misunderstood Role of Pilot Error in Airline Accidents

**Key Dismukes**
- NASA Ames Research Center
**Ben Berman and Loukia Loukopoulos**
- San Jose State University Foundation/NASA Ames Research Center
**ASPA/ICAO Regional Seminar**
- 8-9 March 2005

**Notes:**
	I am going to talk about a NASA study that Ben Berman, Loukia Loukopoulos, and I recently competed.  We are in the final stages of writing a book based on this study.  It’s a rather large book, so all I can do today is give you the highlights.

	The extraordinary level of safety in airline operations is one of modern industry’s great success stories.  But you know, maintaining this very high level of safety is like flying an unstable airplane—if you let your attention wander even briefly it will get away from you.

## Most Airline Accidents Attributed to Crew Error

- What does this mean?
- Why do highly skilled pilots make fatal errors?
- How should we think about the role of errors in accidents?
- Draw upon cognitive science research on skilled performance of human operators

**Notes:**
As you all know, most aviation accidents are attributed to crew error, but what does this mean?  Why do highly skilled professional pilots make errors with consequences sometimes fatal to themselves as well as to their passengers?  How should we think of the role of these errors in accidents when we seek to prevent future accidents?  We are attempting to address these questions in the light of what scientists are learning about the nature of skilled performance of humans performing complex tasks.

## Approach

- Reviewed NTSB reports of the 19 U.S. airline accidents between 1991-2000 attributed primarily to crew error
- Asked:  Why might any airline crew in situation of accident crew – knowing only what they knew – be vulnerable?
- Can never know with certainty why accident crew made specific errors but can determine why the population of pilots is vulnerable
- Considers variability of expert performance as function of interplay of multiple factors

**Notes:**
In this study we reviewed the 19 major U.S. airline accidents between 1991 and 2000 in which the NTSB found crew errors to be among the probable causes.  We used the NTSB reports as the starting point and the raw material for our own analysis.  We did not second guess the NTSB as to what errors were made or as to how these errors contributed to the accident.  Rather, we worked our way step by step through the events of the accident flight, and at each step we asked this question:  Why might any highly experienced airline crew in the situation of the accident crew and knowing only what the accident crew knew at that moment have been vulnerable to responding in much the same way the accident crew responded at that step of the flight? 
We can never know with certainty why an accident crew made the errors they did, but we can determine why a large population of pilots would be vulnerable statistically to making similar errors.  This approach allows us to take into account the variability of expert performance, which is driven by  the complex interplay of multiple factors.  

## Hindsight Bias

- Knowing the outcome of an accident flight reveals what crew should have done differently
- Accident crew does not know the outcome
- They respond to situation as they perceive it at the moment
- Principle of “local rationality”: experts do what seems reasonable, given what they know at the moment and the limits of human information processing
- Errors are not de facto evidence of lack of skill or lack of conscientiousness

**Notes:**
Asking the question this way changes how we think about pilot error and how we think about the causes of accidents. When investigating and analyzing aviation accidents it is very easy to fall into what cognitive scientists call hindsight bias.  Knowing the outcome of an accident, it is easy to identify things the crew could have done differently that would have averted the accident.  But of course the accident crew does not know the outcome their flights in advance; as far as they can tell, up until the moment things start to go wrong, they are conducting flights as routine as thousands they have flown before.  
An important principle here is local rationality.  Experts, such as pilots, typically do what seems reasonable at the time, given their imperfect understanding of the circumstances.  This does not mean that expert pilots never fail to be conscientious, but we suggest that errors are not de facto evidence of lack of conscientiousness, and that the burden of proof falls on anyone claiming that a pilot was not conscientious.

## Two Fallacies About Human Error

- _Myth_:	Experts who make errors performing a 		familiar task reveal lack of skill, vigilance, 	or conscientiousness
- 		_Fact_: Skill, vigilance, and 				conscientiousness are essential but not 		sufficient to prevent error
- _Myth_: If experts can normally perform a task 		without difficulty, they should always be 		able to perform that task correctly
- 		_Fact_: Experts periodically make errors as 	consequence of subtle variations in task 	demands, information available, and 		cognitive processing

**Notes:**
We must reject two common fallacies about human error. Many people assume that if an expert in some domain (aviation, medicine, or any other) makes an error, this is evidence of lack of skill, vigilance, or conscientiousness.  This assumption is both simplistic and wrong Skill, vigilance, and conscientiousness are of course essential for safe, effective performance but are not sufficient. A particularly problematic misconception about the nature of skilled human performance is that, if experts can normally perform some task without difficulty, then they should always be able to perform that task correctly.  But in fact experts in all domains from time to time make inadvertent errors at tasks they normally perform without difficulty.  This is the consequence of the interaction of subtle variations in task demands, incomplete information available to the expert performing the task, and the inherent nature of the cognitive processes that enable skilled performance.

## Human cognition

**of situation & tasks **
**being performed**

**Training, experience,**
** ****& personal goals**

**Social/Organizational**
**Influences**
**  ****Formal procedures &**
**   ****policies**
**  ****Explicit goals & rewards**
**  ****Implicit goals & rewards**
** ****Actual “norms” for line operations**

**Human cognition**
**characteristics & limitations**

**Crew responses to situation**

**Notes:**
Fortunately scientists have now learned a fair amount about human cognitive processes and the conditions that shape the form and probabilities of errors.  Both correct performance and errors are largely shaped by four groups of factors:
1) The immediate demands of the situation and the tasks being performed,
2) The training and experience of the crew
3) Social and organizational factors include not just formal procedures, policies, and explicit goals of the organization , but also implicit goals, and sometimes these are in conflict.  Also the norms for how things are actually done on the line, and these norms may or may not be the same as what is in the FOM.
4)  At the heart of all this are the characteristics and limitations of human cognitive processes.  

All of these factors interact, and it is the way they interact that produces pilot error.

## A Truism

- No one thing “causes” accidents
- Confluence of multiple events, actions taken or not taken, and environmental factors

**Notes:**
One thing is immediately obvious about almost all human factors accidents we have looked at over the years:  No one thing “caused” the accident; rather accidents typically occur from the confluence of multiple events, actions taken or not taken by individuals, and the environment in which those individuals operate.  Although this truism is recognized by the industry we need to look more deeply at the implications of this fact.

## Confluence of Factors in a CFIT Accident

**Non-precision **
**approach ≥ 250 foot **
**     ****terrain clearance**

**Are most pilots **
**aware of this?**

**Weather conditions**

**Airline’s use of **
**QFE altimetry**

**Strong crosswind**

**Autopilot would **
**not hold**

**PF selected **
**Heading Select**

**Additional workload**

**Increased vulnerability**
** ****to error**

**Crew error (70 feet) **
**in altimeter setting**

**Altimeter update**
**not available**

**170 foot error in **
**altimeter reading**

**Tower closed**

**Tower window**
** ****broke**

**Rapid change in **
**barometric pressure**

**Approach controller**
**failed to update**
**altimeter setting**

**Altitude Hold **
**may allow altitude**
** ****sag 130 feet in **
**turbulence**

**PF used Altitude Hold **
**to capture MDA**

**PM used non-standard **
**callouts to alert PF**

**Training & **
**Standardization issues?**

**Aircraft struck trees**
**310 feet below MDA**

**?**

**?**

**Notes:**
This confluence is illustrated in this slide of factors in a CFIT accident in which a MD-83 struck trees 310 feet below MDA on a non-precision approach in 1995.  I wonder if all pilots are even aware that non-precision approaches in the U.S. can give as little as 250 feet of terrain clearance?  Weather played a central role in this accident in several ways:  barometric pressure was changing rapidly, there was a strong crosswind, the tower window broke, causing the tower to close.  The approach controller failed to update the altimeter setting before switching frequency and the crew did not request an update.  At the time the airline used QFE altimetry.  Workload was high, in part because of the crosswind and the PF’s use of Heading Select.  The crew slightly mis-set the altimeters, causing a 70 foot error; this plus the rapid change in barometric pressure caused the aircraft to fly 170 feet lower than the altimeters indicated.  The pilot flying (PF) used Altitude Hold to capture MDA, however in turbulence Altitude Hold can allow the aircraft to sag as much as 130 feet below the target altitude. The pilot monitoring (PM) called out that they were passing through MDA, using somewhat non-standard phraseology and the aircraft struck trees 310 feet below minimum descent altitude (MDA).  Fortunately, although the aircraft was heavily damaged, no one was severely injured.  My point in going through this slide is not to talk about the details of this specific accident.  None of the factors in this accident were all that extraordinary; it was the particular way that all of these factors happened to combine that produced the accident. It’s popular these days to talk about the “accident chain”, but clearly this is not a single chain, it is a confluence of many factors operating in parallel and converging.  The occurrence and combination of all these factors in a single flight is to large degree a matter of chance, and there is the great challenge.

## Chance Combination of Contributing Factors

- Airline accidents are extremely rare in modern operations
- Countermeasures in place for single-point failures of equipment or human performance
- Occasionally accidents slip through multiple defenses because of chance combination of multiple factors
- Number of possible combinations/permutations of factors is vast
- Difficult to devise countermeasures
- Vague advice to pilots to “break the accident chain” is not helpful

**Notes:**
In our modern airspace system accidents are very rare events because the industry has developed ways of preventing single-point failures in equipment or human performance from causing accidents.  The few accidents that slip through all the defenses occur because of the largely random combination of many factors.  This random aspect makes it very difficult to develop countermeasures to prevent future accidents because the number of combinations and permutations of factors that might occur in a flight are virtually infinite.  And it is very scary—none of us like to feel we are operating in a system that we cannot completely control.  Until we deal with this reality we will not make much progress in improving aviation safety.  It is commonplace to propose that we teach pilots to avoid accidents by “breaking the accident chain” but it is not at all clear how pilots can recognize in the midst of a demanding flight the many different ways multiple factors can combine by chance to lead to an accident. 

## Each Accident Has Unique Surface Features and Combinations of Factors

- Countermeasures to surface features of past accidents will not prevent future accidents
- Must examine deep structure of accidents to find common factors

**Notes:**
Each of these 19 accidents we studied is unique, with limited overlap among surface features.  This heterogeneity of the outward form of airline accidents is a challenge to those attempting to improve safety.  Even if the airline industry developed countermeasures aimed at each of these 19 accidents, these countermeasures might have limited benefit because the next 19 accidents are likely to have different surface features.  Thus it is crucial to seek common underlying factors that might be addressed broadly. 

## Six Overlapping Clusters of Error Patterns

- Inadvertent slips and oversights while performing highly practiced tasks under normal conditions
- Inadvertent slips and oversights while performing highly practiced tasks under challenging conditions
- Inadequate execution of non-normal procedures under challenging conditions
- Inadequate response to rare situations for which pilots are not trained
- Judgment in ambiguous situations
- Deviation from explicit guidance or SOP

**Notes:**
We found that almost all of the significant events of these accidents clustered around six themes, which are defined as much by the situations confronting the pilots as by the errors the made.  I will spend the next few minutes talking about each of these six themes.

## 1) Inadvertent Slips/Oversights in Practiced Tasks under Normal Conditions

- Examples:
- Omitting procedural step or checklist item
- Remembering altimeter setting incorrectly
- Misjudging landing flare
- Identical to errors pilots frequently report to ASRS and ASAP and errors observed in LOSA
- Commonplace error had to combine with multiple other factors to result in accident

**Notes:**
The first group consists of inadvertent slips and oversights while performing highly practiced tasks under normal conditions.  Examples are overlooking a checklist item, remembering an altimeter setting incorrectly, and slightly misjudging the landing flare.  These errors are very much the same as the errors pilots themselves report making to ASRS and ASAP programs. From a cognitive perspective occasional errors made by experts are an inevitable consequence of the way the brain is wired, the incomplete information available at the time to the expert, and the competing demands of multiple tasks. No pilot is immune to these errors, so in many cases the difference between an accident flight and a routine non-accident flight is not the presence of errors but the happenstance combination of the errors with several other factors. 

## 2) Inadvertent Slips/Oversights in Practiced Tasks under Challenging Conditions

- Probability of commonplace errors goes up with workload, time pressure, fatigue and stress
- Snowball effects: events/decisions/actions increase workload, time pressure, and stress downstream, increasing chance of more problems and errors

**Notes:**
The probability of making these inadvertent slips and oversights goes up with workload, time pressure, fatigue, and stress, factors that I will talk about later.  In some accidents we noted a snowball effect in which decisions or actions at one stage of the flight increased the crew’s vulnerability to making errors later.  For example, a crew that continued a highly questionable approach in the vicinity of a thunderstorm put themselves in a high workload situation that may have contributed to their forgetting to arm the spoilers.  

## 3) Inadequate Execution of Non-normal Procedures under Challenging Conditions

- Failure to recover from spiral dive, stall, or windshear
- Veridian study suggests existing training not sufficient
- Surprise, confusion, and stress may impede correct diagnosis of upset and timely execution of appropriate procedure

**Notes:**
Four of these 19 accidents involved inadequate execution of non-normal procedures under challenging conditions.  These included imperfect execution of procedures for recovering from a spiral dive, from a stall, and from windshear.  These days pilots are trained to recover from these situations, but a recent study by Veridian Corporation revealed that even with upset training many pilots have trouble executing recovery procedures adequately.  We suspect that one shortcoming of existing upset recovery training is that in the training pilots are expecting the upset and typically they know which upset they are about to encounter.  But in the real world of surprise, confusion, and stress pilots may have trouble identifying the nature of the upset and selecting the correct recovery procedure.

## 4)  Inadequate Response to Rare Situations for which Pilots are not Trained

- Examples:
- False stick shaker activation just after rotation
- Oversensitive autopilot drove aircraft down at Decision Height
- Anomalous airspeed indications past rotation speed
- Uncommanded autothrottle disconnect with non-salient annunciation
- Surprise, confusion, stress, and time pressure play a role
- No data on what percentage of airline pilots would respond adequately in these situations

**Notes:**
The fourth cluster involved inadequate response to rare situations for which pilots are not trained.  These situations included a false stickshaker activation just after rotation, an oversensitive autopilot that drove the aircraft toward the ground near Decision Height, anomalous indications from airspeed indicators that did not become apparent until the aircraft was past rotation speed, and an uncommanded autothrottle disconnect whose annunciation was not at all salient.  The first three of these four situations required quite rapid responses—the crews had at most a few seconds to recognize and analyze a situation for which they were not trained and had never encounter, and within these few seconds the crew had to choose and execute the appropriate action.  Here too surprise, confusion, stress, and time pressure undoubtedly play a role.  No data exist on what percentage of airline pilots would respond quickly and correctly to these situations, but we suspect that performance is unlikely to be reliable under these conditions.

## 5) Judgment and Decision-making in Ambiguous Situations

**Examples:**
- Continuing approach in vicinity of thunderstorms
- Not de-icing or not repeating de-icing
**No algorithm to calculate when to break off approach; company guidance usually generic**
**Crew must integrate incomplete and fragmentary information and make best judgment**
- If guess wrong, crew error is found to be “cause”
**Accident crew judgment & decision-making may not differ from non-accident crews in similar situations:**
- Lincoln Lab study:  Penetration of storm cells on approach not uncommon
- Other flights may have landed  or taken off without difficulty a minute or two before accident flight
**Questions:**
- What are actual industry norms for these operations?
- Sufficient guidance for crews to balance competing goals?
- Implicitly tolerate/encourage less conservative behavior as long as crews get by with it?

**Notes:**
The fifth cluster of errors involved judgment in ambiguous situations that hindsight proves wrong.  An example of judgment in ambiguous situations is continuing an approach toward an airport in the vicinity of thunderstorms.  No algorithm exists for crews to calculate exactly how far they may continue an approach in the vicinity of thunderstorms before it should be abandoned.  Company guidance is generally expressed in rather general terms, and the crew must make this decision by integrating fragmentary and incomplete information from various sources, and playing it by ear.  When an aircraft crashes while attempting an approach under these conditions, the crew is typically found to be at fault.  Yet there are reasons to suspect that the decision-making of the accident crews was similar to that of crews who were more fortunate.  A Lincoln Lab study of radar data at Dallas Fort Worth revealed that when thunderstorms are near the approach path it is not all that uncommon for airliners to penetrate the cells.  And in the investigation of windshear accidents it is not uncommon to find that another aircraft landed or took off a minute or two ahead of the accident aircraft without difficulty.  Both crews had the same information and made the same decision, but rapidly fluctuating conditions allowed one to land without difficulty and caused the other to crash.  In these ambiguous situations, instead of blaming the accident crew for poor judgment, maybe we should focus more on asking what are the industry norms for operating in these situations.  Does the industry provide sufficient guidance for pilots to balance competing goals?  Do we have explicit policies that sound conservative but implicitly tolerate or even encourage less conservative behavior as long as crews get by with it?

## 6) Deviation from Explicit Guidance or SOP

- Example:  Attempting to land from unstabilized approach resulting from slam-dunk approach
- Simple willful violation or more complex issue?
- Are stabilized approach criteria published/trained as guidance or absolute bottom lines?
- What are norms in company and the industry?
- Pilots may not realize that struggling to stabilize approach before touchdown imposes such workload that they cannot evaluate whether landing will work out

**Notes:**
The last cluster involves deviation from explicit guidance or standard operating procedures.   An example is attempting to land from an unstabilized approach resulting from a slam-dunk clearance.  If the company has explicit stabilized approach criteria, these errors may seem simply to be willful violations.  But even here the situation may not be as simple as it seems.  Does the company publish and train the stabilized approach criteria as an absolute bottom line or merely as guidance?  What are the norms for what pilots actually do in the company and in the industry?  We have heard some pilots, even some check pilots, express the view that being unstabilized at 500 feet is not a problem as long as the flying pilot is correcting and gets the aircraft back within normal parameters by touchdown.  What these pilots may not grasp is that correcting an unstabilized approach imposes so much workload that the flying pilot does not have enough mental capacity left over to reliably assess whether he is going to be able to get everything back to normal by touchdown.  

## Cross-Cutting Factors Contributing to Crew Errors

**Notes:**
We identified a range of cross-cutting factors in these accidents that contributed to the vulnerability of pilots to making the sorts of errors I just described. 

## Situations Requiring Rapid Response

- Nearly 2/3 of 19 accidents
- Examples:  upset attitudes, false stick shaker activation after rotation, anomalous airspeed indications at rotation, autopilot-induced oscillation at Decision Height, pilot-induced oscillation during flare
- Very rare occurrences, but high risk
- Surprise is a factor
- Inadequate time to think through situation
- automatic response required

**Notes:**
To our great surprise, nearly 2/3 of these accidents involved situations in which the crew had only a matter of seconds to choose and execute the appropriate response.  Examples include upset attitudes, false stickshaker activation just after rotation, anomalous airspeed indications at rotation, pilot induced oscillation during flare, and autopilot induced oscillation at decision height.  We were surprised because most threatening situations encountered in airline operations allow the crew time to think through what to do, and in these situations it is important to avoid rushing.  We conclude that these 19 accidents included a disproportionately high number of situations requiring very rapid response because, although these situations are quite rare, when they do occur it is extremely difficult for crews to overcome their surprise, assess the situation, and quickly execute the appropriate response.  Human cognitive processes simply do not allow pilots to reliably assess novel situations quickly.

## Challenges of Managing Concurrent Tasks

- A factor in great majority of these accidents
- Workload quite high in some accidents:
- Crews became so overloaded they failed to recognize situation was getting out of control
- Crews may fail to notice subtle cues and integrate information from multiple sources
- Crews may be forced into reactive mode rather than strategic mode
- Monitoring and cross-checking suffer

**Notes:**
The challenge of managing multiple tasks concurrently showed up in the great majority of these accidents.  In some cases workload and time constraints were quite high in the final stages of the accident sequence, and the crews became so overloaded that they failed to recognize that they were losing control of the situation and needed to break off the approach.  Under these conditions pilots may fail to note subtle cues and are less able to integrate and interpret information from multiple sources.  They may also forced into a reactive mode—rather than strategically managing the situation, they may revert to responding to each demand as it arises, without prioritization, because they lack free mental resources to take a strategic approach.  Monitoring and cross-checking may also suffer.

## Challenges of Managing Concurrent Tasks (continued)

- In many accidents adequate time was available for all tasks, however:
- Especially vulnerable to error when switching attention among tasks, interrupted, distracted, or forced to defer tasks out of normal sequence
- Vulnerability inherent in basic cognitive processes
- Can attend to only one distinct task at a given instant
- Once attention is diverted from a task do not always remember to resume task if not prompted
- Better monitoring can help prevent/catch errors
- But monitoring is itself a concurrent task and vulnerable to the same factors that produce errors

**Notes:**

But in many cases adequate time was available to perform all required tasks, however the inherent difficulty of reliably switching attention back and forth among concurrent tasks may have hampered performance.  Even experienced pilots are vulnerable to becoming preoccupied with one task to the neglect of other tasks, and all of us have forgotten to complete a task when interrupted or distracted or forced to defer a task out of the normal sequence.  More effective monitoring might have helped many of these crews prevent or detect most of the errors made—unfortunately, because monitoring is itself a task that must be performed concurrently with other tasks, it is also subject to the fragility of attention switching among tasks.

## Equipment Failures and Design Flaws

- Occurred in 2/3 of these accidents
- Some equipment failures/design flaws precipitated chain of events
- Example:  false stick shaker after rotation
- Some equipment failures/design flaws undermined efforts of crew to respond
- Example:  stick shaker failed to activate when aircraft approached stall

**Notes:**
Equipment failures and design flaws appeared in about 2/3 of these accidents.  In some cases a design flaw or equipment failure precipitated the chain of events leading to the accident—I already mentioned a false stickshaker warning that occurred right after rotation.  In other accidents a flaw or failure undermined the efforts of the crew to manage their situation—for example in several accidents the stick shaker failed to activate when it should have, depriving the crew of critical information.

## Misleading or Missing Cues Normally Present

- False stick shaker is misleading cue
- Hard to sort out under time pressure, high workload, and stress
- Failure of stick shaker removes expected cue
- Crew errors also generate misleading cues or remove normal cues
- e.g., premature Vr callout
- 	    omission of speed and vertical speed callouts

**Notes:**
One the major problems with equipment failures and design flaws was that the they resulted in misleading cues or cues that crews normally depend for alerting being absent.  Through training crews learn to depend on powerful cues such as the stick shaker.  A false stick shaker warning is extremely misleading, as is the absence of stick shaker warning when the aircraft is actually approaching stall.  Under calm conditions pilots can diagnose these equipment failures, but they are very difficult to sort out under high workload, time pressure, and stress.  Another cause of misleading and absent cues was crew errors themselves—in one case an FO called out rotation speed prematurely; in another case the FO failed to make standard callouts for speed and descent rate during an unstabilized approach.

## Plan Continuation Bias

- Unconscious cognitive bias to continue original plan in spite of changing conditions
- Appears stronger as one nears completion of activity (e.g., approach to landing)
- Why are crews reluctant to go-around?
- Bias may prevent noticing subtle cues indicating original conditions have changed
- May combine with other cognitive biases:
- Frequency sampling bias (“It’s always worked before”)
- Reactive responding is easier than proactive thinking

**Notes:**
Plan continuation bias was apparent in at least nine of these 19 accidents.  This is a powerful but unconscious cognitive bias to continue the original course of action or an habitual course of action even when conditions change, making that original plan of action not such a good idea.  Plan continuation bias may be especially strong during the approach phase, when only a few more steps are required to complete the flight.  Many of these accidents could have been prevented by executing a missed approach, so we have to ask why crews find it difficult to bring themselves to make a missed approach.  We have some ideas about this, but I don’t have time to go into them today.

## Stress

- Hard to evaluate extent, but stress is normal physiological/behavioral response to threat
- Acute stress hampers performance
- Narrows attention (“tunneling”)
- Reduces working memory capacity
- Combination of surprise, stress, time pressure, and concurrent task demands can be lethal setup
- Beginning NASA research project on effects of stress on crew performance

**Notes:**
We suspect that stress played a role in many of these accidents by interfering with the crews’ cognitive processes.  However, stress is rather like fatigue--it is hard to find the smoking gun after the accident.  Stress hampers skilled performance by narrowing attention and reducing working memory capacity required to execute even highly practiced tasks.  In particular, the combination of stress and surprise with requirements to respond rapidly and to manage several tasks concurrently, as occurred in several of these accidents, is a lethal setup.  

## Shortcomings in Training and/or Guidance

- >1/3 of accidents
- Inadequate guidance to pilots about known problems (e.g. high sensitivity of wings without leading edge devices to minute amounts of frost)
- Upset attitude recovery training
- How to deal with fact that not possible to train for every possible situation?

**Notes:**
Shortcomings in training and/or guidance appeared in more than a third of these accidents.  In some cases pilots were not provided adequate guidance about problems known to exist by some segments of the industry.  Three of the accidents involved upset attitudes—I’ve already suggested that we need to find ways to develop more realistic scenarios with which to present upset attitude recovery training.  But beyond this, we have to find a way to deal with the fact that it is simply not possible to train for every possible situation—which raises the question of how best to provide generic training and procedures that will work in a broad range of unanticipated situations.

## Social/Organizational Issues 

- Actual norms may deviate from Flight Operations Manuals
- Little data available on extent to which accident crews’ actions are typical/atypical
- Competing pressures not often acknowledged
- e.g., on-time performance vs. conservative response to ambiguous situations
- Pilots may not be consciously aware of influence of internalized competing goals

**Notes:**
Social and organizational issues have a pervasive influence.  For example, how operations are actually conducted on the line may deviate from the ideals expressed in flight operations manuals, for many reasons.  Unfortunately, little data is available to accident investigators on the extent to which the accident crews’ actions were typical or atypical in the situation they faced. Also, pilots may not be consciously aware of being influenced by competing goals that they have internalized, for example the trade-offs between on-time performance and conservative response to ambiguous situations.  
By the way, Dan Marino is the lead author of one of the most useful books on organization issues in aviation accidents:  Beyond Aviation Human Factors.

## Implications and Countermeasures

- Focus on deep structure, not superficial manifestations
- Most accidents are systems accidents
- Unrealistic to expect human operators to never make an error
- Unrealistic to think can automate humans or error out of the system
- Design overall operating system for _resilience_ to equipment failure, unexpected events, uncertainty, and human error

**Notes:**
If you believe what I have been telling you, then there are ways we can improve aviation safety.  However we cannot prevent future accidents if we focus on the superficial manifestations of previous accidents, because every accident involves a unique and random combination of contributing factors.  Rather we must analyze the deep structure of accidents to find common factors.  Almost all accidents are system accidents, and we must analyze what makes the overall system vulnerable.  As John Lauber has said, identification of pilot error in accidents should be the starting point not the end point of our analysis.  It is highly unrealistic to expect crews—no matter how well trained, skilled, and conscientious—to never make errors.  Nor can humans with their imperfections be automated out of the system, for only humans can deal with unexpected and novel situations, and only humans can make value judgments among competing options with advantages and disadvantages.  Thus to maintain and improve safety we must design all aspects of the system with the certain knowledge that human operators will commit errors.  And if we design equipment, procedures, and training to reflect the characteristics and limitations of human cognitive and perceptual processes, we can limit the frequency of errors, improve early detection of errors, and limit the propagation of errors into accidents.  The object is to design the overall operating system to be resilient to the equipment failures, unexpected events, uncertainty, and human errors that inevitably occur.  

## Implications and Countermeasures (continued)

- Need better info on how airspace system typically operates and how crews respond
- e.g., frequency/site of slam-dunk clearances, last-minute runway changes, unstabilized approaches
- FOQA and LOSA are sources of information
- NASA research for next generation FOQA: Aviation Performance Measurement System (APMS)
- Dr. Tom Chidester: > 1% of 16,000 flights: high energy arrivals         unstabilized approaches         landing exceedances
- Must find ways to share FOQA and LOSA data industry-wide to develop comprehensive picture of system vulnerabilities

**Notes:**
We urgently need much better information on how the airspace system really operates and on the range of ways airline crews respond to the challenges posed.  For example, how often and at what airports do controllers issue slam-dunk clearances and last-minute runway changes?  How do crews respond to these challenges and how close do they come to the edge of the safety envelope?  How close to storm cells do flights come during arrival and departure, and how much of the variation among flights is due to crew judgment and how much to chance?  One way of generating this kind of information is through FOQA--Fight Operations Quality Assurance programs—and LOSA—Line Operational Safety Audits.
To date FOQA has focused on detection and analysis of “exceedances” (operation beyond prescribed flight parameter values).  More recently, NASA’s Aviation Performance Measuring System project has been developing  tools to analyze precursor conditions associated with those exceedances. APMS is an advanced version of FOQA. For example, Tom Chidester from NASA  reported analysis of APMS data revealing that unstabilized approaches were often preceded by high-energy arrivals.  More than one percent of 16,000 flights conducted by three air carriers were in higher than desirable energy states (high speed, low drag, and/or high thrust settings) below 10,000 feet and failed to become stabilized by 1,000 feet, but continued to land, exceeding acceptable values for multiple parameters after touchdown.  These data are disturbing, because more than 1/3 of accidents attributed to crew error involve unstabilized approaches.  

## Implications and Countermeasures (continued)

- When FOQA and LOSA uncover deviations from ideal, must find why
- 	e.g., must identify forces discouraging crews from abandoning unstabilized approaches
- Concern for on-time performance and fuel costs?
- Viewed as lack of skill?
- Fear of recrimination?
- Fail to recognize logic for unstabilized approach criteria?

**Notes:**
When FOQA and LOSA data reveal that an airline’s operations deviate from the ideal, it is essential to go beyond simply identifying problem areas and increasing training emphasis—we must find out why the norms deviate from the ideals.  For example, if an airline discovered significant deviation from its published stabilized approach criteria, fixing the problem requires uncovering the forces that discourage crews from aborting unstabilized approaches.  Pilots undoubtedly internalize industry-wide concerns with on-time performance and fuel costs, they may consciously or unconsciously view having to go around as appearing unskillful, and they may fear recrimination from the company.  And pilots may not fully understand the logic or having hard bottom-lines for stabilized approaches, not recognizing that during an unstabilized approach they may become so overloaded that they cannot adequately evaluate whether they will be able to get the approach back under control.  

## Implications and Countermeasures (continued)

- Pilots, airline managers, instructors, designers of equipment and procedures must be well educated about human cognitive characteristics and limitations
- Interaction of cognitive processes with task demands drives vulnerability to error
- Airlines should periodically review normal and non-normal procedures for vulnerability to error
- 	 e.g., checklists are vulnerable to “looking without seeing”, interruptions, and deferred items
- 	 Can reduce vulnerability:
- Execute checklists in slow, deliberate manner, pointing and touching
- Anchor checklist initiation to salient events (e.g., top of descent)
- Treat interruptions and deferred items as red flags and create salient reminder cues

**Notes:**
We suggest that pilots, airline managers, instructors, and designers of equipment and procedures must be well educated about human cognitive characteristics and limitations and how those characteristics and limitations shape vulnerability to error.  We recommend that airlines periodically systematically analyze their operating procedures to identify aspects that increase vulnerability to error.  For example, checklists are a major defense against equipment failures and pilot error, but checklists themselves are vulnerable to cognitive limitations.  Pilots may unwittingly look at items to be checked without seeing the actual status because of the long string of previous flights in which the items are in the expected position.  Initiation and resumption of checklist are vulnerable to being forgotten when pilots are interrupted or forced to perform tasks out of the normal sequence.  These vulnerabilities can be reduced in several ways:
1) Pilots can develop the habit of executing checklists in a slow, deliberately paced manner.  Touching or  pointing to items on the panel also helps.
2) Checklist initiation can be anchored to salient events that always occur –for example top of descent.
3) Interruptions and deferred checklist items should be treated as red flags.

## Implications and Countermeasures (continued)

- Repetitiousness can lead to:
- 	Briefings becoming mindless recitation and crews 		becoming reactive rather than proactive
- Solution: train pilots to use briefings as tool to look ahead, question situation, identify threats, and prepare options
- Beef up training:
-   Upset attitude recovery with realistic scenarios
-   Monitoring
- Acknowledge inherent trade-offs between safety and system efficiency
-   Include all parties in analysis of trade-offs
-   Make policy decisions explicit

**Notes:**
It is easy for briefings to become an automatic, mindless recitation because of the repetitiousness of airline operations.  More broadly, this repetitiousness can lull crews into a reactive mode in which they simply respond automatically to events rather than thinking ahead proactively and strategically.  But we could train pilots to use briefings as a tool to look ahead and question whether the situation they are approaching is truly routine, to identify any unusual aspect or challenges, and to prepare options.  This proactive use of briefings would help maintain situation awareness and reduce vulnerability to plan continuation bias.
We could beef up our training for upset recovery and for other situations  requiring very rapid response. And we should develop specific techniques to train monitoring.
Finally, we should explicitly acknowledge the elephant in the room:  there are inherent trade-offs between the level of safety and system efficiency.  These trade-offs show up in many ways, for example, in decisions in how much training to provide and how conservative to be when flying approaches near thunderstorms.  Cost-benefit trade-offs are inherently policy issues.  Those issues should be analyzed explicitly, and all stakeholders should participate.  My point is that more can be done to protect safety by explicitly analyzing these trade-offs than by naively expecting crews to always perform perfectly, to make perfect decisions in an imperfect world.

## More information on NASA Human Factors Research:

**http://human-factors.arc.nasa.gov/ihs/flightcognition/**

**Notes:**
We hope to have our book to the publisher by summer, but of course it will be a while before it is print.  In the meantime you can find more information about this project and other NASA HF projects at our web site.