Incident Report

[DEFCON]

GU

In the past I've done some representational work for pilots involved in "incident" and "accident" investigations. Those in charge of disecting an event in which the CPT undertook a deviation from SOP generally began and often expressed a concluding "opinion" of "through his actions the pilot was responsible for creating the non-standard event".

The pilot never wins when he deviates from standard in the interest of expediency which in turn has produced an unfavourable outcome.

IOW and with respect to SOP, "Captains Discretion" is a poorly defined authority.

[dragon]

gotta add, and no disrespect to any controller within any silo within the ATC structure, because I have no clue how you do your job, only my belief that it is a very difficult job [especially with the current manpower squeezes] and you guys/girls do it remarkably well..

having said that; there is a big difference between "would you like" and "expect". of course, any change after TOD to expect a different runway than forecast is for all intent and purpose a heads up and you are expected to act appropriately. add another "expect" in there, even back to the original expect and even if it is pre-loaded into RTE 2, and it is eating up a lot of time, offering more room for error and quickly shrinking your scope of situational awareness.. that is a physical given. does it happen in Toronto more than other terminals? I don't do much into the States [ATC congestion one of the reasons I avoid N/S] but I would say it does happen more frequently than other Canadian terminals and definitely more that the big terminals of Europe..

Now, a "would you like".. I always looked at a request as a freebie, a controllers attempt to help me out [or a controller out for that matter]. I think we all agree that safety is the overriding condition on which to base our acceptance or denial.

Once again, I still think our ATC crew does a wonderful job.

comments/thoughts?..

[Guest Gino Under]

Totally agree.

But, non-standard can be a standard briefing when things turn to do-do if it's handled properly. The hurry up and rush syndrome is a torpedo, for sure.

You have to make the time to handle the situation with 'strick' adherence to SOPs. If not, you're left with non-standard.

Now you're sticking your neck out.

[MURRAY]

Considering that the majority of "offered" runway changes are on initial contact with arrival (26 DME arc of YYZ), I think it would be safe to say that we have little or no problem. If you're inside of ten final it's doubtful that your runway will be changed for operational purposes either, unless there is an incident involving FOD on the runway.

If, in fact, it is the PIC's option "at all times", then I find the whole concept of "go along to get along" a little hard to swallow, and I'd guess that at least some of your colleagues do as well.

[Guest Gino Under]

I wish we had the jumpseat available to ATC types from every centre in the country. Maybe then both groups could continue to work well together.

[Guest PortTack]

Similar to a dispatcher filling 4 hours a year for a Transport Canada requirement. Pilots should have to sit with ATC for a session a year and visa versa...filling the others shoes gives a real understanding.

[Guest neo]

Hi Don and thanks,

I suspect (and hope) that we're on the cusp of a revolutionary change in aviation safety. It would perhaps be analagous to the revolution in reliability when airliners dropped pistons and propellors and went to turbine jets. However, this new change will have little to do with more technologically-advanced systems, and instead be about the people in the cockpit and the many other humans that support the job they do.

One need only ask oneself: what would make a crew fly a perfectly good airplane into a mountain at Cali? Or take off on a closed runway at Taipei? Or act on clearly erroneous data as in the AC incident?

These occurences (and many others every year) have a large 'human factors' component to them. The choices that humans made were a major cause of a serious problem. And while the supporting technology can always be improved, until we're prepared to address human factors in a far more sophisticated way, we will make no further significant improvement to airline safety.

Consider: the most technologically-advanced flight department in the world, NASA, has been shown through two consecutive disasters to have no more clever ability to weed out human factors in their operation than anyone else. The Challeger disaster was caused by thinking of the sort that any bushpilot toiling for a gypo operator would recognize: "Screw the weather! Get out there and fly!" So we can readily see, ever more sophisticated technology will not bring safer operations on its own. Addressing the human element and human systems will.

Engineers have sorted out, in the most clever ways, the myriad and exceedingly complex aerodynamics and thermodynamics that make a modern jet engine an icon of reliability. Yet we have barely scratched the surface of our own human qualities as we do our jobs at the nexus of a complex industrial system.

Pilots are sometimes their own worst enemies in this regard. There's many pilots who could tell you what electrical bus controls some obscure system buried deep in the bowels of their airplane, even though there's nothing that he or she can do with that information. But ask those same pilots if they consider themselves to be a type A or type B personality, and you'd probably get a blank stare and embarassed silence. Yet a pilot's personal make-up is an integral and crucial part of having a safe operation.

Discussing and acting on human factors doesn't fit comfortably into the pilot culture as we've developed it thus far. We need to change that. Our thinking needs to focus less on technology and technical skills and more on humans and what makes them tick, if we're to provide those who have entrusted their lives to us a safe journey.

Best wishes,

neo

[Guest Saltaire]

And Canadian ATC should fly south to almost any major hub in the US. It's night and day. Talk about efficient movement!

[MURRAY]

That's because U.S. ATC is dealing primarily with U.S. carriers. It's much easier to be efficient when working with motivated and equally efficient flight crews.

[Don Hudson]

Neo;

Re "Discussing and acting on human factors doesn't fit comfortably into the pilot culture as we've developed it thus far. We need to change that. Our thinking needs to focus less on technology and technical skills and more on humans and what makes them tick, . . . ."

I wholeheartedly agree. To effectively address human factors, we need to talk about "human" traits, not "pilot" traits.

Re NASA..the best reference on the NASA culture before STS-51L is Diane Vaughan's book, The Challenger Launch Decision-Risky Technology, Culture, and Deviance at NASA".

Programs such as FOQA assist in understanding human factors through the crew contact process, an entirely safety-oriented process. The flow of information from the line right up through the organization into senior levels of management is crucial, a point made in Vaughan's book.

[Guest neo]

It's a vast subject to be sure, but here are a couple of examples based on issues that have been identified here on AEF recently.

I've never flown the Airbus, but I've read here that on the FBW versions the take-off trim setting is made by entering a value into the FMS. This numerical value is preceeded by either a '+' or '-' to indicate whether the trim setting is positive or negative. If my understanding is correct, this is an example of a sub-system with a poorly designed human factors risk. It may suit some engineer to have a trim setting assigned a plus or minus value, but it is the last thing a pilot needs to deal with. It matters not one bit to the pilot how the trim scale is calibrated for setting purposes: it could be in letters (A, B, C,....) symbols, or numbers; it only matters that the pilot enter the data correctly. Ergo, why introduce the requirement that you set a plus or minus value in addition to the numerical one, WHEN THAT PLUS OR MINUS VALUE CAN HAVE A SIGNIFICANT IMPACT ON AIRCRAFT SAFETY? Simply make the trim scale 1 to 10, for example, or A through Z, but don't ask for an extra unnecessary keystroke during the most busy time of the flight when its incorrect entry can cause huge problems!

That's an example of a completely unnecessary pilot/aircraft interface requirement that is poorly designed and invites human error.

The second example I'd like to speak to is one that you touched on in a previous post: error-trapping. Error-trapping is a software systems concept and essential in any properly-written code, NO MATTER HOW RELIABLE THAT CODE MAY BE. That's because regardless of how clever the software engineer, situations always arise which he or she cannot foresee. The software needs to be able to handle these situations elegantly, and above all, not 'crash'. (A somewhat grim analogy to our own human factors predicament.) Applying this concept to a pilot's SOP's strongly suggests that all procedures should contain error-trapping in scale with the safety risk inherent in the act.

Going direct off-airways out of radar control? Both pilots confirm charted safe-altitude. (Cali)

Taking off from a multi-runway airport? Both pilots visually confirm the runway entered. (Taipei)

And pre-flight FMS entries that impact take-off performance? You could write a book here, but suffice to say that because of the design and human factors issues noted previously, our current error-trapping is insufficient for such a crucial matter.

Best wishes,

neo

[Guest neo]

It's a vast subject to be sure, but here are a couple of examples based on issues that have been identified here on AEF recently.

I've never flown the Airbus, but I've read here that on the FBW versions the take-off trim setting is made by entering a value into the FMS. This numerical value is preceeded by either a '+' or '-' to indicate whether the trim setting is positive or negative. If my understanding is correct, this is an example of a sub-system with a poorly designed human factors risk. It may suit some engineer to have a trim setting assigned a plus or minus value, but it is the last thing a pilot needs to deal with. It matters not one bit to the pilot how the trim scale is calibrated for setting purposes: it could be in letters (A, B, C,....) symbols, or numbers; it only matters that the pilot enter the data correctly. Ergo, why introduce the requirement that you set a plus or minus value in addition to the numerical one, WHEN THAT PLUS OR MINUS VALUE CAN HAVE A SIGNIFICANT IMPACT ON AIRCRAFT SAFETY? Simply make the trim scale 1 to 10, for example, or A through Z, but don't ask for an extra unnecessary keystroke during the most busy time of the flight when its incorrect entry can cause huge problems!

That's an example of a completely unnecessary pilot/aircraft interface requirement that is poorly designed and invites human error.

The second example I'd like to speak to is one that you touched on in a previous post: error-trapping. Error-trapping is a software systems concept and essential in any properly-written code, NO MATTER HOW RELIABLE THAT CODE MAY BE. That's because regardless of how clever the software engineer, situations always arise which he or she cannot foresee. The software needs to be able to handle these situations elegantly, and above all, not 'crash'. (A somewhat grim analogy to our own human factors predicament.) Applying this concept to a pilot's SOP's strongly suggests that all procedures should contain error-trapping in scale with the safety risk inherent in the act.

Going direct off-airways out of radar control? Both pilots confirm charted safe-altitude. (Cali)

Taking off from a multi-runway airport? Both pilots visually confirm the runway entered. (Taipei)

And pre-flight FMS entries that impact take-off performance? You could write a book here, but suffice to say that because of the design and human factors issues noted previously, our current error-trapping is insufficient for such a crucial matter.

Best wishes,

neo

[Don Hudson]

Hi Neo;

Re the FMC entry for trim...that entry is merely a reminder, not a setting. The trim on the Airbus is set by rotating the trim wheel which is mechanically attached (via hyd. servos) to the horiz. stab. The input on the FMC doesn't even issue a warning if the two are different.

Agree with you on error-trapping. One method is to continuously loop-back to the last action performed to verify it, test it and reify it before moving on. In a distracting environment such behaviour can save a few steps or prevent a larger error from developing.

Mistakes are a part of human activity and creating behaviours which expect them, highlight them and correct them is better than trying to be perfect, which is a very old-fashioned and proven-dangerous macho approach to aviating.

I hear your area is heating up again...are you guys okay?

Don

[Guest neo]

Don,

Thanks for the correction re: the Airbus trim setting issue, and we are more than OK, we are expecting an absolutely ripper vintage.

(But thoughts with those in Kelowna; it could have soooo easily been us with but a slight change in wind.)

For those of you who are railroad buffs, (and I know of one or two here on the forum) the Kelowna fire today destroyed a good number of the amazing Myrah Canyon trestle bridges. They were world-class artifacts of an altogether amazing period in railroading. A very sad loss.

neo

[Don Hudson]

Thanks, Neo;

Toured some lovely vineyards near Langley and am planning to tour the Ok. We'll be sure to drop in! Probably early in the spring...

Sad loss on the trestles...they're works of art. There's another one on VR island not too far from Duncan...good trail to it.

Don

[Guest neo]

Ah, the ol' E&N!

Getting back to flying, it occurs to me that the Airbus trim setting issue I mentioned a post or two ago, might still apply if the plus/minus trim setting was applied manually to a trim wheel: once again there is an artificially-created path to a gross error. Has there ever been an instance of an takeoff with incorrect trim setting on the Airbus directly attributable to the misapplication of a plus for a minus, or vice versa?

A fundamental requirement of new pilot operating systems should be that they minimize the number of ways that you can screw up; and provide for error-trapping scaled to the risk attached to those issues you can't eliminate.

[conehead]

Neo; I know of two CF-18 aircraft that crashed at the end of the runway due to the pilot setting the take-off trim to the (+) rather than the (-). As they reached Vr, the tail of the aircraft began flying, with the nosewheel still on the ground. You can imagine their surprise as they kept hauling back on the stick, to no avail. Both pilots successfully ejected, resulting in the total loss of the aircraft. These were two separate incidents, one in Cold Lake, one in Germany.

[Guest neo]

Thanks for the info, conehead. I sure can imagine their surprise and horror!

I don't want to harp on it too much, especially as this specific issue applies to aircraft that I've never flown, but I think we can all see the general concept: the procedures required to operate an aircraft should never have artificially-created 'gotcha's'. A plus/minus setting for take-off trim is an artificial-created path to a potential gross error. There is no reason whatsoever that it should be there; the trim scale could be labeled in whatever units the manufacturer choses.

One of the great ironies (and let's be honest, tragedies) about these sorts of artificial risks is that the pilot is expected to compensate for them. And compensate we do. Procedures will be created to hopefully trap any error that comes about because of a human factors flaw. Now the pilot's workload and stress levels increase unnecessarily. Attention that could have been devoted to other matters must momentarily be assigned to ensuring that a gross error hasn't arisen. Perversely, this increased workload and stress level increases the risk that error could creep in at some other point of the take-off preparatory flow.

Human factors design flaws feed on themselves and each other. And regretably, pilots often buy into this whole negative feedback loop. We don't demand that aircraft we fly come without design flaws of this sort; instead we often choose to excoriate those pilots who fall foul of them. "Oh you dumb schmuck! Everyone knows about that problem. You should have... etc, etc."

But of course, that's blinkered thinking. It's not a question of knowing what to do, it's a question of controlling potential error. Everyone knows how to add, but if you give a column of numbers to ten people and ask them for the sum, chances are some people will get the answer wrong. So, you can't expect knowledge of a human factors design flaw to preclude error creeping in at that point. You must eliminate the entry point. Doing so also means that pilots now have more time to devote to those issues of error control which cannot be eliminated.

Never design a aircraft system or procedure which artificially (unnecessarily) introduces an entry point for error. If the system cannot be designed to eliminate the potential entry point, then design error-trapping procedures in scale with the risk contained in the potential error.

Best,

neo

[Guest neo]

Thanks for the info, conehead. I sure can imagine their surprise and horror!

I don't want to harp on it too much, especially as this specific issue applies to aircraft that I've never flown, but I think we can all see the general concept: the procedures required to operate an aircraft should never have artificially-created 'gotcha's'. A plus/minus setting for take-off trim is an artificial-created path to a potential gross error. There is no reason whatsoever that it should be there; the trim scale could be labeled in whatever units the manufacturer choses.

One of the great ironies (and let's be honest, tragedies) about these sorts of artificial risks is that the pilot is expected to compensate for them. And compensate we do. Procedures will be created to hopefully trap any error that comes about because of a human factors flaw. Now the pilot's workload and stress levels increase unnecessarily. Attention that could have been devoted to other matters must momentarily be assigned to ensuring that a gross error hasn't arisen. Perversely, this increased workload and stress level increases the risk that error could creep in at some other point of the take-off preparatory flow.

Human factors design flaws feed on themselves and each other. And regretably, pilots often buy into this whole negative feedback loop. We don't demand that aircraft we fly come without design flaws of this sort; instead we often choose to excoriate those pilots who fall foul of them. "Oh you dumb schmuck! Everyone knows about that problem. You should have... etc, etc."

But of course, that's blinkered thinking. It's not a question of knowing what to do, it's a question of controlling potential error. Everyone knows how to add, but if you give a column of numbers to ten people and ask them for the sum, chances are some people will get the answer wrong. So, you can't expect knowledge of a human factors design flaw to preclude error creeping in at that point. You must eliminate the entry point. Doing so also means that pilots now have more time to devote to those issues of error control which cannot be eliminated.

Never design a aircraft system or procedure which artificially (unnecessarily) introduces an entry point for error. If the system cannot be designed to eliminate the potential entry point, then design error-trapping procedures in scale with the risk contained in the potential error.

Best,

neo

[Don Hudson]

Again, an excellent approach to the problem.

Re "Never design a aircraft system or procedure which artificially (unnecessarily) introduces an entry point for error."

I am told that the ejection instructions on a particular fighter were placarded on the canopy frame...

[Guest neo]

Step One: Eject canopy.

Step Two... "Hey!"

[Mitch Cronin]

I know I'm late with this one, and it'll likely be missed entirely, ...But in addition to giving Captain Al Haines, and crew, the credit they most certainly deserve.... It must also be said that those god-awful-beautiful airplanes were built like tanks, and that too was responsible for many of the lives saved. Try cartwheeling a 767 down a runway and count the living... No, don't try it.

DC10's had their flaws, but damn there was some good stuff in them.

Cheers

[Mitch Cronin]

... and another thing... I'd bet my next paycheque that a pilot could do whatever the heck he wanted with the rudder pedals and not break that rudder off, or the vertical stab...

[Guest amejazz]