This page intentionally left blank. humanfactors

une 1, 1999 — American far beneath the airplane as the captain ly completed U.S. National Aeronautics Flight 1420 was seconds nosed Southwest Airlines Flight 1455 and Space Administration (NASA) study from landing at Little Rock, Arkan- down at a steep angle to try to land near of these and 17 other recent accidents sas, U.S., when the captain’s view of the beginning of the 6,032-ft (1,840- gives a different perspective on pilot error, Jthe runway was obscured by heavy rain m) strip. (ATC) had and this perspective holds keys to making lashing the windshield. “I can’t see it,” he brought the -300 in high flights safer in the future.3 said, but the runway quickly reappeared. and fast, and there was a shearing tail- Our analysis suggests that almost From 200 ft to the ground, he struggled wind aloft. As the captain looked at the all experienced pilots operating in the against the thunderstorm’s crosswinds situation on final approach, he thought same environment in which the accident to align the McDonnell Douglas MD-82 he could make it; in quick succession, crews were operating, and knowing only with the centerline, and the ground- he called for gear and flaps to try to what the accident crews knew at each proximity warning system (GPWS) slow the 737. The could moment of the flight, would be vulner- produced two warnings of excessive see that the airplane was exceeding the able to making similar decisions and sink rate. The first officer thought about limits for a stabilized approach. How- errors. Our study draws upon growing telling the captain to go around, but if he ever, he said nothing because he could scientific understanding of how the spoke, his voice was too soft to be heard. see that the captain was doing all he skilled performance of experts, such as Saturated with high workload during the could to correct it. The jet landed near pilots, is driven by the interaction last stages of the approach, the crew had the normal touchdown point — but of moment-to-moment task demands, forgotten to arm the jet’s ground spoilers at 182 kt, the airspeed was more than the availability of information and the pressingBY BENJAMIN A. BERMAN and R. KEY DISMUKES, Ph.D. approach

for automatic deployment and had not 40 kt faster than the computed target social/organizational factors with the completed the last steps of the landing speed. The pilots were unable to stop inherent characteristics and limitations checklist, which included verification the airplane, and it crashed through of human cognitive processes. Whether of the spoilers; consequently, braking a blast fence at the end of the runway, a particular crew in a given situation performance was greatly degraded. crossed a street and came to a stop near makes errors depends as much, or more, During the landing rollout, the airplane a service station. Two passengers were on this somewhat random interaction veered left and right by as much as 16 seriously injured, and the airplane was of factors as it does on the individual degrees before departing the left side substantially damaged.2 characteristics of the pilots. of the runway at high speed. The crash Flights 1420 and 1455 came to grief, into the approach light stanchions at the in part, because of two of the most far end of Runway 04R destroyed the Why did these experienced common themes in the 19 accidents airplane and killed 11 people, including professional pilots make these errors? studied: plan continuation bias — a the captain.1 The U.S. National Transportation Safety deep-rooted tendency of individuals to Board (NTSB) concluded that the crews continue their original plan of action caused both accidents. It’s true that the even when changing circumstances arch 5, 2000 — pilots’ actions and errors led to the ac- require a new plan — and snowball- Runway 08 at Burbank, cidents — and that in the final moments ing workload — workload that builds California, U.S., would have they were in a position to prevent the on itself and increases at an accelerat- Mappeared very short and very crashes but did not. However, our recent- ing rate. Although other factors not 28 | flight safety foundation | AviationSafetyWorld | December 2006 humanfactors

© Scroggins Aviation/Jetphotos.net

A NASA study of 19 recent accidents yields a new pressing the approach perspective on pilot error. © Joe Pries–ATR Team/Airliners.net © Joe Pries–ATR

www.flightsafety.org | AviationSafetyWorld | December 2006 | 29 humanfactors

discussed here played roles in these on-board weather radar to identify a ibility. In hindsight, assembling all the accidents, the problems encountered thunderstorm cell northwest of the field. cues that were available to the crew, one by the crews seem to have centered on At that point, the crew had no way of can readily infer that the thunderstorm these two themes. knowing whether they could land before had arrived at the airport. Yet the crew the thunderstorm arrived. of Flight 1420 persevered, accepting a Plan Continuation Bias Later, as Flight 1420 continued its change of runways to better accommo- The pilots of Flight 1420 were aware from approach, the pilots received a series date the winds, attempting a close-in vi- the outset that thunderstorms could affect of ATC radio transmissions suggesting sual approach to expedite their arrival, their approach to Little Rock. Before be- that the thunderstorm was beginning and then, as conditions continued to ginning the approach, they saw lightning to affect the airport: reports of shifting deteriorate, changing to an instrument and rain near the airport, and they used winds, gusts, heavy rain and low vis- landing system (ILS) approach and

Radar Data and Partial Air Traffic Communication Southwest Airlines Flight 1455, March 5, 2000, Burbank, California, U.S.

9,000

18:03:33 SOCAL: SW 1455, turn left heading 190, vector to final, descend and maintain 6,000. 8,000

18:04:05 SOCAL: SW 1455, maintain 230 or greater until advised.

7,000

6,000 18:05:10 SOCAL: SW 1455, turn left heading 160. 18:05:56 SOCAL: SW 1455, descend and maintain 5,000. If you’d like the visual, you will be following company. Right now they’re your 1 o’clock and 12 miles, turning onto the final out of 4,600.

18:07:45 SOCAL: SW 1455, descend and maintain 3,000. Company’s over Van Nuys now at 3,000. 5,000

18:08:21 SOCAL: SW 1455, cross Van Nuys at or above 3,000. Cleared visual approach Runway 8.

Altitude (ft)Altitude 4,000

3,000 18:09:53 Tower: SW 1455, wind 210 at 6, Runway 8, cleared to land.

2,000

1,000 BUDDE OM & Van Nuys VOR/DME VINEE MM

0 10 8 6 4 2 0 2 Distance From Runway Threshold (nm)

MM = Middle marker OM = Outer marker SOCAL = Southern California Approach Control

Source: U.S. National Transportation Safety Board

Figure 1

30 | flight safety foundation | AviationSafetyWorld | December 2006 humanfactors

pressing that approach to a landing instead of ingly similar to Flights 1420 and 1455.5,6,7 executing a missed approach. Our study suggests that, when standard op- Similarly, the pilots of Flight 1455 tried to cope erating procedures are phrased not as require- in a situation in which their airplane was obviously ments but as strong suggestions that may appear high and fast, and they continued their approach to tacitly approve of bending the rules, pilots despite numerous cues that landing safely would may — perhaps without realizing it — place too be challenging (Figure 1). For example, 1,000 ft much importance on schedule and cost when above touchdown elevation, where company op- making safety/schedule/cost tradeoffs. Also, erating procedures specified that flights should be pilots may not fully understand why guidance stabilized, this flight was unstabilized, far above the should be conservative; that is, they may not glide path, more than 50 kt too fast and descend- recognize that the cognitive demands of recov- ing at more than three times the desired rate; flaps ering an airplane from an unstabilized approach were at the approach setting because of excessive severely impair their ability to assess whether airspeed, and idle thrust was set. Below 1,000 ft, the approach will work out. For all these rea- the GPWS repeatedly annunciated “SINK RATE” sons, many pilots, not just the few who have and “PULL UP,” and the approach remained highly accidents, may deviate from procedures that unstabilized through touchdown. the industry has set up to build extra safety into Too often, pressing an approach in these cir- flight operations. Most of the time, the result of cumstances is attributed to complacency or an these deviations is a successful landing, which intentional deviation from standards, but these further reinforces deviant norms. terms are labels, not explanations. To under- Our study suggests that as pilots amass expe- stand why experienced pilots sometimes con- rience in successfully deviating from procedures, Many pilots, not tinue ill-advised approaches, we must examine they unconsciously recalibrate their assessment the insidious nature of plan continuation bias. of risk toward taking greater chances. This just the few who Plan continuation bias appears to underlie recalibration is abetted by a general tendency of have accidents, what pilots call “press-on-itis,” which a Flight individuals to risk a severe negative outcome of Safety Foundation task force found to be in- very low probability — such as the very small risk may deviate from volved in 42 percent of accidents and incidents of an accident — to avoid the certainty of a much they reviewed.4 Similarly, this bias was apparent less serious negative outcome — such as the procedures that in at least nine of the 19 accidents in our study. inconvenience and the loss of time and expense the industry has set Our analysis suggests that this bias results from associated with a go-around. the interaction of three major components: Another inherent and powerful human cog- up to build extra social/organizational influences, the inherent nitive bias in judgment and decision making is characteristics and limitations of human cogni- expectation bias — when someone expects one safety into flight tion, and incomplete or ambiguous information. situation, he or she is less likely to notice cues Safety is the highest priority in commer- indicating that the situation is not quite what it operations. cial flight operations, but there is an inevitable seems. Having developed expectations that the trade-off between safety and the competing goals thunderstorm had not yet reached the airport of schedule reliability and cost effectiveness. To (Flight 1420) and that the descent and approach ensure conservative margins of safety, airlines profile was manageable (Flight 1455), the crews establish written guidelines and standard proce- in these accidents may have become less sensi- dures for most aspects of operations, including tive to cues that reality was deviating from their specifications for minimum clearance from thun- mental models of the situation. derstorms and criteria for stabilized approaches. Expectation bias is worsened when crews are Yet considerable evidence exists that the norms required to integrate new information that ar- for actual flight operations often deviate consid- rives piecemeal over time in incomplete, some- erably from these ideals, in ways that are strik- times ambiguous, fragments. Human working www.flightsafety.org | AviationSafetyWorld | December 2006 | 31 humanfactors

memory has extremely limited capacity Snowballing Workload crew’s attention contributed to their to hold individual chunks of informa- Errors that are inconsequential in forgetting to arm the spoilers and to tion, and each piece of information themselves have a way of increasing complete the landing checklist. Also, decays rapidly from working memory. crews’ vulnerability to further errors the pilots had been awake more than Further, the cognitive effort required to and combining with happenstance 16 hours at the time of this approach, interpret and integrate these fragments events — with fatal results. By con- and they were flying at a time of day can reach the limits of human capacity tinuing the unstabilized approach, the when they were accustomed to sleep- to process information under the com- captain of Flight 1455 increased the ing. Among the effects of fatigue are peting workload of flying an approach. crew’s workload substantially. Getting slowing of information processing and The crew of Flight 1420 had to the aircraft configured and down to the narrowing of attention. The combina- make inferences about the position glideslope made strong demands on the tion of fatigue, the stress of a chal- of the thunderstorm and the threat pilots’ attention — a very limited cogni- lenging approach and heavy workload it presented by using information tive resource. The high speed of the can severely undermine cognitive obtained from their view through the aircraft (197 kt), with a 2,624 foot-per- performance. windshield, cockpit radar, automatic minute descent rate, increased the rate A particularly insidious manifesta- terminal information service (ATIS) of events and reduced the time available tion of snowballing workload is that information and a series of wind for responding. This situation would it pushes crews into a reactive, rather reports from ATC spread over time. produce stress, and acute stress narrows than proactive, stance. Overloaded The information available from these the field of attention (“tunneling”) and crews often abandon efforts to think sources was incomplete and ambigu- reduces working memory capacity. ahead of the situation strategically, ous; for example, the weather radar was An airplane that landed ahead instead simply responding to events as pointed away from the thunderstorm of Flight 1455 was slow clearing the they occur and failing to ask, “Is this for several minutes while the flight was runway — another development that going to work out?” being vectored, and in any case, this placed demands on the crew’s attention. radar does not delineate the wind field These factors combined to impair the Implications and Countermeasures extending from a thunderstorm. crew’s ability to monitor all relevant Simply labeling crew errors as “failure The situation facing the crew of flight parameters and to determine to follow procedures” misses the es- Flight 1455 may seem to have been whether they could land the airplane sence of the problem. All experts, no obvious from several miles before safely. In post-accident interviews, the matter how conscientious and skilled, touchdown, as the 737 joined the final captain said that he had no idea the air- are vulnerable to inadvertent errors. approach course above the glideslope speed was so fast. Also, the snowballing To develop measures to reduce this at a very fast airspeed. But although the workload made it less likely that the pi- vulnerability, we first must understand excess energy — in the form of altitude lots would remember that the assigned its basis in the interaction of task and speed — was apparent, it was not runway was considerably shorter than demands, limited availability of infor- at all clear that the approach could not the runways they were accustomed to mation, sometimes conflicting organi- be stabilized in time for a safe landing. and recognize the implications. zational goals and random events with No display in any airline cockpit directly Similarly, the decision of the the inherent characteristics and limita- indicates or projects the energy status of crew of Flight 1420 to continue the tions of human cognitive processes. the aircraft all the way to the stopping approach in the face of challenging Even actions that are not inadvertent, point on the runway; thus, the pilots had weather substantially increased their such as continuing an unstabilized to continuously observe cues about the workload. After the accident, the first approach, must be understood in this gradient path to the runway, airspeed, officer told investigators, “I remem- context. pitch attitude, altitude and thrust, and ber that around the time of making Almost all airline accidents are integrate them with other factors that the base-to-final turn, how fast and system accidents. Human reliability in were not displayed — lift, drag and compressed everything seemed to hap- the system can be improved — if pilots, braking performance — to update their pen.” Undoubtedly, this time compres- instructors, check pilots, managers and understanding of the situation. sion and the high demands on the the designers of aircraft equipment

32 | flight safety foundation | AviationSafetyWorld | December 2006 humanfactors

and procedures understand the nature and checklists for design features that Notes of vulnerability to error. For example, invite errors. Examples of correctable 1. U.S. National Transportation Safety Board monitoring and checklists are essential design flaws are checklists conducted (NTSB). Runway Overrun During Landing, defenses, but in snowballing-workload during periods of high interruptions, American Airlines Flight 1420, McDonnell situations, when these defenses are critical items that are permitted to Douglas MD-82, N214AA, Little Rock, most needed, they are most likely to “float” in time (e.g., setting takeoff flaps Arkansas, June 1, 1999. NTSB report no. AAR-01-02. be shed in favor of flying the airplane, at an unspecified time during taxi) and managing systems and communicating. actions that require the monitoring 2. NTSB. Southwest Airlines Flight 1455, Monitoring can be made more reli- pilot to go “head-down” during critical Boeing 737-300, N668SW, Burbank, able, though, by designing procedures periods, such as when a taxiing airplane California, March 5, 2000. NTSB report no. AAB-02-04. that accommodate the workload and nears a runway intersection. by training and checking monitoring Operators should carefully exam- 3. Dismukes, R.K.; Berman, B.A.; as an essential task, rather than as a ine whether they are unintentionally Loukopoulos, L.D. (in press). The Limits of Expertise: Rethinking Pilot Error and secondary task.8 Checklist use can be giving pilots mixed messages about the Causes of Airline Accidents. Aldershot, improved by explaining the cognitive competing goals such as stabilized U.K.: Ashgate. reasons that effectiveness declines with approaches versus on-time perfor- 4. Flight Safety Foundation (FSF). “Killers extensive repetition and showing how mance and fuel costs. For example, if a in Aviation: FSF Task Force Presents this can be countered by slowing the company is serious about compliance Facts About Approach-and-Landing pace of execution to be more deliberate, with stabilized approach criteria, it and Controlled-Flight-Into-Terrain and by pointing to or touching items should publish, train and check those Accidents.” Flight Safety Digest Volume 17 being checked. criteria as hard-and-fast rules rather (November–December 1998) and Volume We also must accept that some vari- than as guidelines. Further, it is crucial 18 (January–February 1999). ability in skilled human performance is to collect data about deviations from 5. Rhoda, D.A.; Pawlak, M.L. An Assessment inevitable and put aside the myth that those criteria — using flight opera- of Thunderstorm Penetrations and because skilled pilots normally perform tional quality assurance (FOQA) and Deviations by Commercial Aircraft in the Terminal Area. Institute of a task without difficulty, they should be line operations safety audits (LOSA) Technology, Lincoln Laboratory, Project able to perform that task without error — and to look for organizational fac- Report NASA/A-2. (1999). 100 percent of the time. tors that tolerate or even encourage Although plan continuation bias is those deviations. 6. NTSB. Flight Into Terrain During Missed Approach, USAir Flight 1016, DC-9-31, powerful, it can be countered once ac- These are some of the ways to N954VJ, Charlotte/Douglas International knowledged. One countermeasure is to increase the reliability of human Airport, Charlotte, North Carolina, July 2, analyze situations more explicitly than performance on the flight deck, mak- 1994. NTSB report no. AAR-95-03. is common among crews. This would ing errors less likely and helping the 7. Chidester, T.R. “Progress on Advanced include explicitly stating the nature of system recover from the errors that Tools for Flight Data Analysis: Strategy for the threat, the observable indications of inevitably occur. This is hard work, but National FOQA Data Aggregation.” Paper the threat and the initial plan for deal- it is the way to prevent accidents. In presented at Shared Vision of Flight Safety ing with the threat. Crews then should comparison, blaming flight crews for Conference. San Diego, California, U.S. explicitly ask, “What if our assumptions making errors is easy, but ultimately 2004. are wrong? How will we know? Will we ineffective. ● 8. Sumwalt, R.L. III; Thomas, R.J.; know in time?” These questions are the Benjamin A. Berman is a senior research as- Dismukes, R.K. “Enhancing Flight- basis for forming realistic backup plans sociate at the U.S. National Aeronautics and Crew Monitoring Skills Can Increase Flight Safety.” In Keeping Safety a and implementing them in time, but Space Administration (NASA) Ames Research Worldwide Priority: Proceedings of the they must be asked before snowballing Center/San Jose State University and a pilot for a major U.S. air carrier. R. Key Dismukes, 55th International Air Safety Seminar. workload limits the pilots’ ability to Ph.D., is chief scientist for aerospace hu- Alexandria, Virginia, U.S.: Flight Safety think ahead. man factors in the Human Factors Research Foundation, 2002. Airlines should periodically review and Technology Division at the NASA Ames normal and non-normal procedures Research Center. www.flightsafety.org | AviationSafetyWorld | December 2006 | 33