To Read the Final Wrong Deck Landings Report

Jarvis Bagshaw Ltd

Wrong Deck Landings

Research and Investigation Report

Commissioned by CHC Helicopter

Final Report

December 11th 2015

Steve Jarvis PhD MSc BEd (hons) FRAeS MIEHF CErgHF

Contents

Part 1 – Overview and summary...... 4

1.1 Introduction ...... 5 1.2 Overview of General findings ...... 5 1.3 WDL high-level analysis ...... 7

Part 2 - Causal factors in WDLs ...... 10

2.1 Type 1 & 3 Errors - Transition from nav instruments to visual . 11

2.1.2 The Visual Transition Zone (VTZ) . . . . 12

2.1.3 General catalysts to triggering errors . . . 14 2.1.3.1 Decoy Platform Concept . . . . 14 2.1.3.2. Resource Use and Limitation . . . 16 2.1.3.3. Familiarity ...... 17 2.1.3.4. Multiple identifiers . . . . . 17

2.1.4 Specific catalysts ...... 18 2.1.4.1 Steep VTZ ...... 18 2.1.4.2 Early target selection . . . . . 19 2.1.4.3 Group factors (social influence) . . . 20 2.1.4.4 Strength of Decoy Pairing Characteristics (DPCs) . 21 2.1.4.5 Loss of visual in circuit and final turn . . 21 2.1.4.6 Weather ...... 22 2.1.4.6.1 Visibility . . . . . 22 2.1.4.6.2 Wind Direction . . . . 22

2.1.5 Accepting and locking the triggering error . . . 23 2.1.5.1 Lack of scrutiny after initial target selection . 23 2.1.5.2 Confirmatory thinking . . . . 23 2.1.5.3 Use of limited (or single) cues . . . 23

2.1.6. Error trapping issues ...... 24 2.1.6.1 Signage and platform identification . . . 24 2.1.6.2 PF/PNF activity on late finals . . . 27 2.1.6.3 Non-use of radar . . . . . 27

2.2 Type 2 errors. FMS / NAV guides a crew to the wrong platform . 28

Part 3 –In depth analysis of problem . . . . . 31

3.1 Expanded fault tree analysis - acquisition of wrong target . . 32 3.1.1 Overview of wrong target acquisition . . . . 32 3.1.2 Wrongly perceived or recalled route/platform . . 33 3.1.3 Incorrect Visual Transition . . . . . 33

3.2 Expanded discussion of factors causing visual acquisition WDL . 35 3.2.1. Correct target not selected (Figure XXX4 below) . . 37 3.2.2. Wrong target / Decoy selected . . . . 39 3.2.3. Wrong platform / Decoy accepted . . . . 41 3.2.4. SOP / formal error traps fail . . . . . 42 3.2.5. Ambiguities not noticed or rejected . . . . 42 3.2.6 Full Fault Tree for visual acquisition . . . . 43 3.2.7 Common mode issues (sub-fault trees A, B and C) . . 43

3.3 Crew followed FMS to incorrect platform (routing to the wrong helideck) 45

Part 4 - Data Analysis Section ...... 47

4.1 Data Collected ...... 48

4.2 Online Survey ...... 49 4.2.1 Topic 1 response (Perceived reasons for WDLs) . . 50 4.2.2 Topic 2 (Perceived system vulnerabilities) . . . 52 4.2.3 Topic 3 (Perceived Training Vulnerabilities) . . 54 4.2.4 Topic 4 (Actual Events for analysis (WDLs or near-WDLs). 56 4.2.5 Analysis of attitude toward wrong deck landings . . 61 4.2.6 Main conclusions from survey findings . . . 63

4.3 Pilot Interviews ...... 64 4.4 Incident report analysis ...... 66 4.5 In-flight observations ...... 68

Part 5 – Recommendations ...... 71

5.1 Ratings for recommendations of this report . . . . 72 5.2 Recommendations for avoiding the triggering error . . . 72 5.3 Recommendations for noticing and trapping the error . . 77 5.4 Recommendations for signage ...... 82

Part 6 – Comments on previous recommendations . . . 84

6.1 CHC WDL working group ...... 85 6.2 IOGP WOHL document ...... 87

Appendices ...... 93

PART 1 – OVERVIEW AND SUMMARY

1.1 Introduction

This report presents the results and analysis of a programme of work carried out between May and November 2015. Work involved 26 hours of in flight observations, nine hours of simulator work, 20 pilot interviews, an online survey (117 responses), and an analysis of incidents. In depth analysis was performed including task analyses and task orientated fault tree analysis.

A wrong deck landing (WDL) event was defined as an aircraft touching down on a platform or vessel other than the one that was planned. However a close approach to the wrong deck may also be problematic and since the entire process was analysed the ‘wrong deck approach’ can be included as a sub-set of the wrong deck landing. The only difference from an analytical perspective is that the wrong deck landing incudes a failed late error trap (such as reading the deck ID) whereas the wrong deck approach does not.

1.2 Overview of General Findings

Most wrong deck landings occur despite the FMS route being correct. A few happen as a direct result of it being incorrect. These two types of WDL are referred to as type 1 and type 2 WDLs respectively in this report. The third type (Type-3) are very similar to type 1 but involve an FMS route that is not fully specified (e.g. to a point near a vessel).

Most Type 1 and 3 WDLs (the vast majority of all WDLs) happen because the transference from FMS navigation to visual navigation goes wrong. The area in which crews transfer from FMS navigation to visual navigation is named the visual transition zone (VTZ) in this report, and attracts the deepest analysis. It is within this area that most gain can be made in resolving WDLs, and therefore most recommendations relate to factors affecting it. The process that generates wrong deck landings by these visual identification errors usually involves a triggering error (wrong selection of a visual target), acceptance of that target, and then failure to trap or notice that it is the wrong target. This process is reflected in the fault tree analysis.

In most cases, instead of selecting the intended platform/vessel the crew select and accept a ‘decoy’ platform / vessel. That decoy usually has some particular characteristics which pair it to the intended target (called decoy pairing characteristics) such as similar name, similar looking structure, same colour, type, location, alignment, etc. Sometimes just one of these can be enough to create a WDL because pilots look for one firm cue as confirmation. Understanding of the decoy concept is important in resolving WDLs. In most actual cases of WDLs the decoy was reasonably apparent and accessible in foresight, but was not noticed or seen as a threat until after the event. Factors that cause the selection (and acceptance) of a wrong target can be as simple as the wrong platform coming into view before the right one, chance platform alignment, or the correct platform being obscured by cloud or shadow when the

crew look up to search. The first sighting of a platform will often get ‘locked-in’ immediately whether right or wrong because of social direction and confirmation (e.g. “visual, in line with the red ship”, “…confirmed”). This has the dual effect of crews selecting the platform that the first one determines to be the intended target (meaning the most visual target stands more chance of selection, often favouring a decoy) AND leaving both pilots feeling more confident in their selection than is justified by the process of selection that was used.

After visually selecting a wrong platform, a crew must trap or notice the error in order to prevent a WDL. But there are a number of factors that impinge on this. Once a visual sighting of a platform or vessel has been accepted, the chance of the crew changing their mind in the face of contrary evidence (trapping the error) gradually decreases (relatively) because of confirmatory thinking and communication by the crew (this has been observed). In other words, they become increasing less likely to question the process the more they agree or confirm that it is the correct target, and this means that they will be less likely to be passively alerted to a wrong deck selection. Other factors overcome self- doubt, such as group processes between the pilots. For these reasons, and others, early selection (e.g. in good VMC) is problematic because identification cues are insufficient at long distance, and yet crews will make the selection early, meaning that by the time the visual cues become sufficiently clear, the crew’s mind-set has had time to strengthen such that they may continue to the wrong platform in the face of seemingly obvious discrepancies.

In terms of error traps, cross-checking with the FMS needs to be more formalised and consistent, and this would be supported by changes in the FMS software that differentiate route waypoints from destinations.

Currently, the main procedural error trap is for the pilots to visually identify the platform name (from it’s ID plates) on late finals. This is seriously flawed. Sign location is a particular factor here. Some signs are located far from the main visual reference that handling pilots use when approaching the helipad (the helipad itself) and also the sign location is often unpredictable for the pilot. This causes flying pilots (PFs) to unconsciously prioritise between the visual reference used for aircraft control and the visual reference used for platform identification (signage). Pilots will almost always prioritise aircraft control, which means that the task of identification will receive little attention and may be dropped without the pilots being fully aware that they have done so. This should not be discouraged. If, with present signage locations, pilots were told to pay more attention to the signs on late finals then a significant safety threat could be generated that would have more chance of producing a serious accident than the subsequent WDL would have. Recommendations are made that, if taken up, would have to involve BOTH signage changes and a late visual error trap, but the latter must not be implemented without the former.

The report makes numerous recommendations split into three areas: avoiding selection errors, effectively trapping those errors, and improving signage. The

recommendations are rated 1 to 4 in terms of their potential likely effect on WDL numbers. Some would be relatively easy to implement but have only a small or temporary effect. Some would undoubtedly have a large effect, but would involve either considerable work and testing, or expense.

1.3 WDL High-Level Analysis

Incident reports, interviews and survey data showed that most wrong deck landings were triggered by a single error (mistake, etc.) that was usually aggravated or promoted by catalysts within the situation. Self evidently the ultimate error was not trapped. Therefore wrong deck landings need at least two things to happen: the triggering error AND no trapping given that error (as shown in the top level of the fault tree below, Fig 1.1).

Figure 1.1 – the highest-level fault tree section

Within most of the WDLs reviewed or discussed, that error occurred anywhere between the flight planning stage (usually before flight) and the visual acquisition of the helipad during late final approach. This area is shown by the black horizontal bracket line in Figure 2, below. Within any single sector these critical errors tended to cluster into two exclusive areas of interest, as shown by the red ovals.

Figure 1.2. The range that WDL triggering errors can occur within a sector (black bracket). Red ovals show the two main clusters. Clearly with a shorter sector (e.g. shuttle) the right hand oval in Figure 1 would be much wider (relatively) and the two error clusters would be closer together, but they nevertheless will remain exclusive.

The two clusters of errors shown by the red ovals in Fig 1.2 can be described as follows:

1. The transition from navigational instruments to visual acquisition. This is the pilots’ transition from being guided by navigational aids (e.g. FMS route) to acquiring a visual target on which to converge and set up the approach. Hence the correct target is selected in the navigational equipment, but the wrong target is selected visually.

2. Route planning and FMS programming; whereby the wrong platform or coordinates are used, for whatever reason. This means that the wrong platform is selected in the navigational system, and accepted before getting airborne in most cases.

The two main error clusters are caused by the near dichotomy based on the FMS route being as intended or not (i.e. FMS right or FMS wrong). The only variations are where the FMS does not fully specify a destination; e.g. if routing to a moving vessel, if the crew are not using the FMS, or if the crew fly an intended but incorrect route despite the FMS route being right.

Expanding the analysis using fault tree analysis (Figure 1.3), these two types of WDL can be seen accompanied by a third type, which happens when the FMS route is neither right nor wrong, but is not well specified. This usually occurs when routing to a moving vessel.

Figure 1.3 – Top of fault tree

From the many forms of data collection and analysis carried out, as well as the actual incident reports, it was found that the first of the three error types (FMS route correct) was by far the most common.

Almost all of these cases involved an incorrect visual transition (meaning that the wrong platform was identified visually and landed on). This is described fully in the next section. The other form of Type 1 error is where the error happened as a result of the crew wrongly perceiving or recalling the route or intended platform (for example if they stop using the FMS because they remember the sequence of platforms and are familiar with it). Hence In these cases, the error could form anywhere in the task (even as a gradual process), and is therefore an exception to the error clustering concept shown by the red ovals in figure 1.2. Hence these cases do not conform to the triggering error and error-trapping hypothesis because the error is part of the crew’s planned sequence. That means that although the platform that the crew visually acquire is the wrong one, it is nevertheless the one they intended to visually acquire, and yet the FMS route is correct. In these situations the error trapping is far more difficult because the crew’s mental model includes the wrong platform as the right one.

However data and analysis show that these cases are a very small minority, and therefore no in depth analysis is presented in this report. Nevertheless they were considered throughout the data collection, analysis and when forming recommendations.

Finally, Type 3 WDLs (as shown in the fault tree, Figure 1.3) have similar causes to type 1 WDLs but these are aggravated due to the underspecified FMS route (usually not an error itself). Hence, technically, type 3 WDLs exist in the right hand red oval of Figure 1. For this reason, type 3 errors are treated the same way from the perspective of later extensions to the fault tree.

PART 2 –CAUSAL FACTORS IN WDLs

2.1 Type 1 and 3 errors

In most of these errors, a problem in transition from navigational instruments to visual acquisition leads to the wrong platform being selected and landed upon

This section details the problem of the visual transition and details where it goes wrong and why. The visual transition means the manner in which pilots swap from being guided by navigational sources to being guided by the visual sight of the platform. This process causes the vast majority of Wrong Deck Landings, which is why this section contains the greatest depth of analysis of the WDL problem.

Figure 2.1 – Type 1 and 3 errors on the fault tree.

2.1.2 The Visual Transition Zone (VTZ)

The concept of a ‘visual transition zone’ (VTZ) has been created to help examine and articulate the process by which pilots replace the FMS navigational cues used to locate the platform, with the visual cues (the sight of the platform) used to set up the approach and/or land. The dotted line in Figure X below shows a theoretical VTZ during a normal (non-shuttle sector).

Fig 2.2 – The black dotted line is the theoretical visual transition zone (VTZ) for a normal sector (non-shuttle).

The ideal transition from FMS to visual cues would probably consist of a comparison period, a reliable swapping of cues from FMS to visual (target selection) after scrutiny is applied, and a number of subsequent cross-checks. From simulator observations using the eye tracker, and line observations, it was observed that the VTZ is very changeable, but can consist of an increase in use of visual cues, accompanied by reduction in use of FMS cues, followed by full changeover on final approach. However observations and data showed that the VTZ rarely matches the shallow straight line shown in Fig 2.2, and the evidence shows that other shapes exist, with related vulnerabilities. These will be shown in subsequent sections. A VTZ occurs on all flights where the FMS is used initially to find the platform.

Various methods were used to build up an understanding of the process that occurs within the visual transition zone (VTZ). As well as active analysis (breaking down and unpacking tasks) methods included interviewing using cognitive task analysis type probes, listening to crew conversations while observing flights, on line survey, and analysing eye tracker footage from two experienced pilots flying a number of sectors in simulators (EC225 and AW139). From these it was clear that the VTZ can be split into at least two cognitive components:

1. Platform selection 2. Platform acceptance

These are reflected in the extended branches of the fault tree, see Part 3 of this report. The two parts of the task may occur almost coincidentally in some cases, but are nevertheless separate in the cognitive sense.

Theoretically the visual transition zone (VTZ) provides crews with a period of coincident cues (both FMS and visual sight of the platform occurring simultaneously) and therefore opportunity to reliably cross-reference the visual target with the FMS generated waypoints. However whereas both cues are theoretically available, in reality the FMS cue retains maximum specification throughout for the period, whereas the visual cue starts off under-specified (unless it appears late in the sector) and becomes increasingly specified as the helicopter approaches the platform.

2.1.3 General catalysts to triggering errors

The data analysis and discussion has identified numerous issues that can be worked with (termed specific and general catalysts) that can lead to wrong deck landing incidents. This is not a full list, because many of the issues identified on the fault tree have been deemed impractical or impossible in terms of playing a role in a solution, and must therefore be assumed to continue to impact upon the issue as normal (e.g. fatigue, lack of attention and general misperception).

2.1.3.1. Decoy Platform Concept

Most wrong deck landings only feature the wrong installation/vessel; the right one plays no part. The wrong platform/vessel is therefore the key to understanding WDLs. In the vast majority of wrong deck landings, the pilots were attracted to a different platform/vessel that acted as a decoy, as opposed to them simply losing the intended platform/vessel and picking up a different one, or not being able to find the intended target. The destination (decoy) characteristics are extremely important in creating a wrong deck-landing situation. The benefit of this is that these characteristics should be foreseeable in most cases and so this concept is helpful from an intervention perspective.

The concept (being termed the ‘decoy’ platform) emerges strongly from analysis of multiple sources where actual incidents and close calls were focussed on. The concept became apparent when coding anecdotes, incident reports and interview transcripts relating to real events. It did not feature at all in general narrative from the survey regarding reasons why pilots think WDLs happen.

In the decoy concept the intended target is ‘paired’ with another platform (the decoy) and this is usually fixed for a considerable time (possibly permanent). In a WDL incident or close call, this decoy (usually close to the intended platform) attracts the crew’s acceptance before the intended target, or on rare occasions attracts the crew away from the correct target. The decoy often holds the crew’s acceptance until landing (creating a WDL). A decoy is therefore akin to a twin of the intended platform, although it does not have to share many features with the intended platform to become a decoy and create a WDL.

The decoy target concept is subtly different to the concept that pilots comment upon whereby many decks nearby are similar. In situations where a number of decks exist, crews can find it difficult to select the correct one from the others, or distinguish one from another. This is not always the case in a decoy situation; the crew may only ever see the decoy. In cases of a decoy the crew are not usually attempting to discern or distinguish one rig from another/others in the area, but are simply trying to spot and confirm their target platform as they would normally. In many cases they are not aware, or vaguely aware of the potential threat of a decoy. Only after landing on it do they become aware of the decoy threat in hindsight. In a decoy situation, the crew fly normally and try to locate

the correct platform in a normal way, but they pick up the decoy in error, and fail to realise it is not their intended target.

The characteristics that the decoy and the intended target share must be considered as the strength of the decoy. Where the intended target platform (whether an installation or vessel) is highly paired with a decoy the chance of a WDL is substantially increased. The shared characteristics are called the decoy- pairing-characteristic (DPCs) and relate to characteristics of the decoy that pair it with the target, that can potentially lead a pilot to select and accept the decoy instead of the target. Common DPCs include the following:

• Similar position • Similar looking infrastructure • Similar name • Similar size • Similar colour • Similar type of installation or vessel • Close to the target platform (although this is not straightforward) • Same NDB frequency • Similar bearing from the helicopter • In line with the approach track

Environmental conditions such as wind direction and visibility can strengthen a decoy considerably by creating or strengthening its Decoy-Pairing- Characteristics (DPCs), such as making the approach paths align, or skewing contrary characteristics such as dulling the platform colour.

It appears that in some cases only one strong DPC is needed to create a decoy, but the more there are the stronger the decoy will be paired with the intended target. However due to the tendency to use few cues for identification, a single DPC can cause WDL by the pilot picking up and accepting the decoy based on one piece of information. After this, confirmation bias tends to focus crew attention on that one DPC to reassure the crews that the correct platform has been acquired (see next section). This can lead to surprising events whereby crews land on platforms named very differently, or of a different type to the intended target, or some considerable distance away. More than one DPC will clearly increase the chances of the wrong platform being selected and accepted. Notably however, the decoy may have some characteristics that are dissimilar or even contrasting from the intended target, and may have nothing in common with the intended target except positional similarities (themselves a DPC). However these can also go unnoticed.

Since Decoy-Pairing-Characteristics (DPCs) attract the pilot to select and accept the decoy instead of the main platform, it is not that the pilot has trouble locating the intended landing site (although this may play a role) but more that another landing site is selected and accepted first (the decoy) and the error does not come to light (is not trapped). The characteristic situation is that because the

pilot is looking for a particular target in seemingly normal circumstances, alarm bells do not ring when the decoy is found first (comes into view, appears, is the only rig in sight, etc.). The error can also be promoted by factors such as the intended target being obscured or not visible (shadowed, masked, hidden, etc.).

DPCs will be extremely important considerations as a basis for any algorithm used to generate WDL threat likelihood.

The obvious part that decoy installations/vessels play in WDLs can be illustrated by considering that a WDL cannot occur where there is only one platform in the area. Hence considering only the target platform in the solution will always be insufficient. Currently decoys are hardly considered in planning or threat consideration (let alone as part of the solution) and yet most sectors end with a platform or vessel that has one or more decoys in the area. The potential decoy platforms to that target and the relationships between the platform and the decoys should be accounted for when a realistic risk of WDL exists for any reason (conditions, decoy type and closeness, etc.)

Whereas a known highly-paired decoy is a WDL threat, an unknown decoy is a substantially greater threat. This will normally take the form of another similar vessel. When planning to land on vessels, a search for potentially highly paired decoys should be initiated at the planning stage. In some cases similar ships (e.g. belonging to the same company) will be known. In other cases it is worth considering the use of electronic resources (such as MarineTraffic) that could offer information as to whether similar vessels are in the area. If a crew knew that two very similar ships were in an area, precluding easy visual identification, then they could manage the threat at the briefing stage and perhaps choose approach types to minimise WDL likelihood.

2.1.3.2. Resource Use and Limitation

The fault tree (part A) illustrates how this factor affects the ability to find the right target and the propensity to accept that target.

On many occasions when the platform is being selected or accepted, there is high task load for one or both pilots (particularly during shuttling). Sometimes this is an unanticipated task or a newly introduced task that must be accomplished in addition to the normal task. Where these situations exist, the pilots are more likely to make selection errors because their monitoring of the platform will be in the form of occasional short dwells outside, rather than longer repeated dwells that are used to maintain the overall picture of platform positions. They are also more likely to accept a colleague’s platform selection, and may even do so with a cursory glance at the target.

It is of note that platform selection and acceptance is often not denoted as a specific responsibility within role of PF and PNF. If the PF is flying manually, then the opportunity for a visual acquisition error is relatively high, and so in such

cases the PNF should take the primary role in insuring correct platform ID where phase of flight allows PNF visual line of sight to the platform (e.g. prior to the final approach). However if the PNF has secondary tasks that demand visual resource, then both pilots may be vulnerable to mis-selection and acceptance errors, and may well not recognise the cross-cockpit vulnerability of their colleague. Engrossed in tasking of one kind or other, both pilots might assume the other has performed normally and therefore not cross-check or apply scrutiny.

The obvious issue here is the selected level of automation. The PF should maintain a high level of automation if the PNF is occupied.

2.1.3.3. Familiarity

The familiarity of a situation can lead crews to select and accept targets easily, from their previous experience. In most cases this is both useful and accurate. However where an unusual situation arises with a decoy more heavily paired than usual (e.g. due to conditions or circumstances), the familiarity can lead to the crew not scrutinising their choice after picking up the decoy.

2.1.3.4. Multiple identifiers

In the present system, it is well known that there are multiple identifiers for the same platform, and crews will use a number of these (ICAO identifier, marine identifier, FMS identifier, etc.). This may be necessary in many respects but it is a very large general catalyst that drives many WDLs indirectly. It is one of the only catalysts (specific or general) that has an impact on all dimensions of the problem, including all three error types, and at all levels (from platform selection to error trapping).

The permutations by which this has the potential to assist in the cause of WDLs are numerous. Clearly the transposing of one platform ID into an erroneous one is ever present in all stages of the flight. However the issue also makes passive error trapping (the noticing of inconsistency) much more unlikely in many circumstances.

2.1.4 Specific catalysts

2.1.4.1 Steep VTZ

In the majority of observed cases the visual identification of the platform was accepted as being correct (active scrutiny then closed or compromised) very soon after the first visual call, often with a simple “check” from the other pilot with no subsequent observed scrutiny from the crew. This means that many crews are closing the scrutiny process on visual targets very quickly after selecting them, which equates to a very steep visual transition zone (VTZ) in most cases, as shown below (Figure 2.3). Several additional factors aggravate this as will later be shown later.

Fig 2.3 Steep visual transition zone. This shows the visual transition period as an initial action of selection and acceptance, where the transition is effectively completed. The deck ID procedure is not part of the VTZ in this case, but is an error trapping action.

The steep visual transition was further confirmed from some eye tracker footage showing that once the target is located and quickly accepted, all further visual scrutiny is concerned with using the installation as a visual, not checking the identification of it. Although not situationally realistic this does give further credence to the theory. Interviews also tended to back this up.

A sizable minority of flight observations noted a different VTZ process. In these cases the process of scrutiny was left open after first selection, or at least there was no obvious closing of the process immediately. This gives a VTZ profile that has an initial selection followed by a longer period of visual transition as shown below (Figure LVT). Notably, the length of this process did not show a steadily decreasing pattern, and most pilots who did not accept the first sighting waited a noticeable amount of time before accepting in most cases (sometimes tens of seconds, sometimes tens of minutes). In most cases the process did appear to be closed (target accepted) before the final error check on final descent. In other words, it appears that in most cases the VTZ is steep (select and very quickly accept) but when it is not that shape, it can be almost any other length after the

initial selection of the target. The one relatively common factor was that crews appeared to indicate acceptance of the platform prior to the final error check.

Figure 2.4 – Less usual Visual Transition Zone, whereby the initial sighting is left open to scrutiny for a relatively long period before being closed off prior to the final error check. This gives a much longer period of scrutiny than the steep VTZ in Figure 2.3.

2.1.4.2 Early target selection

The difficulty of early visual platform acquisition was matched by the data with regards to vulnerabilities around mis-selection and incorrect acceptance when pilots visually select and accept the platform at long distance.

Evidence showed that on most sectors pilots attempted to visually acquire the platform as early as they could. There was no obvious trend as to which pilot (PF or PNF) tended to acquire the platform first. Twenty-four observations were logged of initial platform visual acquisition in VMC. These observations showed that the average point where the first pilot saw the platform (based on listening and watching the crew) was 6.1 miles from the platform. Four were made over 10 miles out (the furthest being 27 miles) but many were made much closer in (eight were within 3 miles). Hence large deviation existed, mainly due to the distance of the sector and the weather conditions.

The chances of selecting the wrong platform at long ranges is relatively high due to: • Lack of target detail • Greater difficulty judging distance • Greater chance of the intended target not yet being visible (far left of fault tree) • Greater chance of selecting a decoy where one exists (see next section).

It has been explained that an initial error of selecting or accepting the wrong platform early on (often in a steep VTZ) can go unchallenged or get locked-in by confirmation bias and minimal cueing, even in the face of increasingly contrary cues as the distance closes. Hence the greater the distance at which the crews

initiate the VTZ process, the greater the risk of picking up, accepting, locking in and landing on the wrong deck. Attempting to select the platform early is therefore a factor in triggering some WDL incidents.

The observations showed that the mean point at which crews diverge from the lateral navigational track in order to manoeuvre onto an approach course was 3.1 miles (maximum observed 6 miles, and minimum 0.8). Given the mean VTZ initiation of 6.1 miles (and maximum observed of 27 miles), the conclusion of interest is that crews are initiating the VTZ process unnecessarily early. In other words, crews are selecting and accepting the visual target and then continuing on the GPS track in any case for a considerable time (usually with the autopilot coupled). They would have continued in that way whether they had spotted the platform or not. So the sighting had no effect until later and therefore an early sighting is of no benefit and makes no difference.

This means it would have made no adverse difference had they selected the target a lot later, but in doing so would have substantially increased the relative chance of correctly selecting the target. This is important because after the VTZ or initial selection is made, crews are less likely to apply scrutiny, more likely to lock-in the early choice through confirmatory processes and ultimately more likely to land on the deck they select first. Hence the first selection of the visual target should be made at a point where the chances of it being wrong are lowest (as late as possible) which is not currently happening. Currently crews are simply selecting the target as early as they can.

This effect probably accounts for the number of WDLs that occur on good VMC days, because on poor days there is less opportunity for early selection and the subsequent locking-in effect.

It was clear from the observations that on many occasions crews were actively looking to find the platform at long range. This often coincided with ‘down time’ in transit (when crews were under low workload with the autopilot in and awaiting the next step in the process, for example engaged in non-operational conversation during a long transit leg). There appeared a natural temptation for pilots to find the platform early in order to step on through the task. This could be partly due to a need to identify the platform while the workload is still very low, before entering a higher workload phase (when visual acquisition and confirmation might be more challenging). It could also be that at such a stage in a long sector, finding the platform represents the next step in getting the job done, and so can feel like a more important part of the process than it actually is.

2.1.4.3 Group factors (social influence)

Observations confirmed that pilots usually steer each others’ attention to the first visual acquisition, meaning that when a pilot notices what they believe to be the platform, they immediately direct the other pilot’s attention to the location of what they see (often pointing to it, or stating features to locate it such as

“directly under that dark cloud”. In most cases the other pilot promptly agrees with the first sighting of their colleague (usually within seconds and with seemingly minimal scrutiny). This will reliably insure that if the decoy platform is more visible and so is erroneously selected, both pilots will make the same error.

When this occurs, it is highly likely that the apparent agreement will act as further confirmation that the correct target has been selected. Both pilots may then apply less scrutiny than they would do if alone, or both pilots feel more confident in their visual sightings due to the apparent agreement (or lack of disagreement) of the other.

Hence, drawing the attention of another pilot to the visual target degrades the independence of the crew in locating the platform. The second pilot verbalising their agreement provides additional confirmation to the first pilot that the correct platform has been located. Elements of groupthink are immediately formed. This groupthink is usually correct, because on most occasions the right platform is selected. However if not, if not it makes subsequent realisation of the error less likely because neither crew feel as much need to challenge their acceptance as they would without such an effect, or if they were alone.

Such effects are well known, and observations showed indirect but strong evidence of these, and no evidence of them being defended against.

2.1.4.4 Strength of Decoy Pairing Characteristics (DPCs)

Where a decoy platform is similar to and/or in a position that is not unexpected (not even an expected position), the chance of this being selected and accepted instead of the intended platform is relatively high. Clearly the more factors are paired, and the stronger they are, the more chance the decoy has of being selected. Proximity to expected position is also a factor, although not a simple linear one, since if the intended target is very close to the decoy it is less likely to be overlooked.

2.1.4.5 Loss of visual contact in circuit and final turn

Observations found that in a left hand final turn (particularly) with the PF on the right, visual contact with the platform is lost for significant amounts of time. On several occasions it appeared that the pilots initiated the roll out in two phases; firstly based on turn rate and/or timing, and secondly adjust the approach heading to the visual picture. This leads to the risk that the correct target could have been selected, but once lost a decoy gets selected during or after the turn.

2.1.4.6 Weather

2.1.4.6.1 Visibility

There is no simple continuum or correlation between visibility/conditions and WDL risk. This is because different weather conditions promote different triggering factors in WDLs. Very good visibility is a risk due to early selection and lock-out. Moderately poor visibility is a risk due to the target platforms being hidden and decoy platforms being picked up first. Very poor visibility leads to an ARA, which is less of a risk (although not completely risk free).

2.1.4.6.2 Wind direction

Increased risk is created where wind direction is matched to bearing between intended and decoy platforms. When this happens a situation is created whereby a decoy platform is positioned on the same approach track as the intended platform. This creates a high risk of WDLs particularly in relatively poor visibility. One of the main cues to selecting and accepting a platform is that it is seen in position ahead of the helicopter. Pilots are used to identifying their target platform in the 12 o’clock position, and are therefore used to searching a small arc ahead for the target. Having a decoy in this position is a major risk, because the pilots can lock onto the decoy platform using only this expected the position as their primary cue, and reject contrary cues as explained.

2.1.5 Accepting and locking the triggering error

2.1.5.1 Lack of scrutiny after initial target selection

Notable from observations was the tendency of crews to drop active scrutiny of targets once they had been seen and accepted (often very quickly in a single VTZ)

2.1.5.2 Confirmatory thinking

Where crews did comment on platforms after the VTZ or initial visual selection, there was a tendency of crews to use conformational comments of platform identification, as opposed to active scrutiny or questioning.

This type of pseudo-questioning or commenting can easily lock in a wrong target as well as a right target. This is worse when the VTZ is quick and steep, because then the visual target has been accepted as the correct installation and the scrutiny relaxed immediately. The comments can be characterised as “this is why we are right” comments as opposed to “this is why we could be wrong” comments. This is sometimes referred to as confirmation bias. In the former case, crews attempt to fit expectations to data (what they see) and vice-versa. They can easily miss unexpected features because they are not actively looking for these. The problem with such questioning is that it easily fails to account for what is seen but is not expected, and what is expected but not seen. It tends to account mostly for what is both seen and expected.

2.1.5.3 Use of limited (or single) cues

Notable as a related issue, was the fact that commonly only one or two visual elements were used (often repeatedly) to make and confirm the identification throughout the identification and acceptance period, and all the way to the final platform identification before landing. Coupled with the confirmatory commenting and questioning, this demonstrates why crews can land on a wrong deck in the face of some seemingly obvious contrary evidence.

2.1.6 Error trapping issues

2.1.6.1. Signage and platform identification

Platform signage plays no part in the visual selection of platforms but in terms of error trapping it is the primary element, because it represents the only definite confirmation of the platform. The signage needs to be readable from as greater distance as possible, and from all angles. Currently, there are many problems with identification signage:

A. Position of signs B. Missing signs C. Clarity of signs & font D. Platform names E. Colour F. Extraneous lettering on signs G. Inconsistency of identifiers

A. Position

The current position of platform signage is too far from the helipad and inconsistent

Eye tracking data supported by observations confirmed that the helideck gradually becomes the only major visual reference used by pilots as they approach it, and then is held by them until landing. Very few natural eye movements are made by the PF away from the deck once the helicopter is within 0.5. miles (often reading distance) from the deck. Although pilots often look around the deck and near obstacles while approaching (e.g. at cranes etc) the eye shifts are small, prepared, and usually within a few degrees of the deck references.

For this reason any signage that requires the pilot to look more than a few degrees from the deck (or search for it) causes the pilot to look away from the primary references that the pilot wants to be looking at.

Such distraction from the handling task has the potential to be a serious safety risk. However on the vast majority of occasions pilots will not prioritise a search for signage over flying control and so they will unconsciously drop the search and confirmation process to concentrate on the flying task references. The sign may not be fully read, and errors in verbalising the sign are more likely. Expectation bias could also cause the pilot to say the expected identifier rather than the real one they looked at because they have not devoted sufficient attention to it. However this means that no final error trap exists in many cases because flying pilots do not have the spatial capacity to both search and fly accurately. Signage should be easily discernable and in the same area as the visual references the pilot is using at the time. Pilots will be able to confirm or

read a sign that appears clearly in the area that they are already looking, even under moderate workload.

Figure 2.5. An example of current signage

The picture above (Figure 2.5) shows a current platform signage example. The sign is positioned out of sight of the PNF and will cause the PF to switch attention from the handling of the helicopter, for several reasons:

1. The distance between the primary reference used for controlling the helicopter at this point (the helideck) and the sign, is too great. 2. The lack of salience of the sign (it needs attention just to find it, before it is read, because it cannot be easily located by the eye – it does stand out in the peripheral vision, and the position cannot be learned (like the position of an instrument) 3. The size of the sign (it cannot be read until late finals) 4. The extra letters around the name (“P15/C-PP” instead of “P15”). This demands attention because the word cannot be deciphered in a single brief glance.

The above mean that the platform identification process will often be flawed, and unlikely to trap errors, because the pilot cannot devote the attention required, and in many cases will either not attempt it or will do it unconsciously and without scrutiny.

It has been shown that even having to calculate cross-wind from an ATC call is enough to interfere with a manual flying skill task on approach, and that is without an off-task visual reference required to obtain the information.

The greater risk in this situation is enforcing a situation where pilots must pay more attention to the signage (against their natural instinct). If they do this with the current situation described, the manual control task could be impacted. Occasionally such an impact will trigger an incident or even an accident.

B. Missing signs

All the above applies equally to missing signs, but these have the potential to cause even greater distraction as the PF attempts to locate them but is unable to..

C. Clarity of signs & font

The present system presents the IDs as capital letter codes. Capital letters are known to be more difficult to discern at a distance due to the shape created by them (the percept), which is a rectangle, whatever letters are used. Signs are often faded or dirty. These unmaintained signs can be unclear and draw too much attention from the flying pilot. The safest effect that this will have is that the pilot will prioritise the flying over the platform identification.

D. Platform names

There are two issues here. Firstly decks in similar locations often have very similar (or near identical) names. This means the decoy can have a similar name to the intended target. Secondly, the names are not meaningful. However the latter probably becomes less of a problem with experience because crews learn the platform names as words that relate to platforms in a meaningful way.

E. Colour

Colour of signage is not always consistent, and this makes a sign slightly harder to locate easily. All signs should be consistent in order to be easily spotted and mentally confirmed as being the deck ID without the pilot having to pay undue attention to this aspect.

F. Extraneous lettering on signs

The ID that the pilot needs is often contained within other elements of the ID. This means that the ID must be selected from a longer code. Under moderate manual workload, this adds to the likelihood that pilots will ignore the sign or simply state what they expect, because otherwise too much attention is demanded, and pilots rightly prioritise the flying task. .

G. Inconsistency of identifiers

Pilots often have to transpose one platform ID type for another. The maritime identifier, FMS identifier and ICAO identifier can be different. This provides large potential for error, and also weakens the error trapping.

2.1.6.2. PF/PNF activity on late finals.

On late final approach, PFs fixate almost exclusively on the helipad, which is necessary and should not be changed. However observations showed a wide variety of PNF actions during the final approach. Some PNFs were heads up throughout the approach, some were heads down, some mixed. Whereas the checklists can require both PF and PNF to confirm the platform name, one of the major difficulties that PNFs face on final approach is that on many occasions they are physically unable to identify the platform because the signage is not visible to them. It is therefore of little use expecting or proceduralising PNFs to confirm the platform ID, if the problem is that they cannot see it. The fix is to make it visible PNF and if this cannot be done, to implement a system whereby PNFs do not need to see it.

2.1.6.3. Non-use of radar

Observations found that not all crews had their radar switched on for all approaches. Radar offers an additional protection over the FMS; it highlights decoys that are not in the FMS or nav system, and may have been picked up (such as other ships or platforms not highlighted on the Nav display). Thus it can be used to reject decoy platforms when overlaid with the FMS. In several cases of anecdotes, had the radar been on, it could have brought the crews’ attention to the fact that there were two platforms in the area when the crew thought it to be only one, and had picked up the decoy.

2.2 Type 2 errors

These errors occur where the FMS / NAV guides the crew to the wrong platform / away from the right platform.

Figure 2.6 Type 2 error location in the high-level fault tree

Data collected show that this mode of WDL makes up only a small minority of the cases. Analysis show that there are a number of possible ways that the wrong platform is presented to the crew as the intended platform before reaching the visual transition, but that none are common, and there are no strong trends. The two exclusive modes of error are:

1. The Crew transpose the right information into the wrong information and enter that into the navigational process.

2. The Wrong information is given to or presented to the crew (including where the FMS database is incorrect or not up to date).

Both these modes can occur either prior to the pilots boarding the aircraft, after boarding pre-flight, and en-route.

The data show that the most common problem is the crews being given the wrong information, however there is no general trend, and even this issue is insufficiently frequent to produce reliable trends. There appear to be many ways that the crews can come to be in a situation whereby they are guided towards the wrong platform before visual acquisition. For example crew can be given the wrong platform as the route, the wrong / conflicting information or the right

platform name/route but the wrong information relating to it. In these cases there is little the crew can do to protect against a WDL. If the crew are given the wrong platform as part of the flight plan, then from their perspective it is not a WDL, since they have carried out the plan correctly. Only if they have been given the conflicting information (e.g. right vessel but wrong coordinates) do they have a chance of trapping it. However where the FMS and the crew intention are both set for the wrong destination (for whatever reason) the crew have a high probability of carrying out that route and landing on the wrong deck.

The survey, along with incident analysis, shows that this problem is neither perceived by many pilots as being a large issue causing WDLs, nor did it feature in the actual related examples (anecdotes). For example the number of comments given relating to the following four factors are as follows:

Imprecise non-updated position reports from moving vessels 5 Select wrong position or coordinates in FMS 8 Select wrong rig in FMS - similar name 1 Crews given wrong information 1

This means that only 15 out of 316 comments given by pilots for perceived WDL causes related to the NAV/FMS containing the wrong platform/route.

This was backed up by the reasons given for actual events (anecdotes) as follows:

Imprecise non-updated position reports from moving vessels 2 Select wrong position or coordinates in FMS 0 Select wrong rig in FMS - similar name 0 Crews given wrong information 4

This means that only 6 of 129 reasons for WDLs events (anecdotes) related to the issue.

In terms of actual incident reports, fewer than 5% of reports could be related to an unintended platform in the navigational route. This number is probably lower, but depends how the analysis is performed, and involves some level of conjecture where information is unclear within the report.

The other issue that can occur is where the FMS information is wrong / out of date, and this can lead crews to navigate towards a point where a platform or vessel is not located. This does not necessarily generate a WDL because in almost all cases there is no decoy platform in the position either. However the factors that creates problems in the visual transition zone (type 1 and 3 errors) equally apply in this case, and so for these errors, the analysis and fault trees for type 1 and 3 errors is appropriate.

It is possible that between 4 and 8% of WDLs are caused by these issues. In surveys, pilots perceived this to be a greater issue than a straightforward wrong route or platform in the system. The factor “Rig position information wrong (e.g. not up to date, moved” was eluded to by 11 pilots in the survey, and seen as contributory to 3 incidents (from anecdotes).

Nevertheless, these findings reveal that this issue is minimal when compared to the incorrect visual transition issue.

PART 3 - IN-DEPTH ANALYSIS OF THE WDL PROBLEM

3.1 Expanded fault tree analysis - acquisition of wrong target

3.1.1 Overview of wrong target acquisition

Part 2 gave an overview of the analysis at a high level, including the top level of the fault tree analysis (shown below). From there the analysis became progressively deeper, unpacking the various independent and dependent error modes that lead to wrong deck landings, with most effort given to the main error mode of selecting the wrong visual target. The light blue filled boxes in Figure 3.1 below represent the main error type for WDLs – the visual transition issue. The main extended fault tree analysis looked into this issue, and hence applies to the extension of either light-blue box.

Figure 3.1 - High level fault tree

The bottom of the fault tree in Figure 3.1 shows that Type 1 WDLs (FMS route correct) are either related to selecting the wrong platform when transitioning from FMS to visual cues (thereby landing on the platform that they did not intend to) or by flying to a platform that the crew thinks is the FMS route, but it is not (thereby landing on the platform that they intended to, but that was the wrong one). These will be discussed in turn. The former is filled in light blue in

the diagram because it involves the visual transition error shared by Type-3 WDLs, and these errors will be analysed in depth.

3.1.2 Wrongly perceived or recalled route/platform

The red oval in the figure below shows the location of this error type on the fault tree.

Figure 3.2 – Location error type (Wrongly perceived platform)

This is not a common error, but cases did appear in the data (survey and interviews). An example is where a crew was shuttling between two platforms repeatedly but with one change within that plan. They forgot this change (or mistook it) and flew to the ‘normal’ platform in the route. In these cases the error trapping is much more difficult to achieve. These WDLs provide a strong case for a crew to follow the FMS route even when they know the platforms, and can see them. It is also important for the crew to recheck the next platform in the plan before departing. This branch has not been extended due to the small number of cases, but was considered in the recommendations.

3.1.3 Incorrect Visual Transition

The red ovals in the figure below show the locations of this on the fault tree.

Figure 3.3 – Location error type (incorrect visual transition)

Visual acquisition errors are caused within the VTZ (by definition) unless, as could hypothetically occur, there is no VTZ because navigational cues run out before visual cues appear. FMS under specification makes the VTZ exceptionally vulnerable to error (causing type 3 errors) and is the most likely cause of there being no VTZ because the FMS cues end before the visual cues begin. This would mean no period of redundant cues and therefore no opportunity for cross- checking.

WDLs caused by incorrect visual transition (whether part of ‘FMS correct type 1’ or ‘FMS underspecified -Type 3’) occur when the crew navigate to the correct platform using navigational sources such as the FMS, until a visual identification error occurs at which point they diverge from the intended track and land on the wrong deck. They may switch straight from the FMS route to visual acquisition of the wrong deck, or may make a correct switch from FMS to visual, but swap to the wrong deck before landing. Other theoretical possibilities exist within this set, such as the crew diverging from the route and then using the wrong FMS waypoint to select a visual target, or the crew mistaking a waypoint for a destination.

In type 3 errors (route under-specified) there is a high chance of a transition ‘vacuum’ where the FMS guidance has ended before any reliable visual identification of the vessel or platform is possible. Such gaps are a breeding ground for errors causing WDLs.

3.2 Expanded fault tree analysis – Acquisition of wrong target

This element of the fault tree can be extended from either the left or right hand node (box 1 or 3) of the very high level tree shown in Figure 3.1, but is not relevant to the central node (box 2). Hence it is for use when the FMS position has been correctly programmed, whether or not it is highly specified.

It was clear from the incident reports and online survey that by far the most common causes of a triggering error leading to a WDL (or ‘near-miss’) is the selection of the wrong platform despite the right platform being correctly prepared for and correctly shown on the FMS/Navigation display. Hence, this aspect was analysed in considerable detail with an expanded part of the fault tree that took account of all WDLs caused by visual acquisition of the wrong target (Figure 3.4, below). Note the three AND gates at the top two levels. This shows that a wrong deck landing caused by the visual target error (by far the most common cause) and this requires three occurrences in order to create the triggering error and two failed occurrences to breach error trapping.

Figure 3.4 - First part of extended fault tree branch (trigger and error trap)

As can be seen, a triggering error is made up of the following three factors, all of which are required to occur. The process of these factors is linear (one after the other, with the exception that they may occur almost coincidentally) and therefore the process equates to the period of the VTZ (visual transition zone). The three factors are:

1. Correct target not selected 2. Wrong target / Decoy selected 3. Wrong platform / Decoy accepted

If the error is to continue to the incident consequence (not get trapped at any point during or after the VTZ), the following are necessary:

4. SOP / formal error traps fail 5. Ambiguities not noticed or rejected

Because all these five factors must combine, there might appear to be a good opportunity for resolution. However the three triggering occurrences could all occur as a single event. This would be particularly likely in the event of a strong decoy being present because if the decoy is seen before the intended target and accepted then the initial occurrence (Correct target not selected) is fulfilled by default. If the decoy has a very strong Decoy-Pairing-Characteristic (DPC) or more than one DPCs, then it might also be accepted very quickly, or even instantly, leaving the error trapping as the only defence against a wrong deck landing. This is particularly likely with a moving vessel, and with poor visibility.

The factors are each expanded upon as follows:

3.2.1. Correct target not selected

As can be seen in the diagram (Figure 3.5, below) there are a large number of OR gates in this branch. This shows that there are many ways in which that this failure can occur. From an intervention perspective, this is problematic because any of these could independently create the top condition, meaning each would have to be mitigated for. This situation is usually best resolved by using an error trap at a high level (or above the level) to catch all the various possibilities, rather than attempts to rectify each possibility at the root. Where the individual factors at lower levels can be easily mitigated for or defended against then attempting to resolve at the roots can be worth doing, but the fault tree indicates that the underlying causes here are difficult to deal with in many cases, and impossible in others. Also, some of the mitigations will form of overall mitigations across all parts of the analysis (e.g. correct target insufficiently identifiable’).

Fortunately in this case the branch is one of three joined by AND gates (as shown earlier) and so targeting one of the other two factors that conjoin it will be effective against errors on this branch. Against this background and since this factor can be breached as part of factor 2 (particularly when dealing with a decoy platform) it is not considered beneficial to make interventions based on this aspect of the problem.

Figure 3.5 – Causes of a failure to select the right target. The yellow branch referred to as ‘A’ is shown below in Figure 3.6.

Figure 3.6 – this extends from a number of parts of the fault tree, and is concerned with limitations of the cognitive resources.

Figure 3.6 illustrates that automation levels have a part to play, and this is controllable. Since ‘A’ features in a number of branches of the fault tree, it is worth looking at from an intervention perspective.

3.2.2. Wrong target / Decoy selected

Figure 3.7 (below) shows five independent factors that can feed this error. As with the previous factor, there is no realistic way to prevent pilots from many of these. For example a pilot may well see the decoy platform first due to many reasons including weather, position and obstruction, none of which are within the control of the operators. However, like the previous factor, there is some scope for read-across between braches; for example the HLO communication features in both. Where a single factor features in a number of branches, there can be value in tackling it, particularly if it has the potential to be a common error mode that creates failure on both branches coincidentally.

Figure 3.7– Causes of mis-selection

3.2.3. Wrong platform / Decoy accepted

Figure 3.8 – The fault tree for ‘wrong platform/decoy’ accepted

This branch of the fault tree is perhaps the most important in terms of WDLs. It is related to the period of time called the Visual Transition Zone (VTZ). Figure 3.8

shows the branches describing the issue of pilots accepting the selected wrong target as the one they are intending. In order to do this they must have failed to find the right target as well as have selected the wrong target (start of the VTZ). Once selected, the might erroneously accept it as the right target immediately or over a period of time, and that period of time equates to the remainder of the visual transition zone - VTZ). Given the period of time this process usually occurs over, there is more room for intervention than the first two processes.

Notably, the highest level of this branch contains four elements under an AND gate. This appears to be a safe situation. However there is a common branch termed ‘B’ which extends from three of the four elements. This is therefore an important area to look at because it has the potential to cause a failure on three of the channels through a single common mode.

The sub-fault tree entitled B (with a grey background) is therefore perhaps the most critical part of the fault tree analysis for WDLs.

Additionally the common branch termed ‘A’ occurs once in this branch of the fault tree. Since ‘A’ occurs in other parts as well (previously shown) it must be looked at more carefully in terms of possible interventions, and possible common mode failures. Interventions would have a chance of preventing errors caused by common mode failures within ‘A’.

The sub-fault tree ‘A’ is therefore also a critical element of the overall analysis of WDLs.

3.2.4 SOP / formal error traps fail

This element is not extended as part of the fault tree analysis since many different error traps and procedures are used across the industry and in different fleets and operations. Suffice to note that error traps involving just flight crew do not prevent all WDLs from occurring. However interviews and survey data related to ‘close-call’ anecdotes do show that WDLs are often prevented by the current error trapping procedures in place. Therefore care should be taken before changing or dismantling the current system.

3.2.5 Ambiguities not noticed or rejected

Clearly ambiguities will exist where the wrong platform has been accepted by a crew (whether installation or vessel). In other words not everything about the wrongly selected platform will match the intended platform. These may be quite small. In most cases of the WDL events the ambiguities were simply not noticed. Usually this is due to the decoy issue; a decoy-pairing characteristic (DPC) has closed the cognitive and CRM process of scrutiny despite other platform characteristics being clearly ambiguous. However in some cases ambiguity is noticed but is dismissed. This is not usually caused by an intention to violate or to take a risk, but is usually due to confirmatory thinking processes (related to

confirmation bias). The ambiguous feature is rationalised in some way or another. For example a pilot may consider that their expectation of the platform structure must have been incorrect on seeing the different structure.

3.2.6 Full fault tree

The full fault tree relating to visual acquisition of the wrong platform is shown in Figure 3.9, below. It is made up of all the elements discussed.

3.2.7 Common mode issues (sub-fault trees A, B and C)

Because ‘A’, ‘B’ and ‘C’ are common extensions of a number of higher-level branches in the fault tree, they are both threats and opportunities. They are opportunities because single interventions have the opportunity to prevent multiple failures within the error generating process. However they are also threats for the same reason, because any common elements feeding up into different sides of a fault tree mean the potential for a single issue to cause the high level fault to occur.

Several areas within both A, B and C can be found where interventions can be made. In this part of the fault tree these are around automation management and task changes (A), and around information, expectation management and tackling confirmation bias (for sub-fault tree B).

Figure 3.9 – full fault tree branch for all visual acquisition errors.

3.3 Crew followed FMS to incorrect platform (routing to the wrong helideck)

This is the second type of Wrong Deck Landing mode, as shown below.

Figure 3.10 – location of type-2 WDLs on the fault tree

The FMS route (or platform/waypoint) can be wrong for varied reasons. As the extended fault tree shows (Fig 3.9, below), it can be caused either by the wrong information being given to the crew, by the crew putting the correct information wrongly into the navigation process, or by the database being incorrect. Without trapping, any of these lead to a situation where a WDL is almost inevitable.

Compared to WDLs caused by flying to an unintended platform, these WDLs are uncommon, and there is no particular trend.

On the expansion of the type-2 WDL fault tree (Fig 3.11, below) no single error box contains a majority of events, or even a big proportion of these WDLs, and this is problematic for solutions. The generation of each error type leading to WDLs in this area is quite different, is minor, and would require different solutions prior to trapping. Resolving the problem cannot therefore be achieved by a single or general solution, but requires solutions to all of these errors. This may be inefficient given that each error type may only account for a tiny number of WDLs, but would require a bespoke solution.

Figure 3.11 –fault tree expanding reasons for the FMS / Nav being wrong

What this shows, along with the frequencies from the analysis, is that there are a variety of ways in which the wrong route or platform becomes the navigational target or mission goal, but none are common.

PART 4 - DATA ANLAYSIS SECTION

4.1 Data collected

Various form of data were collected and analysed from the following sources

Observation flights Twenty-six hours of in flight observations were completed on the AW139 and the S92 (62 sector observations and 51 offshore landing observations). Seven approaches and landings were observed from the side window of the AW139, the remainder from a central seat directly behind the pilots (jump seat on S92). Headsets were worn so that crew communications could be monitored.

Simulator sessions Nine and a half hours of simulator time was spent on the AW139 and the EC225. Eight hours of AW139 simulator time concentrated on all procedures that could have relevance to wrong deck landings, and included IFR, VMC and night procedures. Eye tracking was used on the SME (experienced pilot) both to record the session and to assess what identification cues were being used to locate and verify the platform. Ninety minutes of EC225 simulator time were devoted to wrong deck landings at Bristow, Aberdeen. This was used to explore platform identification and navigational issues, and included the use of eye-tracking on one experienced pilot.

Incident analysis Incidents reports were used to gain an understanding of the issue. Basic analysis was performed on a sample of WDL incident reports. The previous overall analysis by the Company was also utilised.

On line survey One hundred and seventeen (117) pilots filled in a narrative online survey (internationally). The survey was voluntary, and attempted to assess pilot perception of WDL causes, actual incidents and ‘close call’ events.

Interviews Ten pilots were interviewed formally, for between 25 minutes and 1 hour 20 minutes). As well as open interviewing techniques, most interviews also included various elements of cognitive task analysis to explore the cues and decisions of platform identification. Informal conversations took place with 12 pilots (often after an observation flight). These were not recorded but points of interest were written up.

4.2 Online Survey

The online survey was filled-in by 117 pilots. It was in two parts; demographics and narrative questions. The demographics collected were as follows (Table 4.1):

Table 4.1 – demographics of the sample Number of captains 94 Number of First Officers 23 Number of Trainers 37 Total (Number of Participants) 117

Experience brackets 0 to 3 5 4 to 6 6 7 to 9 11 10 to 14 16 15 - 19 17 20 to 30 37 30 plus 25

The narrative section aimed to collect information from pilots related to four topics areas. Results and analysis from each of these four will be described in four separate sections.

The topic areas were:

1. Perceived common reasons that WDLs occur 2. Perceived hardware (design / infrastructure) and procedural vulnerabilities 3. Perceived training vulnerabilities 4. Actual Events for analysis (WDLs or near-WDLs)

The questions asked were:

1. What do you think are the most common reasons for wrong deck landings? 2. Apart from training, what could be improved to help prevent wrong deck landings across the industry? 3. If you were training an inexperienced crew, what would be your advice to help your trainees avoid landing on a wrong platform / vessel? 4. What is the closest that you ever came to landing on the wrong deck or vessel? Please describe what went wrong (and why, if possible)

4.2.1 Topic 1 response (Perceived common reasons that WDLs occur)

The pilot population (based on the survey sample of 117) expressed a wide range of ideas when asked Question 1 (“What do you think are the most common reasons for wrong deck landings?”). Seventy-four different perceived reasons (categories) were deduced by thematic analysis of 316 comments. Where an individual made two or more comments in a single category, these were counted as one comment, meaning that the number of comments in any category is equivalent to the number of pilots who gave that reason.

The 74 categories fell into eight broad classes shown in the list below (Table 4.2) in descending order of comment frequency by pilots. The full category list of reasons put forward is shown in Appendix 1, along with a frequency histogram.

Table 4.2 – Eight main causal classes expressed by pilots

No of No of Class of causal comment categories comments

Pilot actions, performance and human factors 41 183 Signage / Lighting 7 39 Rig characteristics 8 37 Operational and general conditions 6 25 FMS / NAV issue 4 19 Helipad (or vessel) communications 4 8 Ineffective procedures or checklists 3 3 Visual cockpit restriction 1 2

The mean number of comments per category was just over four, and there were no ‘stand-out’ categories (the highest number of pilots commenting on a single category was 13 – “complacency”, and the lowest was one; which was the case for many categories). In essence, this shows that no common reason is perceived across the pilot community; pilots see a wide range of issues as being contributory. This may reflect the difficulty of finding and accepting a solution.

Very few pilots gave more than three comments. The spread of different comments does not show a general trend, but does show differences of opinion among the community. Perhaps the largest difference is whether WDLs are caused by pilots or by the system within which they work (including SOPs, infrastructure and equipment).

By far the largest category of perceived causes was of ‘pilot-related’ issue (first category above). Indeed this contained over half the categories and well over half the total comments.

A large number of pilots offered pilot-related reasons for both the event (their ‘close call’ anecdote, question 4 in the survey) and as causal reasons for WDLs in general (question 1). Some also provided anecdotes of wrong deck landings or ‘close-calls’ in question 4 that were self-critical, including comments such as ‘complacency’ (applied to themselves or their other crew member). This appears to be a healthy attitude to the problem, showing that pilots see that they have a role to play in preventing WDLs. This may help to facilitate acceptance of interventions. These pilots appeared to be equally likely to offer critique around system elements, and overall, many pilots emphasise WDLs as system generated errors. They point to the signage, appearance, procedures or companies as generating WDLs.

However, there is a sizable number of pilots who appear to strongly believe that wrong deck landings mainly happen due to poor performance of other pilots. They used phrases such as “complacency”, “unprofessionalism”, “over- confidence and “laziness”. Some of these same responders gave strongly worded responses to requests for examples or ‘close calls’ in question 4, such as “I have not come remotely close to landing on a wrong deck”.

Such responses to question 4, combined with the comments to all other questions suggest that a considerable group of pilots exist that believe wrong deck landings will not happen to them. Such attitudes must be factored in if training is considered. This will be explored further in the section relating to question 4.

4.2.2 Topic 2 (Perceived hardware (design / infrastructure) and procedural vulnerabilities)

Participants were asked the question: “Apart from training, what could be improved to help prevent wrong deck landings across the industry?”

The question was specifically aimed at eliciting thoughts on non-pilot (i.e. non- training) improvements. From answers to this question, the perceived vulnerabilities inherent in the system can be re-validated. No novel or detailed ideas were proposed. The categories of answers given are shown in Table 4.3 below.

Table 4.3 – Comments proposing to improvements that could be made Number of Improvement category comments A lighting / signage system notifying deck available / unavailable 52 Improved signage / deck markings 48 Helideck crew actions / comms / clearances 23 Better/different crew actions (other) 20 Better confirmation of visual ID by pilots 16 More/better navigational/comms equipment / FMS 15 Better confirmation of FMS pos by pilots 8 Improve SOPs 5 Improve cockpit display 2 Improve checklists 2 Always fly automated approaches 2 Scheduling variety into the roster 2 Emphasise vulnerability of WDLs to pilots 2 Offer pilot incentives and rewards 1

Notably, just over half of all comments (100 out of 198) suggested changes to the landing platform (including signage, markings and lighting) to improve visual identification. Of these, the single largest group of comments proposed fitting a new type of simple and clear visual deck clearance system. Most of these suggested green lights for clear deck and/or red lights for a prohibited or closed deck. Some of these comments discussed flags, signals or flares for this purpose. Almost as many comments made up the second largest category: improved signage / deck markings. Most suggestions related to size and clarity of signs. Almost all comments in these two large categories suggested that the number- one problem that pilot’s wanted help with was the difficulty of obtaining simple unambiguous visual confirmation that they had selected the right landing site before committing to landing.

The next largest category discussed improvement to the HLO or helideck communication or clearance to land system. Some suggested the HLO should be visual with the helicopter and issue a clearance to land. Others discussed

clarifying communications. In common with the two largest categories, most comments in this group appeared to show a desire for a clear signal confirming that the right helicopter was approaching the right deck.

Comments directed towards improvements in pilot performance or behaviour made up less than a quarter of all comments (47 comments out of 198). These were made up of three main categories; crew actions (mixed comments), better confirmation of visual ID (the need for pilots to check the platform identity more thoroughly) and better confirmation of the FMS position (the need to check the FMS position on final approach). A few comments discussed making pilots more aware of the issue or inducing them with rewards.

In conclusion, the comments reinforced the general finding from other aspects of the research, that the main issue pilots struggle with is a method to check that they are approaching the intended platform before committing to land. The comments reinforce the suggestion that there is an informational gap at this point in the system.

4.2.3 Topic 3 (Perceived Training Vulnerabilities)

Participants were asked: “if you were training an inexperienced crew, what would be your advice to help your trainees avoid landing on a wrong platform / vessel?”

209 comments were received (not including repeat comments). The categories of comments are shown in Table 4.4, below.

Table 4.4 – Comments proposing advice to inexperienced pilots No of pilot Categories comments Advice for deck confirmation on final approach 117 Emphasise FMS check (on approach) 15 Emphasise visual check (finals) / read name 35 Emphasise use the RADAR to check 5 Emphasise use NDBs (whenever available) 3 Both pilots must check / confirm 12 Need to vocalise ID (read aloud) 3 More focus on final confirmation 13 Establish communication with rig / vessel, HLO confirmation 13 Use multiple information sources / don't trust single sources 9 Maintain sterile cockpit on approach 4 Confirm deck early 3 Do not confirm the deck early 1 Fly a longer stabilised approach 1 General advice 50 Comply / pay more attention to, checklists / SOPs 28 Emphasise consequences to pilots 1 Communication between pilots 2 Tap experience of others 1 General diligence, attention, take time 18 Contingencies 19 Go around if in doubt 5 Fly over or circle the rig prior to approach (or if in doubt) 14 Planning and en route 20 Check position reports/updates en route 2 Continued monitoring of track and distance en route 1 Better Planning / Preparation 17 Helplessness 3 Training cannot help 3

Most comments were general in their approach, and did not go into detail. The majority of comments advise trainees to put more focus on identifying and checking the platform on final approach, either as part of SOPs/checklists or

generally. More focus on planning and preparation was also popular advice. Some participants offered practical operational advise such as lengthening the final approach, always overflying the rig or seeking clearer HLO confirmation. No details were given of any proof that the proposed training interventions work. The general tone was of pilots paying more attention and checking or planning more often and more carefully. Whilst undoubtedly important, such advice will not reduce the numbers wrong deck landings beyond its current level. Only a tiny number of pilots displayed a helpless attitude; commenting that WDLs could not be reduced unless the infrastructure is changed.

4.2.4 Topic 4 - Actual Events for analysis (WDLs or near-WDLs)

Ninety-eight responses were given to Q4. Most were anecdotes of WDLs or ‘close-calls’ as requested (62). Of these, 7 were real WDLs experienced by the respondent, 4 were WDLs that they knew of, and 51 described first-hand near- WDLs (close-calls). A large proportion of responses were denials that the pilot had ever been close to experiencing a WDL (32). The remaining 4 were unrelated comments. The type of anecdote was categorised as in Table 4.5 below.

Table 4.5 – types of response to Q4 No of Category of response / anecdote to Q4 responses Actual WDLs 7 3rd party WDL described 4 Close call (stated as someone else's error / fault) 7 Close call (other's cause, averted by respondent) 5 Close call (acceptance of some role / error) 27 Close call (no description) 12 Not yet' type of comment 9 No (neutral tone) 5 No (firm and expanded) 18 Non-related comment 4

One break down performed was the attribution of each ‘close-call anecdote’ (in other words did the respondent attribute it to something or someone, and if so what or whom?). Forty-one of 51 ‘close-call anecdotes attributed at least one reason for occurring. Table 5 (above) shows that of these 41, 27 respondents included themselves as all or part of the reason why it happened. Twelve respondents specifically attributed the cause to others or to a technical cause. Of these, 5 went further to point out that their actions had averted the WDL.

One important point emerging from this is that only about half of pilots who answered the question reported that they had experienced such an event (either WDL or near-WDL) in which they contributed causally.

Reasons given for experiencing WDLs or Close-calls (Q4)

As stated, sixty-two incidents of either WDLs or close-calls (WDLs that were narrowly avoided) were given. 142 reasons were directly offered by participants for these 62 events (therefore averaging over two per event). The thematic analysis structure that emerged during the analysis of Question1 (Reasons for wrong deck landings) was found to provide most categories required for the analysis for Question 4 (real events). The only additional categories that were needed for Q4 were as follows:

• Rig obscured by cockpit structure (1)

• Rig obscured behind other rig (2) • Forgot to get deck clearance (1) • Another rig or vessel near to target (27) • IMC/VMC intermittent (1)

This means that the above five reasons were not given by participants when they were asked what they thought caused WDLs (Q1), but were nevertheless offered by participants when asked to describe actual WDLs or close-calls (Q4). The reasons could therefore represent an actual threat that is not well perceived by crews. Equally they could represent a threat that crews simply did not consider when answering question 1.

Figure 4.1 (below) indicates where reasons given for WDLs (Q1) differ from reasons given for pilot’s own experiences of WDLS or close calls (Q4). The red line is the former and blue line the latter (not all categories are shown). The far right hand side shows the peak created from the category mentioned above (‘Another rig or vessel near to the target’). This is clearly the largest difference between the two sets of data.

0 Stress Distraction Low/poor SA Signs too small Rushing, hurrying Unfamiliarity of crew Bad Weather / vis. Etc Not following checklist Signage dificult to read Complacency (the word) Task prioritisation issues Installations /vessels in line Lack of Attention / vigilance Similar looking boats / vessels Signage poor (general comment) Shuttle lights / multiple landings Another rig or vessel near to target Coordinates changes as vessel moves Cleared to land too early - not yet visual Workload or extra tasks in inal approach commit/ID platform before inal approach Appearance not distinguisable / lack of cues Not following FMS on/during inal approach Not positively identiiying platform / instalation Restricted vision of one pilot, meaning cannot read Rig position information wrong (e.g. in database, not up

Figure 4.1 – This shows reasons given for WDLs (Q1 - red) and reasons given for pilot’s own experiences of WDLS or close calls (Q4 - blue). Note that not all reasons are shown (due to size) and also that any category scoring 1 or below on both was omitted.

Table 4.6 (below) shows the categories of interest emerging from Question 4 responses (either due to their total number or due to difference with Question 1 totals). The table gives the equivalent totals and percentages for both Q1 and Q4. Those representing over 4% of comments in question 4 are highlighted in grey, and the highest total is in red.

Table 4.6 – Categories of interest in reasons given for real experiences Q1 Q4 Categories Num Q1 Num Q4 -ber % -ber % Complacency (the word) 18 5.7% 4 2.8% Lack of Attention / vigilance 10 3.2% 2 1.4% Distraction 7 2.2% 2 1.4% Fatigue 11 3.5% 2 1.4% Workload or extra tasks in final approach 16 5.1% 0 0.0% Expectancy - sees rig they expect to see 8 2.5% 0 0.0% Unfamiliarity of crew 5 1.6% 5 3.5% Low/poor SA 7 2.2% 1 0.7% Select wrong position or coordinates in FMS 8 2.5% 0 0.0% Not following procedures (general) 9 2.8% 0 0.0% Not following checklist 7 2.2% 2 1.4% Failure to check/read name on finals 13 4.1% 0 0.0% Not positively identifying platform / installation 10 3.2% 2 1.4% Signage poor (general comment) 16 5.1% 1 0.7% Signage missing, not visible or hard to find 8 2.5% 1 0.7% Nearby rigs look similar 13 4.1% 15 10.6 Similar looking boats / vessels 2 0.6% 13 9.2% Installations /vessels in line 2 0.6% 6 4.2% A lot of rigs in area 6 1.9% 5 3.5% Shuttle flights / multiple landings 4 1.3% 9 6.3% Bad Weather / vis. Etc. 12 3.8% 7 4.9% Good weather 2 0.6% 5 3.5% Rig position information wrong (e.g. in database, 11 3.5% 3 2.1% not up to date, moved, etc.) Imprecise non-updated position reports from 5 1.6% 2 1.4% moving vessels 19.0 Another rig or vessel near to target (‘decoy’) 0 0.0% 27 %

Across the board, reasons given for actual events (Q4) paint a less varied or wide-ranging picture than the hypothetical reasons offered for WDLs from Q1. The major issues emerging from the anecdotes were as follows:

Firstly, a very large number of real WDLs (or close calls) occur specifically when another vessel or rig is very close to the target vessel, effectively forming a ‘decoy’. The proximity and arrangement were emphasised far more than the appearance of the decoy. In the initial open responses (question 1) none of the 117 respondents expressed this idea specifically, yet in the anecdotal question (Q4) 27 out of 62 pilots referred to it specifically. Question 1 did generate general statements about installations and vessels looking similar or being close together (e.g. “similar looking rigs nearby”). However it was clear from Q4 responses that a specific second ‘decoy’ target plays a major role in most incidents, as opposed to simply having many decks in the area, or platforms around that look similar.

Secondly, a considerable number of events have involved this decoy lining up with the real target in approach direction (about 10%). This was mentioned at a far greater rate in Q4 than in Q1.

Thirdly, shuttle flights appear particularly vulnerable, and this issue was mentioned often. This could simply reflect frequency of landings, but it is probable that the nature of shuttle tasks makes these operations more vulnerable.

Fourthly, both good and bad weather were mentioned as contributing. Good weather was mentioned at a higher rate in Q4 than Q1. However it is worth noting that poor weather, and specifically poor visibility (including haze, rain and general low viz conditions, was still deemed to be a major factor, and was mentioned more often than good weather in both questions.

Other factors that were deemed to have played a role such as signage, human factors, fatigue, appearance etc, but these were not mentioned in large numbers of cases in Q4, and were spread widely and at low frequency.

Most pilot-related issues (including complacency, lack of attention, fatigue, stress, workload, distraction and expectancy) were less evident in the Q4 responses than in the Q1 responses.

In summary, the overall picture painted from the real events (Q4) was heavily concentrated on a few major issues, and this contrasted to the wide spread of reasons given by pilots when simply asked to provide reasons why WDLs occur (Q1). Real WDLs and close calls appear more predictable in terms of cause than Q1 responses would suggest. It is probable that a second platform or vessel in close proximity to the target creates the conditions for most wrong deck landings, and if certain situational factors are apparent (shuttle flights, approach direction alignment, issues of visibility) then the possibility of a WDL is relatively high.

4.2.5 Analysis of attitude toward wrong deck landings

Analysis combining question 1 and question 4 further considered the attitude pilots held to WDLs. Two of groups were of interest, formed from the analysis of anecdote type (Table 4.5). Group one were those 27 respondents in Q4 who included themselves as all or part of the reason why an event happened (i.e. admitting that their actions contributed to a near-WDL). Group two were those pilots who firmly stated that they had never had a WDL or close call. Group 1 were 27 pilots, group two 19.

The Q1 responses (reason for WDLs) were traced back for pilots in both groups. It was found that group-1 pilots (those describing a near-event as being partly their cause) gave 36 causal comments for why wrong deck landings occurred when they had answered Q1. Group 2 (those strongly denying having had such an event) were found to have given 22 reasons for wrong deck landings in question 1.

All the question 1 responses (both groups) were categorised as either pilot- attributable or system attributable causal factors. In other words the reasons that these pilots gave as their perceptions of why WDLs happen were tagged as either pilot or system caused. It was expected that Group-2 pilots who made strong denials about having been close to wrong deck landings (in Q4) would attribute causes to other pilots in their responses to Q1 (due to normal attribution bias) while those admitting a close call in Q4 (Group-1) would be more prepared to attribute system causes in Q1, even though they admitted some responsibility. This was found to be the case, and was supported statistically.

Table 4.7 (below) is a chi-square 2 x 2 contingency table comparing the two groups, in terms of their propensity to give pilot-related or system-related factors as reasons for WDLs in answer to Question 1. It shows a statistically significant difference between the two groups and their Q1 answers (Chi square = 5.0128, p=0.025161), which is based around the recognition of system-related causes. In responding to Q1, group-1 pilots tended to split WDL causes fairly evenly between pilot and system. Group-2 pilots were just as likely to point to pilot-related causes, but far less likely to point to system-related causes.

Table 4.7 – Chi square 2 x 2 test on Group 1 and Group 2 reasons given for WDLs

Group 1 (Own Group 2 (Strongly Marginal Row Close Call) deny close call) Totals Pilot related causes 21 (24.83) [0.59] 19 (15.17) [0.97] 40 System related causes 15 (11.17) [1.31] 3 (6.83) [2.15] 18 Marginal Column Totals 36 22 58

Even when additional pilots are included into group-1 (those who simply expressed that they had had close calls without stating the reason why), the statistic is still significant (chi square 3.8813, p =0.048825), as seen in Table 4.8 below.

Table 4.8 - Chi square 2 x 2 test on Group 1 (including those admitting a close call without giving a reason) and Group 2.

Group 1 (Own Close Group 2 (Strongly Marginal Row Call OR neutral) deny close call) Totals Pilot related causes 33 (36.54) [0.34] 19 (15.46) [0.81] 52 System related causes 19 (15.46) [0.81] 3 (6.54) [1.92] 22 Marginal Column Totals 52 22 74

The conclusion must be drawn that there are a considerable proportion of pilots who believe that wrong deck landings are a problem for other pilots, but not themselves. Most of these have not had a WDL or close call, which acts as confirmatory evidence to support their view. This group will be the most difficult in terms of introduction of new procedures and training, because either they do not currently accept that WDLs are something that they are potentially vulnerable to, or they believe that they manage the threat effectively already.

4.2.6 Main conclusions from survey findings

Reasons for WDLs

When asked to comment on this generally, pilots gave many answers, covering at least 74 reasons, but no outstanding trend was found. Most pilots gave some reasons relating to pilot performance and many also gave reasons relating to infrastructure issues (e.g. signage, appearance and clustering of platforms).

However when commenting on actual events they had been involved in (Q4), much stronger and narrower themes emerged. Importantly, the issue of a second platform or vessel close to the target, which was specifically mentioned as being a factor in 27 experiences.

This ‘decoy’ platform is what draws the pilot away from the main target, facilitating the specific triggering error that begins the WDL process. Confounding issues such as poor visibility or haze, the decoy being aligned into wind, shuttle operations and similar appearance all acted as promoters and facilitators to the WDL triggering error.

System improvements

Most pilots pointed to physical infrastructure improvements to make deck more identifiable (e.g. better and bigger signs) or to convey landing status (e.g. a new light system to show clear decks). Better communications with HLOs was also put forward frequently.

Advice to pilots on avoiding WDLs

Pilots would advise inexperienced colleagues to focus more on the precise identification of the platform on finals (e.g. check of FMS, visual and radar) prepare thoroughly, adhere to procedures and checklists, and generally pay more attention and do not rush. They also advise going around or overflying the platform if at all unsure. In giving such advise, the pilots demonstrate that they believe that some WDLs can be avoided by doing these things themselves.

Attitude to WDLs

Only a very small number of pilots believe that WDLs are inevitable because they are caused entirely by the system in which they work, and cannot be trained against. At the other end of the spectrum, a larger group believe that WDLs are the result of poor pilot performance to which they themselves are not subject. Both groups may be difficult to obtain buy-in from in terms of training and procedures for defence against WDLs. However the majority of pilots appear to believe that WDLs are caused by a mixture of human and system factors, and show that they feel vulnerable to having one (using statements such as “I haven’t

had one yet…”). In general this shows that most pilots would be prepared to engage in solutions, because they would feel it had relevance to them.

4.3 Pilot Interviews

Pilots were interviewed using open and conversational techniques. They were asked to talk about the issue of wrong deck landings without prejudice, and the interviewer used prompts to maintain the conversation on the issue of WDLs while trying to avoid leading the participant.

Pilot interview responses tended to expand upon the themes that the survey data picked up. Most pilots commented on the issues of infrastructure appearance as being a particular problem, and of poor signage making the process of identification difficult (even impossible) to close before committing to a landing. Many examples were given of each.

All pilots interviewed were able to relate either a WDL incident that they had been involved in, or a ‘close-call’. In the same way as the survey responses, the main theme emerging from the actual incidents tended to be around a decoy target of some sort nearby that was wrongly identified as the main target. Initially, the issue of appearance was not emphasised by many interviewees, although when pressed most said that the ‘decoy’ was a similar type of installation or vessel. Shuttling operations and low visibility played a part in many of the anecdotes.

There were differences to the interview data. The two most noticeable were the issues of distraction and CRM, which emerged often in interview, but were rarely mentioned in the survey. This could have been due to the depth enabled by the interview as opposed to surveys. Many pilots stated that they had accepted a colleague’s platform identification without question or that their colleague had accepted theirs. Also, many participants said that they or their colleague were ‘out of the loop’ during an important period where the deck was selected (usually when PNF, due to en route planning and communication issues). They related experiences whereby they had first visually engaged with the platform after the PF had already selected and confirmed it, sometimes on final approach.

Participants were also asked to talk through the process of acquiring the correct platform during a sector (a type of cognitive task analysis). In line with in flight observations, it was clear from the analysed responses that pilots sometimes start the identification process many miles out from the platform. At this time they usually look in the direction shown on the FMS (usually 12 o’clock) and attempt to obtain a sighting of the platform. At this point, most claimed to identify the platform only as belonging to a group of installation types (e.g. accommodation platform, jack-up, vessel, production platform, etc.). As they near the selected target, they look for clearer and clearer signs by which to identify it.

It is of significant interest that the pilots speak in terms of trying to identify the features on the selected structure as belonging to the intended target, as opposed to identifying features that did not belong to the intended target. The later would be less prone to natural confirmation bias.

All pilots said that it was normal (necessary) to set up the helicopter on the final approach track before being able to identify the platform from its identification plate. This was borne out by in flight observations. Pilots then discussed how, after setting up on the final approach track, the identification plate remains unreadable for a considerable time and usually only forms part of the final checks before landing. All pilots showed frustration at the identification plates on the structures and ships, claiming that they were too small, inconsistent, often dirty or obscured, in different places, not on all sides of the structure, and only visible to the PF from the point at which the lettering is large enough to read. It was claimed that in many cases, the signage was so poor that the platform could not be properly identified until after the crew had committed to land.

In conclusion, the interview analysis showed a process by which structures are selected early (before they are identifiable) and not finally accepted as the right structure until late on approach. This period (called in the report the ‘transition interface’) could clearly be many miles and many minutes in length. Even from interviews, it appeared that pilots could be using confirmatory techniques rather than open scrutiny during the transition interface. Such techniques are natural and intuitive, but vulnerable to confirmation bias, which can increasingly convince a pilot that the wrong target is the right one as they approach it. This issue was triangulated with the in flight observational analysis. From the interviews it was clear that pilots feel there is often no way to accurately identify a platform until it is too late to avoid landing on it (a combination of poor signage and lack of distinguishing features). The idea that a single ‘decoy’ platform is involved in many wrong deck landings was confirmed within the analysis of the interviews.

4.4 Incident report analysis

A sample of 18 company incident reports were analysed in depth; 71 causal factors were noted. Most of these fitted the framework emerging from the survey analysis, and were therefore coded as such. Three new factors were added (labelled ‘NEW’ in Table 4.9). Table 4.9 (below) shows the factors and the number of reports continuing each factor (the three new factors are at the bottom).

Table 4.9 - Factors as interpreted from sample of company WDL reports No. of reports indicating the Factors interpreted from WDL incident reports factor Distraction (PF) 2 Distraction (PNF) 5 Fatigue 1 Poor Pre-flight preparation 3 Not following FMS on/during final approach 1 Not following procedures (general) 1 Not following checklist 1 Failure to check/read name on finals 2 Not positively identifying platform / installation 5 Signage poor (general comment) 1 Signage missing, not visible or hard to find 4 Signs too small 1 Nearby rigs look similar 2 Similar looking boats / vessels 4 Appearance not distinguishable / lack of cues 3 Similar platform names 5 Installations /vessels in line 2 A lot of rigs in area 1 Shuttle flights / multiple landings 2 Bad Weather / vis. Etc. 2 Good weather 2 Rig position information wrong (e.g. in database, not up to date, moved Etc.) 2 Imprecise non-updated position reports from moving vessels 1 Helideck Communication poor or difficult 4 Crews given wrong information (wrong rig planned) 2 Another rig or vessel near to target 9 Composite rig - wrong platform on same rig (NEW) 1 Sun/ glare (NEW) 2 Not informed of other vessel with similar name in area (NEW) 1

The most notable result was the frequency of ‘Another rig or vessel near target’ (9 instances). This is the category that describes where a specific ‘decoy’ platform has played a major role in the incident. It is probable larger than shown here, but only cases where specific reference was made to a decoy-type platform as playing an active role were coded as such. This category emerged from the analysis of the anecdotes in the online survey, having not emerged from the more expansive general pilot perceptions of WDL causes. It also emerged from the interviews, particularly where pilots related their own experiences of WDLs or ‘close-calls’. Hence, from three converging sources of analysis from three independent data sets relating to actual event causation, it appears to be a factor that is key to the understanding of why a large proportion of WDLs occur.

In terms of pilots performance, distraction of PF and/or PM were notable categories, as was ‘not positively identifying the name prior to landing’.

In terms of infrastructure, similar looking vessels caused a large proportion of WDLs. Additionally, missing, hidden, obscured and otherwise hard to find signage, as well as and similar deck names, all emerged again as important factors.

Many of the WDL incidents took place on vessels, and it would appear the rate of WDLs on vessels is very high compared to those on fixed installations (as a factor of the frequency of landings on each type).

4.5 In-flight observations

Twenty-six hours of in flight observation was completed (62 sector observations and 51 offshore landing observations). The observation schedule is shown in Appendix 3.

Pre-flight

FMS programming - The FMS was always programmed before take off on the observation flights, never deferred. However in interviews some crews claimed programming did sometimes get deferred. Occasionally the FMS did require re- programming en-route.

TEM and briefing

There were no formal threat and error briefings pre-flight, as far as observers could ascertain. Occasionally crews did make comments of a threat and error nature, but rarely in terms of wrong deck landing. One exception was a crew where the FO explained that 463 and 462 platforms look identical.

In terms of briefings for the next platform, there were a number of cases (about 30% of flight included some such form of briefing, albeit sometimes in the cruise). Comments usually related to the platform name, bearing and/or distance and which seat the landing would be flown from. One crew discussed a missed approach procedure. No crews discussed how the installation should look, or the shape of the infrastructure.

Cruise and transition

Most flights contained some low workload periods in the cruise, particularly on non-shuttling sectors. The observer’s estimate of the ‘down-time’ (low workload time) varied between 15% and 80% and tended to relate to sector length.

Pilots usually flew the route using the ND/GPS and autopilot. The Transition from arrival to circuit / approach was observed. The mean distance at which crews fly the aircraft away from the FMS track to create an approach was 3.1 miles, and this varied between 0.8 and 6 miles.

Platform Identification Process

Less communication directly relating to platform identification was heard than anticipated. Procedures were used, and pilots drew each others’ attention to the platform visually having identified it.

It appeared that the first action on seeing a platform was to draw the other pilot’s attention to the platform (although it is accepted that this is also the most observable action after seeing the platform). For 90% of the observations, this

was a verbal call (e.g. “visual” or “platform seen”) but on some occasions was a gesture (e.g. pointing) without any verbalisation. For well over half the observations, the other pilot immediately confirmed when this communication was given (e.g. “checked”, “visual”, “got it”, “yeah” etc), and for another large proportion the other pilot confirmed visual within a short time (about 30 seconds). In most cases, no more conversation was heard relating to platform identification. This appears to show the first stage of acceptance occurs early in the process.

On occasions, the platform identification was not ‘closed’ as quickly as normal (sometimes because of visibility or because the crew did not appear satisfied with the identification). On these occasions, most comments that occurred after the platform had first been identified were of a closed or confirmatory nature. For example:

“That has to be it doesn’t it?” “right track, right distance, so that’s it” “Crane on the right, it’s what we expect”

The implications of this will be analysed later in the section.

In the observational sectors, the mean distance at which the crew visually selected the platform was 6.1 miles. The shortest distance (not including ARA approaches) was 1.8 miles and the furthest was 27 miles. On most occasions the other pilot confirmed with no more discussion, and so the platform acceptance appears to have followed straight on from the first sign of visual selection (about 6 miles). Hence in most cases it appeared that the acceptance of that platform was almost immediate, and it would have to be actively rejected if the error discovered later. However on most flights there was no indication that the crew were actively seeking to confirm or identify the platform further until the descent towards the helideck.

Noticeably very few of the observed comments, questions or briefings, discussed whether the platform that had been identified could be an unintended platform / decoy. In most cases the decoy will be close and may look similar.

Observations found that FMS waypoints were suspended very rarely, but that waypoints did not disappear on approach. The ‘direct to’ function was used commonly.

Many crews did not appear to use the radar in short sectors (from what the observer could discern).

On the observed flights, the level of RT traffic was never high during the circuit or final approach.

On many sectors, the PNF was head-down for long periods during the circuit and/or approach; including the late final. However this varied considerably with crews. Some crews rarely had a time where one pilot was head-down. The PF was always head-up (within reason).

A number of times it was observed that during the final turn to the installation, the crew were not visual with, or maintaining visual with the installation for a significant time. It was clear that the PF (on right) was unable to maintain visual with the platform in a final turn to the left. On several occasions it appeared that the pilots initiated the roll out in two phases; firstly based on turn rate and/or timing, and secondly adjust the approach heading to the visual picture.

Only five sectors were observed in which any sort of FMS/GPS/NAV cross-check was verbalised in circuit or on approach to the installation.

Calls relating to reading the installation identity prior to LDP were varied. Many were a declaration of the platform name (although it could not be known whether the pilots were reading this from the platform), some were simply in the form of “ok”, and at other times no call was made. In terms of the PNF, on short finals there was a large variety in what they were observed to be doing. Some PNFs called out heights, heads down or monitored speed. Other times the PNF remained heads up and vocalised that they were looking for the ID plate, or said that they could not see it. Some PNF were witnessed to read the installation name in the late stages, whereas several said that it could not be seen in this phase. Some PNFs used other signage such as the deck markings and lifeboat markings. Some PNFs called the ID but clearly could not see it. Some PNFs remained head-up and said nothing, whereas others alternated between head down and head up.

The average time from the first pilot making an identification call (platform name) to the LDP was 43 seconds (27 times were recording as best the observer could). The shortest time was 24 seconds, the longest was 80 seconds.

PART 5 - RECOMMENDATIONS

5.1 Ratings for recommendations of this report

Recommendations are given a rating between 1 and 4 as to how effect they would probably be in reducing WDLs. It will be seen that the error trapping has most potential for preventing WDLs. The ratings act as follows:

• Rating 1. This will probably help to resolve some factors that contribute to WDLs, but is unlikely to make a difference to WDL numbers on its own. • Rating 2. These recommendations are likely to make some difference to WDL numbers (possibly a small difference) but any effect will probably be temporary unless continued effort is put in to reinforce them over time. • Rating 3. These recommendations are likely to make some difference to WDL numbers, and any such effect is likely to last. • Rating 4. This will almost certainly lower WDL numbers substantially and noticeably, and will work in the long term

5.2 Recommendations for avoiding the triggering error

For obvious reasons, it can be assumed that installations and vessels will always be open to confusion, and cannot be redesigned or redecorated so that they are all different. This means that any solution must not be wholly reliant on the physical appearance of the intended landing site, and indeed should assume that all vessels look the same and all platforms look the same.

Recommendation 1 - Late platform selection (rating – 2)

Crews should select the platform no sooner than 5 miles (when on FMS track), and not share any sighting between them prior to that point. Also crews should be trained to call visual without directing the other pilot’s attention, and allow them to find the target independently until a given point.

Recommendation 2 – Automation level (rating – 1)

Where possible, PFs should maintain a high level of automation (not fly manually) unless the PNF is under a low workload and able to maintain visual contact with the platform. Where a PNF is under anything but low workload, the PF should fly coupled until late finals, and particularly when manoeuvring to approach.

Recommendation 3 – Final turn task resourcing (rating – 1)

Final turns. In final turns onto approach where the PF is on the outside of the turn, the PNF must maintain close visual contact with the intended target in the turn and confirm that the correct target has been taken-up on rolling out using the FMS track. The PF should use the FMS track to assist in lining up. Where the PF is manual flying and on the inside of a turn, the PNF should shadow the turn on the FMS track.

Recommendation 4 – Crew training (rating – 1 to 2)

Crew training in the real factors behind WDLs, particularly where knowledge of these can potentially help crews avoid WDLs. Training could cover the following and be part of CRM sessions;

• Types and ways of landing on the wrong deck (and vulnerability of even the best crews to a WDL) • Training on the issue of the visual transition, and ease of mis-selection. Decoys and the Decoy Pairing Characteristics that create a threat. • Importance of practicing maintaining FMS reference until late. • Problems of early target selection • Risk of group-process (directing colleagues’ attention to the platform immediately it is sighted, and risk of accepting agreement as confirmation of correct sighting). • Use of higher level automation levels, especially when the PNF task-load is very high and when the threat of a decoy is high. Doing so will reduce the workload of the PF compensating for the PNF workload. PF manual flying at such a time leaves a crew very vulnerable to mis-selection, as well as accepting that wrong target. • Pilots should be shown that it is not normal or desirable to fly manually and maintain visual contact with the platform all the time (whichever side of the flight deck they are on). Hence there is a risk of reselecting the wrong target in this period. It is therefore a good idea for the PNF to check the rollout with the FMS track.

Recommendation 5 – decoy check and feature priming (rating – 2)

This is a simpler version of ‘recommendation 7’ below. In the pre-flight phase, where crews see that they have a potential decoy platform near on in line with an intended platform, they should do the following:

1. Note the threat, and which sector it is on.

2. From photos or pictures, find one certain and visible feature on the intended platform that is NOT on the decoy platform. Having prepared themselves in this way, the PNF should use this one piece of information to selected target at that point. For example if the intended target has a large crane on the left and the decoy does not, then the crew might write a note - “Should see large crane on left of AB1 platform”. By preparing this early, they will not risk choosing a common characteristic to differentiate the platform at the time, but will have prepared a characteristic that definitely differentiates the intended target from the decoy.

It is important that the crews do not become overly focussed on the decoy itself (e.g. choosing it’s unique features of the decoy) in case it causes them to select the decoy in error.

Recommendation 6 – Awareness and preparation for potential decoy vessels (rating 3 or 4 – for vessel landing only)

This is in line with recommendation 5 but specifically for vessels. In most wrong vessel landings, the intended vessel is never seen or considered by the helicopter crew; only the decoy vessel is seen and used prior to the landing. Some decoy vessels are almost impossible to differentiate from the target vessel. Therefore it is essential that the crew are made aware of a potential decoy and any detail possible if wrong vessel landings are to be avoided. A system is required by which all vessels with a helipad that will be potentially in the vicinity of an intended landing vessel are known to the crew prior to take off (e.g ‘MarineTraffic’). Ideally the crew should be able to see pictures of the decoy and the target in order to prepare. They should select a unique aspect of the target that is different on the decoy, as an error check.

Recommendation 7 - Decoy threat anticipation and management (rating - 3)

IMPORTANT - Recommendation 7 and 8 are recommendations for designing and testing two general proposals and implementing only if trials establish that there is benefit and that no inadvertent consequences emerge.

In many cases, the existence of a decoy platform can easily be established before the sector (even in the planning stage) and therefore avoidance of it can become part of the task. The existence of another similar structure, particularly near the end of the sector (before the intended target) should give cause for consideration of threat potential. Where another platform is close by and aligns with the final approach track or will appear earlier in the final turn, these must be considered as threats, particularly in lower visibility. Lowered visibility means that platforms will stand out less than usual, in terms of colour and detail, and therefore the structure may be quite different to the decoy, and yet still be a threat. This is the same with very good visibility (e.g. 10k or more) if selecting early.

It was noted in observations that little TEM was conducted by crews, and almost none around potential wrong deck landings. This is probably because WDLs are not seen by pilots as the most safety critical issue, and also the anticipation of a wrong deck landing is a complex process.

Pre-flight briefings are the ideal place for crews to note where particular WDL threats exist, and discuss them.

A process could put in place to support the prediction and avoidance of WDLs by recognising when one or more decoy platforms / vessels represent a high threat. Training or information dissemination for threat management around WDLs would be a good starting point, based on findings within this work. But in future this could be supported automatically by software linked to the flight plan. An

algorithm could by programmed to produce a coefficient of risk for each deck in the route. The coefficient would be loaded by factors such as:

• Decoy Proximity • Decoy alignment with wind if less than three miles from target, or on track • Distance from departure point to destination minus distance from departure point to decoy (if decoy is before intended target it is more of a risk) • Visibility • Decoy type similarity • Name similarity • Frequency similarity • Evidence base

But it would also include assessments from a group of pilots about where certain known threats are.

When crews receive their route prior to briefing, they would see a risk factor and hyperlink next to any platform scoring highly. They could simply click on this (as a link) and be presented with information about the threat including pictures of all platforms/vessels involved. The algorithm and database could be continually updated as experience is gained and fed into it.

Recommendation 8 - Offset final waypoint (rating 3 or 4, but needs testing. Some risks of WDL by other modes)

IMPORTANT - Recommendation 6 and 7 are recommendations for designing and testing two general proposals and implementing only if trials establish that there is benefit and that no advertent consequences emerge.

All non-ARA sectors should be flown to an offset point near the destination platform, but never to the destination directly. The offset waypoint would be a set distance (e.g. 2 miles) left or right of track (the downwind side) and preferably slightly ahead of the platform. This would have the following advantages:

1. Since the waypoint is not visible, it could ONLY BE achieved through FMS navigation (not by flying to it visually) and therefore the visual transition error could not apply until a common distance final turn, where it is much less likely to be an issue. The crew would have far less opportunity to select a decoy at any point in the sector, and would not therefore fly visually to the decoy.

2. It would mean that every flight has a roll out from a final turn (even those approaching straight in). This would allow reliable error trap placement (the error trap happens on the roll out, and all sectors have a roll-out.

3. It would mean less manoeuvring in most flights, therefore limiting the possibility of losing the platform in the manoeuvre.

4. It would avoid the natural crew urge to choose the platform on the nose, and reduce the opportunity and temptation for early visual selection.

Additionally, for many flights, the sector distance flown would be very slightly less than currently. Currently in most cases where a crew fly a straight line to a platform, they end up having to manoeuvre several miles away from it in any case.

Recommendation 9 - FMS route downlink (rating - only for the very small percentage of type-2 WDLs - 3)

Where crews have to manually type routes into the FMS from the source (paper or iPad) there is a potential for errors in typing. An automatic downlink would save time, allow a more thorough threat and error assessment, and reduce error.

Recommendation 10 - Vessel differentiation (rating 3)

Clearly having two almost identical vessels in an area will promote most, and sometimes all, of the errors required for WDLs. Knowledge of the decoy vessel will help considerably, and allow a crew to manage the potential error by using radar etc with awareness of the decoy. A late error trap using the radio operator will also help, as recommended in this report. However consideration must be given to differentiating very similar looking and painted vessels, or at least not actively trying to make them look identical and have almost the same name (i.e. for branding purposes). Consideration should be given by operators of almost identical vessels, to differentiating them by name and sight. The illustrations below are from a recent company workgroup findings document, and show two almost identical vessels with the names “Siemdaya 1” and “Siemdaya 2”.

Figure 5.1 – similar looking vessels

5.3 Recommendations for noticing and trapping the error

Recommendation 11 – FMS software change (rating – 4)

FMS software should be developed requiring the crew to allocate route waypoints with ‘destination status’ where those waypoints are intended landing sites for the planned route. Such status should differentiate the waypoint from others and only show the route as solid until that waypoint (or preferably show no route beyond that waypoint in normal navigational modes). The waypoint should also remain until landing. If possible the weight on wheels switch should be used to scroll the flight plan on to the next destination waypoint.

The FMS would extend a 2-mile dotted white line downwind of the landing waypoint (platform) if the wind is over 5 knots. This would offer a great deal of situational awareness support to the pilots as they manoeuvre onto the final approach path.

Doing this would solve several issues causing WDLs, lower pilot workload (hence enhancing safety in other areas of the task) and allow the development of a more reliable crew cross check of the FMS on approach.

Recommendation 12 – Early final approach error trap (rating 2- 3 or even 4, depending upon design and implementation)

Since stabilised approaches are mandatory, the opportunity for a commonly placed error trap is available. The trap should be as early as possible while being able to include all sectors (including shuttles). It should also involve both pilots, be extremely easy to achieve, and take very little time.

The essence of such a check would be to take the furthest common straight approach distance that all flights will pass through. In other words take the shortest possible final approach track that an aircraft will take, and put the check at that point for all aircraft.

Alternatively the point could be the roll out onto final approach. This would be stronger as a cue. However the disadvantages are that approaches will be different lengths and some will be straight-in and not involve a final turn. One way to deal with this would be for aircraft not to ever fly directly to a platform – see recommendation 8.

Whichever point is chosen by the operator, the check would be simple. The PF calls “intended platform” the PNF states the platform ID that is intended. The PF then states “FMS platform” and the PNF looks at the screen and calls the name of the nearest platform in the 12 o’clock position on the FMS. The PF then calls “ID complete” if the two match.

A shape could be drawn permanently on the Nav screen to assist (in the absence of a software intervention). For example it could be an elongated red outlined oval (very thin lined) such as in Figure 5.2 below. The oval would be vertical, extending from a centimetre above the aircraft symbol to near the top of the screen. It would be about 3cms wide. Equally, two diverging lines would be ideal. With such a symbol the PNF need only look at the NAV screen and call the nearest platform name within the shape. This would help direct attention and lower workload, and build the check into the culture. An example is below.

Figure 5.2

Recommendation 13 – Late approach Visual Error Trap (rating 3 if combined with signage recommendation)

A late error trap that locks the helicopter with the platform is desirable. This should be at a late point in the approach but with sufficient time and space for a comfortable missed approach to be initiated and flown if an error is trapped.

Ideally, this should be completed by a radio call between the crew and a person the deck, not by a visual confirmation. However it is recognised that on some platforms there will not be a person available and so the crew must perform this check themselves.

If the sign is placed very close to the helideck and in easy clear view (as in recommendation 19 - ‘signage’) then the PF will have little problem reading the letters and numbers on it, even if they do not process the information or make any comparisons. Indeed this is an ideal situation. The PNF cannot see the sign and so must make the independent comparison with the expected situation, from

what the PF reads. This offers a more reliable cross check of the platform ID than the current system.

It is therefore recommended (only if signage location is changed as described in recommendations for signage) that as the platform is approached the procedure is that the PF reads the ID plate on the helideck edge, and the PNF then reads the expected deck ID from the procedure. It is up to the PNF to identify if there is difference between the two IDs that were vocalised (this recognition will be almost automatic) and also the PF can call if they notice a difference. The PNF should not state the expected deck ID in the approach before the PF has read it from the sign.

IMPORTANT - With the current signage situation a safety issue exists if pilots are simply told to pay more attention to signage during late finals because control of the helicopter could be impeded due to visual searching away from the primary control reference. Occasionally this could trigger an incident or even an accident. Hence the late error trapping using signs should only be implemented if the signage is put into safe positions first.

Recommendation 14 (HLO error trap, particularly vessels) (rating – 4)

Vessels are more vulnerable than a fixed platform for many reasons. However on a vessel, there is always a person available. Hence it is recommended that for vessels a system is set up between the person and the helicopter. One suggestion would be that contact is made first, then at the commencement of the 1 mile final approach the helicopter crew call ‘aircraft-callsign direct inbound’. Only when the vessel crew member sees a helicopter approaching on a final approach do they state “vessel-name visual”. If the helicopter does not hear this call by a set distance (e.g. 0.3 miles) then they perform a missed approach. This would also be very effective on platforms, but is labour intensive. However WDLs onto moving vessels are a particularly difficult problem to resolve, and many of the other recommendations in this report cannot be applied.

Recommendation 15 – Always use radar return (rating – 1)

The radar should be interrogated with the Nav display when approaching the platform. This would help to prevent a situation whereby an unknown decoy was selected by the crew, and they were unaware that the actual platform was nearby but unnoticed. The radar could also form part of the check in a final turn.

Recommendation 16 – reducing conformational strategies (rating 1-2)

Crews should be made familiar with the risks of confirmational strategies, and the normal human propensity to use them. Crews should practice finding unanticipated data from the visual scene and checking whether it ought to be there, and whether it fits any potential decoys.

This could form part of a CRM training course, and would integrate with the training issue around early platform selection. Crews should learn that the propensity to accept the error becomes weaker over time due to confirmation bias, and requires clear contrary cues to break it down. For this reason early visual platform selection should be discouraged, because clear signs of error will take longer to emerge post-selection.

Recommendation 17 – reduce multiple platform IDs (rating 2-3)

In the present system, it is well known that there are multiple identifiers for the same platform, and crews will use a number of these (ICAO identifier, marine identifier, FMS identifier, etc.). This may be necessary in many respects but it is a very large general catalyst that drives many WDLs indirectly. Where possible, consideration should be given to how all IDs could be made to relate to the helipad. A worldwide standard naming convention would help (as identified in the IOGP report).

Recommendation 18 – clearance lights (rating 3 or 4 BUT only for the tiny proportion of very high consequence WDLs)

This is a future consideration, but requires consideration (risk assessment and trialling work).

To avoid the highest consequence WDLs (those that would cause danger, such as if the platform was venting gas) a simple clearance light or ring of lights on the helideck would be beneficial, to be switched on whenever a helideck was safe to land. If not seen, the approach is broken off and the situation can be progressed from that point. A red light (or similar) could strengthen this. Although the system will prevent most high risk WLDs it will not prevent all WDLs.

There are a number of considerations for such a system and a considerable amount of work and risk assessment would be required prior to implementation. The following is also stated in a previous section in response to this suggestion on the IOGP review.

Consideration should be given to issues of fail-safe, and issues around diversions. Another important consideration is that a crew seeing green lights will factor this heavily as confirmation that the platform they can see is the correct one for them. Hence, if other platforms (specifically the decoy / decoys) also have the lights on, it might make a crew more likely to mis-select that platform as their intended target. Although the subsequent WDL will be onto a ‘safe’ platform, there are serious risk considerations. For example if green lights were visible at a distance, and was on because another helicopter was using the platform then lighting system could create a greater risk of mid-air collision, or at least crew distraction and confusion that could lead to a problem. These risks must be fully considered. Hence, there are questions to be asked about how long the lights

remain on, when they come on and what they mean (can a helicopter divert onto a red light platform in an emergency?). If red light platforms are to be avoided at all costs, then the crew and planners need prior knowledge of this in case of diversions.

A deck lighting system of this sort would not stop the majority of WDLs it would only prevent the rarest WDLs that were of the highest consequence. The bottom line is that the system would almost certainly be effective, but would need a lot of work before implementing.

5.4 Recommendations for signage (rating 4, if done well and thoroughly and combined with late error trap recommendation)

Signage is extremely important for the final error trapping process. Presently the signage is only visible on late final approach when the pilot is manually handling using the outside deck references to control the flight path. The location of signage is not easily predictable for pilots, and signs are sometimes not visible or missing. All of this means that pilots cannot easily find and read the signs without attentional shifts that interfere with the manual flying process. Because of this, any attempt to direct pilot visual attention away from the handling task in order to prevent WDLs without overhauling the signage system would present a safety risk.

Recommendation 19 (rating 3, if combined with effective late error trap)

Signs should be

• Positioned on the edge of the helipad (so as to be close to the flying- pilot’s main visual reference) as in Figure 5.1. There should be a sign on each side of the helipad that an approach can be made from, and the position and placement should be consistent across platforms.

Figure 5.1 - Proposed sign position and format

• Include only the deck ID used by crews (no prefix and suffix e.g. “-DP”)

• As large as possible

• Highly visible, very clear, and well maintained. They should also be consistent in colour.

• Identifiable as helipad ID names by the use of a surround (e.g. a hexagon) that also bounds the key figures if others are included. If prefixes and suffixes are insisted upon, the main deck name should be bounded by the shape. This will lead to faster recognition (making a wrong platform ID easier to detect) but also mean that the pilot does not have to perceive the code or letters first in order to know whether they are the deck ID (i.e. to make searching for the deck ID easier/quicker and alleviate the need to confirm that code is indeed the deck ID). In other words the pilot knows that what he or she is reading is the deck ID because it is inside a Hexagon which means that any words or codes that are not enclosed by a hexagon can be discarded without reading them or working out weather they are important. Along with consistency of placement location, this will make a late error trap on the platform ID realistic. See Figure 5.1.

PART 6 - COMMENTS ON PREVIOUS RECOMMENDATIONS

Comments on previous recommendations

This section looks at previous recommendations for reducing WDLs from two reports. Some of the comments are opinion of the author, because the recommendations could not be informed by any work done. An early decision was made not to be influenced by previous recommendations, but to allow the data collected to drive the recommendations made in this report. The two sets of previous recommendations were then looked at.

In some cases, where clear recommendations were made previously that were good, they have not been repeated in the recommendation section of the report, unless there was good reason to do so.

6.1 Helioffshore WDL working group discussion document

The discussion document produced by the WDL working group proposes a number of recommendations, each is commented upon here.

1 Impress upon crews the need to always follow the checklists (rating <1).

This is worth doing if done sensitively but it will not reduce WDL numbers noticeably if at all. Checklist usage in the air is always subject to influences of the dynamic situation. Most pilots do not consciously omit checklists or consciously make checklist errors. All pilots use checklists unconsciously on occasions, especially when airborne (all pilots, despite what they will say) and so general training messages requesting better checklist usage will have almost no effect even if the pilots accept them fully (unless an operator has a current problem with crews not following SOPS, in which case the solution would be quite different). This is also a very small part of the answer in WDLs (if at all).

If approached wrongly, it may have the opposite effect. A risk is that some pilots could see such messages as ill-conceived (and so the message is undermined) or as an attack on their professionalism.

2 Name the intended destination during briefings & radio calls, by both helicopter crews & HLOs or R/Os. (Rating 1 to 2, if implemented well)

Agree, but with reservations. The R/O or HLO should name the deck that they are ‘clearing’. Pilots should brief the deck in the descent or before a shuttle take off. However if the deck name is used in all radio calls this could lead to pilots reducing attention on it. Hearing and saying it so often could lead to pilots simply sounding out the right deck name, regardless of what they see on the Nav display or deck ID. I.e. the deck ID becomes a sound that can be made unconsciously without even bringing up an image of the figures, word or platform.

3 Improve the sizing and visibility of vessel identification and helideck markings (rating 3)

Fully agree, and should go further. Size and visibility is only one part of this problem in terms of identifying the platform from its signage. See report conclusions for the other factors (commonality, position, bounding, etc.).

4 Require crews to use FMS/NAV overlay on the radar screen when available (rating 1).

Agree that this would resolve some wrong deck landings, but the detail and practicality is important. The word ‘use’ ought to mean switch it on and pay attention to the overlay. However this is a general instruction, not a specific check, and it will take voluntary crew attention but usually provide information that is no extra use to the crew (because the correct deck has already been identified). Crews therefore may not adhere to this, particular in seemingly easy shuttling tasks. However it would certainly help in the case where a decoy platform exists and is not known to the crew. Again, see recommendations sections.

5 Reduce the number of last minute route changes (rating 2).

This is desirable and will sometimes prevent the issue of task saturation and may prevent a WDL.

6 When routing to highly mobile vessels, crews gather position & weather information themselves during the planning phase (rating 1).

This is worth doing if the outcome of the crew analysis of information is triangulated to avoid errors and mistakes caused, for example, by crews rushing due to being late or having other issues taking their time. By doing the work themselves, crews are more likely to remember more of the information and have better prepared situational awareness.

7 Reduce radio chatter (rating <1 for WDLs specifically).

A few WDLs appear to involve excessive radio chatter, so any reduction would be helpful in many respects, not just wrong deck landings . However compared to other causal factors, the issue is not seen as a priority for resolving the issue of wrong deck landings.

6.2 IOGP WOHL document

The IOGP WOHL document (Jan 2015) proposes many recommendations. Comments are given here.

PF-1: Standardized scheduling scheme with mandatory “stop the clock” for any changes. Minimizing flight detail changes. No changes within 60 minutes of ETD. (Rating 1 to 2 depending upon what is done).

By itself, this would be unlikely to make any difference in preventing WLDs due to the way that the majority occur. However it would facilitate and assist a revised pre-flight process (such as recommendation 5 or 7 in this report) whereby crews identify and/or prepare for a potential WDL as part of the pre- flight process. However it will not assist in the majority of cases, but is good practice if it can be achieved and will resolve other issues that crews face as well as possible assistance with WDL preparation. If it prevents in-flight changes then it is likely to be effective in preventing some WDLs. Additionally, if it prevents last minute changes that impact upon TEM then it will also be more effective.

PF-2: Consider avoidance of providing route details too early to crew To avoid low engagement threshold in the planning process (rating <1)

This would require trialling, since nothing in this work informed this idea. However in the opinion of this author, such a policy would not give a net benefit in tackling WDLs.

PF-3: Standardization of the manifest & routing information (rating 1 in combination with other recommendations, and rating 2 for the 20 minute updating of positions).

This suggestion would be useful as part of the overall contributory factors to WDLs, by supporting other interventions such as better TEM around WDL threats. This idea will provide indirect support for other WDL initiatives, but not prevent WDLs itself. The 20 minute updating of positions from moving vessels should certainly be considered, as this will help.

PF-4: Pre-flight (TEM) crew briefing (rating – see recommendations 5, 6 and 7 in this report)

From a WDL perspective, this will help. It is discussed differently as part of the recommendations in this report (particularly recommendation 5, 6 and 7), so the reader is referred to those sections.

PF-5: Proper documentation (rating – unsure of the scope of the problem within wider industry, Probably 1).

This will assist in preventing WDLs. Elements of this align with a number recommendations in the report.

FE-1: Entering and cross-checking of the route (in FMS) prior to departure i.a.w. provided routing information (rating 1 for type 2 WDLs only).

Route errors contribute to a minority of WDLs, and so this will not resolve more than a few WDLs, but any focus on correct routes entering the FMS will work. See report recommendation 8.

FE-2: Route verification (in FMS & visual clues) prior to each departure. (Rating Potentially 1 depending on the implementation and detail).

Many crews already perform a quick process prior to leaving a platform, on some or most occasions. The effectiveness of such a policy would be in the detail of it. Most departures occur from platforms and with passengers aboard. The environment is usually dynamic and the pilots try not to spend any extra time on the deck that is perceived as unnecessary. That does not mean they rush, but they try not to create delays. Having a general policy for pilots to check this as part of a checklist item (e.g. “brief for next platform”) could have very little effect, because the process will be interpreted a different way by different pilots, and will be short-cut on most occasions, and not usually seen as relevant or necessary. Stipulating the process will have some temporary benefits but will lead to pilots paying lip service to it on many, if not most, occasions. The process would need to be very simple and formalised, containing a few discrete check points only, as opposed to requiring a re-brief of destinations.

One check could be for a pilot to look at the FMS to see the destination and ask a prepared open question to their colleague such as “next destination?” Whether the colleague looks at the FMS to answer is irrelevant, but they should answer. This would bring both pilots into the loop. This is not repeated in the recommendations section. Doing this would have some effect on WDLs caused by crews mis-sequencing from the route (see fault tree), but these are currently in a minority.

FE-3: Communication (rating – unable to give rating)

This is too general to comment on. Clearly communication is important, but a balance is required in order to reduce radio clutter.

FE-4: Better usage of FMS capabilities to improve situational awareness. Rating <1 with current FMS

This would work in an ideal world, but is the wrong thing to do currently. The flaw here is that the crew would have to action this on every sector. The information it would provide would be of great benefit when a WDL is being triggered, and would therefore prevent WDLs. However it will not do so because

it will not be used by crews in reality, or will be short-cut. The reason is that adds conscious work for the pilots (particularly over a multi sector trip) that on almost all occasions is not required at all, and even worse, on occasions can be seen to be not required while it is being done. This goes against the way that humans operate, and will be dropped by pilots very quickly. For this reason, if it was implemented it will result in routine violations of the policy, and in crews not following it on most occasions. Therefore it will have little positive effect, and yet it will create frustration and normalised violations in crews, which is unhelpful to safety and relations.

The current report details how the FMS could be updated to provide this kind of situation every time without crew having to program it. This would offer all the advantages on a permanent bases, and would be appreciated by crews. See recommendation 11.

FE-5: Approach Briefing (rating <1)

Care should be taken with this idea because in Flight briefings have the potential to distract crews from more important considerations. Hence even if it helped reduce WDLs it could cause other incidents. Given the way that WDLs are generated, an approach briefing would only be useful before target selection. It is unlikely that an approach briefing would trap a mis-selection error that has been made already, and certainly not better than a designed error trap could (see those in the report section 5.3). On many occasions such a briefing would simply get in the way of the task and be of no use, and therefore it risks being dropped, short-cut or forgotten by crews unless it is made extremely simple and as part of a formal set of checks.

In the author’s opinion, this would not be effective against WDLs, and could cause other issues.

SF-1: Available references – proper implementation in the checklists (rating unable).

It is difficult to comment on this since there is little information about how it would be actioned. Clearly having the right information available cannot do any harm and may help.

SF-2: Visual recce for confirmation – rating impractical (<1)

In the online survey, this was popular as a reason given as to why WDLs happen (in hindsight), i.e. the crew did not fly over the confirm. No observation flights were observed in which the crew performed a recce or flyover in order to confirm the platform name.

Clearly the problem here is that unless this is part of a missed approach / go- around then it means that the crew will have to do it very regularly, because final

identification of a vessel or platform is problematic before 1 mile. Operationally, this is probably unacceptable and will also introduce more risks due to the manoeuvring low down while looking over at a platform, as well as further opportunity for a WDL (because a new manoeuvre would be flown and the wrong deck could be picked up).

So whereas in hindsight, such a process seems obvious to have performed, a crew who do not know that they are about to land on the wrong deck will not know that a fly over will be of benefit. It is clearly impractical for all sectors to involve a recce/flyover ‘just in case’, or even for all occasions when the platform is in doubt.

A safer and more reliable option would be to say that if in doubt by late finals, then fly a proper missed approach. (Note - This is not a recommendation by this report)

SF-3: Deck clearance (rating potential 4)

See recommendation 14 in section 5.3 (HLO error trap, particularly vessels)

SF-4: Take-off brief & route verification on deck during shuttle operations

This was considered the same as recommendation FE-2 (Route verification (in FMS & visual clues) prior to each departure), and so the reader is referred back to the response to that recommendation (above).

OI-1: Switchable green-red helideck lighting to indicate the status of the helideck (green is clear to land, red is no landing approved). Potentially 3 or 4 for high-risk events).

Lighting systems of this kind would clearly be of benefit, if set up and operated the right way. That is not a given, and the right way is not known and would need testing.

The colours of the lights need to be considered. Consideration should also be given to issues of fail-safe, and issues around diversions. Additionally, although the system will prevent most high risk WLDs it will not prevent all WDLs unless platforms switch to green lights for a very short time during the helicopter’s arrival only.

Another important consideration here is that a crew seeing green lights will factor it as confirmation that the selected platform is the correct one. Hence, if other platforms (specifically the decoy / decoys) also have green lights on, a crew are more likely to mis-select that platform as their intended target. Although the subsequent WDL will be onto a ‘safe’ platform, there are risk considerations.

Hence, there are questions to be asked about how long the lights remain on, when they come on and what they mean (i.e in an emergency diversion).

OI-2: Status lights to indicate only a hazardous condition (gas leak) on the installation (rating potentially 4 for high consequence WDLs only).

This would be simple and very effective for preventing high consequence WDLs only. Clearly the red light would need to have failsafe consideration. The strength of the system would be held by the red light usage being minimised to highly critical times only. It should not drift towards a system where platforms switch on red lights whenever a landing aircraft would be inconvenient, or whenever they are not expecting one, unless tests prove that this is workable.

OI-3: Similarity of (field) sister rigs/ships/mobiles (rating – see report)

This issue has already been covered and can be read in a number of report recommendations.

OI-5: Presence/clarity of name of the installation (rating 2)

This is very important for error trapping and is fully covered in recommendation section 5.3

OT-1: Familiarity with wrong info scenario (rating – 1)

This is worth doing, and should feed into TEM training. It will not solve the majority of issues with WDLs and its effectiveness will also reduce with time, like any training.

See recommendation 4 in this report.

OT-2: Installation naming convention (rating potential 2 – 3)

This is a key issue that will continue to promote WDLs despite all other interventions, and so does require resolution. In itself it does not directly cause many WDLs, but it has the potential to cause errors throughout the WDL landscape. See recommendation 17 of this report.

OT-3: Simulator training (0 to 2, but it depends on the detail and what is to be trained. In many cases the rating is <1)

This is might be worth trying as it would be easy to implement into LOFT training scenarios. However in the author’s opinion it would make little difference to the WDL issue for many reasons including the capability of the simulator to produce realistic platform situations and the psychological validity (i.e. crews are not in their normal social environment).

However the opportunity would exist to help crews practice non-confirmatory strategies and resist social effects that confirm the platform to each other. See section 2.1.4 and 2.1.5 and recommendation 4 (section 5.2).

OT-4: Radio Operator and HLO training (rating 1-2 potential)

This would improve many areas and help several other recommendations. However unless specific training is focussed on these issues discussed and interventions being made, then the WDL situation would remain mostly unchanged.

OT-5: Routes (rating potentially 2 in combination with other recommendations)

All the recommendations under OT-5 are sensible and would help to mitigate the situation whereby the PNF becomes overloaded and the helicopter turns into a single crew operation which promotes selection and confirmation errors, and hence WDLs.

However although these changes will definitely be helpful, they will not markedly change the WDL landscape directly. Clearly they might prove difficult to implement. So from a cost-benefit analysis these may be a low priority (if the ‘cost’ is very high).

OT-6: Varying appreciation of WDL and its consequences (rating 1 – 2 in combination with other recommendations only. By itself this will have little effect).

Buy-in from all areas of the industry is clearly an important foundation whatever recommendations are made. If it is considered that the OT-6 recommendations will improve visibility and buy in at the time (or just before) implementation of new processes, this is a very good idea.

However there may be little benefit in doing this unless other processes around solving the problem are moving, because any initial enthusiasm may be wasted if nothing is being seen to happen, and will move away to other concerns.

APPENDICES

Appendix 1 Pilot actions, performance and human factors (183) 18 Complacency (the word) 1 Laziness 1 Unprofessionalism 2 Over-confidence 10 Lack of Attention / vigilance 2 shortcuts / less checking due good weather / viz. 7 Distraction 4 Non-sterile cockpit on approach 3 Stress 11 Fatigue 16 Workload or extra tasks in final approach 8 Expectancy - sees rig they expect to see 5 Rushing, hurrying 5 Poor crew Communication and/or CRM 2 Task prioritisation issues 2 Confusion due to information sources 1 Workload caused by paperwork in flight 1 Customer changes causing crew confusion 5 Unfamiliarity of crew 1 Confirmation bias 1 Pilots fulfilling perceived expectation of perfection 3 Pressure to complete mission 2 commit/ID platform before final approach 1 Poor training 1 Lack of arousal 1 Human Error 1 Using few information sources - Not cross-checking other info / equipment 2 Poor Pre-flight preparation 7 Low/poor SA 9 Not following procedures (general) 7 Not following checklist 13 Failure to check/read name on finals 10 Not positively identifying platform / installation 1 Breaking sequence of checklist or procedure 1 Not using NDB 6 Not overfly deck - Straight landing 1 Checklist lip-service 8 Select wrong position or coordinates in FMS 1 Not following FMS on/during final approach 1 Select wrong rig in FMS - similar name 1 Losing rig on curved approach pattern

Signage / lighting (39) 16 Signage poor (general comment) 3 Signage inconsistent/ non-standardised or not corresponding 4 Signage difficult to read 8 Signage missing, not visible or hard to find 6 Signs too small 1 Signage or markings incorrect 1 Deck Lighting non standard

Rig characteristics (37) 13 Nearby rigs look similar 2 Similar looking boats / vessels 3 Decks close / clustered and similar appearance 4 Appearance not distinguishable / lack of cues 6 Similar platform names 2 Installations in line 6 A lot of rigs in area 1 Same beacon frequency for different installations

Operational and general conditions (25) 4 Shuttle flights / multiple landings 1 Landing to minima from radar approach 5 Other traffic 12 Bad Weather / vis. Etc. 2 Good weather 1 night

FMS / Nav issue (19) 11 Rig position information wrong (eg. database not up to date, moved, etc.) 1 Poor FMS display 5 Imprecise non-updated position reports from moving vessels 2 Coordinates changes as vessel moves

Helipad comms (8) 3 Helideck Communication poor or difficult 3 Cleared to land too early - not yet visual 1 Cleared to land process causes WDLs 1 Crews given wrong information

Procedures and Checklists are ineffective (3) 1 Procedures or checklists poor 1 Checklists too long or complex 1 Checklist changes

Visual restriction (2) 2 Restricted vision of one pilot, meaning cannot read label until too late

Appendix 2 No of comments No of given for comments actual offered in events first (anecdotes) question Complacency (the word) 4 18 Laziness 0 1 Unprofessionalism 0 1 Over-confidence 0 2 Lack of Attention / vigilance 2 10 shortcuts / less checking due good weather / viz 0 2 Distraction 2 7 Non-sterile cockpit on approach 0 4 Stress 0 3 Fatigue 2 11 Workload or extra tasks in final approach 0 16 Expectancy - sees rig they expect to see 0 8 Rushing, hurrying 0 5 Poor crew Communication and/or CRM 2 5 Task prioritisation issues 0 2 Confusion due to information sources 0 2 Workload caused by paperwork in flight 0 1 Customer changes causing crew confusion 1 1 Unfamiliarity of crew 5 5 Confirmation bias 0 1 Pilots fulfilling perceived expectation of perfection 1 1 Pressure to complete mission 1 3 commit/ID platform before final approach 0 2 Poor training 0 1 Lack of arousal 0 1 Human Error 1 1 Using too few information sources 0 1 Poor Pre-flight preparation 1 2 Low/poor SA 1 7 select wrong position or coordinates in FMS 0 8 Not following FMS on/during final approach 2 1 select wrong rig in FMS - similar name 0 1 Losing rig on curved approach pattern 0 1 Not following procedures (general) 0 9 Not following checklist 2 7 Failure to check/read name on finals 0 13 Not positively identifying platform / installation 2 10 Breaking sequence of checklist or procedure 0 1

Not using NDB 0 1 Not overfly deck - Straight landing 0 6 Checklist lip-service 0 1 Signage poor (general comment) 1 16 Signage inconsistent/ non-standardised or not corresponding 0 3 Signage difficult to read 0 4 Signage missing, not visible or hard to find 1 8 Signs too small 1 6 Signage or markings incorrect 0 1 Deck Lighting non standard 0 1 Nearby rigs look similar 15 13 Similar looking boats / vessels 13 2 Decks close / clustered and similar appearance 0 3 Appearance not distinguishable / lack of cues 0 4 Similar platform names 4 6 Installations /vessels in line 6 2 A lot of rigs in area 5 6 Same beacon frequency for different installations 0 1 Shuttle flights / multiple landings 9 4 Landing to minima from radar approach 0 Other traffic 1 5 Bad Weather / vis. Etc. 7 12 Good weather 5 2 night 1 1 Rig position information wrong (e.g. not up to date, moved,) 3 11 Poor FMS display 0 1 Imprecise non-updated position reports from moving vessels 2 5 Coordinates changes as vessel moves 0 2 Helideck Communication poor or difficult 1 3 Cleared to land too early - not yet visual 0 3 Cleared to land process causes WDLs 0 1 Crews given wrong information 4 1 Procedures or checklists poor 0 1 Checklists too long or complex 0 1 Checklist changes 0 1 Restricted vision of one pilot - cannot read label until too late 0 2 Rig obscured by cockpit structure 1 Rig obscured behind other rig 2 Forgot to get deck clearance 1 Another rig or vessel near to target 27 IMC/VMC intermittent 2 Prevented by HLOs 1

Appendix 3 - In Flight Observations

The following protocol was used to assist observations. Not all questions were answered on all sectors, and other observations were made.

FMS programming / checking 1. Does the PNF programme the entire route into the FMS before lifting at the Company Base? 2. Any programming deferred until the cruise? If so, does the PF check this? 3. Any change/re-plan of route after departure from Base? If so, are both pilots involved? On the ground / helideck 4. What briefings do the pilots do related to the next waypoint / deck? 5. How much communication is there related to possible misidentification of platform? What? 6. Any threat and error briefings? What? In flight 7. Does ‘down-time’ appear in the flights (i.e. less formality between pilots) 8. Do pilots fly the track as on the ND, and until how many miles approximately? 9. How much do the two pilots communicate about the platform identification? Spotting platform 10. What sort of questions and communications do pilots make about the destination while trying to spot it? 11. How far out do they start trying to find the platform? 12. Note the first communications of platform identification 13. What does the first pilot to make the spot do? 14. Is it clear when the platform has been identified… what get’s said? After this, is it challenged? 15. Do pilots continue to question the identification? 16. Do pilots keep the process ‘open’ after initial sighting? 17. Do pilots use open questions after sighting the probable platform? 18. At what point do pilots close the ID process (stop ACTIVE questioning)? 19. Do any other cues draw their attention / get confirmed after this? 20. Any other notes about the platform spotting / confirming Nav Display 21. How do pilots use the FMC (do they suspend waypoints? Do they use the ‘direct to’ command?) 22. What scale do the pilots set their NDs as they get nearer the platform? 23. When nearing the platform (e.g. 5nm and 2.5nm) is there a gap between heli-symbol and platform waypoint? 24. Does platform waypoint disappear prior to landing? 25. Is there a verbal cross-check with ND when nearing the platform (or in circuit)? Final circuit and Approach 26. How much communication is there from 5nm to platform (how many channels, who is doing what, how busy does it get at worst?) – are the two pilots still in reasonable communication with each other or are they focused on separate comms? 27. When manoeuvring onto approach, what is the situation in terms of heads up and heads down? 28. What is the max time from being able to read the deck ID to reaching the decision point? 29. What does the PNF do on final approach after view of deck is lost? (where look, what say?) 30. How does the PNF do a deck ID check on finals??