ELIMINATING "COCKPIT-CAUSED" ACCIDENTS

Error-tolerant Crew Procedures for the Year 2000

Captain Steve Last

This document may be freely reproduced in the interests of air safety provided due acknowledgement is given. Comments or requests for additional copies should be addressed to the author at

The Barn, Hill Farm Road, Marlow Bottom,
Bucks SL7 3LX, England
e-mail: srlast@Compuserve.com
Phone: (+44) 1628 484003
Fax: (+44) 1628 486350

Contents

Executive Summary

Bringing Standard Operating Procedures into the 21st Century

Appendix 1: Common objections to the concept

Appencix 2: Objections to the data

Appendix 3: An airline case history - four CFIT "close calls"

Appendix 4: "First Officersī Sectors."

Appendix 5: Where did the situation get out of hand?

Appendix 6: a specimen SOP allocation of duties

About the author

Notes, amplifications, and references

Executive Summary.

It is essential to the long term future of the airline industry to make a major reduction in the overall accident rate. Human error, and in particular flight crew errors, are recognised as the most important single contributor to the current accident rate. Achieving the desired target requires a global reduction in collective crew errors of the order of 80%, but a decade or more of attempts to achieve this by improving individual crew member performance shows little prospect of meeting that objective.

One of the primary safety tools for flight crews is their Standard Operating Procedures. However, the "engineering" analysis of conventional crew operations in this paper shows they cannot achieve the necessary reliability, because subordinate crew members cannot be relied on to switch from a "help" to an "oppose" mode when necessary. A "humanistic" analysis also indicates that this kind of failure is inherent in the culture of most societies.

Actual data on airline accidents, as well as much anecdotal and other evidence, indicates that the breakdown of crew procedures which require co-pilots to make a "mode switch" from "assist" to "prevent" is in fact a major factor in those accidents. An alternative, "delegated flying" method of operation should in theory be more reliable from both perspectives. Actual comparative data available indicates that this alternative procedure does indeed produce significantly better results, possibly as high as the 80% error reduction improvement needed, if not more.

The alternative "delegated flying" SOP incorporates techniques specifically recommended in ICAOīs recent CFIT study, as well as one of the fundamental problem-solving tools recommended in most CRM training. Consequently, there is an unarguable case for the industry to make changes which will incorporate the concept of delegation of routine non-critical flying tasks into normal operating procedures for transports with a crew of two pilots or more. An implementation strategy is recommended which should enable the industry to achieve its safety target on all multi-crew transport aircraft at virtually zero cost, with no requirement for additional equipment.

The paper is self-contained, but the Notes and Appendices contain additional explanatory material, references, examples, and comment on the questions which a radical change such as is proposed normally generate.

Bringing Standard Operating Procedures into the 21st Century.

The challenge: achieving a large reduction in the accident rate.

The air transport industry today faces a major challenge. There is a wide consensus that unless we dramatically improve our overall safety performance, there will be an unacceptable increase in the total number of accidents over the coming years. Flight safety is critically dependent on flight crews solving problems correctly, and the majority of accidents now involve failure to resolve some sort of problem affecting the crew and their aircraft and/or their environment: in almost all cases a solution was available, but for various reasons was not applied. This situation has been recognised for at least twenty years, and various remedies have been proposed, but so far they are having have only marginal effects on the total safety picture, basically because they tend to address individual symptoms of the problem. They are not sufficiently radical to provide the step-change improvement actually needed across all segments of the business, from old to new aircraft technology, and from regional and commuter carriers to major intercontinental airlines.

The fact is that some of the basic problem-solving tools provided to crews are simply no longer adequate for the demands being made. To eliminate these accidents it is essential to focus on detecting and correcting errors, rather than on unrealistic attempts further to eliminate them. We must make flight operations error tolerant. Flight crews, and specifically airline flight operations managements, need to apply both basic engineering safety principles, and elementary human relations concepts, to the operational problems that crews encounter. This proposal addresses that task, and outlines the radical change which will provide the improvement needed.

Can training fix the problem?

We know that both global, generalised accident data, and detailed studies such as the NTSBīs 1994 study of U.S. airline accidents, indicate that failures originating in the flight deck are the predominant primary cause in airline accidents. Typically, the approach to dealing with this is by crew training and education, intended to improve crew performance by improving the quality of individual crew members.

But accidents are not generally due to single failures of sub-standard individuals: usually, it is the way that previously "satisfactory" individuals received and processed information in a specific instance which was at fault. That is why the enormous amount of effort expended in training has not produced the desired result. The origin of accidents in complex, low risk/high hazard systems such as aviation lie in the organisation and system management: the individuals involved in the actual accident are merely the final links in the chain of weaknesses.

To reduce the accident rate sufficiently by training individual crew members, it would be necessary to improve crew member "quality" by about an order of magnitude. But most crews already believe they operate in a very safe manner - most airline pilots would rate their work as being considerably safer than many other aspects of their lives. It is certainly safer than most other types of aviation. Whilst airline pilots generally accept that there is a need for improvement, they see the problem as inadequate or inappropriate tools to do the job - not a lack of good qualities within the pilots themselves.

It is extremely improbable that we will be able to convince every individual pilot that he or she needs personally to be ten times safer in future than today - let alone actually to make them so. Comparing accident and incident statistics with typical transport pilot career flying exposure will quickly show that most pilots rarely experience significant incidents, and those that they do experience are not generally crew-originated - indeed most incidents involve the crew members preventing errors originating elsewhere from becoming accidents. Managers generally have far less exposure than line pilots and are even less likely to be experience a problem, so their perception of personal risk is probably further skewed by this. Consequently, all pilots must recognise that although they individually may never have experienced even the slightest hint of a specific problem, the risk from that cause may still be unacceptably high, and it may be necessary to alter their working methods to deal with that risk.

Around the world, there are also economic and political factors tending to drive the quality of crew "raw materials" DOWN, not UP. It follows that since we still need to reduce the "cockpit caused" accident rate by a factor of 5 to 10, we cannot rely on improved training of individual pilots as the primary means to improve the quality of either existing or future crews, to reduce cockpit-caused accidents. We need some radical thinking, and it is in the crew procedures area that the biggest, quickest and by far the lowest cost improvements can be made. However, this is also the area in which entrenched prejudices (driven largely by misleading subjective experience of risk) pose the biggest obstacles to achieving our improved flight safety objectives. In other words: we pilots may be our own worst enemies, and some traditional concepts in flight operations are now actively hindering our safety record.

The role of Standard Operating Procedures (SOPs)

"Non-adherence to SOPs" is a primary accident cause. Some recent studies give clues as to why this can happen, but they fail to address a basic question: is the whole philosophy underlying most airline crew co-ordination SOPs still in fact valid?

The vast majority of aircraft, including all basic training types, are designed from the outset for a minimum crew of only one pilot. Licensing authorities base not only the initial qualification for a commercial licence, but also their recurrent qualification requirements for a multi-crew transport, on the basis of single pilot operation. While the need for each pilot individually to be capable of all operational functions is self-evident, the large transport aircraft which we are concerned with however are fundamentally different in that they are not operated by a single pilot, but by a crew of at least two pilots. This mismatch - do we deal with a pilot or a multi-person crew? - lies at the root of many transport aircraft accidents, for the air transport industry still tends to think primarily of the pilot and of only as an afterthought of "the crew".

A crucial question addressing the problem of crew-caused accidents was asked at an SAE conference on Human Error Avoidance in 1990. It was this:

"When the operational profile is analysed to establish crew duties, independent checks by the pilot-not-flying, and checklist sequences, how rigorous are we in actual practice? How completely are the assumptions wrung out, documented, and cross-checked? What process is followed when a procedure change is proposed? Who performs the new "failure mode and effects analysis"? Who is in charge of the master "dual-channel integrity" document?"

It asks, in effect, who analyses crew procedures to ensure that the crew function safely as a system? And the answer is that usually, no-one does.

From "pilot", to "pilots", to "crew".

In single-pilot aircraft it is inevitable that the one pilot is responsible for all tasks. Single-pilot aircraft are used for private, military, and general aviation, where the accident rate is higher than in air transport. It is because the consequences of airline accidents are so enormous, in human and financial terms, that reducing the transport accident rate further is so important. If we are to achieve this objective, we can no longer operate big transport aircraft as if they are just large, complicated and expensive versions of the Piper Cub. Instead it is essential to ensure that SOPs are written which wring every ounce of benefit from the fact that we normally have at least a two-pilot crew available.

As the original single-pilot airmail aeroplane grew into the larger transport, the traditional operational concept recognised that the single pilot could no longer handle everything himself. So functions such as communication and systems operation were delegated to assistants. The primary role of "the pilot" remained direct responsibility for all flight path inputs: almost universally the pilot with overall responsibility for the flight is also called the "pilot flying", "Handling pilot", or some such terminology. If a First Officer is acting as Pilot-in-Command Under Supervision, then he or she usually becomes the "pilot flying": command - "being in charge" - is regarded as fundamentally inseparable from direct Control.

The role of Crew Resource Management.

More up-to-date thinking has given us much improved facilities on the aircraft, and Crew Resource Management (CRM). At the very least, CRM is intended to ensure that the Pilot receives information and advice from not only the other crew members, but also from external sources. A fundamental element will also be that wherever possible, adherence to SOPs will enhance safety. CRM training may also incorporate advice to delegate the aircraft handling functions under many circumstances, as well as utilising as much as possible of the aircraft avionics. This will often result in a conflict: SOPs say that handling should be done by the Pilot in Charge (the Pilot Flying), but good CRM indicates it should be delegated to the other pilot as a lower priority task. A question which is often lacking in some CRM courses however is how to determine when the situation has become serious enough to warrant this delegation, i.e. when to abandon the basic SOP allocation of duties because it does not give the pilot-in- charge the opportunity to resolve the bigger problems. At the same time of course the CRM training emphasises the need to stick to SOPs.

In many of the events used as examples for CRM training, a fairly dramatic event is used to illustrate the benefits of what is being advocated - a good example perhaps being the UAL DC10 accident at Sioux City. However, in many real world accident and incident scenarios, it is evident that a gradual breakdown of ability to "see the overall picture" has occurred as successive minor events pile up, frequently overwhelming the pilotīs ability to determine that a "break point" has been reached where this transfer (and departure from the basic SOP) has really become essential. To protect against this situation it would be necessary to have the delegation achieved BEFORE the degradation sequence starts, and the inevitable deterioration of judgement under pressure occurs. In fact of course this is eminently logical: if delegation provides a better way of managing situations which have become hazardous, isnīt it equally a better way of managing situations BEFORE they become hazardous? Incorporate it into the SOP, and there is no requirement to deviate from the SOP to achieve good CRM. Appendix 5 contains a more detailed analysis of this problem, based on a fictional accident scenario.

So in the standard modern two-person flight deck default SOPs, the Pilot, (usually in the left seat) handles the aircraft, receives inputs from ATC, from the company, and from the systems, and functions as the overall commander. The Co-pilot (usually in the right seat) handles communication and system operations. The Co-pilot has two basic functions: most of the time, to assist the Pilot in achieving his intentions, but also monitoring, correcting, and if necessary preventing the Pilot doing what he intends - a pretty standard basic airline allocation of duties.

This situation can be analysed from two different perspectives. One is a "mechanistic" approach, looking at it from a system design perspective, in terms of crew members as components with interconnections and reliability criteria. The second could be called a "humanistic" approach, with a social interactions perspective, dealing with relationships and perceptions, society and culture. However, both approaches point to same conclusion: basic crew co-ordination SOP concepts must be changed to meet current challenges.

Ranks, roles, and functions - making clear what we mean.

"When I use a word," Humpty Dumpty said in rather a scornful tone "it means just what I choose it to mean - neither more nor less." - Lewis Carroll

Firstly however it is necessary to clarify some basic terminology issues. In the airline industry some basic words are often assumed to have a common meaning, when in fact there are subtle but significant differences which depend on the speaker or writerīs personal background. The terms "Captain," "Pilot," "Pilot Flying (PF)", or "First Officer", "Co-pilot" and "Pilot not Flying (PNF)" have common meanings at some times, and different meanings at others, but exactly when the meaning changes varies enormously within the industry. Some airlines mix crew rank, role and function almost indiscriminately - the wording of their SOPs may generate a basic assumption that "Captain = pilot in charge = pilot flying" . (It will be seen in Appendix 4 how this affects the way that "First Officersī sectors" are dealt with).

While airlines may actually interchange these terms differently, individual pilots tend to assume that their interpretation of the terms is in fact common to everyone else. A rational discussion of crew procedures cannot be conducted without a clear mutual understanding what these terms actually mean. In this discussion, the following concepts are used in the context of a time period when two or more individuals are flying together as a single crew, i.e. for a flying duty period, which may comprise more than one flight.

The terms Captain and First Officer should be used to describe ranks which an individual holds within the airline. Rank cannot change during the course of a flying duty period: if you are a Captain when you sign in for a duty, you will expect to sign out as one as well.

The terms "Pilot" and "Co-pilot" should be used to indicate roles. Generally the "Pilot" is the crew member regarded as being "in charge" of the flight and primarily responsible for its overall conduct and decision-making. Crew members generally do not change roles during the course of an individual flight, but may exchange roles during the course of a flying duty period. Typical "leg and leg flying" involves this exchange, which lasts for units of one complete flight: during a flying duty period of a day with four sectors, each may act as "pilot-in-charge" for two sectors and co-pilot for two sectors. For this discussion the terms "P1" (first pilot or "pilot-in-charge") and "P2" (second pilot) will be used.

The terms "Pilot Flying" (or "PF") and "Pilot not Flying" (or "PNF") should designate tasks, indicating which individual in a crew has the immediate responsibility for short term control of the aircraft flight path. It is quite common for this to change during the course of an individual flight. For example, the P1 (in charge) may ask the P2 (co-pilot) to take the controls whilst he deals examines the implications of a particular technical failure, or wants to discuss some aspect of operations with the airlineīs control centre. Since both pilots are actually in a flying machine, however, for this discussion the terms "handling pilot (HP)" and "non-handling pilot (NHP)" will be used.

The reason for this will be clear when it is realised that an identical division of physical activity in Standard Operating Procedures may be written down as allocating them to "Pilot Flying" and "Pilot not flying" in airline A, to Captain and First Officer in airline B, to Captain and Co-pilot in airline C, etc. Within each airline all the pilots know what is meant, e.g. when a Captain may "be" a co-pilot, or a co-pilot a "pilot flying"; but these rules do not necessarily have any common meaning between airlines A, B, and C.

How reliable is our control system?

Envisage a system with the following characteristics. It has two control units with the same basic characteristics, except that the primary unit has more input parameters than the secondary (5 compared to 3); more output force or authority (as indicated by the thickness of the "output" line), and has a higher reliability (10-4 vs. 10-3). The normal function of the secondary unit is to add its output to that of the primary controller. (Figure 5).

The control system also has an alternate mode. (Figure 6). In this alternate mode, the secondary controller must detect and rectify faulty outputs from the primary, and if the fault continues, disconnect the primary system and takes over the output. But when we examine this, we can see that since the secondary unit has fewer inputs and is also less reliable than the primary, it is more likely to be in error if it computes a different output to the primary. It also has less output force to operate the "torque switch" and take over if it has correctly detected a failure in the primary. Few engineers, and not many pilots, would see this as a 10-7 reliability system , and a Failure Mode and Effects Analysis is likely to reject this system as inherently unsound.

However, substitute a standard airline crew, with typical SOPs, into this picture and what do you get? The (nominally) less capable and less powerful First Officer is charged with firstly assisting the Captain to achieve his objectives, whilst simultaneously monitoring them for correctness, and if necessary preventing him achieving them.

Much CRM training is about persuading individual pilots to overcome the fundamental and obvious weakness of this system, by educating them into changing their personal behaviour and social patterns. It would be more productive to redesign the system first, and then strengthen its components. The effectiveness of CRM training is greatly diminished by our collective failure to recognise both this and the conflicts pointed out earlier, and it appears that many crew members in fact subconsciously recognise that there are inconsistencies in what they are being told.

That comment leads to the alternative "humanistic" way of approaching the issue, for those who don't like the idea of comparing a human system to a mechanical one. "Failure to adhere to SOPs" is the most common element in crew error accident causes. Initially it usually results from either inadequate assimilation of available information, or some misinterpretation of information which has been absorbed. The psychological factors which lead pilots into either of these situations under conditions of stress and high workload are well known. If either results in an inappropriate response by the pilot flying, it is directly converted into action which affects the aircraft situation and/or flight path. The problem then becomes one of recognition and recovery, and the longer the time taken for this to occur the less likely it is that it will be successful. Recognition and recovery are critical to achieving error tolerance, and anything which inhibits error recognition and recovery is a major safety hazard. Almost all SOPs therefore also incorporate statements requiring the non-handling pilot to intervene to prevent a hazardous action by the handling pilot being continued. Failure to do so is another non-adherence to the SOP - a monitoring or challenging failure.

The fundamental characteristic of most SOPs is that they allocate the initiative for all action to the pilot in charge, nominally the Captain. The task of error recognition and correction is allocated to a subordinate. The degree to which the subordinate is able to achieve such corrections is driven by his or her ability to overcome the difference in authority between the parties, which is sometimes known as the "Cross-cockpit Authority Gradient". Most CRM training includes a significant element which attempts to modify individual behaviour, for example to overcome inhibitions about speaking out when mistakes are noticed. However, admirable as this idea may be, in many areas of the world it is just not going to achieve the order-of-magnitude improvement needed, especially if the basic SOP structural philosophy actually works against it. Even in the USA, some years ago an NTSB report noted "It is extremely difficult for crew members to challenge a captain even when the captain offers a threat to the safety of the flight. The concept of command authority and its inviolate nature, except in the case of incapacitation, has become a practice without exception".

The cultural conflict.

In the flight deck (just as elsewhere) we are all encumbered with certain habits and assumptions which can collectively be labeled as "culture". This includes professional, company and national or social aspects, and for the reasons stated earlier, the professional culture of the pilot already tends heavily to an individualistic attitude, which CRM training generally attempts to minimise. However, a lot of this aspect of CRM work seems also to be biased to a particular, idealised Western cultural and social model, which is entirely inappropriate for many airlines. This issue of cultural differences has now become a respectable subject to mention, and not before time. Much emphasis in many CRM courses is placed on achieving two-way communication, responsiveness to inputs from junior crew members, and the need for initiative from those junior crew members. In practice there is often resistance to some aspects of this by non-US crews - and sometimes by US crews, too. We have to find a way to build on cultural strengths to reinforce good CRM, not have CRM and cultural factors oppose each other.

The ideal to which many CRM courses seem to aspire is a sort of "Good Buddies" concept. This is really an American social ideal based primarily on strong respect for the individual. Its characteristics include emphasising that all individuals are equally valuable; that teamwork needs a leader to be "first amongst equals"; and it incorporates full respect for the inputs of all members of the team, regardless of their status. In the ideal world of this concept, a flight crew would consist of experienced people who can respect and relate to each other as equals, taking it in turns to assist each other. Individual satisfaction is critically important; expert piloting - control manipulation - is viewed as the most satisfying attainment, and the best collective result is obtained as a consequence of all individuals being satisfied.

However, most other societies have an ideal which is different to some extent. The opposite extreme can perhaps be described in an equally over-simplistic way by an "Oriental" model which I'll call the "Good Boss" concept. Its characteristics might include the view that rank and position inherently endow opinions and actions with correctness; the views of the most skilled and experienced team member should be the most respected; teamwork needs a strong, decisive leader; and the value of inputs is proportional to the importance of the team member. Being an expert pilot is viewed as the most prestigious attainment. In an ideal world the crew would have a highly skilled commander accurately supported by qualified and obedient subordinates. Group satisfaction is critically important, and an individual is satisfied best as a result of the group being satisfied - rather than in the Western model where group satisfaction springs from each individual being satisfied.

In these societies, respect for authority and conformity to group norms is seen as a very positive and beneficial thing. However, many Western aviation "experts" give the impression via their CRM advocacy, that it is a hazard in operating large aircraft. It seems both arrogant and counterproductive to tell people that if they want to fly safely, they need to change their entire social and cultural framework when they enter the cockpit. Would it not be better to find some way of changing the recommended methods of working to take advantage of those cultural strengths, rather than attempting to undermine them? What I am going to suggest not only does just that, but it also simultaneously reinforces the Western, "ideal equals", techniques.

How well are we doing?

Before looking in detail at a different concept, however, we have to ask whether the present system does actually work. Many accidents reports tell the same story, but do not spell out the issue clearly enough to make convincing data. In the NTSB study of 47 US crew-related accidents referred to earlier, 84% of the accidents involved a "monitoring or challenging" failure. In almost the same percentage, it was the lower authority unit - the First Officer - which failed to make the switch from assist to over-ride. Bear in mind that this is the result in the USA, which already has the most favourable social, cultural and economic climate for CRM and other forms of advanced training, and in which the "good buddies" concept is most likely to bear fruit. It also already has a far better accident record than most of the world. We have no reason to assume that better results can ever be obtained in other global regions.

Considerations in SOP design.

So it appears that whether you approach the issue of crew co-ordination SOPs from the mechanistic or the humanistic view, the current concept must be modified to achieve a significant improvement in reliability of the crew, as opposed to the pilot. How can we modify procedures to achieve our objectives? A "systems engineering" approach might include the following considerations.

Determine the real worst case, and structure the procedural philosophy to address this as the default operational situation. (Just as we require an engineering and performance capability to handle an engine failure at V1 on every takeoff, we should require a crew capability to operate safely with all permitted combinations of circumstances. For example, we should assume there will be minimal experience and adverse weather - which is NOT necessarily very low visibility - on every flight. Then when those circumstances do not apply - the vast majority of occasions - we will have additional margins.)

Evaluate all possible alternative procedures, and adopt the procedure which gives the minimum risk.. "We have always done it this way" or "Everyone else does it this way", is not good enough. Rather, recognise that "if you do what youīve always done, youīll get what youīve always got".

Design procedures to maximise the incentive to adhere to them, and minimise the opportunity for deliberate deviation from them.

Ask if error detection and correction is possible? If an error can be corrected after detection - and most can - then maximise the chance that it will be. If it canīt, minimise the chance of it happening in the first place. There is little point in detecting an error if we do not then correct it. If it can be corrected, we should optimise the detection and correction process. That is what makes the system error tolerant.

From both a mechanistic and human perspective this means that the higher authority individual should SUPERVISE rather than initiate an action. So wherever possible, we need to separate the concept of command from the need for immediate physical control. However if a particular error cannot be corrected, then we must minimise the probability of its initial occurrence, which means that the most skilled and reliable crew member should take that action.

In practical terms, this implies that since there are few non-correctable errors in normal operation, the majority of the routine flying tasks should normally be delegated. However, there are two decision/action areas which occur routinely where at the limit of the routine operational envelope an error cannot be corrected, and therefore should not be delegated by the pilot in charge. These are a go/stop decision on takeoff, and a land/go-around decision at DH/MDA in limiting visibility. The certification requirements of the aircraft itself ASSUME that a correct decision will be made in both these cases, and there is no margin for error.

An SOP for the 21st century.

So a basic default operational procedure optimising error detection and correction would involve the Pilot in Charge (P1) carrying out the takeoff (just as in conventional operation), but delegating the en-route flying, and approach to the P2, prior to making the landing. "Ownership" of the sector remains with the P1, even although the P2 may spend more time handling the controls, and it is important to emphasise this. Having performed the most critical handling function (takeoff) the P1 takes on the more important operational management functions of command and communication, until again it is necessary to carry out the critical handling function of the landing. Because the P1 would then be responsible for most communication, a potential error path between from external environment to decision-maker and back is also eliminated. (See Appendix 6 for a more detailed Specimen SOP Allocation Of Duties.)

Many airlines have already adopted the concept of delegating the approach handling in marginal weather or low visibility conditions, as is recommended by ICAOīs recent CFIT study. To achieve the safety improvement needed, it is simply necessary to extend this practice to become the "normal" way of operating, as opposed to a "special procedure" valuable only for unusual "low visibility" approaches, or for "problem situations" as suggested in CRM .

The impact of changing from the conventional "assisted piloting" to a "delegate and command" procedure has some subtle human relations benefits in each of the two major cultural extremes described earlier. In strongly hierarchical cultures, it takes advantage of pre-existing attitudes, instead of attempting to undermine them. The F/O will now routinely fly the aircraft, as "the bossīs deputy" - not only when allowed to be a "pretend boss" himself. Specifically, he has to conduct much of the flight to the bossī satisfaction, and particularly to fly the approach so that "the Boss" can make a good landing off it. Psychologically, he has a strong incentive to adhere to rules and procedures: if he does it wrong, the boss will not be happy, since the boss is going to take over later - not just in the event that it gets so screwed up as to be actually dangerous. Conversely, if he does a really good job, his performance will make the bossī task easier, reflecting well on the boss as well as on himself. Collective, "team" performance is enhanced.

Meanwhile, the Captainīs status is raised, because he is clearly seen to be supervising and commanding a subordinate, and will be taking over when the most demanding task has to be done. He becomes the "Master" or father figure who encourages and advises the more junior person, and as the skill of the junior pilot increases with experience, it reflects credit on the senior person. Moreover, any reservations the Captain may have about the F/Oīs ability (which would cause him to tend to disregard any criticism or correction from the F/O) are translated into additional safety margins: for example, in reviewing the F/Oīs proposed descent profile, he could add a few extra miles if he considers the plan to be optimistic. Many accidents appear to stem from the belief of the pilot flying that he can actually "make it", when prudence suggests otherwise. Delegating the "important but routine" activity encourages both pilots to err on the side of caution, and helps eliminate complacency.

On the other hand, in cultures where "equal partners" is a widely accepted objective, it also tends to achieve exactly the kind of equalisation of skills necessary to reach the "Good Buddies" ideal. (In this context, it is important to note that the suggestion that routine flying be delegated from the pilot to the co-pilot has no impact whatever on the concept of "First Officers sectors", other than to enhance their value. "Pilot-in-Command under Supervision" flying is essential to the long-term safety of the airline, not to its short-term safety. There is no change needed to an airlineīs policies on this matter solely as a result of changing the "basic" procedure. During an F/Oīs leg, the F/O would make the takeoff and landing and the Captain fly the en-route and arrival. Appendix 4 contains a more detailed explanation of this complex issue.)

Imagine a Captain who keeps all the takeoffs and landings to himself: he will now end up losing out on routine flying, while his F/Os become extremely skilled, especially at instrument approaches. With conventional "assisted" procedures, such Captains become more practised at all flying tasks, at the expense of their junior colleagues. They cause their F/Osī skills to decline - which will make them even less likely to respect the F/Osī inputs when they are most needed, whilst the F/Os become less qualified to make effective inputs. In practice, the need to maintain a balance of skills will cause the most egotistic Captains (of whom we still have some) to become more even-handed, because otherwise their own skills will degrade. It should not be concluded from anything said so far that the "delegation" concept requires that Captains should always do the takeoff and landing, and First Officers all the other flying, any more than current basic SOPs require Captains to do all the takeoffs and landings .

Whereīs the data?

Both the "mechanistic" and "human" arguments given here may be regarded as interesting but hypothetical, but data is needed for the argument to be convincing. There is a significant body of experimental data which shows the benefits of delegation of flying tasks in non-normal situations, and this is generally accepted as part of the core of CRM training. Most authorities on low visibility operations also accept that there are severe physiological limitations on the ability of a pilot to make simultaneous use of both instrument and marginal visual cues, and strongly encourage delegation of the flying tasks to either the other pilot, the autopilot, or both, until a clear and unambiguous decision can be made that adequate visual reference has been achieved. However until now, there has until now been little real-world data published to support the clear theoretical benefits of making this the normal practice. Some comparative figures do exist however, from what was in many ways an unrecognised "experiment" performed in normal operations some years ago.

During this period, a major international airline had two different, autonomous operations, one using the conventional "assisted piloting" philosophy, and the other using the "maximum delegation piloting" philosophy. The initial selection criteria, the educational, licensing and training standards, and the cultural background of all the pilots was identical, and the two operations had a single very comprehensive incident reporting and analysis organisation. Both operations involved primarily second generation jets including narrow and wide-body types - no "glass cockpit" types. The only other significant difference was in average sector length - one was mostly an intercontinental operation with a 4 hour average sector length, the other mostly an international and domestic operation of 1.2 hour average sectors. A total of some 1.6m flying hours and 920,000 sectors were examined.

A basic item recorded by the airlineīs safety department was the occurrence of incidents attributed to "faulty operating technique" in other words, crew errors. Across a 4-year period encompassing almost a million operations, the rate at which these occurred was almost five times greater in the "assisted" operation than in the "commanded" one. (Figure 9)

Whilst the two operations were mostly with different aircraft types, as well as different average sector lengths, which may have skewed the statistics, there was one common type, operating similar long-haul routes with identical sector lengths. Even with this relatively small sample size, the difference is still marked. (fig.10)

Finally, it worth noting that there appeared to be a reasonable correlation between the occurrence of crew error incidents of all types, and the more specific occurrence of Controlled Flight Towards Terrain, as evidenced by the occurrence of "genuine" (i.e. not nuisance or false) GPWS events. (fig. 11)

A consequence of the "delegated" concept is that by separating responsibility for handling the approach from that of the landing, it is possible to minimise many of the physiological and psychological problems which arise when one individual is forced to make a transition from instrument information to external visual cues. There is a great deal of temptation to make this transition much earlier than is actually necessary, and replace accurate and valid instrument data with much more compelling (but potentially misleading) external cues. One classic situation where this occurs involves abandoning an instrument approach in favour of a visual one, and landing at the wrong airport when a similarly oriented runway is located fairly close to the proper destination - events which occur with embarrassing frequency.

A different study over a much longer and earlier period, but concentrating on the approach and landing phase only, showed that for uncorrected major deviations from a flight path which could have been flown correctly by instrument information alone (that is, deviations prior to Decision Height (DH) or Minimum Descent Altitude (MDA), the incident/accident rate difference increased to some 9 to 1. This includes events of gross deviations during descent such as impact with terrain, and landing at the wrong airport. As might be expected, there was a much smaller difference in the rate of events during the actual landing phase (i.e. after passing DH/MDA), when differences in the procedures was minimal. Various arguments exist against concluding that crew procedures played any part in generating the differences in event rates shown, but in this authorīs view they collapse under investigation, and again for simplicity are discussed in Appendix 2.

Where do we go from here?

Summarising everything said so far, it becomes clear that:

  • it is imperative that we make a significant reduction in collective crew errors.
  • a decade or more of attempts to improve individual crew performance has not achieved the required result.
  • an "engineering" analysis of conventional crew operations shows they cannot achieve the desired reliability because subordinate crew members cannot be relied on to switch from a "help" to an "oppose" mode when necessary.
  • a "humanistic" analysis also indicates that this kind of failure is inherent in the culture of most societies.
  • actual NTSB data on airline accidents, as well as much anecdotal and other evidence, indicates that the breakdown of crew procedures which require co-pilots to make a "mode switch" from "assist" to "prevent" is in fact a major factor in those accidents.
  • an alternative method of operation is possible and should in theory be more reliable from both perspectives.
  • the only comparative data available indicates that the alternative does indeed produce significantly better results.
  • a significant part of that alternative method is specifically recommended in the ICAO CFIT study.
  • the alternative method incorporates one of the fundamental problem-solving tools recommended in most CRM training.

Given all those facts, there is a clear and unarguable case for the industry to make changes which will incorporate the concept of delegation of routine non-critical flying tasks into normal operating procedures for transports with a crew of two pilots or more.

What then is the obstacle to introducing a change which has the ability to achieve the order-of-magnitude safety improvement needed? It can politely be called "natural conservatism"; a less kind description would be "lack of professionalism in airline management, and immaturity in the airline pilot community". The objections to changing are almost always emotional. People are concerned that the effect will be less "satisfying" flying; that traditions are being abandoned; that accepting a different way of working is somehow an admission of earlier inadequacy, or indicative of surrender to an alien, "not invented here", philosophy. They overlook the fact that our primary objective is to convey passengers with the maximum safety we can, and at present we are failing to do this.

If you have been sent this document and read as far as this, then without doubt you personally have some significant responsibility and influence over the management of flight operations. The challenge now is this: unless you can prove that the arguments wrong, you have no option but to start changing the way that you recommend that airline pilots work. You cannot sit back and say "this does not involve my operation". Pilots have been lectured for years about complacency, and the need to change their behaviour patterns, to be receptive to new ideas, and to put rational judgement of safety ahead of personal prejudices and concerns. If you neither accept nor refute the logic of this paper, but ignore it and just carry on as before, then it the complacency which causes accidents is YOURS, not that of the line pilots actually involved. "Cockpit-caused" accidents will continue at their present rate, and you personally will bear some of the responsibility for them.

An implementation strategy to reduce the "Cockpit-caused" accident rate.

Aircraft Manufacturers. Many airlines rely heavily on manufacturers recommendations for all crew procedures. It is common for airlines to simply take the manufacturerīs Flight Crew Operating Manual or equivalent and simply incorporate it unchanged as the operations manual. The basic FCOM however is really intended as a set of instructions on "how to make the aircraft function". It is not guidance as to how best to make the aircraft fit into the operational environment. Much resistance to this new concept is justified by statements to the effect that "itīs not recommended by the manufacturer, so itīs not the way the manufacturer intended the aircraft to be flown, so it canīt be right". In parallel with the "how to make it work" manual, manufacturers must start to advocate delegated flying procedures for routine line operations. It is not enough to shrug your shoulders and say "itīs up to the airlines". The manufacturerīs name and reputation are associated with the catastrophe.

Regulators must recognise that multi-crew transport operations are different to single-crew operations. They must devise recurrent training and checking requirements which do not sacrifice crew-oriented activity in order to emphasise inappropriate single-pilot criteria - not a difficult task but one which requires a little imagination.

Pilot groups must be open-minded about evaluating new ideas, and not insist on retaining traditions based on outmoded aircraft characteristics. They need to examine fact, data, and logic and not react too hastily to under-informed opinion and rumour.

And most importantly, management pilots must take time out to evaluate the lessons of past accidents and incidents, in order to eliminate their causes, not their symptoms. Changing what you tell your pilots to do is not an admission of being "wrong" but demonstrates leadership by showing an ability to learn.

Whilst it would be foolish to claim that any single idea can totally eliminate accidents caused by crew error, adoption by the airline industry of the "delegated flying" SOP outlined in this paper offers the potential to achieve the large reduction in the "crew-caused" accident rate we urgently need. The cost of doing so is minimal. No new equipment is needed, on the ground or in the air. It is not an option that we can afford to turn down. Those airlines which already have adopted some elements of the procedure will simply see reductions in the cost and an increase in effectiveness of their existing training, as their operations are consolidated in a logically consistent philosophy. Others have the opportunity to move into a more appropriate way of operating for the next century with a single executive level decision. The time has come for airline flight operations to be brought up to date. We cannot wait for improvements to individuals, equipment, or facilities, to solve our problems: for the most part, the solution lies in our own hands. It is time to implement it.

Steve Last

June 1997

Appendix 1: Common objections to the concept.

Arguments against new ideas generally pass through three distinct stages, from "itīs not true" to "well, it may be true but itīs not important" to "itīs true and itīs important, but itīs not new - we knew it all along." - UNPOPULAR WISDOM.

"The incidents and accidents basically arise from individuals failing to perform as needed. We just need to weed out the substandard ones". Unfortunately, anyone can be sub-standard on occasion. In every accident the people involved had previously been assessed as reaching an acceptable standard by those responsible for such assessment. We cannot afford to detect sub-standard individuals by hindsight after an event. The problem is not identifying individual "bad apples" in a barrel - it is that the barrel can leak, allowing good but weak apples to "go bad".

"We can put more effort into training to a higher standard instead". This requires time, money and motivation. The vast majority of crews already operate to standards much above the minimum. "More training" has been the approach for the last decade or more and has not achieved the objective. Applying even more resources is like trying to fill a crate of beer bottles through a fire hose - most of the beer will be wasted, even if you can get the financial resources` to buy the pump and all that beer.

"We have inexperienced co-pilots so the captains have to do most of the sectors. The more junior F/Os couldnīt handle flying many of our more challenging approaches." In that case it is very unlikely that they could properly monitor the captains anyway, and are most unlikely to be effective at correcting errors. In the most critical circumstances, your operation in fact is essentially a single pilot one.

"We encourage our Captains to get the F/Os to speak up". Maybe so. However when faced with a difficult or deteriorating situation they will probably defer to the Captainīs judgement. The only thing you can actually guarantee is that your F/O is capable of meeting the demands of his licence, e.g. flying an instrument approach and go-around. If you have them doing a lot of that they will very rapidly build up both skills and confidence, which will help them respond to the Captainsī receptiveness.

"We only have very experienced crews, so we donīt need to change anything". You are very fortunate. However the record shows that errors still occur with the most experienced and skilled crews. Often very experienced crews are the ones who fall victim to complacency. Having someone else do a critical job for you can often make you more conservative about risks. Let your friend drive your brand new high powered sports car with you in the passenger seat - you will probably discourage him from taking some risks you might find acceptable if you were actually driving. And just because you havenīt experienced a specific problem yet does not mean you will not tomorrow.

"We fly "leg and leg about" so the F/Os are doing half the flying anyway - if we continue to do that your suggestion couldnīt have any impact, because weīd just reverse the occasions when each is flying." A seductive but erroneous conclusion. See Appendix 4.

"This concept might have been a good idea when we had to fly a lot of manual approaches - now we have good autopilots which take the load instead". It is true that the original "monitored approach" was conceived to deal with approach and visual transition problems in poor visibility, and that very low visibility operations have now become relatively much safer because of the development of autoland systems. Automation has solved one set of problems but given us some different ones. If automation had solved the basic operational management problems we would not have so many Committees, Steering Groups, Safety Seminars and Task Forces studying the human factors issues of aircraft automation. Automation is a tool, not a substitute for human intelligence: if we do make blunders, automation allows us to carry them out with a great deal of ease and precision. Delegating routine the flying to the co-pilot, and having him delegate the manipulation of the control surfaces to the automation, probably provides the optimum number of defences against errors being put into effect. However, anyone who believes that todayīs automation is a substitute for a second human brain is fooling himself.

"This is fine for a short-haul, high intensity operation, but in our long-haul environment we donīt get enough handling practice anyway, so it wouldnīt work for us". Why not? The fundamental difference at the two ends of the spectrum is exposure rate: an ultra-long-haul crew may get only 5% of the practice of an ultra-short-haul crew. That is a function of the sector length and maximum possible flying hours, not of operational procedures - with long sectors you get little practice, however you do it. What can be altered is the balance between crew members, and delegation at least ensures that both pilots will have some "hands on" time on each flight. It is certainly also arguable that lack of practice makes errors more likely, and in that case reliable detection and correction become even more important.

"Yes, but in a long haul operation each crew is statistically less likely to experience poor weather or emergency situations where perhaps delegation could be useful." Maybe so. However, when they do they will be faced with a correspondingly less familiar and more stressful and error-inducing situation. They still need error protection.

"But we do advocate delegation in those circumstances." So now you want them to deal with unusual or more challenging situations by using a set of procedures which theyīre not really familiar with, practiced at, or comfortable with?

"Changing control close to the ground is bound to be dangerous - the landing pilot has to get the feel of the aircraft above Decision Height". There is no evidence that taking control at low altitude is inherently more risky than at any other altitude. If the P2 is using the autopilot then the trim characteristics are the same as if the P1 had been flying - the autopilot acts the same regardless of whoīs programming it. If you advocate leaving the autopilot engaged down to minimums in "conventional" operation in limiting conditions then you have already disproved the need to "get the feel of the controls" (which presumably means moving them to confirm aircraft reaction, and hence disturbing a stable approach).

"That might be true if the autopilot is engaged - what if you have to do it manually and you have an inexperienced First Officer who is having trouble getting it in trim?" The implication of this is that your F/O is really below the necessary standard for line operation, since he canīt fly the aircraft adequately. This might create a problem for the Captain in the short term. The airlineīs problem though is that such an F/O would be most unlikely to be able to detect and correct any errors made by the Captain - again you really have a one-and-a-half crew operation. Give the F/Os practice and they will get very good very fast.

Appendix 2 - objections to the data.

"The data is all very old. Itīs out of date and irrelevant - donīt you have anything more recent ?" It is true that it is old, however that does not make it "out of date" in the sense of irrelevant. Unfortunately in 1980 the data collection, analysis, and recording techniques were changed, and comparative data became much harder to obtain. Also, the two operations started to become merged so that the philosophical boundaries became blurred. The data is still relevant to the issue under discussion.

"No, itīs not. The aircraft types are now quite different. We have much better automation which makes this irrelevant now." Some - most - of the aircraft types have been replaced with automated glass cockpit types. These generally have better handling qualities and higher mechanical reliability. They require greater overall aircraft management skills, not greater control manipulation skills. Automation does simple tasks with great accuracy: it will do the wrong thing (and successive wrong things, if so instructed) with great accuracy. It can also tend to induce complacency. The concept that delegation of a task to an automatic device is largely equivalent to delegating it to another human ignores the fundamental fact that automation does not contain intelligence.

"Since 1980 weīve put everybody through CRM and other courses, and improved the "assisted" procedures in detail with better call-outs etc. So comparing the two data sets for then doesnīt tell you much about whether it would still be the same today." Maybe so. However itīs the only data available. The same improvements (CRM training, call-outs etc.) have also been made to the "delegated" operation. The absence of current data doesnīt undermine the fundamental logic. The vast majority of operations still use the basic "assisted" concept, and still break down too often.

"None of those who investigated the "assisted" flying events came to the conclusion that changing the procedures as you suggest was a good idea - they were all due to other factors." Not actually true - see Appendix 3. However it is true that those responsible for the procedures did not see any reason to change them, and it is questionable whether a scientific (as opposed to an opinion-based) analysis of the problems was ever made.

"The biggest factor is that the "assisted" flying was on intercontinental routes in much less benign environments than the "delegated", which was mostly done in Europe". That depends what you call a "benign" environment. In fact the percentage exposure of intercontinental operations to the kind of adverse weather associated with many accidents is relatively low. A United Kingdom CAA Study of the long-haul operational environment (Airworthiness Technical Note 111, August 1974) shows that the probability of such aircraft encountering either visibility of less than 3km, or a crosswind of 20 kts., is of the order of 3%, i.e. for a typical long-haul pilot each might be encountered on only perhaps 1 or 2 occasions per year on average. Short-haul European operations encounter less benign weather with a far greater frequency. However it may be true that a higher percentage of long-haul operations are conducted closer to the performance margins of the aircraft - there is no data to substantiate this however, nor to indicate that this was a relevant factor in the incidents themselves. Similarly, it is hard to find data to substantiate any claim that long-haul operations encounter poor ATC services, or inadequate landing aids, at a greater rate than short-haul ones do per se. In essence, this argument boils down to a statement that long-haul operation is simply inherently more risky. If this argument is used as a reason not to take action to reduce risk then the industry had better cease pressing for longer and longer range aircraft and insist on landing more frequently.

"But the major element in the long-haul environment is that crews are much more fatigued at the critical points in the flight". This is actually another version of the previous argument. It is certainly the case that a higher proportion of the long-haul flights were probably conducted at unfavourable circadian rhythm times, and possibly with lower levels of alertness. However the shorthaul environment also contained fatiguing elements including night shift operations and lengthy high intensity duty periods. All of the operations covered were conducted under scheduling rules which were the subject of a union-management agreement, which itself was set within the limits of a regulatory regime which had been specifically established following a lengthy and detailed investigation commission into flight crew fatigue issues. This legislation established detailed requirements to address the subject of number and length of sectors, amount and quality of rest periods, acclimatization to local time, etc., to minimise the effect of crew fatigue on flight safety. There was little sign at the time of a general concern amongst the pilot community that the lifestyle inherent in long-haul operation was in fact so adverse as to make crew errors due to fatigue a major concern. Consequently it is hard to see that these elements alone would account for the differences actually seen. On the other hand, it would seem sensible to recognize that since such factors might well render crews more susceptible to error, making the need for reliable error detection and correction even more apparent.

Appendix 3: An airline case history - four CFIT "close calls".

A major airline experienced four near-disasters with Controlled Flight Towards Terrain over a period of some 23 years, with one particular type of aircraft. The basic SOP on this fleet was the "assisted flying" concept, and in each of the events the Captain was the pilot flying the aircraft. In each case a catastrophe was averted more by good fortune than anything else. These events are particularly interesting because the illustrate a number of common aspects to aircraft accidents, the organizational responses to them, and issues of entrenched airline "culture". Because they involved no immediate injuries or major damage, all the crews involved survived the events themselves, and thus were available to participate in the subsequent analysis.

Event No. 1

In 1974, a four engined wide-body descended to within 70 feet radio altitude of the ground almost 7 miles from a high altitude airport. During an ILS approach, being flown by the Captain in instrument conditions, an altitude below that of the airport was mistakenly dialled into the altitude select, and an attempt was made to descend to it. A go-around was initiated when the ground was sighted. This event was the subject of a full accident enquiry by the airlineīs State Accident Investigation organisation, which concluded that amongst other factors which included crew sickness (the First Officer had been taking medication which may have reduced his performance and alertness), the fundamental causes were that the Captainīs planning and conduct of the approach gave himself and his crew too little time to monitor the progress of the flight properly. His overall supervision of the approach was adversely affected by his personal preoccupation with the control of the aircraft, and the system of monitoring used by the company (i.e. monitoring by the junior crew members) did not function properly at a time when the cockpit workload was high. Accordingly, the national Accident Investigation Board recommended that the company should re-examine its allocation of crew duties and monitoring responsibilities during descent and approach, so as to enable the commander to exercise his supervisory function to greater effect.

The airlineīs own conclusions however were that the fundamental problem lay with the individual crew members rather than with the procedures laid down - the "bad apple" was therefore removed from the barrel and the Captain left the company. At around this time the airline was involved in a rather acrimonious merger with another carrier which used the "delegated flying philosophy". The recommendation that the procedures be reviewed "to allow the Captain more opportunity to supervise" was seen in some quarters as an attempt to interfere in the internal airline negotiations over integrating the new merged airline, and the basic procedures remained unchanged.

Event No. 2

Eighteen months later in 1976, a four engine wide-body descended into treetops about two miles short of the runway during a non-precision approach in good visibility, and a go-around was made. Again, the event was the subject of a full accident enquiry by the airlineīs State Accident Investigation organisation, which concluded that this incident was primarily caused by a poorly planned and executed approach by the Captain, and inadequate monitoring of the aircraft flight path by the crew. Again it was recommended that the airline re-examine its crew procedures to establish whether a reallocation of crew duties and monitoring responsibilities would permit a greater degree of supervision. Once again this issue did not feature in the airlineīs internal recommendations; it was concluded that the fundamental problem lay with the poor quality of the individual crew members rather than with the procedures laid down. The "bad apples" were therefore removed from the barrel: the Captain left the company, the other crew members were disciplined, and the basic procedures remained unchanged.

During the merger-related negotiations the issue of SOPs was the subject of much heated discussion. At one stage this resulted in a high level management group submitting recommendations for unification across the airline based on "assisted flying", and abandonment of the "delegated flying" concept. This suggestion was eventually disregarded when it was shown that the recommendations had been made based on "evidence" in which the position of other airlines had been deliberately falsified to support it, an action which caused the sole non-airline member of the group to refuse to sign it the groupīs report. However, this set the tone for the airline over the next twenty years: with no single operational philosophy across the entire organisation, the credibility of its management in seeking to obtain adherence to its SOPs was damaged. What was unacceptable on some types of aircraft was perfectly normal on others.

Event No. 3

Thirteen years later, in 1989, a four engined wide body made a badly controlled low visibility approach at its home base airport. During a go around it descended to 75 feet radio altitude, in the vicinity of an airport hotel and other buildings which rose to 70 feet. Again, contributory factors included crew member sickness and experience levels. For various reasons the airlineīs State Accident Investigation organisation did not conduct an investigation: it was left to the airline itself. It is likely that given the circumstances which led to the event, an Accident Enquiry would have come to similar conclusions to that reached in the earlier events: that poor overall supervision and monitoring had allowed an unsatisfactory approach to be continued to far too low an altitude. Although a number of detail recommendations for changes were made, the fundamental conclusion was again that the problem lay with the poor quality of the individual crew members rather than with the basic procedures laid down. More "bad apples" were therefore again removed from the barrel: the Captain left the company, the other crew members were disciplined, and the basic procedures remained unchanged. Internal memoranda however noted that the State Accident Investigatorsī recommendation regarding crew procedures in Event 2 was never adopted, nor featured in the companyīs internal recommendations, and linkage of that accident to Event 3 could have proved embarrassing.

Following this event the Captain was charged with criminal negligence in endangering people in the aircraft and on the ground. It is indicative of the inadequacy of criminal proceedings to deal with complex technical safety matters of this kind that he was found guilty of endangering his passengers but not guilty of endangering people on the ground. The Captain was fined, lost his licence, and later committed suicide.

Event No. 4.

Early in 1997, a four-engine wide-body aircraft making a straight in ILS approach at night at an airport in a developing country failed to obtain the glideslope signal, but the Captain, having had visual contact with the ground, elected to continue using DME data for altitude guidance. Unfortunately, the data for the wrong DME facility was used, and as a result the aircraft descended to some 350 feet radio altitude about 6 miles short of the runway, when a go-around was initiated. The final result of the investigation into this event is not available at the time of writing, but three months later the fleet procedures were changed to bring them into line with those used on the other fleets in the airline, i.e. replacing "assisted" flying with the "delegated flying" concept for all approaches, and finally implementing the official recommendations arising from event 1 some 20 years earlier.

Lessons to learn?

Significant factors in these events appear to include these.

In each event, all the information was available to the crew to have avoided the danger they encountered.

In each event, an initially satisfactory situation deteriorated as a number of individually containable events compounded on top of each other.

In each event, it is possible to see with hindsight that the overall situation awareness of the pilot in charge had suffered because of his need to concentrate on a subset of detailed, aircraft handling, tasks.

In each event, the other crew members had reservations about what was being done, but did not act forcefully enough to change the course of events.

In the first three events a "satisfactory" outcome was regarded as the eviction from the community of individuals whom events had proven to be unsatisfactory. In the first three events the fleetīs culture found it impossible to accept that it, as well as the individuals, could be at fault. The ability to deal with difficult situations was seen as a test of individual worth. All its members had, by definition, shown themselves to be "worthy" until the moment when they failed. The fact that individual failure might entail massive loss of life was not a consideration: it could always be avoided by ever more stringent "quality control". The organisation in fact exhibited all the "right stuff" individualistic characteristics of the pilot professional culture recognised by other researchers such as Merritt et al. Strenuous efforts are made in CRM training to change attitudes of Captains towards accepting that they might be wrong; yet the reluctance of those with authority over the fleet to accept the possibility they might not be right is simply the same problem on a larger scale.

Appendix 4: "First Officersī Sectors."

A very common objection to a revised SOP runs along the lines of "We agree that in theory you might get more effective error correction if the Captain is doing the correcting. But to get that benefit youīd have to have the Captains doing all the takeoffs and landings, and the F/Os doing all the rest of the flying. We want our F/Os to do takeoffs and landings as well, so we fly ëleg and leg aboutī. So in our case the F/Os are already doing half the flying anyway, and the Captains are already doing half the monitoring. We want to continue that policy, so your suggestion couldnīt have any impact, because weīd just reverse most of the occasions when each is flying without changing the overall effectiveness."

This question of "First Officersī Sectors" is a complex one and deserves some special consideration. The objection voiced above is highly seductive, because superficially it is self-evidently true. However, on examination it will be seen that it is true only if two specific conditions are met. They are:

  • all sectors are mandatorily allocated at random on a 50-50 basis between the two pilots.
  • the only factor in the cross-cockpit authority gradient which inhibits error prevention is rank.

In practice these conditions are not met, and under all actual circumstances there will be a benefit. The underlying logic of the objection can be illustrated like this. Take a theoretical operation which involves 1000 sectors. Assume that it is flown by two-member crews of equal competence. Letīs assume also that on every flight the pilot in charge does all the flying, and makes one significant mistake. Also assume that the "authority gradient" consists only of the difference in rank, and the Captains pick up and correct all errors made by the First Officers, but the F/Os only correct 85% of the Captainsī errors. (These numbers are exaggerated, purely to illustrate the principle involved.)

If the Captains fly all 1000 sectors, they will make 1000 errors, and 850 (85%) will be picked up, leaving 150 uncorrected ones. Say they "give away" 100 sectors. There will be 900 errors on "their" sectors, of which 85% will be corrected, whilst during the F/Osī 100 sectors there will be 100 errors, all of which will be corrected. Net result: 135 uncorrected errors. This will continue until at the point where 50% of the legs are "given away", and the uncorrected errors are down to 75, or 7.5 % of the total. This is the lower line on the graph.

Now take the situation where the flying which contains "correctable" errors (i.e. other than the actual takeoff and landing) is delegated. If the Captains "give away" nothing; all the errors are made by the F/Os, and all are corrected. Net result: zero uncorrected errors. Simple arithmetic shows that now the uncorrected error rate will increase until at 50% F/O sectors, again there are 75 uncorrected errors - the upper line on the graph. The argument then is clear: with 50-50 leg and leg flying the "delegated" concept produces no benefit because there are exactly the same number of uncorrected errors. However, what is overlooked at this point is that 50% is the maximum number of legs which will ever be allocated to the F/Os, not the minimum. At all values between none and 50% First Officersī sectors (which is the practical range), there is always a benefit.

Before going much further, we again need to examine some basic concepts. There are many flavours of "First Officersī sectors", and each airline tends to think that its own is the basic recipe. Within each airline there are also different degrees of freedom to re-assign duties, some of which are company constrained, and some limited by regulation, so that not all flying by First Officers involves being "given the sector" - specific training requirements are one such area. For most airlines, however, it appears there are two different objectives which affect their policy. They are long-term and short-term safety impact, and most policies involve a trade-off between the two.

Take two extreme examples. One airline might believe that the optimum overall safety is achieved by making every flight as safe as it is possible to make it - maximising individual flight short-term safety. A consequence of this might be a decision that since the most skilled person in the crew is (at least nominally) the Captain, only Captains may make takeoffs and/or landings. This may ensure that each flight is as safe as it can be with that particular crew. A further consequence however would be that some flights with newly promoted captains, who would have virtually no experience of takeoffs and landings, would be less safe than others.

Another airline might decide on a different way to maximise its long-term safety. It might require that all its Captains, including newly promoted ones, must have a significant amount of takeoff and landing experience in all conditions. Consequently, it requires its Captains to allocate 50% of the sectors to the First Officers, regardless of conditions, so they have that experience when promoted. It has applied the reverse short-term logic to achieve the same apparent objective - the safest operation in the long term.

In reality of course few if any airlines operate to these extreme policies, but most end up with rules which restrict or encourage Captains in using their discretion as to how much "additional margins" are needed to trade off the apparent safety gain from performing the takeoff and landing themselves, versus allowing a junior, less experienced and (theoretically at least) less skilled colleague do it. These limitations may range from "anything except Cat3B landings" to "only if the First Officer has been authorised and assessed as suitable for promotion", but all recognise that in some conditions it is necessary to restrict First Officers sectors. Consequently, for practical purposes the actual number of legs given to F/Os will always fall in the range from nil to 50%, and it is hard to envisage an operation where it would rise above 50%. Similarly, the existence of any limitations means that the distribution of those sectors is not random, either. Consequently, the first condition for the objection to be valid is not met.

The other condition is that the only factor in the "cross-cockpit authority gradient" which inhibits error prevention is rank. Rank was earlier defined as being a long-term position within the airline and which does not change in the course of a flying duty period. When a Captain and First Officer are flying together, the relative authority of each is not a simple "binary" one based on rank alone: all Captains are not identical, all F/Os are not identical, and the combinations are infinite. There are in fact several components to the "authority gradient" which include personal factors and role.

Personal factors include experience and interpersonal aspects. Two individuals could have joined an airline on the same day, and have identical skills and experience. The sole personal difference in fact between a Captain and his F/O could in fact be a seniority number allocated randomly which has resulted in one achieving promotion before the other. Rank as such is unlikely to be a very strong factor inhibiting the F/O from effective monitoring in normal operations. This pairing will in fact be quite close to the ideal "good buddies" crew. There is still even with this crew an inhibiting factor, which is the effect of role.

During the Captainīs sectors, his "good buddy" in the right hand seat may not be bothered by the difference in rank, but he may still be somewhat inhibited by the fact of the Captain being "in charge". He knows that their relative skill levels are pretty finely balanced, and hence eitherīs judgement may be valid, and may thus be inclined not to vocalize criticisms. This factor becomes more significant however when the Captain gives his colleague the next sector: in effect, in giving the sector away, some of his authority of rank is also transferred. The Captain might not be inhibited from correcting a very inexperienced F/O, but he may be reluctant to interfere when he has already given permission to his friend to act as "the boss". In reality, when a Captain "gives away" the sector, he also relinquishes an element (perhaps a very small element, but perceptible none-the-less) of his authority - the "in charge" element. From a human relations perspective it may be quite difficult to retrieve this. It will be embarrassing to both parties to have to reverse this decision, involving loss of face for the F/O and at least an internal admission by the Captain that he may also have misjudged the F/Oīs skills. Consequently, the "cross-cockpit authority gradient" is made up of two elements - that of rank PLUS that of being "in charge", and there is an inhibition on error correction (though perhaps not so much on detection) which is due to this.

This is in fact confirmed by the NTSB data which seems to show that although Captains have a much higher success rate at monitoring and challenging than F/Os, it is still nowhere near 100%. During a "Captainīs leg", authority is composed of two elements - a "rank" element and a "role" ("in charge") element, and during a First Officerīs leg he has a varying degree (based on experience and other interpersonal factors) of extra authority based on his "in charge" role. In both cases this authority acts as an inhibiting factor on the other pilotīs ability to correct errors.

Let us assume that this thesis is correct and that the "in charge" element does inhibit correction by a certain amount, compared to the 85% and 100% rates ascribed purely to the "rank" effect before. Letīs say that the effect is to change the correction rate by 5% of the errors - in other words, if you correct 5% more if you are in charge, and 5% less if you are not. (Once again, please note that these numbers are simply to illustrate the direction of the effect, and are not intended to be accurate). In the "assisted" flying operations, the F/O now corrects 80% of the Captainīs errors during Captainsī sectors and the Captains only correct 95% (instead of 100%) of errors during the F/Osī sectors.

If the Captains fly all 1000 sectors, they will make 1000 errors, and 800 will be picked up, leaving 200 uncorrected ones. Say they "give away" 100 sectors. There will be 900 errors on "their" sectors, of which 80% will be corrected (leaving 180), whilst during the F/Osī 100 sectors there will be 100 errors, 95 of which will be corrected. Net result: 185 uncorrected errors. This will continue until at the point where 50% of the legs are "given away" the uncorrected errors are down to 85. The possible range is between 200 and 125 uncorrected errors, or the correction rate is between 80% and 87.5%. (Lower line on graph).

Now take the situation where the flying which contains "correctable" errors (i.e. other than the actual takeoff and landing) is delegated. The Captainsī correction rate is already at 100%, but now the F/Osī correction rate is increased by the 5% "in-charge role" factor to 90%. If the Captains "give away" no sectors, all the correctable errors are made by the F/Os, and all are corrected. Net result, as before, zero uncorrected errors. Now assume that the Captains give away 100 sectors. The result will be zero uncorrected errors during the 900 "Captainsī sectors", and 100 errors during the F/Osī sectors, of which 90% are corrected. Net result: 10 uncorrected errors. At the 50-50 leg and leg flying level the there will be a total of 50 uncorrected errors, compared with 85 during "assisted" flying. The range is between zero and 50 (upper line on graph), compared to a range of 200 to 85.

In other words, if the authority gradient is due purely to rank, there will be a benefit from "delegated" flying until the exact 50-50 leg-and-leg random distribution is reached, and then the two systems are equal. In any of the more likely situations, i.e. if there is less than 50-50 random allocation of flying, or any effect at all is allowed for the effect of the "in-charge" role, there will always be a benefit to delegation. In practice, there is no way that changing to the delegated procedure will not provide a safety benefit, regardless of the airlineīs policy in respect of First Officersī sectors.

Appendix 5: where did the situation get out of hand?

This Appendix describes and analyses a fictional accident scenario to show how conventional "assisted" crew co-ordination procedures and CRM training are not properly integrated, and do not minimise the risk that a crew will be drawn into a situation where they are vulnerable to a variety of human factors failings. It is recognised that many of the detail aspects found in actual accidents is missing, but by creating a fictional event the possibility of making inaccurate and potentially offensive statements about actual events and individuals is eliminated. Most experienced pilots will have encountered some or all of the principal elements making up this story - they will just not have had them combine in this way.

Flight XXX99 - a typical CFIT disaster.

Flight XXX99 was a modern two-engined; two-crew jet, operating a late evening service to Sommeton, in a developing country. Sommeton, elevation 420ī m.s.l., has a single 2800m. runway 17/35 and is situated on the south side of a river delta. The aircraft was fully serviceable but was approximately 90 minutes behind schedule because of a technical defect rectified prior to departure. The aircraft was scheduled to arrive at 2115 local, and depart at 2205, 55 minutes before Sommetonīs 2300 noise curfew, which would be extended for a maximum of an hour in the event of delays. The crew were aware that the scheduled turn-around time was one hour, and also knew that the airline could routinely achieve a 35-minute turn-around if necessary. The crew were therefore anticipating that they would be arriving about 15 minutes before the curfew, and departing during the curfew extension period with about half an hour margin before complete closure.

The crew comprised a Captain aged 40 with a total of 9,000 hours, of which 4000 hours were on type, and who had considerable experience of operation into Sommeton. The First Officer was aged 30, with 5000 hours total time, but had only recently converted onto type and had not operated into Sommeton before.

The weather forecast was: wind 010/10, visibility 10 km. or more, cloud 1500īscattered, 4000ī broken, temporarily visibility 3500m in haze, 700ī broken. The NOTAMS included the following: Taxiway "C" closed between E and D. Glideslope ILS 17 unreliable. ILS-DME 17 u/s. Additional company briefings included: "Map shifts have been experienced during approaches at Sommeton. These are under investigation by the manufacturers. Until the causes are resolved, approaches must be conducted using raw data displays only."

The Company operations manual recommended SOPs based on the "assisted flying" philosophy that the Pilot-in-Charge should normally act as pilot flying. However, in recognition of the companyīs implementation of its CRM training it also contained the following advice: "In situations generating high workload, such as serious aircraft deficiencies, Captains should give consideration to delegating the flying to the co-pilot, in order to give maximum attention to the effect of such situations on the safety of the flight".

At 2217 the following ATIS information was received: "ATIS "C" at 2200L, Runway 35 in use, wind 360 degrees 9kts, visibility 10km., cloud scattered 1800 feet, broken 4000 feet". At 2220, the Captain gave a descent briefing, which covered all standard items such as minimum safe altitudes and altimeter settings, brake and thrust reverser settings, airport information, etc. and included the following. "Weīll start descent at from FL330 at TODES, which is 85 DME from STN. Descending initially at 290kt, then 250 kts. below 10,000, to cross STN at 7000. They donīt have radar here so weīll be doing the procedural ILS for 35, but it looks like we should be able to go visual with any luck once we get down below 4000. We go outbound on the 198 Radial to 14DME, descending to 3000ī and reducing to 200kt. Once we start the inbound turn we can descend to 2200ī, expecting to establish on the ILS at about 7 on the ILS DME, with 22 flap. Final flap is 27, to go down the glideslope at 6 DME. Minimums are 620 ft and 700m RVR, and the go-around is straight out the STN at 3000. Iīll use the autopilot all the way round onto final. Vapp is 140, weīll have 145 with that wind. Standard call-outs at all times. If youīre unhappy about anything donīt hesitate to say so".

At 2222 Sommeton Centre cleared XXX99 to descend to FL290. R/T quality was poor. The First Officer read back "FL290" but the Captain selected FL250 in the altitude select. The voice recorder contains the following conversation:

Capt: OK, FL250 set

F/O: uh-. I think that was 290.

Capt: no, Iīm sure it was 250 - thatīs where they usually hand us over.

F/O: OK - they could use a decent mike down there.

F/O: uh- you know Iīm sure he said two NINE zero-.. Iīd like to just check it.

Capt: OK-if you want to.

Sommeton confirmed FL 290.

Capt: Thanks for picking that up, I was sure he said twenty-five.

About a minute later the Captain remarked "sure is a nice night down there - I think thatīs Capital City over there" (about thirty miles ahead). At 2226 XXX99 was handed off to Sommeton Approach which cleared it to FL160, and added "traffic is northbound, domestic departure off runway 17".

At this point the Captain remarked "the domestic terminal is up at the north end of the field, about as far as you can get from our terminal. -- he must have taken a tailwind." About twenty seconds later he asked the F/O "find out what the wind is." Approach responded "wind is 010 at 4 knots, do you want runway 17?" The F/O replied "standby." The Captain then said, "hmmm, if we take 17 weīll save about eight or nine minutes plus we wonīt have to taxi the full length back. Weīve got about fifty miles-.. tell him weīll take 17". The F/O duly confirmed that XXX99 was requesting a straight-in on Runway 17.

At 2229 the Captain said "have you got the 17 plate?" but the F/Oīs response was interrupted by a radio call from Sommeton Approach, who asked XXX99 its DME from STN. The F/O replied "DME 30". Approach then cleared XXX99 to turn left and join the 17 ILS at GRADA, cleared to 4000 feet. The Captain then said "OK, weīre a bit high now, so Iīll get it all off so we get in the groove again as soon as we can", extended full speed-brakes, and turned onto a heading of 120.

F/O: Thatīs 110.7, "ISS", Iīve identified the 17 ILS for you.

Capt. Thanks- I guess thatīs Ridgeville up ahead. Should hit the ILS soon - Iīll make it 140 (degrees heading).

About two minutes later, the Captain retracted the speed-brakes and called for ten flaps.

F/O: Speed checked, ten flaps--. By the way you need to go to raw data not map.

Capt. Oh yes. OK. Thanks.

An alert tone sounded.

F/O: Uh oh whatīs that-.. itīs "Flap Motor".

Capt: OK Iīll hold this speed, do the "Flap Motor" checklist.

F/O: um-.. it says "do not use standby motor-.. use 27 flap on selector-. use Vapp 32 plus 25 kts--check landing distance". Just a minute--"

Capt: OK-.

F/O: I make it itīs too short - this chartīs a bit confusing but I--..

Capt:. No Iīm sure itīs not too short, have another look-

Capt: S*** itīs gone through the localizer.

The Autopilot disconnect alert sounded.

Capt: Iīve taken it out - I can see Ridgeville. Maintaining 4000.

The Captain then made several turns to re-establish on the ILS centerline.

F/O: OK I think youīre OK for landing distance - do you want to check it?

Capt: No, we need to get down. Do you have a glideslope your side?

F/O: uh no--. your final speedīs gonna be 170

App. XXX99 you are cleared for the approach 17 call the tower.

XXX99: Roger

Capt. OK weīre on the ILS, select flap 18, Iīm reducing to 190- whereīs that Glideslope? We can go down to 2200 at Ridgeville-. 7 on the DME like we said.. (Speed-brakes then stowed)-. Give me the landing checklist when you can-.. are you sure that speedīs right, sounds a bit high

F/O: hang on- oh no itīs based on the 32 flap setting not the 27 we were planning on. But you only select to 27.

Capt: yeah its confusing. I still donīt have a glide-slope - what height should we be at on that DME?

F/O: uh-. Letīs see--. I think itīs 2200, weīre at 6.

Capt. OK weīre in the groove then, ask him whereīs that glideslope.

Approach confirmed glideslope is off due to power problem, and changed XXX99 to tower.

Capt: call me the DME heights.

Radio altimeter voice was heard at this point: "One thousand"

F/O: this doesnīt seem right somehow.

Capt. Did you call the tower? - I can see the ground

F/O: OK, DME 4, should be 1600 - youīre about 80 high.

Tower was contacted and landing clearance obtained, wind 010 at 3 knots.

F/O: landing check is complete, should be 900 feet.

Capt: funny I donīt have the runway

F/O: I donīt think we should-.

Capt: something ainīt right - weīll go around. Go-round, flap 18.

Thrust levers were fully advanced but the aircraft hit a group of houses on the top of a ridge at 740 ft. m.s.l. There were no survivors among the 179 passengers and crew and 46 casualties on the ground.

In the subsequent investigation it transpired that the DME readings and aircraft altitudes corresponded to an accurately flown profile using the DME distances from the ILS DME shown on the 17 approach plate. Unfortunately however the only DME being displayed was that for STN, some 4 miles out on the centre-line. Consequently the profile was actually flown 1200 feet low, and the aircraft hit the village (Ridgeville) on the ridge north of the bay. Although the aircraft was fitted with GPWS no alerts were triggered, because the aircraft did not penetrate any of the mode boundaries. The town which the Captain thought he had identified as Ridgeville was actually Pointon, situated in a geographically similar location some seven miles further North. The actual weather at Sommeton was visibility 3 km. in haze, cloud 400 ft scattered, 600 broken. Consequently neither Sommeton nor Ridgeville were actually visible at any time from the aircraft.

So what was the original cause of the accident? In retrospect it is easy to see that the Captain became overloaded with the tasks of hand-flying the aircraft, particularly after the autopilot failed to cope with the additional speed resulting from the flap abnormality. Consequently his overall situational awareness was impaired. The First Officerīs situation awareness was impaired by the need to obtain the detailed information on handling the flap abnormality, and then to assist the captain by providing him with specific height information. His situation awareness was better - he was concerned that "something wasnīt right" earlier than the Captain - but he was unable to translate this into effective action. All the information needed to conduct the approach safely was available - but the crew did not make full use of it.

One conclusion that could be reached is simply that the accident was caused by the failure of the crew to follow their SOPs. For example the SOP required that a detailed briefing be carried out for the approach for being used. The Captain briefed for R/W 35, but actually used R/W 17. Most aspects of the briefing would have been identical, but the specific approach plate was not. The Captainīs attempt to address this was interrupted by ATC, and he did not return to it, perhaps because he was confident that his experienced F/O did not need detailed instructions on interpreting it.

The SOPs also advised that in "In situations generating high workload, such as serious aircraft deficiencies, Captains should give consideration to delegating the flying to the co-pilot, in order to give maximum attention to the effect of such situations on the safety of the flight". Clearly in this case the workload became excessive, but the Captain did not follow this advice on effective Crew resource Management.

So what factors went into generating the excessive workload, and the failure to manage resources effectively? The Captain, although very experienced, was by no means a "domineering" type of person. In his briefing he made it clear that he wanted the F/O to vocalize any concerns. Subsequently, when the F/O queried the Captainīs interpretation of the altitude clearance, he supported obtaining clarification, and thanked the F/O for pointing out the error. Later, he thanked him for prompting over the need to switch from map to raw data. Likewise, the F/O was quite experienced, and had no difficulty in querying the Captainīs action regarding the altitude, or prompting him when he detected an omission. The interpersonal CRM attitudes of the crew were in fact close to those which would be desired.

The flight was running late, and the crew recognised that it would be desirable to retrieve some of the lost time. Although they were fully expecting to be able to depart before the extended curfew, any additional delay would result in a significant problem with an enforced overnight stop and all the subsequent cost and other penalties. Although he had planned for a full instrument approach, however, the Captainīs mental model of the situation was biased by the fact that the forecast was for relatively benign weather, and the received ATIS seemed to confirm this. In addition, he could clearly see places some distance away from cruise altitude. His expectation was obviously that he would be able to transition to visual flight considerably above the Decision Height for the approach. This was further reinforced by the fact that the only weather information that was actually current was passed to him was in response to his query about the wind: the ATIS information did not reflect the actual conditions in the approach area. The Captain was familiar with the airport and its surrounding terrain, but the F/O was not. The F/O naturally regarded the Captainīs judgement on what was safe in this particular location as being superior to his own, and was expecting to learn from the Captain in this regard.

The first point where the plan was amended was when the crew were advised of the opposite traffic, and realised it had used not used the runway stated on the ATIS. This lead to the Captain discovering that the wind was not exactly as reported. That in turn led him to realise that he could not only reduce the time pressure due to the late operation, but also make some economic savings for the airline, by making a straight in approach - not only would the flight time be reduced by several minutes, but he could avoid the lengthy taxiing back from the far end of the runway, and turn almost straight onto the terminal ramp after landing. At a range of some 50 miles or more from the airport, a change of runway should be well within the crew and aircraft capability, especially in essentially good weather, but it did require prompt action to adjust the descent profile, which was taken. However, this decision reduced the available time to complete the operation, and increased the crew workload significantly.

The second significant change then came when the crew attempted to extend the flaps whilst turning in to join the 17 ILS. This relatively minor technical defect had two major effects: it increased the F/Oīs workload dramatically as although the checklist items were very limited they required concentration on the detail of a complex chart, with which he was not very familiar. It also meant that the aircraftīs speed had to be maintained considerably higher than was desirable, further compressing the time-scale and increasing the Captainīs workload. This then took another step up when, because the speed was high, the autopilot was unable to execute a good capture of the ILS localiser.

The need to hand-fly from this point dramatically reduced the Captainīs "spare" capacity. His familiarity with the area meant that the combination of "recognised landmarks" and apparently "good weather" allowed him to be satisfied that it was safe to continue, because he was confident that he would not only have full ILS instrument guidance, but the visual information would also improve rapidly as the aircraft descended. However, because he now had so little spare mental capacity he was unable to consider some of the other facts which had been of relatively little significance earlier, such as the promulgated unreliability of the 17 ILS glideslope, and unserviceability of the 17 ILS DME. The F/O meanwhile had no particular reason to question the Captainīs judgement, especially since the Captain had proven right in stating (from experience) that the runway would be long enough for the flap condition, when the F/O had had difficulty in extracting this data under pressure. The F/O saw his main task as assisting the Captain as much as he could and in ensuring that the landing checks were properly completed as commanded.

When it became apparent that the glideslope information was not going to appear it became necessary to find some substitute. Since the ILS plate also contained DME data, it was obvious that this would be the thing to use, particularly since it was after all only needed as a temporary supplement to the visual cues - the Captain thought he knew where he was, and expected to become visual any time after 4000 feet. The only DME data on display confirmed this mental model, and corresponded with the values which had been given in the initial briefing, although they were for the opposite runway and the source changed in that approach from the STN DME to the 35 ILS DME.

Nevertheless, other factors somehow caused the F/O to have doubts, which he vocalized when the Radio altimeter audio came on., but these were not strong enough to convince him that his judgement was better than that of the Captain, who knew the area, could see the ground, and was both flying the aircraft and in command. Very soon after, both pilots became seriously alarmed that things were not working out as they had anticipated - but by then, it was too late.

The Captain failed to recognise that his workload had risen to the point where his situational awareness and judgement was becoming impaired. This was however inevitable, since the reason for this failure was the workload itself. The company SOPs recommended that in such circumstances, he actually should abandon the basic SOP, and delegate the flying so as to better retain overall command judgement - but did not tell him how to recognise that situation. The example given in the SOPs implied that high workload would arise in the event of serious aircraft deficiencies, which is true, but not comprehensive. If with the benefit of hindsight, we query the Captainīs judgement, we have in turn to answer this question: what was the appropriate point for him to have decided that the situation justified departing from the airlineīs basic SOP, (which required him as Pilot-in-Charge to act as pilot flying), and ask his First Officer to act as pilot flying while he resolved more significant problems - a decision which in itself would signal to the First Officer that a major problem had arisen? Was it

  1. when he himself realised that "something wasnīt right" and initiated the go-around (by which time disaster was unavoidable)?
  2. When the F/O commented that "something wasnīt right" at 1000 ft. radio (by which time the aircraft was already well established on the wrong profile)?
  3. When they established that the glideslope was not available (but is glide-slope failure a "major problem")?
  4. When the autopilot failed to capture the ILS localiser (but is hand-flying so difficult?)
  5. When the "flap motor" alert occurred (but is that a major aircraft defect)?
  6. When it was decided to switch from runway 35 to 17 (but is changing runways such a big deal)?
  7. When the aircraft departed 90 minutes off schedule from its previous station (but is just being late so unusual)?

It can be seen that in fact each of these events (perhaps as well as others) contributed to the situation, but no single one can be clearly identified as THE point where every pilot would agree it would have been desirable for the Captain to give himself a bit more opportunity to assess the situation. Moreover, in a number of these cases the workload rose as result of decisions by the crew themselves - requiring a paradoxical recognition that a decision which was believed to be sound had made the flight less safe.

In fact it is only by revising the basic allocation of duties so that delegation is the normal procedure, that the Captain would not have been faced with this problem. If that had been the case then the risk would have been significantly lower. It would be easy to construct a parallel, fictional tale using the alternative procedure and which (obviously) did not terminate in disaster - but futile, as it would hardly be convincing. Instead, one must just ask whether it is more or less likely that events would have worked out differently. For example, if the First Officer had been asked to conduct the entire descent and approach (on instruments, and without the need to acquire visual cues), and his workload started to increase due to the need to hand-fly the aircraft, is it more or less likely that he would have used the external scene as a substitute for instrument information? If the Captain had been the first one to become concerned that they were not actually in the right place, is it more or less likely that the crew would have initiated an early go-around? If the Captain had been the one to be concerned (rightly or wrongly) that there was no longer enough landing distance, is it more or less likely that the crew would have taken some delaying action (such as a hold) whilst establishing the correct data?

This authorīs view is that in most cases, any individualīs ability to evaluate the overall situation is enhanced by offloading short-term manipulative tasks. However once those tasks have been accepted, it becomes increasingly harder to assess oneīs own workload level. The ability to conform to the advice to "delegate for better CRM in high workload situations", particularly where these may have been even partially self-induced (as in this case, with the decision to change the planned arrival runway) may also be severely constrained by a natural reluctance to admit that a difficult situation has developed. The "strong individual" culture of many pilots gives a powerful psychological incentive to continue acting as though everything is absolutely under control, even when a more objective evaluation would suggest that an individualīs limits are being reached. Equally, all pilot training engrains a need to stick to SOPs, especially when things go wrong. A captain who follows the advice given - "in situations generating high workload, such as serious aircraft deficiencies, Captains should give consideration to delegating the flying to the co-pilot, in order to give maximum attention to the effect of such situations on the safety of the flight" is saying, in fact, "we have such a serious problem that we have to deviate from our normal SOPs, because they canīt cope with the situation" - and an unspoken subtext to that would be "and weīre on our own from here on". Making such a statement both requires a major intellectual and emotional effort on the part of the Captain, and has a significant intellectual and emotional effect on the First Officer; indeed, it may induce undesirable additional stress in the latter in particular. It recognizes in fact that the flight is now outside the normal range of safe operation, so the normal procedures can no longer apply.

For this crew, the basic SOP was not fault-tolerant, because it did not assume that entirely normal imperfections would sometimes combine into a predictable high risk situation: time pressure, technical problems, incorrect weather reporting and unreliable facilities. When they did coincide, it took relatively little by way of human failure to let the situation to get out of control. The only way to maximize the probability that all resources will be used when needed is to ensure that this is built into the basic procedures to which all pilots are expected to conform. This removes the conflict between good CRM for abnormal situations, and normal duty allocations for normal operations.

Appendix 6: a specimen SOP allocation of duties.

This appendix is intended to illustrate (in a very simplified manner) how the principles described can be translated into practical instructions,. It is initially assumed that the Captain will act as P1, but at his discretion, P1 and P2 duties may be exchanged, except for actions required by regulation to be carried out by the Pilot in Command which are notified as as "Captain" in the P1 column.

For practical purposes the flight is broken into three segments: (1) pre-departure and takeoff; (2) climb, en-route and approach, and (3) landing. The takeoff phase ends when the after takeoff check is completed. The landing phase starts when the P1 has made a decision to land after obtaining the necessary visual references, and ends at the parking gate. This results in a practical minimum number of times control is handed over, while providing the maximum practical level of error detection and correction. The P1 is the handling pilot (HP) for takeoff and landing (including taxying), but delegates the handling for the other flight phases.

Standard call-outs are not specified here: there is no change required to an airlineīs current requirements in this respect except to ensure that they assigned to the appropriate pilot as P1 or P2. In addition, whatever callout is made at minimums will also signal the transfer of control if adequate visual reference has been obtained: e.g. if the P2 callout is "Minimums" or "Decide" the P1 response might be "Landing", signifying that the P1 is taking control, or "Go-around" instructing the P2 to carry out the go-around.

P1 P2 Comments
Pre-departure through to end of after-takeoff check:
Duties as currently assigned to "pilot flying" (PF). Duties as currently assigned to "pilot not flying" (PNF). No change from "assisted" concept. However, assigning handling of actual engine start may be desirable, as period around engine starting is frequently one of very high workload. P1 priority should be command and supervision, dealing with communication, liaison, and strategy.
CAPTAIN: actions required by regulation to be carried out by the aircraft commander   Specified as Captain, not as P1. Examples: signatures on specific documents .
Climb, cruise, descent and approach:
Command and communication, and duties currently assigned to "pilot not flying" (PNF). Control aircraft, and any non-command duties as currently assigned to "pilot flying" (PF). Maximizes error detection and correction probability. Maximizes CRM capability Maximizes P1 capacity for problem anticipation, detection and solution.
Review and approve P2 approach plan, and conduct appropriate briefing. Planning and execution of approach, using appropriate level of automation. Incorporates ICAO CFIT recommendation as standard procedure.
Acquires visual cues and takes control for landing,

or

Relinquishes control and continues specific duties currently assigned to "pilot not flying" (PNF). Incorporates ICAO CFIT recommendation as standard procedure
Calls for go-around executes go-around Eliminates need for flying pilot to attempt to change from instruments to visual and back to instruments for go-around.
Landing and after landing:
Control aircraft, and duties as currently assigned to "pilot flying" (PF). specific duties currently assigned to "pilot not flying" (PNF). No change from "assisted" concept.

About the author.

Steve Last has been a professional airline pilot flying international and intercontinental routes for over 32 years. At the age of 18 he entered the College of Air Training, a specialist airline flight training establishment set up by the then British state-owned airlines, British European Airways (BEA) and British Overseas Airways (BOAC). In 1965 he joined BEA as a co-pilot on the De Haviland Trident (the first three-engined narrow-body jet), at the time the most technically sophisticated airliner flying, and on which the first passenger carrying autoland operations were performed, leading to the worldīs first Category 3B approval. At the age of 30 he was promoted to Captain on the Vickers Vanguard (a large four-engined turboprop), operating scheduled and charter freight services in Europe and the Mediterranean. He then returned to passenger flying in British Airways as a Captain on the Trident, Boeing 757, Airbus A320, and currently Boeing 747-400.

Steve Last has been involved in air safety and standards activity for most of his career. He has held positions as Vice-Chairman of the Technical Committee of the British Airline Pilotsī Association (BALPA), and within the International Federation of Airline Pilots Associations (IFALPA) where among othe r positions he was elected as Principal Vice President for Technical Standards, Principal Vice President for Administration and Finance, and Chairman of the Aircraft Design and Operations Committee.

As an IFALPA nominee he has been involved with various international organisations, including the International Civil Aviation Organisation (ICAO) (Airworthiness Committee, Operations Panel, and ETOPs Study Group); JAA (Human Factors Steering Group); and Society of Automotive Engineers (G-10 Human Behavioral Engineering Technology). He is currently the Chairman of the SAEīs S-7 (Flight Deck and Handling Qualities for Transport Aircraft), and is the author of several SAE papers.

In 1989 Steve Last was asked to join the Flight Operations Technical Projects Department of British Airways, as Project Pilot for the Canadair Regional Jet, and was Technical Officer for Developing Technologies until 1996. He has participated in numerous technical trials and evaluations, and acted as adviser and consultant to the UK CAA and to Avionics Vendors. He a frequent request speaker, session leader or chairman at airline industry technical meetings and symposia.

Notes, amplifications, and references

[ CRM-DEVEL Home ] [ What's New ] [ Resources ] [ CRM-DEVEL Mailing List ]
[ Neil Krey's Professional Aviation Instruction Forum ] [ Neil Krey's FLIGHT DECK ] [ Aviation Instruction Bookstore ] [ Aviation Instruction Career Center ]

Copyright © 1996-2005 by Neil C. Krey unless otherwise indicated.
Non-commercial reproduction rights granted if the following notice is included:
"Source: Neil Krey's CRM Developers Forum, http://www.crm-devel.org"