A Human Factors Analysis of Business Jet Approach and Landing Accidents

Transcription

1 A Human Factors Analysis of Business Jet Approach and Landing Accidents Patrick R. Veillette, Ph.D. NetJets From January 1991 through December 2002, there were 251 accidents and 808 incidents involving business jets (Veillette, in preparation). The accidents included 67 fatal accidents (26.7 percent of the total). The 2004 study was part of a multi-year effort which examined 251 accident reports from official accident investigation agencies of many international government agencies. The study also analyzed 808 incident reports in the U.S. Federal Aviation Administration s incident database, as well as 3,190 reports submitted by flight crews of business jets to the U.S. National Aeronautics and Space Administration s Aviation Safety Reporting System (ASRS). This report will highlight the more prominent human factors which contributed to approach and landing accidents of business jets. Other major portions of the multi-year study will be reported in appropriate future forums. Of the 251 accidents, 167 occurred during the approach and landing phases of flight. Of these, 132 (84 percent) involved human error. Fifty-nine involved runway excursions, 25 involved CFIT, 14 involved undershoots, 11 involved loss of control, 10 involved hard landings, seven involved failure to extend the landing gear, three involved hitting objects and three involved miscellaneous events (Table 1). All of the 25 CFIT accidents and 10 of the 11 loss-of-control accidents were fatal. In addition to the 132 human-caused approach and landing phase accidents, 176 landing incidents involved human-caused runway excursions. (Veillette, in preparation) Table 1: Consequences of Crew-caused Errors in 132 Approach and Landing Accidents Category Fatal Non-fatal Runway Excursion 0 59 Controlled Flight Into Terrain 25 0 Undershoots 0 14 Loss of Control 10 1 Hard Landings 0 10 Failure to Extend Gear 0 7 Other 0 6 Total Note: Some reports included more than one subject. Source: Patrick R. Veillette, Ph.D., from accident reports of the U.S. National Transportation Safety Board, United Kingdom s Air Accident Investigation Branch, Canada s Transportation Safety Board, Australia s Bureau of Air Safety Investigation (BASI), and Airclaims, on 132 approach-phase accidents. Pilot deviation from basic operational procedures contributed to 66 percent of the approach and landing accidents (Table 2, page 26). This includes 67 accidents which involved unstabilized approaches and 13 CFIT accidents which involved the flight crew s descent to an incorrect minimum descent altitude before reaching the appropriate sector of the approach. Inadequate employment of back-up braking systems was a factor in 15 runway overruns. 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

2 Table 2: Significant Crew-caused Factors in 132 Approach and Landing Accidents Pilot Deviation from Basic Operational Procedures 66% Inadequate Cross-check by Second Crewmember 43% Flight Handling 40% Inadequate Positional Awareness 39% Failure to Adequately Evaluate Runway and Weather Conditions 33% Inadequate Judgment 33% Note: Some reports included more than one subject. Source: Patrick R. Veillette, Ph.D., from accident reports of the U.S. National Transportation Safety Board, United Kingdom s Air Accident Investigation Branch, Canada s Transportation Safety Board, Australia s Bureau of Air Safety Investigation (BASI), and Airclaims, on 132 approach-phase accidents. Incorrect braking procedures occurred in 14 accidents. Thirteen accidents involved failure to execute the instrument approach in a correct landing configuration. Seven of the 13 included failure to extend the landing gear. Seven accidents involved improper use of thrust reverse systems contrary to procedures specified in aircraft manuals. Other procedural errors included failure to make required call-outs; making inaccurate call-outs; not conducting or completing required checklist or briefs; not following prescribed checklist procedures; and failing to consult charts or obtain critical information. (NTSB, 1994) Previous studies have found that pilot deviation from basic operational procedures was the leading crew-caused factor in air carrier accidents. Lautman and Gallimore (1987) analyzed 93 hull-loss accidents that occurred between 1977 and 1984 and found that 33 percent were caused by pilot deviation from basic operating procedures. Duke s (1991) analysis of 21 turbojet Part 121 accidents found that lack of procedural behavior accounted for 69 percent of crew errors. Inadequate cross-check by a second crewmember was present in 43 percent of the accidents. Eleven resulted in CFIT accidents and 46 resulted in approach and landing accidents. Flight handling difficulties occurred in 40 percent of the accidents. This factor resulted in 11 loss of control accidents, of which 10 were fatal, 32 landing overrun accidents and 10 hard landing accidents. Thirty-nine percent of the accidents were caused in part by inadequate positional awareness. Seventeen contributed to CFIT accidents and 35 caused approach accidents. The flight crew failed to adequately evaluate the aircraft s ability to land and stop within an adequate distance given the runway and meteorological conditions in 44 accidents (33 percent). Forty-two (71 percent) landing overruns/landing excursion accidents and 123 (70 percent) runway excursion incidents occurred on contaminated runways. Improper evaluation of the winds for the approach was a factor in 13 ALAs and 29 incidents. Inadequate judgment was involved in 33 percent of the accidents. Thirty-two approach and landing accidents involved a failure to execute a go-around or missed approach when the aircraft was not stabilized at an appropriate airspeed, and 16 accidents involved a failure to go around when the aircraft deviated significantly from the glideslope. Seven accidents occurred when pilots continued an instrument approach below DH/MDA in absence of adequate visual cues. Five accidents occurred when flight crews continued a landing attempt when the runway environment could no longer be positively identified. Deviation From Operational Procedures A NASA study stated that carefully developed procedures and guidelines to enhance flight crew monitoring can make a significant contribution to improving aviation safety. The NASA study also stated, In complex humanmachine systems, operations, training, and standardization depend on an elaborate set of procedures which are specified and mandated by the operational management of the organization. These procedures indicate to the human operator the manner in which operational management intends to have various tasks performed. The intent is to provide guidance to the pilots, to ensure a logical, efficient, safe and predictable means of carrying out the mission objectives. The function of a well designed procedure is to aid flight crews by dictating and specifying 26 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

3 a progression of sub-tasks and actions to ensure that the primary task at hand will be carried out in a manner that is efficient, logical, and also error resistant. It should also promote coordination. (Degani and Wiener, 1994) Examples of poorly designed or poorly implemented SOPs include: Lack of criteria for go-around Lack of crew coordination procedures Lack of positional awareness call-outs (altitudes, localizer, glideslope) Inadequate FMS management Concurrent duties during high workload phases of flight, and Failure in cross-check. The International Civil Aviation Organization (ICAO) believes that crew error could be open to significant reduction through changes in cockpit operational procedures. (ICAO, CFIT study, 1994) A review of six vital characteristics of cockpit operational procedures involved in the approach and landing accidents (Table 3) found that 35 percent had inadequate specification in properly defining the tasks, and 52 percent lacked adequate specification regarding when the task should be conducted (time and sequence). Eightyfour percent of the procedures lacked specification of the crewmember responsible for conducting the procedure, and 66 percent lacked adequate specification of the actions involved in the task. Similarly, 76 percent lacked adequate specification of the sequence of actions, and 85 percent lacked adequate specification of the types of feedback (callout, indicators) required from crewmembers. Table 3: Characteristics of Inadequate Procedures Ambiguous Specification 1. What the Task Is 35% 2. When the Task Is Conducted (Time and Sequence) 52% 3. By Whom It Is Conducted 84% 4. How the Task Is Done (Actions) 66% 5. What the Sequence of Actions Consists of 76% 6. What Type of Feedback Is Provided (Callout, Indicator) 85% Source: Patrick R. Veillette, Ph.D., from accident reports of the U.S. National Transportation Safety Board, United Kingdom s Air Accident Investigation Branch, Canada s Transportation Safety Board, Australia s Bureau of Air Safety Investigation (BASI), and Airclaims, on 132 approach-phase accidents. The 1994 NASA study on the design of flight deck procedures submits that the classification of pilot deviation from basic operational procedures can be misleading. The authors believed one should first ask whether the procedures were compatible with the operating environment, whether the procedures were consistent and logical, and most important, was there something in the design of the procedures or the manner in which they were taught that led to a deviation? (Degani and Wiener, 1994) Documentation in 57 percent of the accident reports indicated that task saturation interfered with crew coordination (Table 4, page 28). Fifty-three percent indicated that concurrent duties interfered with crew coordination. Inadequately specified procedures were indicated for deviating from SOPs in 48 percent of the reports. Thirty-two percent of the accident reports indicated that the SOPs as written induced extra workload, and 30 percent indicated that the SOPs created conflicts with time management. Twenty-one percent of the reports indicated technical deficiencies with SOPs. Eighteen percent cited incompatibility of the procedures with the operating environment. The structure of the operating environment has previously been cited as a 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

4 Table 4: Underlying Factors That Contributed to Deviations From SOPs Percent Task Saturation 57 Required Concurrent Duties 53 Inadequately Specifi ed 48 Interruptions, Distractions 44 Induced Extra Workload 32 Created Confl icts With Time Management 30 Technical Defi ciencies 21 Incompatible with the Operating Environment 19 Unfamiliarity, Inadequate Training 18 Variance in Procedure From Another Employer 16 Mixed Fleet of Aircraft 14 Note: Some reports included more than one subject. Source: Patrick R. Veillette, Ph.D., from accident reports of the U.S. National Transportation Safety Board, United Kingdom s Air Accident Investigation Branch, Canada s Transportation Safety Board, Australia s Bureau of Air Safety Investigation (BASI), and Airclaims, on 132 approach-phase accidents. crucial factor in procedural development. For example, a short-haul operator flying many legs per day may wish to minimize ground time. At intermediate stops, the pilots may remain in the cockpit and keep certain equipment powered in order to facilitate a rapid turn-around. Other differences include high-frequency short-haul flights vs. long-haul operations where flight crews will perform their checklists significantly less. (Degani and Wiener, 1994) Nearly 18 percent cited unfamiliarity or lack of training. Corporations do have a culture, stemming largely from the nature of their business, their geographic location, the background of their founders and present management. Some critical procedures such as rejected takeoff or in-flight engine failure are also executed differently at various operators. Nearly 16 percent cited differences in procedures from previous employers or from simulator training centers. Many operators have a mixed fleet of aircraft, various cockpit configurations of aircraft they already had, and aircraft they did not previously operate. Fourteen percent of the accident reports indicated negative habit transfer from mixed fleets of aircraft. Eight percent cited incompatibility with the cockpit layout. Procedures must be compatible with the ergonomic layout of the flight deck. For instance, some aircraft are equipped with nosewheel tillers which are not within easy reach for the first officer. If the first officer is the pilot flying, this necessitates transfer of control during the takeoff roll. Inadequate Monitoring Skills Frequently Cited Forty-three percent of the approach and landing accident reports indicated inadequate monitoring. According to previous studies, A flight crew member must carefully monitor the aircraft s flight path and systems, as well as actively cross-check the other pilot s actions, or safety can be compromised. (Sumwalt, 1999) Other studies have found crew monitoring deficiencies as an important factor in accidents. An analysis by the ICAO of controlled-flight-into-terrain accidents found that poor crew monitoring was a factor in half of the 24 accidents reviewed. (ICAO, 1994) An NTSB report on flight-crew-caused air carrier accidents said that 31 (84 percent) of the 37 accidents reviewed involved inadequate crew monitoring or challenging. Among all 37 accidents, 53 (76 percent) of the 70 monitoring/challenging errors failed to catch errors that [NTSB] had identified as causal to the report. An additional 12 monitoring/challenging failures (17 percent) were failures to catch errors that contributed to the cause of the accident. (NTSB, 1994.) 28 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

5 A University of Texas data archive of more than 2,000 airline flights noted that roughly 62 percent of unintentional errors went undetected by the flight crew. The study noted that more effective crew monitoring could have averted 19 percent of errors and 69 percent of undesired aircraft states. (Fiorino, 2002) This study utilized the definition of a monitoring error as a failure to adequately watch, observe, keep track of, or cross-check any or all of the following: (1) the aircraft s trajectory, i.e., taxi and flight path, speed management, navigation; (2) automation systems and mode status, i.e., flight management system (FMS) entries, mode control panel (MCP) settings/selections, awareness of automation mode; and (3) aircraft systems and components, i.e., fuel quantity, aircraft configuration, system status. (Sumwalt, 1999) For each of the accident reports, this study tallied the ways in which safety was affected by insufficient monitoring (Table 5). Eighty-one percent of the monitoring errors resulted in a significant deviation from the appropriate airspeed. Sixty-one percent resulted in a degradation of the aircraft s airspeed and/or sink rate. Forty-four percent resulted in a significant deviation from the instrument approach procedure. Twenty-three percent resulted in the aircraft landing in an unapproved configuration. Table 5: Safety Consequences of Monitoring Errors Safety Consequence Percent Signifi cant Deviation from Appropriate Speed 81 Degradation of Speed/Sink Rate 61 Deviation from Instrument Approach Procedure 44 Landing in an Unapproved Confi guration 23 Note: Some reports included more than one subject. Source: Patrick R. Veillette, Ph.D., from accident reports of the U.S. National Transportation Safety Board, United Kingdom s Air Accident Investigation Branch, Canada s Transportation Safety Board, Australia s Bureau of Air Safety Investigation (BASI), and Airclaims, on 57 approach-phase accidents. Most of the monitoring errors were associated with crewmembers preoccupied with other required duties (Table 6). Forty-four percent of the reports indicated that air crews had been distracted by a radio communication with air traffic control, the fixed base operator or obtaining ATIS. Forty-three percent of the pilots cited performing checklists as a distraction from their monitoring duties. Scanning for air traffic was cited in 41 percent of the events, and heads down activity associated with reprogramming the FMS was involved in 39 percent of the reports. Often several of these existed at the same time. Attention diverted to aircraft systems operations existed in 26 percent of the incidents; intra-cockpit communications occurred in 22 percent and passenger/cabin related activities occurred in 20 percent of the events. Table 6: Tasks or Functions Performed Before and During Monitoring Errors Task Percent Radio Communications (ATC, unicom, company radio, ATIS) 44 Checklists (checklists, paperwork, chart reviews) 43 Traffi c Avoidance Scanning 41 Cockpit Automation 39 Aircraft Systems 26 Intra-cockpit Communications 22 Passenger/Cabin Related Activities 20 Note: Some reports included more than one subject. Source: Patrick R. Veillette, Ph.D., from accident reports of the U.S. National Transportation Safety Board, United Kingdom s Air Accident Investigation Branch, Canada s Transportation Safety Board, Australia s Bureau of Air Safety Investigation (BASI), and Airclaims, on 57 approach-phase accidents. 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

6 This trend is similar to other studies. In a NASA study of cockpit interruptions and distractions, the pilot-notflying reported that preoccupation with non-monitoring duties prevented monitoring the other pilot closely enough to catch an error being made. In 13 of the 35 incidents, the pilot not flying was preoccupied with some form of head-down work, most commonly paperwork or programming the FMS. The report said, We found it interesting that flight-related tasks were referenced in such a high percent (80 percent) of the reports in this study. On the one hand, it could be argued that because these functions are required for flight (radio communications, checklists, navigation, etc.), they would be mentioned in most of the reports. On the other hand, many report narratives suggested that crews were performing these tasks in lieu of the monitoring task. (Dismukes, Young, Sumwalt, 1998) Another study of ASRS data recommended, Management of flight operations departments, as well as regulatory officials, must realize that it is incumbent on them to provide air crews with clearly thought-out guidelines to maximize their monitoring of aircraft trajectory, automation, and systems. Procedures that conflict with crew monitoring must be minimized or eliminated. (Sumwalt, Morrison, Watson, Taub, 1997) References Degani, Asaf; Wiener, Earl L. On the Design of Flight-Deck Procedures. NASA Contractor Report , June NASA-Ames Research Center, Moffett Field, California. Dismukes, K.; Young, G.; Sumwalt, R. Cockpit Interruptions and Distractions: Effective Management Requires a Careful Balancing Act. ASRS Directline (December 1998): 4-9. Duke, T.A. Just What Are Flight Crew Errors? Flight Safety Digest (Volume 10, No. 7): Fiorino, Frances. Crew Monitoring High on ALPA s Training Agenda. Aviation Week & Space Technology December 2, 2002: 56. International Civil Aviation Organization (ICAO). Safety Analysis: Human Factors and Organizational Issues in Controlled Flight Into Terrain (CFIT) Accidents, Montreal, Quebec, Canada: ICAO, Lautman, L; Gallimore, P.L. Control of the Crew Caused Accident: Results of a 12-operator survey. Boeing Airliner (April-June 1987): 1-6. NTSB. Safety Study: A Review of Flightcrew-Involved, Major Accidents of U.S. Air Carriers, 1978 through Report no. NTSB/SS-94-/1. Washington, D.C., United States: NTSB, Sumwalt, Robert L. Enhancing Flight-Crew Monitoring Skills Can Increase Flight Safety. Flight Safety Digest March Sumwalt, R.L.; Morrison, R.; Watson, A.; Taube, E. What ASRS Data Tell About Inadequate Flight Crew Monitoring. In Proceedings of the Ninth International Symposium on Aviation Psychology. R.S. Jensen, L. Rakovan, eds. Columbus, Ohio, United States: Ohio State University, Veillette, P. Approach and Landing Accidents of Business Jet Aircraft, In preparation. About the Author Patrick R. Veillette, Ph.D., is presently a Raytheon Hawker 800XP First Officer for a major U.S. corporation. He formerly was a Boeing 727 first officer for a U.S. Federal Aviation Regulations Part 121 air carrier, and also has flown fixed-wing emergency medical services operations, aerial fire fighting operations and 14 CFR 135 on-demand charter-aircraft flight operations. He formerly investigated failure modes, weaknesses and performance capabilities of aircraft involved in accidents and was an accident investigator for the U.S. Department of Agriculture. Veillette received a bachelor s degree in aeronautical engineering from the U.S th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

7 Air Force Academy and a doctorate in civil engineering at the University of Utah. He is the 1992 and 1994 recipient of the Transportation Research Board s Graduate Research Award and the 1994 recipient of the American Institute of Aeronautics and Astronautics William T. Piper award. He has conducted numerous research projects on cockpit automation and human error in high-risk environments, and is the author of more than 115 scientific papers and articles in various professional pilot journals. In 24 years of flying experience, he has accumulated over 13,000 hours of flight experience in more than 90 types of aircraft, from balloons to sea planes, gliders, war birds, supersonic jets, business jets and large commercial transports. Veillette has an air transport pilot certificate with type ratings in the HS-125 and SD-3, and is a former U.S. Federal Aviation Administration designated pilot examiner. Veillette is a member of Flight Safety Foundation s Corporate Aviation Advisory Committee. Additional material follows on pages Human Factors in Corporate Approach and Landing Accidents Patrick R. Veillette, Ph.D. 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

8 Multi-Year Effort 251 Accident Reports 808 Incident Reports 3,190 NASA ASRS Reports Phases of Flight Go-Around Landing Approach Descent Cruise Non-Fatal Fatal Climb Takeoff Ground th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

9 Human vs. Other Causes Go-Around Landing Approach Descent Cruise Climb Human Mech, Other Takeoff Ground Primary Causes CFIT Takeoff Mechanical Non-Fatal Fatal ALA th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

10 Consequences of Crew Errors in 132 ALAs Other Gear-Up Hard Landing Loss of Control Undershoot CFIT Runway Excursion Non-Fatal Fatal Leading CFIT factors Fatigue System Ops Decision Making Communication Navigation Monitoring CRM Procedures Situational Awareness Source: Veillette study, in preparation 34 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

11 Factors Involved in ALAs Judgment Failure to Evaluate Omission/Incorrect CRM Flight Handling Slow/Delayed Unstable Approach Source: Veillette study, in preparation Factors in Unstable Approaches Windshear, Gusts Icing FMS Mgt Energy Mgt Demanding ATC Inadequate Coor "Slam/dunk" Source: Veillette study, in preparation 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

12 Crew Errors in 132 ALAs Inadequate Judgment Fail to Evaluate Positional Awareness Flight Handling Inad. Monitoring Dev from BOP Deviation from SOPs common in previous studies Lautman and Gallimore (1987): 33% of hull loss accidents between Duke (1991): 69% of crew errors in 21 Part 121 turbojet accidents 36 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

13 Examples of Procedural Errors 67unstabilized approaches 15improper emergency brake use 14incorrect braking procedure 13 descent to incorrect min. altitude 13incorrect landing configuration Other Common Procedural Errors Failure to make required call-outs Making inaccurate call-outs Not conducting checklists or SOPs 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

14 Pilot Deviation from SOPs (can be misleading) Were procedures compatible with the flight environment? Were the procedures consistent and logical? Did the design lead to a deviation? Was the training in the procedure adequate and complete? Characteristics of Well Designed Procedures Ensure logical, efficient, safe, and predictable means Dictate and specifying a progression of sub-tasks and actions Should be error resistant and promote coordination Ref: Wiener, th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

15 Inadequacies of Procedures Feedback Sequence How By Whom When What Factors Contributing to Deviation From Procedures Mixed Fleet Previous Exp. Unfamiliarity Incompatible Technical Diff. Time Mgt Conflict Extra Workload Distraction Inadequate Spec. Concurrent Duties Task Saturation th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

16 43% Indicated Inadequate Monitoring Crews must carefully monitor a/c flight path and systems, as well as actively cross-check each other (Sumwalt, 1999) Crew Monitoring Studies ICAO (50% of CFIT accidents) NTSB (84%) University of Texas (62% of unintentional errors were undetected) 40 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004

17 Consequences of Monitoring Errors Configuration Dev from IAP Speed/Sink Rate A/S Deviation Tasks Performed During Monitoring Errors Pax/Cabin Crew Comm Aircraft Systems FMS Mgt Traffic Scan Checklists Radio Comm th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April

18 ASRS Study: Provide air crews with clearly thoughtout guidelines to maximize their monitoring of aircraft trajectory, automation and systems. Procedures that conflict with crew monitoring must be minimized or eliminated (Sumwalt, et al., 1997) 42 49th annual CASS FSF & NBAA Quality Safety: Oasis in the Desert Tucson, Arizona April 2004