1 / 26

Ben Berman NASA Ames Research Center/San Jose State University Key Dismukes

Cognitive Limitations and Vulnerabilities on the Flight Deck: What Can We Do?. Ben Berman NASA Ames Research Center/San Jose State University Key Dismukes NASA Ames Research Center Loukia Loukopoulos NASA Ames Research Center/San Jose State University Human Factors in Aviation Conference

Download Presentation

Ben Berman NASA Ames Research Center/San Jose State University Key Dismukes

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Cognitive Limitations and Vulnerabilities on the Flight Deck: What Can We Do? Ben Berman NASA Ames Research Center/San Jose State University Key Dismukes NASA Ames Research Center Loukia Loukopoulos NASA Ames Research Center/San Jose State University Human Factors in Aviation Conference San Antonio, Texas March 6, 2007

  2. “Most Airline Accidents Attributed to Crew Error” What does this mean? • Why do highly skilled pilots make fatal errors? • How should we think about the role of errors in accidents? Draw upon cognitive science research on skilled performance of human operators

  3. Broken Bolt vs.Unflipped Switch • Physical causes leave characteristic traces • No such thing for human performance • “Why” drops out, for good reason • Can never know with certainty why accident crew made specific errors--but can determine why the population of pilots is vulnerable • Put “why” back into the analysis with informed perspective

  4. Approach • Reviewed NTSB reports of the 19 U.S. airline accidents between 1991-2001 attributed primarily to crew error • Followed the approach of NTSB (1994) • Asked: Why might any airline crew in situation of accident crew – knowing only what they knew – be vulnerable?

  5. Hindsight Bias • Knowing the outcome of an accident flight reveals what the crew should have done differently • But: accident crew does not know the outcome • They respond to situation as they perceive it at the moment • Presumption has to be that more underlies an error than lack of skill or motivation

  6. Training, experience, & personal goals • Social/Organizational • Influences • Formal procedures & policies • Explicit goals & rewards • Implicit goals & rewards • Actual “norms” for line operations Immediate demands of situation & tasks being performed Human cognition characteristics & limitations Crew responses to situation

  7. American 903May 12, 1997 West Palm Beach, Florida • Airbus 300/600 in its initial descent for Miami • Airplane leveled, slowed, and began a holding pattern at 16,000 feet • Uncontrolled roll and pitch oscillations; steep descent; recovered with one serious injury/damage to the tail that was discovered much later • Probable cause: “The flight crew’s failure to maintain adequate airspeed during level-off which led to an inadvertent stall, and their subsequent failure to use proper stall recovery techniques” • Contributing factor: “The flight crew’s failure to properly use the autothrottle”

  8. American 903:Sequence of Events • Autothrottle became disconnected during descent from cruise--not clear why, and not noticed or remembered by the crew • Autopilot captured 16,000 feet and pitched up to maintain altitude, so airspeed decreased • Vibration and buffeting began that the crew attributed to turbulence • Airplane stalled and departed controlled flight • Crew recovered below 13,000 feet, proceeded to safe landing in Miami

  9. American 903:Dim Cues, Missing Cues, and Hints • Autothrottle disconnection did not have salient annunciation • Dim cue (compared to autopilot, for example) • Crews often do not notice unexpected mode changes • Autothrottles had tripped off on other flights • Hint about accidents from everyday operations • Crew might have disconnected autothrottle without thinking about it or remembering • Automaticity

  10. American 903:Out of the Loop, Missing Cues, and the Wrong Procedure • Neither pilot noticed the airspeed loss until well below maneuvering speed • Vulnerability from being out of the active control loop • Crew expected aircraft to slow, just not that much • Stall warning did not activate prior to stall • Dependence on missing cue • Crew performed wind shear recovery rather than stall recovery • Primed to think about thunderstorms • Training for wind shear and min-altitude approach to stall recovery • Again, absence of timely stall warning

  11. American 903:Lessons • Tendency toward degraded monitoring of normally reliable automation is rooted in basic human cognitive vulnerabilities • Simply cautioning pilots to monitor more carefully will not greatly reduce vulnerability, by itself. • Snowball effect of one error producing overload that undermines error-trapping and results in more errors • Missing cues can be extremely hazardous • Concept of reliability on the flight deck • Variability of performance • Two pilots, redundant procedures, several warning systems, and an airplane: goal is to keep errors from sneaking through all those layers of cheese

  12. Each Accident Has Unique Surface Features and Combinations of Factors • Countermeasures to surface features of past accidents will not prevent future accidents • Must examine deep structure of accidents to find common factors

  13. Cross-Cutting Factors Contributing to Crew Errors • Situations requiring rapid response • Challenges of managing concurrent tasks • Equipment failure and design flaws • Misleading or missing cues normally present • Stress • Shortcomings in training and/or guidance • Social/organizational issues • Plan continuation bias

  14. Cross-Cutting Factors Situations requiring rapid response • Nearly 2/3 of 19 accidents • Examples: upset attitudes, false stick shaker activation after rotation, anomalous airspeed indications at rotation, autopilot-induced oscillation at Decision Height, pilot-induced oscillation during flare • Very rare occurrences, but high risk • Surprise is a factor • Inadequate time to think through situation • Automatic response required from pilot

  15. Cross-Cutting Factors Challenges of managing concurrent tasks • Workload high in some accidents (e.g., Little Rock, 1999) • Overloaded crews failed to recognize situation getting out of hand (“snowball effect”): losing the ability to recognize that they were overloaded • Monitoring and cross-checking suffered • Crews became reactive instead of proactive/strategic • But: adequate time available for all tasks in many accidents • Inherent cognitive limitations in switching attention: preoccupation with one task of many; forgetting to resume interrupted or deferred tasks

  16. Cross-Cutting Factors Stress • Stress is normal physiological/behavioral response to threat • Acute stress hampers performance • Narrows attention (“tunneling”) • Reduces working memory capacity • Combination of surprise, stress, time pressure, and concurrent task demands can be lethal setup

  17. Cross-Cutting Factors Social/Organizational Issues • Actual norms may deviate from Flight Operations Manual • Accident crew judgment & decision-making may not differ from non-accident crews in similar situations: • Lincoln Lab study: Penetration of storm cells on approach not uncommon • Other flights may have landed or taken off without difficulty a minute or two before accident flight • Little data available on extent to which accident crews’ actions are typical/atypical • Competing pressures not often acknowledged • Implicit messages from company may conflict with formal guidance • e.g. on-time performance vs. conservative response to ambiguous situations • Pilots may not be consciously aware of influence of internalized competing goal

  18. Cross-Cutting Factors Plan continuation bias (e.g., Burbank, 2000) • Unconscious cognitive bias to continue original plan in spite of changing conditions • Appears stronger as one nears completion of activity (e.g., approach to landing) • Why are crews reluctant to go-around? • Bias may prevent noticing subtle cues indicating original conditions have changed • Reactive responding is easier than proactive thinking • Default plan always worked before

  19. Implications and Countermeasures:The Individual • Vulnerabilities are inherent in our human cognition • Limitations, biases • Effects extend to error trapping mechanisms • Monitoring subject to task shedding under workload • Checklists automatized, subject to slips/omissions • Recognize realistic rather than theoretical performance of humans in generating errors as they work, and in catching errors

  20. Implications and Countermeasures:The Aviation System • Accept the variability of human performance • Because someone makes an error does not make them deficient or complacent • Errors are inevitable • Recognize that errors are probabilistic • Society’s demand for reliability is nearly unlimited • Focus on net system reliability, made up of: • Reliability of each error trapping mechanism • Independence of error trapping mechanisms to prevent the holes in the swiss cheese from lining up: (e.g., landing checklist initiation cued by callout to extend the gear)

  21. Implications and Countermeasures:The Aviation System (cont’d) • Causal attribution to individual can distract attention from underlying cause and prevention • Remediation lies with the system • Guard against “don’t do that anymore” prescriptions • No evidence of Bad Apple theory • All other remediation requires more difficult changes in the system

  22. Net System Reliability: “Okay, what can we do?” • Treat monitoring and crosschecking as being as important as anything else we do • Suggestions for training & checking: • Cut down on negative training (e.g., continuing unstabilized approaches in sim makes plan continuation bias stronger on the line • Teach pilots to monitor, give them the opportunity to practice in the sim • Build at least one realistic challenge and decision into every sim session • Teach how to manage workload, practice in the sim

  23. “What can we do?”(continued) • Procedures design review • Match human characteristics and limitations • Independence • Equipment design review • Match human characteristics and limitations • Safety Change: • Heed the hints--the next accident is trying to warn you about itself right now • AA903, AA1340, CAL1943 • How to separate the wheat from the chaff?

  24. Dismukes, R. K., Berman, B.A., & Loukopoulos, L. L. The Limits of Expertise: Rethinking Pilot Error and the Causes of Airline Accidents. www.ashgate.com More information on NASA Human Factors Research: http://human-factors.arc.nasa.gov/his/flightcognition/ This research was partially funded by NASA’s Aviation Safety Program and by the FAA (Eleana Edens, Program Manager).

  25. What else can we do?

More Related