- Runway Safety and Incursion Prevention Panel
- Thoughts on the New View of Human Error Part III: “New View” Accounts of Human Error
- COPA Corner-Did You Really Get All Your ADs?
- Research Efforts on Survival Issues-Industry at Work
- Deviations-Standard Instrument Departures (SID)
In 2005, NAV CANADA invited stakeholders to form an independent working group to oversee runway incursion-prevention activities in Canada. This was as a result of the dissolution of a previous group known as the Incursion Prevention Action Team (IPAT), co-chaired by Transport Canada and NAV CANADA.
In the course of its life, IPAT was tasked with implementing recommendations contained in reports on runway incursions produced by both Transport Canada and NAV CANADA. Following the successful adoption of these recommendations, it was decided not to extend IPAT beyond its April 2005, expiry date. NAV CANADA identified a need to continue oversight of runway incursion-prevention activities, and this resulted in the formation of the Runway Safety and Incursion Prevention Panel (RSIPP).
Membership in this multi-disciplinary group will remain open, but is normally composed of one primary and one back-up representative from NAV CANADA, the Canadian Airports Council (CAC), the Canadian Owners and Pilots Association (COPA), the Air Line Pilots Association, International (ALPA), the Canadian Air Traffic Control Association (CATCA), the Air Traffic Specialist Association of Canada (ATSAC), and the Air Transport Association of Canada (ATAC). Additional members include other aviation stakeholders identified by the panel, and observers with a direct interest in runway safety, such as the Transport Canada Aerodrome and Air Navigation Branch, the Transportation Safety Board of Canada (TSB), and technical specialists from stakeholder organizations.
The panel’s mandate is to provide a forum for the exchange of safety-related information pertaining to the movement of aircraft and vehicles in the vicinity of the runway, with the aim of promoting runway safety and with a primary focus on the reduction in the risk of runway incursions.
The panel accepted the following International Civil Aviation Organization (ICAO) definition of runway incursion on April 27, 2006:
Any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle, or person on the protected area of a surface designated for the landing and take-off of aircraft.
This differs from the previous definition used by NAV CANADA, which defined a runway incursion as:
Any occurrence at an airport involving the unauthorized or unplanned presence of an aircraft, vehicle or person on the protected area of a surface designated for aircraft landings and departures.
Differences to note:
ICAO uses “aerodromes” rather than “ airports.”
ICAO uses “incorrect” rather than“unauthorized or unplanned.”
ICAO uses “landing and take-off of aircraft” rather than “aircraft landings and departures.”
It should be noted that NAV CANADA tracks runway incursion statistics only at aerodromes where NAV CANADA provides services.
RSIPP activities include:
a) Reviewing the current runway incursionprevention activities applicable to operations at Canadian aerodromes;
b) Reviewing international runway incursion-prevention activities with the objective of identifying and promoting proven best practices, where feasible;
c) Recommending methods for sharing safety information within the aviation community and suggesting runway incursion strategies/initiatives;
d) Sharing available runway incursion data to identify and analyze potential runway incursion safety issues or trends;
e) Making recommendations for runway safety and incursion-prevention to supporting agencies; and
f) Submitting an annual report that summarizes the findings, recommendations and accomplishments of the committee over the past year, for distribution to member organizations by panel members.
Runway incursion statistics
Runway incursions are classified as to the severity of the risk. Category A events are ones of extreme risk with instantaneous action required to avoid a collision. Very few runway incursions are Category A. In Category B incursions, there is a significant potential for collision. For example, action is required to prevent a vehicle entering a runway where an aircraft is cleared to land. Category C is similar to B, but there is ample time and distance to avoid a potential collision. Category D describes situations where there is little or no chance of collision. For example, this might be used to classify a situation where a vehicle proceeds onto a runway without permission, but there are no aircraft landing or taking off. Factors such as weather, speed of the involved aircraft, and time to take action are considered in a matrix in order to determine the risk. Chart 1 shows runway incursions in terms of the severity of the risk.
All Runway Incursions by Severity
Runway incursions are also considered in terms of the source of the deviation. The current groupings are air traffic services (ATS) deviations, pilot deviations and vehicle/pedestrian deviations. Different approaches must be used to reduce these various types of deviations. Chart 2 shows a comparison of pilot deviations between Canadian-registered aircraft and foreign-registered aircraft in 2005.
Pilot Deviation-Canadian-Registered Aircraft versus Foreign-Registered Aircraft
All incursions involving ATS deviations are systematically investigated by NAV CANADA. These investigations provide detailed information as to the contributing factors in terms of ATS and are used to prevent further incidents. In summary, the mandate of RSIPP is to provide a forum for the exchange of safety-related information pertaining to runway incursions, with the aim of promoting runway safety.
The following article is the third in a three-part series describing some aspects of the “new view” of human error. (Dekker, 2002)
This new view was introduced in issue 3/2006 of the Aviation Safety Letter (ASL) in an interview with Sidney Dekker.
The series presented the following topics:
Thoughts on the New View of Human Error Part I: Do Bad Apples Exist? (published in ASL 4/2006)
Thoughts on the New View of Human Error Part II: Hindsight Bias (published in ASL 1/2007)
Thoughts on the New View of Human Error Part III: “New View” Accounts of Human Error
“New View” Accounts of Human Error
The “old view” of human error has its roots in human nature and the culture of blame. We have an innate need to make sense of uncertainty, and find someone who is at fault. This need has its roots in humans needing to believe “that it can’t happen to me.” (Dekker, 2006)
The tenets of the “old view” include (Dekker, 2006):
- Human frailties lie behind the majority of remaining accidents. Human errors are the dominant cause of remaining trouble that hasn’t been engineered or organized away yet.
- Safety rules, prescriptive procedures and management policies are supposed to control this element of erratic human behaviour.
- However, this control is undercut by unreliable, unpredictable people who still don’t do what they are supposed to do.
- Some bad apples keep having negative attitudes toward safety, which adversely affects their behaviour. So not attending to safety is a personal problem; a motivational one; an issue of mere individual choice.
- The basically safe system, of multiple defences carefully constructed by the organization, is undermined by erratic people. All we need to do is protect it better from the bad apples.
What we have learned thus far though, is that the “old view” is deeply counterproductive. It has been tried for over two decades without noticeable effect (e.g. the Flight Safety Foundation [FSF] still identifies 80 percent of accidents as caused by human error); and it assumes the system is safe, and that by removing the bad apples, the system will continue to be safe. The basic attribution error is the psychological way of describing the “old view.” All humans have a tendency, when examining the behaviour of other people, to overestimate the degree to which their behaviour results from permanent characteristics, such as attitude or personality, and to underestimate the influence of the situation.
“Old view” explanations of accidents can include things like: somebody did not pay enough attention; if only somebody had recognized the significance of this indication, of that piece of data, then nothing would have happened; somebody should have put in a little more effort; somebody thought that making a shortcut on a safety rule was not such a big deal, and so on. These explanations conform to the view that human error is a cause of trouble in otherwise safe systems. In this case, you stop looking any further as soon as you have found a convenient “human error” to blame for the trouble. Such a conclusion and its implications are thought to get to the causes of system failure.
“Old view” investigations typically single out particularly ill-performing practitioners; find evidence of erratic, wrong or inappropriate behaviour; and bring to light people’s bad decisions, their inaccurate assessments, and their deviations from written guidance or procedures. They also often conclude how frontline operators failed to notice certain data, or did not adhere to procedures that appeared relevant only after the fact. If this is what they conclude, then it is logical to recommend the retraining of particular individuals, and the tightening of procedures or oversight.
Why is it so easy and comfortable to adopt the “old view”? First, it is cheap and easy. The “old view” believes failure is an aberration, a temporary hiccup in an otherwise smoothly-performing, safe operation. Nothing more fundamental, or more expensive, needs to be changed. Second, in the aftermath of failure, pressure can exist to save public image; to do something immediately to return the system to a safe state. Taking out defective practitioners is always a good start to recovering the perception of safety. It tells people that the mishap is not a systemic problem, but just a local glitch in an otherwise smooth operation. You are doing something; you are taking action. The fatal attribution error and the blame cycle are alive and well. Third, personal responsibility and the illusions of choice are two other reasons why it is easy to adopt this view. Practitioners in safety-critical systems usually assume great personal responsibility for the outcomes of their actions. Practitioners are trained and paid to carry this responsibility. But the flip side of taking this responsibility is the assumption that they have the authority, and the power, to match the responsibility. The assumption is that people can simply choose between making errors and not making them-independent of the world around them. In reality, people are not immune to pressures, and organizations would not want them to be. To err or not to err is not a choice. People’s work is subject to and constrained by multiple factors.
To actually make progress on safety, Dekker (2006) argues that you must realize that people come to work to do a good job. The system is not basically safe-people create safety during normal work in an imperfect system. This is the premise of the local rationality principle: people are doing reasonable things, given their point of view, focus of attention, knowledge of the situation, objectives, and the objectives of the larger organization in which they work. People in safety-critical jobs are generally motivated to stay alive and to keep their passengers and customers alive. They do not go out of their way to fly into mountainsides, to damage equipment, to install components backwards, and so on. In the end, what they are doing makes sense to them at that time. It has to make sense; otherwise, they would not be doing it. So, if you want to understand human error, your job is to understand why it made sense to them, because if it made sense to them, it may well make sense to others, which means that the problem may show up again and again. If you want to understand human error, you have to assume that people were doing reasonable things, given the complexities, dilemmas, tradeoffs and uncertainty that surrounded them. Just finding and highlighting people’s mistakes explains nothing. Saying what people did not do, or what they should have done, does not explain why they did what they did.
The “new view” of human error was born out of recent insights in the field of human factors, specifically the study of human performance in complex systems and normal work. What is striking about many mishaps is that people were doing exactly the sorts of things they would usually be doing-the things that usually lead to success and safety. People were doing what made sense, given the situational indications, operational pressures, and organizational norms existing at the time. Accidents are seldom preceded by bizarre behaviour.
To adopt the “new view,” you must acknowledge that failures are baked into the very nature of your work and organization; that they are symptoms of deeper trouble or by-products of systemic brittleness in the way you do your business. (Dekker, 2006) It means having to acknowledge that mishaps are the result of everyday influences on everyday decision making, not isolated cases of erratic individuals behaving unrepresentatively. (Dekker, 2006) It means having to find out why what people did back there actually made sense, given the organization and operation that surrounded them. (Dekker, 2006)
The tenets of the “new view” include (Dekker, 2006):
- Systems are not basically safe. People in them have to create safety by tying together the patchwork of technologies, adapting under pressure, and acting under uncertainty.
- Safety is never the only goal in systems that people operate. Multiple interacting pressures and goals are always at work. There are economic pressures, and pressures that have to do with schedules, competition, customer service, and public image.
- Trade-offs between safety and other goals often have to be made with uncertainty and ambiguity. Goals, other than safety, are easy to measure. However, how much people borrow from safety to achieve those goals is very difficult to measure.
- Trade-offs between safety and other goals enter, recognizably or not, into thousands of little and larger decisions and considerations that practitioners make every day. These trades-offs are made with uncertainty, and often under time pressure.
The “new view” does not claim that people are perfect, that goals are always met, that situations are always assessed correctly, etc. In the face of failure, the “new view” differs from the “old view” in that it does not judge people for failing; it goes beyond saying what people should have noticed or could have done. Instead, the “new view” seeks to explain “why.” It wants to understand why people made the assessments or decisions they made-why these assessments or decisions would have made sense from their point of view, inside the situation. When you see people’s situation from the inside, as much like these people did themselves as you can reconstruct, you may begin to see that they were trying to make the best of their circumstances, under the uncertainty and ambiguity surrounding them. When viewed from inside the situation, their behaviour probably made sense-it was systematically connected to features of the their tools, tasks, and environment.
“New view” explanations of accidents can include things like: why did it make sense to the mechanic to install the flight controls as he did? What goals was the pilot considering when he landed in an unstable configuration? Why did it make sense for that baggage handler to load the aircraft from that location? Systems are not basically safe. People create safety while negotiating multiple system goals. Human errors do not come unexpectedly. They are the other side of human expertise-the human ability to conduct these negotiations while faced with ambiguous evidence and uncertain outcomes.
“New view” explanations of accidents tend to have the following characteristics:
- Overall goal: In “new view” accounts, the goal of the investigation and accompanying report is clearly stated at the very beginning of each report: to learn.
- Language used: In “new view” accounts, contextual language is used to explain the actions, situations, context and circumstances. Judgment of these actions, situations, and circumstances is not present. Describing the context, the situation surrounding the human actions is critical to understanding why those human actions made sense at the time.
- Hindsight bias control employed: The “new view” approach demands that hindsight bias be controlled to ensure investigators understand and reconstruct why things made sense at the time to the operational personnel experiencing the situation, rather than saying what they should have done or could have done.
- Depth of system issues explored: “New view” accounts are complete descriptions of the accidents from the one or two human operators whose actions directly related to the harm, including the contextual situation and circumstances surrounding their actions and decisions. The goal of “new view” investigations is to reform the situation and learn; the circumstances are investigated to the level of detail necessary to change the system for the better.
- Amount of data collected and analyzed: “New view” accounts often contain significant amounts of data and analysis. All sources of data necessary to explain the conclusions are to be included in the accounts, along with supporting evidence. In addition,“new view” accounts often contain photos, court statements, and extensive background about the technical and organizational factors involved in the accidents. “New view” accounts are typically long and detailed because this level of analysis and detail is necessary to reconstruct the actions, situations, context and circumstances.
- Length and development of arguments (“leave a trace”): “New view” accounts typically leave a trace throughout the report from data (sequence of events), analysis, findings, conclusion and recommendations/corrective actions. As a reader of a “new view” account, it is possible to follow from the contextual descriptions to the descriptions of why events and actions made sense to the people at the time, to in some cases, conceptual explanations. By clearly outlining the data, the analysis, and the conclusions, the reader is made fully aware of how the investigator drew their conclusions.
“New view” investigations are driven by one unifying principle: human errors are symptoms of deeper trouble. This means a human error is a starting point in an investigation. If you want to learn from failures, you must look at human errors as:
- A window on a problem that every practitioner in the system might have;
- A marker in the system’s everyday behaviour; and
- An opportunity to learn more about organizational, operational and technological features that create error potential.
Dekker, S., The Field Guide to Understanding Human Error, Ashgate, England, 2006.
Every year, as part of the preparation for an aircraft’s annual inspection, most diligent owners of certified aircraft will go to the Transport Canada (TC) Web site and search for the airworthiness directives (AD) that are applicable to their aircraft.
This is accomplished by clicking on “Airworthiness Directives” on TC’s Continuing Airworthiness Web Information System (CAWIS) Web site, www.tc.gc.ca/aviation/applications/cawis-swimn/, entering the aircraft’s registration into the search box, and then checking the AD list that the CAWIS system produces. Some ADs that come up will be old, nonrepetitive ones that are already signed off, and others will be repetitive ones that need doing on a regular basis. The list also has to be checked for applicability, as not all ADs will apply to your individual aircraft serial number, but pretty quickly you can pare the list down to those that need doing.
Field maintenance on a Cessna 172
So, if you do that search by aircraft registration, you should get all the ADs for your aircraft, right? Wrong!
The list that you just searched will give you all applicable ADs for your airframe, engine and propeller. It does not give you the ADs that are applicable to anything else, such as carburetors, seat belts or any after-market supplemental type certificate (STC) installed equipment, such as autopilots, doors or wing-tip fairings. Those items are contained in a separate miscellaneous equipment AD list. Because TC has no way of knowing which accessories are installed on your aircraft, you have to check this list to see which ones are applicable.
As of October 2006, there were 551 ADs on that list! Many are items like escape slides for airliners, but some are definitely equipment that could be found on small aircraft.
A good example is AD 96-12-22. This is a repetitive AD on Cessna engine oil filter adapters assemblies. These are commonly installed on any brand of aircraft (not just Cessnas) equipped with a Teledyne Continental Motors aircraft engine, including O-200, O-470, IO-470, TSIO-470, O-520, IO-520, TSIO-520, GTSIO-520, IO-550, TSIO-550 powerplants. It requires an inspection with the first 100 hr time-in-service and then every time the engine oil filter is removed. You won’t find this AD without checking the miscellaneous equipment AD list.
Setting valve clearances
As well as doing a search by the aircraft registration, aircraft owners need to check the miscellaneous equipment AD list to make sure no ADs are missed. The miscellaneous equipment AD list on the TC CAWIS system can only be found by clicking on “Advanced Search” and then “All ADs” beside “List Miscellaneous Equipment ADs.” You can find out more about COPA at http://www.copanational.org/.
The Survival and Flight Equipment (SAFE) Association is a non-profit, professional association, dedicated to the preservation of human life, and in particular, increasing survivability of those faced with the dangers associated with all aspects of recreational, commercial and military aviation.
Founded in 1956 as the Space and Flight Equipment Association, the name was changed to the Survival and Flight Equipment Association in 1969, to better reflect the immerging group of core members. Any ambiguity was dropped in 1976 when the name was finally changed to the SAFE Association. SAFE is headquartered in Oregon, but boasts an international group of members and maintains chapters through the world, most notably, regional chapters in the United States, SAFE Europe and, of course, the Canadian chapter of SAFE.
SAFE provides a common meeting ground for the sharing of problems, ideas and information. The Association’s members represent the fields of engineering, psychology, medicine, physiology, management, education, industrial safety, survival training, fire and rescue, human factors, equipment design, and the many sub-fields associated with the design and operation of aircraft, automobiles, buses, trucks, trains, spacecraft and watercraft. Individual and corporate members include equipment manufacturers, college professors, students, airline employees, government officials, aviators and military life support specialists. This broad representation provides a unique meeting ground for basic and applied scientists, the design engineer, the government representative, the training specialist and the ultimate user/operator to discuss and solve problems in safety and survival.
SAFE’s regional chapters sponsor meetings and workshops that provide an exchange of ideas, information on members’ activities and presentations of new equipment and procedures encompassing governmental, private and commercial application in the field of safety and survival.
From August 29–30, 2006 the Canadian and U.S. East Coast chapters of SAFE hosted a joint meeting in Ottawa, Ont., to further promote the exchange of ideas between North American members. Government and industry experts briefed current programs, such as the ejection seat upgrade for the CF-18 Hornet. Aviation life support equipment and pilot flight equipment is also undergoing redesign and integration qualification to provide Canadian aircrew with state-of-the-art technology.
SAFE culminates each year’s activities with the annual SAFE Symposium, which was held in Reno, Nev., the week of October 23, 2006. The Symposium is attended by an international group of professionals who share problems and solutions in the field of safety and survival. Presentation topics ranged from cockpit design, restraint systems and injury reduction, on-board oxygen generation systems (OBOGS), improved personal protective equipment concepts, to the latest aircraft passenger egress aids, safety and crew training.
The proceedings of the Annual Symposium and other publications, such as journals and newsletters, are valuable reference sources for the professional involved in the fields of aviation safety and survival. For more information about the activities of the SAFE Association and regional and international chapters, please go to http://www.safeassociation.com/.
Many of our busier airports have published SIDs. Air traffic controllers issue these SIDs to pilots operating on IFR flight plans to ensure that there is IFR separation between the departing aircraft and other IFR flights. The use of SIDs allows pilots to know the departure routing in advance and reduces voice communication.
A review of incident reports has revealed an increase in SID deviations this year as compared to the average over the past three years. In many cases, pilots read back the SID as issued, but did not comply with the published SID and followed a different route. In most of these cases, there was a heading deviation, but there were also altitude busts. These all resulted in an actual or potential loss of IFR separation, which could lead to a collision. Most SIDs are radar vector procedures that require further air traffic control action to get the departing aircraft to the flight-planned route. In the future, there will be more Pilot Navigation (Pilot Nav) SIDs that provide the most efficient path from the runway to the en-route structure.
Pilots are reminded to review each SID issued and to follow the procedure as published. If there are any questions, please ask for clarification.
The Transport Canada Aeronautical Information Manual (TC AIM) section on SIDs is being re-written to make it very clear as to what is expected of a pilot receiving a SID clearance. As well, contact is being made with specific companies that have a high proportion of deviations, to share these findings with them.
Forest fire season is once again upon us, and each year there are aircraft violating the airspace in and around forest fires. This includes private, commercial and military aircraft. Section 601.15 of the Canadian Aviation Regulations (CARs) provides that no unauthorized person shall operate an aircraft over a forest fire area, or over any area that is located within 5 NM of one, at an altitude of less than 3 000 ft AGL. Refer to the “Take Five” originally published in ASL3/99, which can also be found at http://www.tc.gc.ca/eng/civilaviation/publications/tp185-3-99-t5_forestfire-3886.htm.
Birdstrikes don’t matter? Think again!
- Date modified: