CAP 737

UT University of Texas CAP 737 Foreword December 2016 Page 8 Foreword Cap 737 has been re-structured in response to commercial air transport needs, identified by the Crew Resource Management Advisory Panel, to provide more focussed and applied practical CRM training guidance. The civil aviation community has fully embraced the need for change and have made significant contributions in the form of anecdotal experiences to provide context to the complex human behaviours described in the document. The document is structured into 6 main parts:  Human Factors knowledge and application comprises 15 chapters covering the full range of individual and team human characteristics that manifest themselves within aircraft operational roles. The approach adopted throughout these chapters is threefold:  Firstly a theoretical explanation relating to each of the human processes or behaviours is provided to equip the trainers with the pertinent knowledge  Secondly a description of the application of the specific human attributes within roles and tasks is provided and is supported by contextual anecdotal illustrations.  Thirdly practical guidance in how the specific human vulnerabilities can be understood through suggested CRM training activities is provided.  Specific context guidance comprises 3 chapters which explores the application of CRM training within three focal areas.  The first area is automation and the challenges in mode management and its impact on situation awareness and workload are discussed. The impact of manual flying skills and its contribution to predictive monitoring skills is debated. CRM challenges associated with novel interfaces (e.g. electronic flight bags) are tabled.  The second area relates to the interfaces that the aircrew and cabin crew have with external agencies (turnaround co-ordinators, dispatchers, cargo and ground handlers, line engineering, customer service agents and airport operations staff) and identifies the value of aligning cultures and attitudes through a more comprehensive approach to CRM training. Case study material reinforces the need to widen the CRM training net. CAP 737 Foreword December 2016 Page 9  The third area provides guidance in the delivery of CRM training to cabin crew and emphasises the contribution that cabin crew can make to flight safety with examples provided.  CRM assessment comprises 2 chapters which detail the instructor competencies required to carry out CRM and TEM assessment and the behavioural marker system as a method of feedback to the crew. This will enable Instructors and Examiners to understand and comply with the EASA requirements contained in AMC1 FCL.920 and AMC1 ORO.FC 115 & 215 (h). Observation skills are key attributes and example case studies are provided. Candidate behavioural markers are provided.  CRM effectiveness comprises guidance in the development and application of facilitation skills which are an essential part of the assessment task. It also provides a set of guidelines and checklists which underpin good CRM practices in terms of required trainer attributes and competencies. The overall aim is to ensure that the Air Transport Operators are able to recognise indicators which contribute towards effective CRM.  CRM in safety management emphasises the importance of recognising poor CRM as an aviation hazard and good CRM as risk mitigation strategy. It provides advice in the capturing and classifying of accident and incident data where human vulnerabilities are identified as contributing factors. The encouragement of non-punitive reporting to capture human error safety trends for internal occurrence reporting is very important as this provides feedback to the CRM trainers to ensure that robust risk mitigation strategies are in place.  CRM regulation has changed in that the UK CRMI accreditation scheme is no longer in place (apart from ground trainers). The responsibility for development and maintenance of CRM training in accordance with EASA regulation (AMC1 FCL.920 and AMC1 ORO.FC 115 & 215 (h) and Standards Document 29 will be devolved to the Air Transport Operators. This section of the report summarises the CRM training expectations from the perspective of the regulator. CAP 737 Introduction to Crew Resource Management (CRM) and Threat and Error Management (TEM) December 2016 Page 10 Introduction to Crew Resource Management (CRM) and Threat and Error Management (TEM) Crew Resource Management (CRM) Originally called Cockpit Resource Management, CRM training emerged after the recognition that the technical skills of piloting an aircraft were insufficient to ensure safety and best performance; accidents were occurring for reasons other than inadequate piloting skills. It was apparent that pilots needed to learn more about how best to manage all the resources available to them in the cockpit including other crew-members, procedures, the machine interface, and themselves (i.e. recognising where they were most vulnerable and what their strengths were). This management of resources was the original essence of CRM training (hence the term). Many of the elements identified as necessary to support pilots in this process were borrowed from the scientific or management domain (e.g. communication, personality theory, error and leadership). Others came from common aviation practice (e.g. ‘airmanship’ and ‘captaincy’). Cockpit resource management quickly grew to encompass wider crew resources, including cabin crew, and was renamed Crew Resource Management, hence retaining the same acronym. CRM is now considered essential training for most aviation professionals who make an operational contribution, including air traffic controllers and engineers. This document is written primarily for flight crew, and then cabin crew. However the first sections of the chapters in Part A are deliberately generic and can therefore apply across contexts. The scope of CRM has also grown and diversified to the extent that it is now easier to list the sorts of areas that get taught in CRM than to attempt to define exactly what CRM training is. A general but inadequate definition would be the training of the cognitive and social skills needed to support technical training in order to optimise safe and efficient aircraft operation. It is clear that to be most effective, such skills must be integrated into the job role, and this integration is something that CRM has traditionally struggled with. This document attempts to address this by including a second section in each knowledge chapter (Part A, Chapters 1 – 15) called ‘application’ which puts the knowledge within an operational context (mainly for flight crew, with a variety of operations represented). Finally, good use of CRM skills relies on effective training and assessment by practitioners (CRM trainers, flying instructors, examiners, etc.). To support this, the third and final section of each knowledge chapter (Part A, Chapters 1 – 15) deals with the teaching and delivery of that subject, and where possible examples are included. Additionally, there is a CAP 737 Introduction to Crew Resource Management (CRM) and Threat and Error Management (TEM) December 2016 Page 11 section dedicated to resources, including assessment and requirements (from EASA regulatory guidance material). In this handbook, the use of the term ‘Human Factors’ (HF) includes CRM along with other aspects of human performance. Emergence and development of CRM The introduction of cockpit voice recorders (CVR) in the 1970s strongly suggested that non-technical operational elements (often called ‘human factors’) were contributing strongly to many accidents. CVR data, along with analyses of accident causation (e.g. Ruffle-Smith 1979) led to a US based conference entitled ‘Resource Management on the Flight Deck’ in 1979. It was concluded that the majority of pilot-related errors were failures of interpersonal skills, communications, decision-making, and leadership (Cooper, White, & Lauber, 1980). The loss of a United Airlines DC 8 at Portland in 1978 was an important driver for the introduction of CRM training. Analysis of the cockpit voice recordings led the National Transportation Safety Board (1979) to conclude that a contributory factor was the captain’s failure to accept input from other flight crew members, as well as the lack of assertiveness from those crew members themselves. Following this United Airlines set up the very first comprehensive CRM course in 1981 (see Helmreich et al. 1999). Since then research findings have consistently cited human contribution and CRM (under many labels) as contributory factors in the majority of accidents, but it is not known exactly how CRM training has influenced the situation. Cockpit Voice Recorders can only uncover audible evidence, so understandably the content of early CRM courses tended towards areas within social psychology and group dynamics such as leadership, communication and interpersonal skills, because these could be deduced from the CVR conversations. A common theme was the perceived authoritarian role of captains and the lack of assertiveness from other crew-members as inferred from accident CVRs. Because of the areas being addressed, early courses were often developed and run by people whose backgrounds were primarily in psychology or management, and these people often extended CRM ideas further into their own domain. These courses had mixed reviews from pilots, one problem being a lack of direct application and integration of CRM to the flight deck (pilots themselves were left to work out how to integrate it into their job roles). Content of CRM grew with recognition that many important issues were out of direct reach of the CVR, such as monitoring and mode awareness, fatigue and vigilance, situational awareness and individual decision-making. Although retaining the title ‘CRM’, such training now covers a much wider scope that is often referred to under the umbrella terms of ‘non- technical skills’ and ‘human factors’. CAP 737 Introduction to Crew Resource Management (CRM) and Threat and Error Management (TEM) December 2016 Page 12 Threat and Error Management (TEM) In the 1990s, threat and error management (TEM) was introduced, and under current EASA FCL regulations it should be covered during all training events. The practical summation of threat and error management for flight crew is the practice of thinking ahead in order to predict and avoid errors and operational threats, and manage any that occur (similar to the practice of defensive driving). There is an old saying (that emerges in various forms): A superior pilot uses his superior judgement to avoid situations that would require his superior skills Like all great sayings, the source of it is contested (and probably unknown) but it probably dates back to the 1940s at least. Certainly the UK’s Royal Air Force has used it on posters over many decades. Threat and Error Management gives this message a more formal and theoretical underpinning, but TEM is more than just a re-application of a good mantra. Threat and error management uses accident theory based on the work of James Reason (see Reason 1990). It has three elements relevant to flight crew; threats, errors and undesired aircraft states. Threats and errors have the potential to cause undesired aircraft states, and when they do so, those states must be managed (Maurino 2005). A foundation of TEM is the acceptance that threats will occur and errors will be made. Hence TEM is not an attempt to eliminate threats and errors, but is concerned with the management of them. The model of flight crew error management (Helmreich et al 1999a) expands these ideas. The model (see Figure 1 below) describes how risks to the operation can be expected (e.g. terrain and runway length) or unexpected (e.g. emergencies, malfunctions, traffic, etc.). Such threats are external to the operation and generally beyond the control of the flight crew, and must be managed by the CRM behaviours of threat recognition and avoidance in order to achieve a safe operation (hence the term ‘threat management’). Additional risk comes from errors made by those other than the flight crew (external threats, such as errors made by air traffic controllers) and errors made by the flight crew (internal threats). These errors must be managed by the CRM skills of error detection and management, and if mismanaged can lead to further errors and potential incidents or accidents. Helmreich et al (1999b) describe how CRM as a countermeasure to error has three lines of defence. The optimum state of error management (first line of defence) is the avoidance of errors before they occur. This is sometimes said to involve a high level of situational awareness in order that pilots can foresee issues and threats that may cause errors. Errors that are not avoided need to be recognised and understood (trapped) immediately so that they do not occur or there are no consequences (second line of defence). On rare occasions, if errors and threats are not trapped, then they might have consequences that will require mitigation. Mitigation is the last line of defence and is the least desirable state CAP 737 Introduction to Crew Resource Management (CRM) and Threat and Error Management (TEM) December 2016 Page 13 of error management. It is said that a crew that have to continually trap and mitigate errors is probably one working at a low level of situational awareness (caused by any number of factors including high workload on other tasks, low currency, stress, fatigue, fight or flight, emotional pressure, etc.). Figure 1. Model of flight crew error management. From Helmreich et al (1999a) CAP 737 Introduction to Crew Resource Management (CRM) and Threat and Error Management (TEM) December 2016 Page 14 A central practical mantra of TEM is ‘avoid, trap, mitigate’. Helmreich et al’s (1999b) error troika (Figure 2 below) proposes that most errors are avoided and of those that occur, most are trapped. Figure 2. The error troika. From Helmreich et al, 1999b In the UK, TEM is usually seen as sitting within CRM, but the flight crew error management model (Figure 1) explains how the opposite view can exist (and is possibly even predominant in some countries) since CRM behaviours can be viewed as a part of overall threat and error management. Whichever perspective one takes it is clear that there are many links between TEM and CRM. Research has found evidence that strong leadership, inquiry, workload management and automation management are correlated with fewer mismanaged errors and undesired aircraft states (Helmreich 2006). Additionally, crews that develop contingency management plans (such as discussing threat strategies) have fewer mismanaged threats. CAP 737 Section A: Human factors knowledge and application December 2016 Page 15 SECTION A Human factors knowledge and application In this section: This section is split into two parts: Part A1 – The Individual Chapters 1 – 12 contain knowledge areas that are most closely aligned with individual factors and performance and hence are applicable to everyone, including those operating as flight crew, cabin crew, and those operating small single pilot aircraft. Part A2 – The Crew Chapters 13 – 15 contain knowledge applicable to teams and crews, mostly applicable to multi-crew pilots and other teams such as cabin crew, but with concepts that single pilots can also benefit from. From a scientific perspective, much of this section draws from social psychology and group dynamics. Chapter topics generally align with current EASA requirements in terms of areas covered. For more guidance on regulation see Section B, Part 5, Chapter 25 (CRM regulations). This section (Section A) can be treated like a textbook of fifteen chapters. With the exception of Chapters 10 and 11 each chapter is divided into three distinct parts: basic theory, application to aviation operations, and relevance for CRM practice, as follows:  Knowledge – A very brief theoretical introduction to the topic  Application – How the knowledge applies in aviation operations  Application to CRM – Assistance for the CRM trainer / instructor / examiner in putting across the knowledge Use of Anecdotes Throughout Section A, numerous anecdotes are used to illustrate theory. These are short stories that will help to add ‘colour’ and application to the narrative. The anecdotes come from all types of operation right across civil aviation, including air transport (fixed and rotary wing) and recreational flying of various types. Anecdotes have kindly been supplied by volunteers. Where those volunteers preferred not to be named in the document, the anecdote has no reference. Where volunteers were comfortable to be named, the anecdote is followed by a number referring to the list of contributors in the front of this document. CAP 737 Section A: Human factors knowledge and application December 2016 Page 16 Limitations of Section A Section A is not an exhaustive description of all CRM knowledge required by a CRM trainer. Each topic is covered with some basic theory that is then integrated into the flight operations domain (within the ‘application’ sub-sections) and finally discussed with relevance to CRM training. The focus has been on width rather than depth of coverage. The scientific knowledge has been intentionally simplified and phrased in a non- ambiguous manner that may, on occasions, seem frustratingly imprecise to researchers and scientists. The chapters sometimes state scientific information as if simple fact, when usually the precision of the information is still debatable within science. This has been done in order to make the document more easily accessible, readable and more usable in the practical domain. For example, a statement might be used such as: Startle is a reflex that automatically happens in response to a shocking event Scientists in the domain would not enjoy such a statement, because although not overtly incorrect, it does not reflect the precision of the evidential inferences or on going arguments. A more correct version of the above sentence would be: Although still debated, ‘startle’ is usually considered to exhibit more characteristics of a reflex than an emotion by modern researchers. This is because the acoustic startle pathway is known to be relatively short, and that evidence from eye-blink amplitude measurements suggests the activation happens before full conscious awareness. Startle can therefore be argued to be an autonomous response to a stimulus, and the term ‘reflex’ can be justified in this context. The reader can see that if topics were approached in this way, this manual would be difficult to read, and less usable in the practical domain. Researchers are asked to treat this as a limitation to be considered if ever quoting from this manual in scientific research literature. CAP 737 Section A, Part 1: The Individual December 2016 Page 17 SECTION A, PART 1 The Individual In this Part: Chapter 1 Information Processing Chapter 2 Perception Chapter 3 Attention Chapter 4 Vigilance and Monitoring Chapter 5 Workload Chapter 6 Surprise and Startle Chapter 7 Situational Awareness Chapter 8 Decision Making Chapter 9 Error and skills Chapter 10 Stress in Aviation, Stress Management Chapter 11 Sleep and Fatigue Chapter 12 Personality and Culture CAP 737 Section A, Part 1, Chapter 1: Information processing December 2016 Page 18 SECTION A, PART 1, CHAPTER 1 Information processing Knowledge This chapter gives a brief theoretical foundation for subsequent (more applied) chapters. ‘Information Processing’ attempts to explain how the human brain responds to incoming information. It is a general theory that can help to understand areas such as situational awareness and decision-making. There are three fundamental stages: ‘information input’, ‘processing’, and ‘response’ (input, process, output). Information in (e.g. sights and sounds) Process the information Respond to the information 1. Input (information in) When senses are stimulated (e.g. a sound or sight), the stimulus is remembered by a special ‘sensory memory’ just long enough for an unconscious interpretation ‘perception’ to determine whether the stimulus is important enough to draw the person’s attention to. Hence for incoming information to be processed (thought about) it must be sensed, perceived and noticed. 2. Processing (process the information) Processing compares incoming information to long-term memories in order to interpret it and decide what to do next. Processing takes mental effort (it creates and adds to mental workload). Operations such as hypothesising, assessing, calculating, decision-making, or any other thought process can be referred to as ‘processing’. Some well-learned perceptions can bypass this processing stage by triggering a skilled response automatically (even without seemingly catching our attention). Even complex tasks like driving a car can become automatic; many experienced car drivers ‘find themselves’ stopped at a red traffic light without remembering it happening. Role of Memory Previous experiences must be stored in long-term memory (LTM) for future scrutiny. Additionally, automatic routines such as speech and motor programs must be stored (in a long-term area called ‘procedural memory’). Furthermore, during mental processing there is a need for the short-term buffering of information (like computer RAM) and this is done in an area called the ‘working memory’. CAP 737 Section A, Part 1, Chapter 1: Information processing December 2016 Page 19 Hence there are at least four types of memory that have been theorised:  Sensory Memory  Long-Term Memory (LTM).  Working memory  Procedural memory (similar to the colloquial phrase ‘muscle memory’) There are other hypotheses of memory in information processing, and so trainers will encounter other terms in use, but they will usually parallel one of the four ‘types’ above. Figure 3. Simplified generic diagram of Information Processing (based on simplification and merger of many other authors' work Figure 3 above is a simplified version of the overall theory. It works from left to right. Sensory memory remembers stimuli just long enough to allow perception, which passes the information to either conscious processing (working memory) or automatic processing (procedural routines). Much could be added, but one useful addition would be a feedback arrow from ‘response’ back to the start, since ongoing tasks such as flying are constantly being updated based on feedback. Note the shaded area called ‘Attention’ in Figure 3. Attention will be discussed further in other sections because it is so fundamental to cognition and error. Attention is also aligned with mental effort (concentration, thinking, etc.). Conscious activities require attention and unconscious (automatic) activities do not. All central processing involves attention (hence it is within the shaded area). Long-term memories are generally agreed to be unconscious stores, therefore outside the ‘attention’ area. CAP 737 Section A, Part 1, Chapter 1: Information processing December 2016 Page 20 3. Response Responding usually takes a physical or verbal form (doing or saying) but there are other responses such as thoughts, eye movements, doing nothing, etc. Well-learned motor skills require almost no attention (i.e. ‘fire and forget’). This is very effective and efficient but it can lead to a problem if the wrong skill is triggered and then continues unnoticed. Application of Knowledge – information processing Information processing theory can help practitioners articulate or understand a mental task. Consider a complex task such as making a divert decision (see the decision-making section for more specific analysis on this decision). It involves input, processing and actions. The information comes from many sources and causes heavy processing (in working memory). A problem at any stage of information processing could affect the outcome, for example:  Sensing: Failing to hear an important radio call about the weather at the diversion, due to turning the volume down during a critical discussion.  Perceiving: Misperception of the fuel gauges (selecting an airfield too far away).  Processing: Miscalculating the crosswind vector at the diversion airfield.  Responding: Accidentally selecting a speed of 140 knots rather than a heading of 140 degrees. Almost all actions and operations can be analysed in this way, including quick and simple tasks. Identifying the problem stage can help inform solutions. Application to CRM – information processing A basic understanding of information processing can help articulate ideas and assessments of why people do what they do (e.g. for classroom case studies, diagnosing events in simulators, etc.). The process of information acquisition means that the foundations for an accident can be laid before a crew ever make a decision or do any conscious mental processing. If information is not seen, noticed, or correctly perceived, then any subsequent action is more likely to look like an error. In case studies, it is always important to attempt to establish (or hypothesise) what information an accident crew based their actions on, before determining if the actions themselves were erroneous. It is also important for trainers to remember that a ‘failure’ of processing (seemingly not responding appropriately, or at all, to a situation) could in fact stem from any part of the process. In a similar way, when observing an event in the simulator or on the line, the observer should consider the whole process equally, not just the part that is closest to the consequence, or the part that the crew vocalise the most. For example a crew may make a seemingly poor decision (e.g. choosing to continue the sector CAP 737 Section A, Part 1, Chapter 1: Information processing December 2016 Page 21 after a simulated problem after take off) and the trainer notes ‘decision making’ down on their behavioural marker sheet. But the trainer should still be open to other possibilities such as information not having been perceived correctly (the decision might indeed have been good when considering the information as the crew perceived it). The trainer should therefore debrief in a way that allows a diagnoses of the whole task (input, processing and output) to pinpoint at what stage the problem occurred. Such a debrief might be called a ‘cognitive task analysis’ (CTA). In the most basic form, the instructor can start by asking the crew to break the whole process into just three or four stages, or draw a brief basic timeline (of what happened when). Questions can then be asked about the stages. The trainer should establish any differences between their own observation and the crew’s picture of the situation and ask questions that attempt to uncover where the issues occurred, and what they were. Examples of such questions would be:  “Which part of the task do you think worked well?  “Did you find any part of the task difficult? Why?”  “In hindsight, would you do anything differently? What/Why?”  “What information were you basing the decision on?”  “At [this stage] what information do you recall being most aware of?”  “At this point, was there anything causing you concern?”  “What information source would you have based the decision on, if that source was unavailable?”  “Did the decision feel urgent?” The aim of these sorts of questions would be to find out where the process went wrong. For example, it might have been that the response was appropriate given the information the crew perceived, but the information was incomplete or misperceived by the crew. The trainer then needs to focus on that element, not the decision making or response. CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 22 SECTION A, PART 1, CHAPTER 2 Perception Knowledge Incoming stimuli need to be quickly interpreted so as to know roughly what is being sensed. This process of perception is fast and effortless. Perception can be said to build ‘mental models’ of what the senses collect. For centuries, people have created optical Illusions that act to ‘fool’ the perceptual process (illusions are designed to create a misperception; i.e. there appears to be a difference between what you perceive and what is true). Figure 4. The Müller-Lyer Illusion by F.C. Müller-Lyer 1889. The two parallel lines are of equal length, but most people percieve the top one to be shorter. The exact reason for this is still debated. Figure 5. The Zöllner Illusion (Johann Karl Friedrich Zöllner, 1860). The diagonal lines are all parallel, but due to the short horizontal and vertical cross-lines, they do not appear so. The exact reason is also still debated. The essence of the perceptual process is that it imposes knowledge and experience onto incoming sensory information in order to form a quick understanding of it. In other words the brain takes a very quick ‘best guess’ as to what the stimuli represent based on what it has learned of previously similar stimuli. As well as the object being perceived, the context around the object also feeds the perceptual process of that object. A good example is a form of illusion created by the CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 23 suggestion of perspective in two-dimensional images, such as classic convergence illusions like the one in fig 6 below. Figure 6. Classic Perspective Illusion Sometimes called the Ponzo Illusion, putting two identically sized objects on a scene with suggested perspective causes one object to be perceived as larger than the other. This is because the brain naturally compensates for the perspective as it would in the real world (objects nearer the horizon or closer to the vanishing point are perceived as further away, and the size is unconsciously compensated for by the perceptual process). Piloting an aircraft would be impossible without the use of perception, but on rare occasions the process will inevitably lead to the brain ‘guessing’ wrongly about the meaning (or properties) of an object. Which comes first: noticing or perceiving? In terms of information acquisition, there has long been a scientific debate about which comes first: the drawing of attention to a stimulus (noticing) or the perceiving of that stimulus (what is it?). To avoid a complex but fascinating indulgence into the science, it is practically useful (and generally correct) to consider that many things will get perceived (to an extent) whether they catch our attention or not, and that only some things that are perceived will draw our attention (either because of their physical characteristics or the meaning around them). Almost everything that catches our attention will be perceived. Hence we probably perceive more than we attend to. Application of knowledge – Perception This section explains common perceptual illusions in flying. The single most important learning point regarding perceptual illusions is well established in aviation: pilots are rightly trained that unless obviously wrong, instrument readings should be prioritised over sensations (both vestibular and visual). It may be worth the CRM instructor recapping these illusions in order to reinforce that important point, and showing the number and breadth of situations to which it applies. CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 24 Glideslope The need for VASIs and PAPIs stem from the difficulty that all pilots have (to varying extents at various times) in accurately judging the right glideslope angle using purely visual judgment. There are no reliable natural visual cues for glideslope angle. The raw, uncorrected shape (a trapezium) that a runway presents to the eye during a final approach is one of the most important cues for the perceptual process (known as form- ratio). Because of this, one of the most common illusions is caused by a sloping runway surface. A runway that slopes downhill, away from the pilot is likely to generate a high approach (as the pilot attempts to maintain the normal perception of form-ratio). This could lead to a high-energy approach (to a downhill sloping runway) and the risk of an overrun. Equally, an upward sloping runway, as viewed from the pilot, may cause a low approach for the same reason. Hence it is important that whatever the runway shape seems to suggest about the glideslope, technical sources of glideslope information are carefully monitored (whether PAPI, ILS glideslope etc.) even on a visual approach. These illusions are unlikely to cause consequences in isolation, but can contribute to a situation. As well as the sight of the runway, ground cues such as texture and horizon play an important role in maintaining the correct perception of the glideslope. The perceptual limitation inherent in judging approach path angle is particularly critical when there are no outside visual features other than the runway or helipad. Normally, when visual with a runway a pilot will also use ground cues some of which will become increasingly visible in their peripheral vision as they descend (such as ground texture). If these cues do not appear as normal, it can lead the pilot to unconsciously understand the reason for their absence as excess aircraft height. Hence in situations where there are no ground cues (such as night time approaches over desert or unlit water) the common and strong impression (perception) can be that the aircraft is high on the glideslope. This is dangerous because it leads the pilot to descend (i.e. depart from the glideslope). This specific illusion is often called the black-hole illusion, due to the apparent visual ‘black hole’ between the aircraft and the runway. It was a dark but clear night with no horizon and our destination, a lone platform, could be easily seen with some distance to go. I briefed the approach and we commenced the descent. During the descent I was aware that something was not right. I understood that given my altitude and range from the platform I was too low, yet visually the approach appeared to be steep. I was aware of the black hole approach illusion having briefed it many times during CRM training, yet I was unprepared for the strength of the illusion I was now encountering. My co-pilot had fortunately been vigilantly monitoring the situation and re-orientated me with a command to climb. CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 25 Height Visual height illusions can be potentially dangerous in visual flight regimes such as military low flying, helicopter operations or general aviation, but even occasionally in commercial airline operations. An illusion might be innocuous by itself, but if workload is high due to other tasks then such illusions can cause problems, particularly below a thousand feet. Numerous factors feed the visual perception of height, including: 1. The visibility of texture and detail that can be seen on the ground, and the size of known objects (i.e. houses and animals). 2. The relative speed of ground texture flow (the slower that the ground seems to be moving relative to the viewer, the further away it is perceived to be). 3. Perspective and shape, e.g. of buildings, mountains, runways etc. 4. Known landmarks, distances and angles. Miniaturised ground objects (miniature trees, small fields) can give the impression that the ground is further away than it is. Likewise, larger than expected objects can make the ground seem closer than it really is. The commander (PF) was carrying out some SAR training approaches to a mountain peak at night using night vision goggles. The summit was strewn with large boulders and with no other object for reference the commander perceived the boulders to be smaller than they were. Several approaches were made and on each occasion the commander went around believing he had become too low. Poor visibility can also make ground objects seem further away (removing the colour and clarity associated with close objects). Flying very slowly and/or into a strong headwind can contribute to a perception that the aircraft is higher than it is and this can be exacerbated with ground lights at night. Night also removes many cues, particularly ground detail. Changes in the spacing and brightness of ground lights can feed illusions (roads, houses, etc.). Featureless terrain, water and glare remove several cues to height. Loss of perceptual cues will put a slightly heavier burden on the pilot to pay attention to height. Speed Humans have evolved ways of perceiving the speed of their movement, but for obvious reasons humans have not evolved a perceptual process for airspeed. A major natural cue for perceiving the speed of one’s movement is texture flow, usually in peripheral vision. Other cues can also factor such as noise (volume and pitch change), perception of attitude (nose-low attitude can be mistaken for speed), buffeting and control response, and vestibular acceleration cues. Difference between speed and airspeed may be learned but even then, movement cues will feed airspeed perception. Aerobatic and post-stall accidents frequently occur when pilots apply too much back-pressure to the control column because the nose-down attitude gives the impression of sufficient airspeed before the CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 26 airspeed has built up in the dive, leading to a secondary stall or flick. This can be a fatal misperception of speed caused by use of an unreliable cue. Substituting ground speed cues for airspeed indications is common. A disproportionate number of accidents are caused after turning downwind during pylon racing (Eshelby 1996) almost certainly for this reason. Another example occurs where gliders stall and ‘flick’ while rotating into the climb during winch launching, usually resulting in serious (often fatal) accidents. A disproportionate number of such accidents happen in calm conditions. Because pilots factor natural cues into their airspeed perception during the moments of launch (texture flow, acceleration and time elapsed) their timing of the rotation is skewed by ground speed, not airspeed. Due to this, calm conditions can cause launches to err towards early and steep rotations and high angles of attack, occasionally just enough to stall a high performance glider (which account for most such accidents despite accounting for a fraction of such launches). Aerobatic and airshow pilots performing low rolls or other ‘airspeed-critical’ manoeuvres downwind are also vulnerable, as are general aviation aircraft after engine failure on climb out (i.e. turning back downwind for a landing). Although the message seems simple (“use the airspeed indicator”) in practice this may not be easy in certain situations because perception is powerful and not under conscious control. Late on in the approach my mind was focussed on the very short runway. Things seemed ok: the nose seemed higher than normal but there was no sensation of losing airspeed. I remember momentarily thinking that it must be to do with the airfield sloping (I had not landed here before). As I flared, the aircraft didn’t seem to respond at all and just fell onto the runway very heavily (fortunately without damage). I later realised that I had landed with at least 15 knots of tailwind, and had probably run out of airspeed by the flare. The tailwind must have given me the impression of speed and I had clearly not properly monitored the airspeed indicator. The above anecdote is a good example of the power of ground cues to feed perception, particularly when under high workload. This effect has contributed to many serious accidents. In 2008, an Extra 300 aerobatic aircraft transiting an air display was destroyed and its passenger seriously injured after worsening weather led the pilot to make an emergency landing in a field. The tailwind component was between 10 and 15 knots. The following section is from a UK AAIB report: In assessing speed at low level, pilots use a number of cues: primarily the airspeed indicator, but also the power setting and attitude, the feel of the controls and the impression of speed, sensed in the peripheral vision, by the rate at which the ground texture passes by. This last cue has been identified as being particularly powerful and difficult to ignore, and is known to have been a factor in the context of downwind landing accidents. It is possible that this impression of increasing ground speed as the aircraft turned downwind influenced the pilot inadvertently to allow the airspeed to reduce until the aircraft stalled, at which point there was insufficient height in which to recover control (AAIB 2009). CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 27 Attitude and Bank angle The inner ear has small receptors that pass information to the brain. Head orientation information is sensed using otoliths. These can be considered as little spirit levels (they have lots of little hairs with tiny weights on at the end, that bend whenever the head tilts). Head rotations (accelerations) are sensed in three dimensions by three semi-circular canals (fluid filled tubes in a circular shape). The perception of gravity can be masked (indeed replaced) by aircraft bank angle or acceleration. This means that a pilot can have a perception of being upright when they are banked, and vice-versa. This does not usually fool visual perception and it is therefore useful that visual perception is prioritised naturally; except when there are insufficient natural visual cues of the outside world. An additional limitation with the vestibular system is that it requires a threshold of acceleration or displacement in order to be perceived. Hence, if orientation changes slowly, that change may be invisible to the perceptual process. The classic problem is often called ‘the leans’ and occurs in IMC (or even on a dark night) as follows: a gradual increase in bank angle occurs unnoticed to the pilot. The pilot then notices the bank angle on the attitude indicator (e.g. artificial horizon) and rolls the aircraft back to level flight. The vestibular system only senses this second roll (returning the aircraft to level flight) but not the first roll that banked the aircraft gradually. The net vestibular perception therefore becomes that the aircraft is now banked, when it has in fact returned to level flight. This gives the pilot a feeling of being banked despite the attitude indicator showing proof that the wings are level. Because the attitude indicator is small (uses foveal vision) this illusion is not overcome by visual perception, and so the erroneous feeling of being banked remains. This is uncomfortable at best and dangerous at worst. If attention is distracted to a different task, then the pilot could unconsciously roll the aircraft without noticing in order to negate the uncomfortable sensation created by the feeling of being banked, and this might have consequences. Pilots must understand and accept that they must always control the bank angle of an aircraft with visual cues, whether external or internal (attitude director) and never use a sense of orientation. Another well-known issue is that the hairs in the otoliths will be bent backwards by forward acceleration in exactly the same way as they get bent backwards by gravity when the head is tilted back. Therefore pitching upward and accelerating forward generate the same cue to the perceptual process, and hence the same perception, unless another sensory cue is factored in. This is a good reason why the attitude indicator should be used to establish pitch angle after take off on a dark night, or indeed any time when there is a lack of valid external cues. Application to CRM – Perception It is reasonable to ask whether there is any value in teaching pilots about perception. CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 28 The CRM trainer should be careful if discussing vulnerabilities around perception in a general way. Although a valid thing to do, the trainer must not imply that because perceptions can occasionally be wrong or even dangerous, pilots should treat them all with caution. It is an illusion caused by the benefit of hindsight (called hindsight bias) to point to a single misperception and suggest that the pilot should have questioned it at the time. Additionally, we have no choice in the way we perceive things and no matter how much we stare at misperceptions they will not change (consider the optical illusion, it does not suddenly become a non-illusion once you know it is wrong). If audience members infer that they are being told to be cautious of perceptions in general then they will be justified in moaning that CRM and human factors training does not apply to the real world. Despite this there is value in teaching about perception and perceptual illusions: Firstly, as described in the previous section there are common perceptual illusions that apply to pilots. Knowledge of these can help to prepare for or avoid problems. Secondly (and less usefully) there may be some value in discussing what can happen (i.e. misperception) so that in rare cases individuals might consider a reappraisal or cross check if they are receiving contradictory information. However even this is subject to hindsight in the same way as before. In terms of classroom teaching, optical illusions provide an easy and fun way to support the theory around perception. Asking the key question as the illusion appears is a good way to do it; e.g. “which line looks longest here?” Usually the audience will know that they are seeing an illusion, and some will second-guess the answer. That is fine. The trainer can ask those people whether that is what they see or what they know / guess. The trainer can point out that s/he sees line A as longest, no matter how many times s/he shows the slide. The trainer must never show any hint of trying to fool the audience with the illusion, and no hint of superiority. The trainer must remember that they only know the key to the illusion because they have seen it before, not because of their expertise or qualifications. The simple objective is to show as clearly as possible that perception can occasionally be at odds with reality. For example the trainer can point out that: When we look at the Müller-Lyer illusion we ‘see’ two lines of different lengths, and yet we know rationally that the lines are the same length. Hence in that specifically engineered case, perception does not match reality. Additionally, it is worth showing that no matter how hard we stare at the illusion, we still cannot help but be ‘fooled’ by it. Perception cannot be ‘over-ruled’. This leads to the question of ‘why learn about it? So what?’ There are several good reasons. Firstly, in order that pilots can be more prepared to counter common illusions if they recognise their possibility in specific context (vestibular illusions during instrument flying are the classic example). Secondly, if pilots know the context then they can use different cues or consciously cross-check during a specific period (e.g. approaching a runway on a dark night with no ground features). CAP 737 Section A, Part 1, Chapter 2: Perception December 2016 Page 29 In terms of common illusions, it can help to ask the audience for examples that have occurred to them, or ask them to find the specific applications for certain common modes of illusions (e.g. convergence and perspective). Importantly, most teaching of common perceptual illusions should be put into definite and highly specific context, because it is the context that will trigger the recall of the illusion’s effects in the real world, not simply the knowledge of perception and illusions in general. Whereas we can work out the application of a real world illusion easily enough in hindsight, it is very difficult in foresight or at the time that it occurs. CAP 737 Section A, Part 1, Chapter 3: Attention December 2016 Page 30 SECTION A, PART 1, CHAPTER 3 Attention Knowledge To pay attention to something is to concentrate on it, whether that is a stimulus that has been sensed, a threat, a decision, a calculation, etc. Critically, attention is limited; if some attention is being used for one thing then it cannot be used for something else. A person can choose to pay their attention wherever they deem it necessary (the visual scene, a conversation, thoughts, actions, etc.). That does not mean attention is required to do everything; e.g. autonomous actions can continue without attention such as in driving. It is generally accepted that we can only fully concentrate on (pay attention to) one thing at a time. As well as voluntarily controlling what and where to pay attention, attention can also be diverted or captured (e.g. by a flashing light). Huge amounts of data hit the senses but only a small proportion ever catch attention and enter awareness. Therefore it must not be assumed that whenever something is sensed (e.g. seen by the eye) it has been noticed. A good example comes from excellent work of institutions such as the University of Illinois Visual Cognition Lab (such as the famous Gorilla in a Basketball game by Chabris and Simon). Sometimes things that would appear to be perfectly audible or visible do not catch our attention and do not receive any further processing. The brain only has the capacity to process a small amount of what is sensed, and it can be surprising what it can miss. A whole field of science is dedicated to how and why we become aware of some stimuli but not others. The traditional theory is that of a filter, which passively prevents all but the most important sensory information from getting through to the working memory. When stimuli cause attention to be drawn (get through the filter) it is called attentional ‘breakthrough’. Critical information such as an alarm should breakthrough but irrelevant background ‘clutter’ (noise) should not. The physical properties of stimuli are an important clue for the brain as to whether a stimulus should attract its attention; bigger, louder, brighter stimuli and those with relative movement stand out from the background and are more likely to breakthrough (draw attention / get through the filter). Occasionally however, particularly during very high workload, even a very salient stimulus will fail to ‘breakthrough’. For example, in many of the classic passenger evacuation trials by the late Professor Helen Muir, participants reported a lack of noise during the evacuation, when in fact there had been a tremendous din. Clearly the sound had vibrated participants’ eardrums, but their brains had not consciously registered the noise. This could have been a lack of memory encoding due to the stress of the situation, but it seems more likely that the noise was ‘filtered out’ or not attended to because there were more important things to pay attention to and so the noise did not get noticed. CAP 737 Section A, Part 1, Chapter 3: Attention December 2016 Page 31 Whereas physical properties can help attentional breakthrough, the ‘meaning’ of a stimulus can also help. The classic ‘cocktail party effect’ describes how, with many conversations occurring all around, one conversation can suddenly breakthrough to attention because a word or phrase was particularly interesting (the classic example is the person’s own name being said by someone else). This suggests that there is at least some pre-processing of stimuli prior to attention being drawn, even if it is not realised or remembered. Attention is aligned with capacity and resource because some difficult tasks need a lot of attention (sometimes too much) and there is only a limited supply. As such, attention is one of the most important hypothetical concepts when considering workload and multi- tasking. Application of knowledge - attention The sensory organs and their memory buffers (sensory memory) are not discerning; they will collect practically everything that they are able to physically sense. Hence much of the time pilots may not notice something when in fact they have physically sensed it. The general issue of ‘not noticing something’ is often cited as the cause of accidents; e.g. VFR mid-air collisions (ineffective lookout), low speed events (failure to monitor airspeed), automation related events (failed to notice the autopilot disengage, or failed to monitor mode annunciators), lateral disorientation accidents (failed to cross-check the navigation), configuration related events (failed to notice the flaps were not set), and many others. Although a simplistic and selective point, it is true in hindsight that had these critical parameters caught the pilots’ attention then the particular accident would have been prevented (albeit perhaps as a substitution for a different accident). Hence it is fair to ask why they did not get noticed. Eastern Flight 401 was perhaps the first documented major airline loss caused by a loss of automation mode awareness (1972). The autopilot changed mode (it stopped holding the altitude) but no one noticed. The audible chime did not ‘breakthrough’ the attention. There were no outside visual references because it was dark. The mode annunciators probably did not draw attention, and if they did their meaning was not perceived. Additionally all crew were involved in solving a problem, and so their attentional resources were utilised already (a CRM issue). Humans have a limited pool of attention from which to draw; we cannot notice or pay attention to everything. Activities such as problem solving or communicating mean that other factors can get neglected (like in Flight 401). A more recent alternative to filter theory is to metaphorically consider attention as a spotlight. If the spotlight is on one thing, then it cannot be on another. On many occasions, the need is greater than the resource available and so attention has to be carefully managed. For example, a manually flown final turn requires a pilot to share visual attention between at least three widely separated areas (the runway, the airspeed, and the attitude). This is an attentional compromise. Live flying experiments (using gliders) CAP 737 Section A, Part 1, Chapter 3: Attention December 2016 Page 32 show that pilots who pay less attention to attitude are more likely to over-use the rudder and fly skidding final turns (Jarvis and Harris 2007). However, correcting this by paying more attention to attitude risks misalignment of the final approach or mismanaged airspeed. Paying attention to one thing usually requires withdrawing attention from another thing, but without an obvious solution. Importantly therefore, trainers must avoid simply pointing out what a pilot was NOT doing enough of and suggesting they do more of it. Attention does not work like this. The trainer must consider why the attention was where it was, and what will happen if it is now artificially re-prioritised; has the trainer simply substituted one potential accident mode for another? The solution usually lies in better planning and managing of the workload (workload management) rather than simplistic feedback to pay more attention to something. Occasionally attention can be distracted from the primary task because of low workload, particularly when the distraction has emotional relevance or interest. This is especially possible when everything is going well, or as planned. Flying a visual approach to one of the thousand islands in the Med, I was fascinated by the perfect combination of blue sky, emerald sea and inviting landing strip glittering under the sun. I thought – “Why is everything is so right and perfect this morning?” Then the FO’s voice came – “What you are aiming at is the taxiway Captain” It was only then, I acknowledged the beauty of the runway as well.” [11] The discussion of attention theory is continued and expanded in the workload section. Application to CRM – attention Pilots will benefit from recognising that anyone can miss things, even when those things are very salient. They will feel more confident intervening when they think that a colleague has missed something if they know that (1) it is common to miss obvious things, and (2) the colleague also knows this to be true (perhaps because of the CRM training) and so knows that the intervention is nothing personal. It may also motivate crew to practice double-checking at specific important times, in the knowledge that they are also vulnerable. Many CRM courses have used movies such as Simon’s Basketball game (University of Illinois visual cognition lab) and other similar clips, in order to powerfully demonstrate this. This has been successful, and makes for a fun session. The CRM trainer should however follow through with an accurate explanation for their movie or game as well as to discuss application of this to flight operations, and suggestions of how and when such knowledge can help. Otherwise an important opportunity is missed. CAP 737 Section A, Part 1, Chapter 4: Vigilance and monitoring December 2016 Page 33 SECTION A, PART 1, CHAPTER 4 Vigilance and monitoring Knowledge Vigilance refers to sustaining attention on something so as to notice when a non-ordinary event happens (e.g. monitoring a radar screen in case of incoming threats). In practice, and in the context of flying an automated airliner, this activity is often referred to as monitoring. The term vigilance is usually used to refer to tasks where the object of interest is independent of the person monitoring it and this is an important area in the operational oversight of modern automated systems. Vigilance research has a long history. Researchers such as Norman Mackworth helped to firmly establish the concept of ‘performance decrement’ in valid vigilance tasks (see Mackworth, 1948). It was shown that vigilance performance dipped significantly within half an hour. It is now accepted that sustaining ones attention is difficult due to the way the attentional system works, and that performance will drop significantly over a short time. This drop is still known as the vigilance decrement. It is now agreed that most of it occurs within just 15 minutes of starting a vigilance task (Teichner, 1974) and can occur within a few minutes if the vigilance task is especially demanding. The traditional view was that vigilance tasks were very undemanding and so users became bored, and it was this ‘underload’ that caused attention to be withdrawn leading to the decrement. However modern science suggests that vigilance tasks create high workload, frustration, fatigue and stress (Warm JS, Parasuraman R, Matthews G, 2008). It is now widely hypothesised that attention is withdrawn from the task because of its unrewarding workload and perceived relevance. It has also been proposed that the performance decrement is due to fatigue. The relationship between fatigue and vigilance is not settled in science. It has been demonstrated that maintaining vigilance will add to fatigue and will be more difficult when fatigued. Fatigue and vigilance are nevertheless independent entities. To avoid participant confusion it is probably best that vigilance and fatigue are not discussed as if part of the same phenomenon in CRM training. It is better to teach vigilance primarily as part of attention, information processing, monitoring, situational awareness, workload or even automation. Fatigue impacts on most areas of human performance, and many factors increase fatigue. Vigilance does not appear to be a special case, although it may appear so to practitioners because it is very noticeable. There is no ‘silver bullet’ for improving vigilance. The human brain is not set up to monitor unchanging or non-signalling independent parameters for long periods. No matter how much good intention or motivation someone has, they will still be subject to vigilance decrement. CAP 737 Section A, Part 1, Chapter 4: Vigilance and monitoring December 2016 Page 34 Application of knowledge – vigilance and monitoring Every time I ignored some of the flight instruments and didn’t pay them the necessary timely attention, I learned a lesson. Looking at them again was like meeting one of those difficult people in life whose teachings you won’t forget. So do respect them and give them this so needed attention through good scanning. [11] It is arguable that ‘vigilance’ is the foundation of the modern pilot’s work, but equally it is easy to attribute ‘vigilance decrement’ whenever something goes unnoticed, or to attribute ‘complacency’. In modern automated aircraft, pilots are not expected to pay attention to a single specific item for an extended period of time, but to continually re-visit various parameters. Such checking may well decrease in frequency or attentiveness and although it is arguable whether this is the same thing as vigilance, there would appear to be read-across to vigilance research: Secondary checking increases workload and since it rarely leads to intervention or consequence (mainly due to technical reliability) it causes frustration and stress as described in vigilance research. It is clear that (in common with single primary vigilance tasks) withdrawal of attention from the vigilance task will lower workload. Because pilots must scan numerous sources of information it can be unrealistic after an event to suggest a pilot suffered a lack of vigilance; it is just as likely that their attention was elsewhere, particularly when a lot was happening. When workload becomes high on a primary task such as manual flying or emergency actions, attention narrows to that task, and so monitoring of other sources degrades. This is not an effect of vigilance or fatigue; it is a matter of cognitive workload. However, even when workload is low it is almost inevitable that high levels of vigilance are not maintained. Elements that are seemingly unchanging (reliably static), or have no direct feedback to the main task, or are rarely consequential, or are not easy to interpret, will often be dropped quickly. Unfortunately, modern automated flight decks contain a lot of information sources that fit these descriptions. Because of this it can be tempting for pilots to stop monitoring, or to be distracted from the monitoring task, particularly when the autopilot is engaged. The aircraft was in the cruise with the autopilot fully coupled when the commander (PM) became aware that the first officer (PF) was staring out of his side window and that something on the ground had drawn his attention. The commander decided to time how long it would take before the first officer’s attention returned to scanning the instruments. His attention was diverted for over three minutes. When pilots drop sources from their scan, they often do not remember dropping those unless a reason arises. However, occasionally a pilot makes an effort or recalls the readings, and in these cases they recall monitoring that source. Hence pilots can gain a false impression of their own ability to monitor (while noticing the lack of monitoring in others). CAP 737 Section A, Part 1, Chapter 4: Vigilance and monitoring December 2016 Page 35 The experienced training captain was becoming more and more passionate; “How many times do I have to tell these guys to monitor properly? They engage the autopilot and just stop monitoring! Perhaps they should all fly general aviation like I did, so that they learn not to be so complacent….” The training captain carried on while I wondered how to break the news to him that during the simulator experiment that he was now being debriefed about, he and his co pilot had missed the deliberately failed instrument that he was now referring to. It wasn’t that he or his pilots were complacent, it was that they were human. [5] Pilots of all levels of experience are susceptible to this monitoring degradation and the brain is very quick to determine what is and is not worthy of attention in a scan (a matter of minutes). It is generally recognised that closed loop monitoring tasks (such as control or tracking tasks) suffer far less from the effect of vigilance decrement. For example, when a pilot is flying an aircraft manually in IMC there is very little decrement in terms of vigilance towards the primary flight instruments. One hypothesis is that because the controlling task is more aligned with the brain’s normal functioning there is no build up of stress or frustration, and so no urge to reduce attention on task. The use of procedural memory for manual controlling means that this task does not generate the workload associated with maintaining attention on an open-loop area of interest. This statement might appear slightly unintuitive, but it is probable that the slight workload caused by the perceptual motor control (closed loop control) is less than that caused by having to direct attention to an open loop task that is causing strain and frustration. Application to CRM – vigilance and monitoring Can vigilance be taught? The bad news Unfortunately the research work in the area of vigilance is mainly descriptive (describing vigilance) rather than prescriptive. There is no evidence that the vigilance decrement can be permanently reduced by training or instruction. People do not become generally more vigilant just because they understand the vigilance decrement or feel more motivated to be vigilant. This is chiefly because the vigilance decrement is not under voluntary control and is not a factor of motivation. There is therefore no ‘easy win’ for the CRM trainer in this respect. Discussing the consequences and risks of the vigilance decrement will also have little direct effect, although it may provide some motivation to improve and cross-check. Accident reports, analyses and CRM courses sometimes imply or state that pilots must maintain constantly high levels of vigilance in order to avoid catastrophic consequences, and this also gets aligned with professionalism. However, whereas there is little doubt that greater crew vigilance would have prevented many accidents, such expectations are CAP 737 Section A, Part 1, Chapter 4: Vigilance and monitoring December 2016 Page 36 usually unrealistic because they take no account of the reasons behind the vigilant decrement. Of all people, the CRM trainer should account for human factors in any proposed solution that they recommend or imply. Vigilance (and automation) is one area where this does not always happen. The good news Learning about vigilance decrement could prepare a pilot to support their colleague, being more aware that a lack of vigilance is not something that only happens at night or when fatigued. They will then be less surprised and more confident to intervene if they recognise a lack of vigilance in a highly competent and fresh colleague. Additionally, the colleague will be more receptive and encouraging of the intervention if they understand the reality of the vigilance issue in themselves. A vigilance or monitoring session should do more than teach theory. It should attempt to engage the participants in thinking of ways to help avoid as much of the natural decrement as possible or mitigate its effects, including sharing tasks where necessary. However it is not for the CRM trainer to change policy, procedure or technical training issues, and so the CRM trainer should avoid directly instructing pilots how to monitor (or what to pay more attention to) unless it is done in line with flight operations / technical training. It is generally impractical to devise exercises that allow participants to experience and demonstrate vigilance decrement, due to the time required. However if time were available and an exercise was devised, then a competitive element could be introduced to show that despite motivation and effort, the vigilance decrement applies to all. An example session might have the following objectives: 1. Participants understand that all people are subject to vigilance decrement (especially themselves) a) Discuss background and theory to vigilance decrement b) Extract several examples from the class if possible 2. Participants state for themselves (through facilitation) specific areas of risk around vigilance decrements: a) What elements are vulnerable to decrement? b) When is the decrement more likely to happen and be hazardous? c) What increases decrement (fatigue, workload on another task, etc.)? 3. Participants own the problem and discuss solutions a) e.g. What can you do to add resilience? 4. Participants understand why people withdraw attention during vigilance tasks CAP 737 Section A, Part 1, Chapter 4: Vigilance and monitoring December 2016 Page 37 5. Participants have the opportunity to demonstrate and practice their understanding using case-studies An exercise that can assist the above objectives is:  Participants get into small groups (not absolutely necessary)  A flight phase is described.  They are asked to note the following:  What THREE specific pieces of information are the most important for a pilot to monitor in this phase (defined as specific informational elements, these would include airspeed tape, individual mode annunciator, altitude tape, radio altitude, attitude indicator, runway visual, etc)  What risk is associated with not monitoring each (of your three) effectively?  Rank those three by priority  How could you ensure the top ranked one was ALWAYS monitored? Then debrief the class, make a class ‘list’ on a flip chart, from their separate lists. Do all the groups agree? Why / why not? The idea is that the group accept the need to monitor carefully (and on particular items), consider the need to monitor certain elements, the risks associated with not doing so, and that it is not obvious what should be monitored (usually there is too much). A further debriefing question to the class could be “what problems did YOU have doing this exercise?” This question should elicit some responses that demonstrate that the participants have thought more deeply about the issues of monitoring and vigilance, for example:  How do you determine the ‘importance’ of something without hindsight?  Some elements need only be glanced at occasionally, whereas others should be scanned as often as possible.  Some elements are only important if they go wrong, others require active scanning (if controlling – e.g. manual flying).  It depends what is happening (is everything going ok?)  Notice the problem of NOT having hindsight to fall back on (i.e. the real world) All of these prompts and questions are designed to open discussion and facilitate a better understanding of the complexity of the issues and the need to consider the issue of monitoring in more detail. CAP 737 Section A, Part 1, Chapter 4: Vigilance and monitoring December 2016 Page 38 Categorising Vigilance The CRM trainer should treat vigilance as part of attention and cognition, not as part of fatigue. If vigilance is delivered as part of a fatigue lesson, then pilots could easily get the impression that feeling awake and fresh (fatigued) will make them vigilant. This is not true. Pilots should understand that vigilance decrement is a direct factor of the time and task, and whereas fatigue will make things worse it is not a necessary condition for the performance decrement. CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 39 SECTION A, PART 1, CHAPTER 5 Human error, skill, reliability, and error management Knowledge Skill acquisition Prior to discussing human error, it is important to consider some basic points about acquiring skills. A skilled task is always much more difficult to achieve when one first starts to learn it, but somehow with repeated practice the skill becomes very easy to do. This applies to complex skills even more than simple skills. The universal example is driving a car; at first it seems impossible to master all the concurrent tasks required and the workload appears impossible to cope with. However, after several years those same tasks generate such a low workload that the driver switches on the radio to relieve the boredom. Indeed the driver may find herself at a red light in neutral gear, having achieved all the tasks that she found impossibly difficult two years before, but without even noticing herself doing them. The common models of skill acquisition are continuums that describe this skill learning process. Perhaps the most well known is the Fitts & Posner three stage model (1967). This describes initial skill learning as the cognitive stage, that gives way to the associative stage, and finally the autonomous stage. These are not three completely separate and exclusive categories but just simply a way to describe a continuous process. Clearly the more complex the skill is, the longer the process takes, but it is surprising how the most seemingly impossible tasks can eventually become automatic for someone who practices enough (such as riding a unicycle while juggling clubs). Once a skill is autonomous then it requires little or no attention to carry out, and so the process of making repeated tasks into automatic routines is one of the human brain’s most important strategies of reducing workload on known tasks, in order to release attention for use on other tasks. This process does not just apply to motor skills, but many sets of procedures that are repeated reliably, arguably including decisions. Hence a new and novel problem requiring a decision will take a lot of effort and conscious thought, regardless how much of an expert someone is. Hence, an expert pilot faced with a completely novel problem is still effectively working at the cognitive stage of learning in terms of that particular situation. Later we will also call this ‘knowledge-based performance’. If, having thought the problem through, the pilot comes to the wrong conclusion, then they are said to have made a ‘knowledge-based mistake’ (as will be discussed in the following section). On the other hand, if the same pilot carelessly selects Flaps 20 instead of arming the speed brake then they have made a skill- based error (as will be described) because the error occurred during a fully learned skill CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 40 due to the automated processing (the autonomous phase of learning was reached long ago). Error types depend upon the processing that caused them, and the processing tends to depend on the stage of learning that the person is at in terms of the task being done (or the ease of the task, which amounts to the same thing). One can see instantly that experts are more vulnerable to certain errors than novices, and vice-versa, due to the processing of the task and therefore the stage on the learning continuum. A final point on skill learning is that it is generally understood that skills cannot be improved without practice of some kind. At the very least, it seems that repetition is required to form the autonomous routines, improve them and maintain them. Human Error It has long been accepted that errors are inevitable; even the Roman Philosopher Cicero stated: “It is the nature of man to err”. That does not mean that the frequency of error cannot be reduced or the effects cannot be avoided or mitigated. CRM has long been part of the drive to reduce errors and their consequences. Agreeing upon a definition of human error is problematic and surprisingly difficult. Some within academia argue that human error is a construction that only exists in hindsight. Although most people within industry do not share this view, the concept is instructive for those observing or analysing events. It can be very easy to pick out errors after an event, without noticing that the error was only identified by its consequences. This is fine, as long as it is appreciated that the flight crew who made the error did so without knowledge of those subsequent consequences. This sounds simple and obvious, but is challenging for the human to appreciate because once consequences occur the preceding events are then recalled as being more likely to have led to those consequences than they really were, or than they appeared to be at the time. James Reason defines error as follows: “A generic term to encompass all those occasions in which a planned sequence of mental or physical activities fails to achieve its intended outcome, and when these failures cannot be attributed to the intervention of some chance agency” (Reason 1990). This definition is reasonably workable for a practitioner. Outside academia most people understand error to be a general (fairly loose) term referring to when humans get something wrong, such as an incorrect action, a forgotten check or a bad decision. Error is not therefore a particular mechanism of creating unsafe events, but a term used to denote any human factors process going wrong and having consequences. It therefore spans across all other areas of human factors (information processing, decision making, situational awareness, etc.). There are also underlying conditions under which humans are more likely to make errors such as circadian lows, stress, high workload and fatigue). Dekker (2002) differentiates between two philosophies of human error, that he calls an old view and a new view. The old view is said to be where human error is seen as indicating a CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 41 human problem; meaning that an error is seen as having been caused by the human agent and it causes a problem to the safe running of the system (the ‘bad apple’ theory). In the modern view human error is seen as indicating a wider system problem and being a symptom of a non-ideal system. This so called ‘new view’ is a socio-technical approach whereby all elements of a system (design of interfaces, procedures, working practices and human vulnerabilities) are considered as being inextricably connected. Any ‘failure’ is therefore a failure of the whole system, and so the whole system requires looking at, not just the human agent who happened to make the error. Questions asked after a serious error would be ‘why did the system allow this error to occur? Why did the system cause this person to do what they did? Why did the system not block or mitigate the consequence of the error’. This is a challenging way of thinking about error not least because it can be misinterpreted as making excuses for negligent performance. Clearly it is reasonable to consider error in many ways, which may include aspects of both views. Certain errors may appear to some observers to fit one view better than the other. Alfonse Chapanis (1951) differentiated between two important patterns of error using a metaphor of two expended rifle targets (Figure 7). One marksman (target A) has achieved a high numerical score but most bullet holes are scattered widely and randomly within the central portion of the target. The other marksman (target B) has a low score but all the bullet holes form a tight cluster (group) just outside the central portion. Most people would recognise that the difference between the scores is down to the sighting of the rifle, not the accuracy of the shooting, and that the second marksman has better aim despite scoring lower. The off-centre error was produced by the rifle sight not by the person’s aim. This can be metaphorically considered a system issue (set aside the fact that the sighting is part of the skill when firing a rifle). Figure 7. The bullet holes are an excellent metaphor for error. Where lots of errors from different people are found in the same place within a system (i.e. lots of people are making identical errors) this is called ‘constant error’ and is almost always attributable to non-human CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 42 system elements (i.e. not the aiming of the rifle, but the sights). An adjustment within the system (setting the sights) is far more likely to eliminate the errors than trying to retrain each individual who makes them, or trying to change attitudes. This aligns easily with the ‘new view’ of human error. However, where errors are scattered around a system, much more diagnosis is required. It could be a common mode such as poor training, poor attitude or fatigue, but there could also be an element of individual human cause. It could equally be poor coding and identification of errors. However where the same individual continues to make the same mistakes, but others do not, then the solution should involve the individual. Application of the ‘old view’ to all circumstances is common but can be unsafe because even where constant human error is recognised it is not used to steer solutions in the right direction. Instead, the old view tends to look at individual humans within the system (e.g. the pilot, controller, engineer) and attempt to ‘fix’ them (through retraining or sanctions) or remove them. The opportunity for systematic remedial action is therefore lost, as the opportunity to learn the cause of the problem. Error types Firstly, errors are categorised within the umbrella term ‘unsafe acts’, which includes all errors but also other issues. An unsafe act is an action (or inaction) that leads to a safety issue. Whereas an unsafe act can happen by accident (error) it can also happen intentionally (violation). There are many ways to categorise unsafe acts, but the most widely used is Rasmussen’s SRK taxonomy (Rasmussen 1986) and an extension of it; Reason’s generic error modelling system (GEMS). Although it is usually unimportant for the CRM trainer to be able to label and categorise unsafe acts, they should know the basic categorises for use when reading accident and incident reports, and other literature. Unsafe acts are usually divided into three major types: errors (skill-based), mistakes (knowledge-based) and violations. The traditional way to understand this classification is to divide unsafe acts into those that are intended and those that are not. Skill based errors (called slips and lapses) are unintended actions or omissions, whereas mistakes and violations are intended acts or omissions, but mistaken. However perhaps a more useful method (loosely related to the framework) is to consider within which of the skill learning stages or which part of the information-processing system the unsafe act occurred. Skill-based errors If an unsafe act (including an omission) occurs as part of a learned skill or unconscious procedure then it is called a skill-based error. If this error occurred because the skilled action was inappropriate for the situation, this is called a slip (raising the flap lever while intending to have raised the gear lever). If on the other hand the error occurs because a skill or task step was omitted, or something was forgotten, this is a lapse (forgetting to raise the undercarriage). Lapses can be particularly insidious in aviation, due to the rule- based nature of many fundamental safety processes. The following extract shows how a CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 43 seemingly minor lapse can lead to a potentially fatal situation, with only a few chances to trap the error, and none to mitigate it: I push the Pitts round the outside loop. I glance in to check the top-height – 900 feet, which surprises me. 900 feet is on the low side of lovely, but high enough and better than I expected – so I keep pushing. Landscape scrolls up the windscreens and then the Leicester runway fills the gap between cowling and top wing, swelling rapidly. I push on, past the down-vertical, past the point-of-no-return… And then, and only then, I remember that the altimeter was set for Farnborough, not for Leicester. I was simply 230 feet lower than I thought I was. Man! The runway! Just PUSH… I recorded a negative figure on the G-meter which prompted a major inspection of the airframe, and caused the Pitts factory to state that this was so far outside normal parameters that they could not offer comment. It was my fault. I deliberately miss-set the altimeter in the first place, failed to rectify it during my precious pre-aerobatic briefing, then topped it off by failing to notice over two whole manoeuvres that things were going altogether too well for a heavy S2-A with the front screen on. Mea definitely culpa. They told me my fin missed the runway by ten feet that morning. The most impressive low-level push-out anyone had ever seen; well would have been... [6] Extract from ‘High Time’ (Lecomber 2013) with permission One also hears the terms ‘error of commission’ and ‘error of omission’, which are effectively the same as slip and lapse. People make skill-based errors all the time. For example taking the wrong turn on a car journey because that is the turning they usually take on most other journeys (this would be called a slip, because it is an error of ‘doing’ something). An example of a lapse would be that the driver forgot to post a letter on the way to work, because usually her journey passes the post box without stopping. This is called a lapse because it is an error of not doing something. One can see that the situational drivers to slips and lapses are similar even though the labels are different. Skill- based errors are related to attention because with little or no attention the error can occur. The reason that attention is not paid is not a matter of complacency; it is that the skilled routine does not require attention. Skill-based errors are usually more likely when there are subtle differences between two situations or actions that get confused. The term ‘habit capture’ is sometimes used to describe these sorts of skill-based errors. The anecdote below, from commercial rotary wing operation, is a good example. The standard departure required a climb to 3000ft, however, on this occasion the departure clearance was initially to not above 2000ft. Despite correctly acknowledging the clearance, the crew briefed and programmed the automation for a standard climb to 3000ft. Fortunately, as they approached 2000ft they were transferred to the departure controller and the error was corrected before a level bust occurred. CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 44 Knowledge based mistakes If an unsafe act happens as part of a ‘thinking’ task such as making a decision, then it is called a mistake (also called a knowledge-based mistake) or a violation. The action was carried out as intended (there was no slip or lapse) but it turned out to be wrong. Where a decision or action requires an effortful conscious (knowledge-based) thought process then it would normally have involved some aspect of novelty and therefore would be approached in a similar way to the cognitive stage of skill learning. Mistakes are unsafe acts where a person determines or decides their actions through thinking and carries them out correctly, but the actions do not have the desired consequences. In other words their actions were intentional but do not have the anticipated or hoped for effect. In the terminology of ‘human error’ all issues raised in part 1 of the decision-making chapter (Chapter 9, part 1) relate to knowledge based mistakes. The classic definition is that mistakes occur in the planning stage of an activity, such that the planned actions are correctly carried out, but the plan turns out to have been wrong. Violations It is worth looking at the difference between violations and mistakes or errors. Reason points out that violations differ from slips, lapses and mistakes because they are deliberate ‘illegal’ actions, i.e. somebody did something knowing it to be against the rules. There are some important points to recognise about violations in aviation work. Firstly, most violations are ‘well-intentioned’. The person carrying them out believes that they are necessary, or they are the best course of action. Secondly, violations are extremely common, and depending upon how the definition is applied, they are part of almost all tasks. Thirdly, most violations lead to positive or neutral results rather than adverse consequences. This is not to suggest that violations are good, but simply to state facts. There are many reasons that violations occur. The main one is that personnel consider them necessary to get the job done. Violations can be roughly split into two types: routine violations and exceptional violations. Routine Violations Sometimes, procedures do not account for the cumulative time required to follow them and so personnel find ways of doing the tasks more quickly. These routine violations therefore save time and lower temporal workload. The result could be safer working and fewer incidents. Clearly, when violations have evolved within such a system, it can be dangerous simply to remove them all without allowing more time for the same tasks, because the workload will increase markedly and unintended consequences will result. The solution is to understand the violations, and attempt to change practices and procedures in a way that addresses the sorts of issues that the routine violations have evolved in response to. In these cases, no amount of enforcement, training or re-education will result in a violation- free environment that is as effective or as safe as previously. Hence the CRM trainer themselves can have little impact upon these sorts of situations. Tackling routine violations CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 45 that have evolved in response to task demand involves much more consideration than simply telling people to stop violating. However, other routine violations occur when personnel do not understand, remember or agree with procedures. Again, these can quickly become part of normal working. These should be easier to resolve, by educating personnel in the reasons behind the procedures. Exceptional violations Some violations occur occasionally and have little precedent. These are known as exceptional violations. They are not necessarily extreme and most (not all) are intended for a good outcome. Whereas routine violations are normal ways of working, exceptional violations are acts that stand out as being different. They might be in response to unusual situations (where it is felt that SOPS are insufficient or not working), they might be an attempt to go beyond SOPs for even better performance (e.g. to catch up from a late departure), they might even stem from boredom (i.e. trying something different or being inquisitive) or rarely they may be deliberately harmful actions (sabotage). Sometimes a violation will precede an incident or accident. In most cases it is too easy for an investigator or trainer to focus on the violation as the main cause, and fail to see that similar violations occur all the time, and do not cause these sorts of events. The danger is that the solution put forward is ‘follow the procedure’. This is almost always too simple and the trainer should try to see past the violation in order to look at all the interaction of other accident factors as well, so as to understand the complexity. Error management A key concept associated with error management is that of “defences in depth”, based on the premise that there are many stages in any system where errors can occur, and similarly many stages where defences can be built to prevent and trap errors. Reason has highlighted the concept of ‘defences’ against human error within an organisation and has coined the notion of ‘defences in depth’. Examples of defences are pre-flight checks, automatic warnings, challenge-response procedures, etc. which help prevent and ‘trap’ human errors, reducing the likelihood of negative consequences. It is when these defences are weakened and breached that human errors can result in incidents or accidents. These defences have been portrayed diagrammatically, as several slices of Swiss cheese (and hence the model has become known as Professor Reason’s “Swiss cheese” model) (see Figure 8). CAP 737 Section A, Part 1, Chapter 5: Human error, skill, reliability, and error management December 2016 Page 46 Figure 8. Reason's Swiss Cheese Accident Metaphor Some failures are ‘latent’, meaning that they have been made at some point in the past and lay dormant. They may have been introduced at the time an aircraft was designed or may be associated with a management decision. Errors made by front line personnel such as flight crew are unsafe acts (‘active’ failures). The more holes in a system’s defences the more likely it is that errors result in incidents or accidents, but it is only in certain circumstances, when all holes ‘line up’, that these occur.