- ISSUE 2/2010
- Copyright and Credits
- Guest Editorial
- Feature: Deadly Omissions
- Flight Operations
- Maintenance and Certification
- Accident Synopses
- Recently Released TSB Reports
- Regulations and You
- Debrief: Stick to the Basics: Stable Approach and Sterile Cockpit
- Take Five: Underwater Egress
- Full HTML Version
- PDF Version
by Alan Dean and Shawn Pruchnicki. This article was originally published in the December 2008 issue of AeroSafety World magazine and is reprinted with the permission of the Flight Safety Foundation.
Human memory fails in predictable patterns that can be avoided by paying close attention to SOPs when distractions occur.
In August 1987, a McDonnell Douglas DC-9 flight crew taxiing to Runway 03C at Detroit Metropolitan Wayne County Airport (DTW) failed to conduct the taxi checklist. Consequently, the flaps were never set for takeoff, causing the lift-deficient aircraft to crash immediately after takeoff. As a result, 156 souls perished when the aerodynamically stalled aircraft crashed in a parking lot just off the end of the runway.
Nearly 21 years later, in January 2008, a Bombardier CRJ200 crew committed the identical checklist omission at another major U.S. Midwest airport. However, instead of the omission culminating in a fatal accident, a “config flaps” aural warning sounded, and the takeoff was safely aborted.
In the case of the DTW DC-9, the aural warning never sounded. And, although the reason for the failure of the warning system was never determined, it is important to understand that the system’s failure is the only variable that separates the DC-9 crash from the CRJ aborted takeoff. Aside from this single difference, these two events are human factors equivalents of identical twins.
Alarmingly, these types of events may be more common than realized. Preliminary investigation of the August 2008 Spanair McDonnell Douglas MD-82 take-off accident in Madrid, Spain, found that the aircraft’s flaps were in the retracted position. A recent study of the U.S. National Aeronautics and Space Administration’s Aviation Safety Reporting System database revealed numerous reports of airline crews failing to properly configure flaps for takeoff. Seeking to understand the human factors commonalities of these types of incidents, we assembled summaries of the DC-9 and CRJ events.
Boarding of the DC-9 had been delayed by weather for nearly one hour. After passengers were boarded, the before-starting-engines checklist was accomplished, and the aircraft departed from the gate. Ground control responded to the first officer’s (FO) taxi request with routing to a different runway than originally anticipated. The controller also advised the crew that the automatic terminal information service (ATIS) recording had been updated to include a warning that low-level wind shear advisories were in effect due to convective activity in the area.
As the captain (CA) initiated taxi, the FO obtained the new ATIS information and recalculated take-off performance numbers. While the FO was “head down,” visually focused inside the cockpit, the CA passed by an assigned taxiway. Ground control redirected them, and the taxi resumed with some miscellaneous conversation regarding the earlier weather delay. This delay was significant because the crew’s next flight was to an airport with an arrival curfew.
Seven minutes after leaving the gate, the DC-9 crew was cleared to taxi into position and hold on the runway. Although the CA failed to call for the before-takeoff checklist, the FO verbalized all associated items prior to receiving a take-off clearance. As the CA commenced the take-off roll, the FO was initially unable to engage the autothrottle system. This issue was resolved as the aircraft rapidly approached 100 kt. Next, the cockpit voice recorder (CVR) captured the FO verbalizing “V1,” then “rotate,” closely followed by the sounds of the stick shaker and subsequent ground impact.
The CRJ crew had completed the before-taxi checklist after passenger boarding and requested permission to taxi. As the CA called “flaps 20, taxi checklist,” he initiated a right turn as instructed by the controller, but quickly realized that this would send them in the wrong direction. Stopping the aircraft, he interrupted the FO’s checklist routine in order to seek clarification. Once that issue was resolved, they manoeuvred along a congested ramp toward their assigned runway. As soon as they reached the runway, the tower controller cleared the crew for immediate takeoff. The line-up checklist was called for, and the FO read it, concluding with “Take-off config okay…line-up check complete.” Aircraft control was then transferred to the FO, who began advancing the thrust levers. The “config flaps” aural warning immediately sounded, and at approximately 30 kt the CA aborted the takeoff.
From the narratives, it is apparent that both crews experienced external pressures to expedite their departures. For the delayed DC-9’s crew, it was an airport arrival curfew, while the CRJ crew felt rushed when they were cleared for immediate takeoff.
Both crews likewise encountered distractions as soon as they departed from their gates. For the DC-9 crew, as the taxi began, it became necessary to obtain updated ATIS information and confirm performance data for the unexpected runway change. The CRJ crew received erroneous taxi instructions, which needed clarification. It is important to note that both crews’ distractions came at the exact point when the flaps would normally be extended for takeoff according to the taxi checklist.
But to simply say these flights were plagued with errors resulting from rushing and distractions is too simplistic. Many more insidious threats were lurking on each flight deck; threats and human limitations which went untrapped—that is, undetected and unmanaged—ultimately causing both crews to skip entire checklists. Some of those threats included experience/repetition, memory problems, expectation bias and checklist discipline.
“Interruptions, distractions and deviations from standard operating procedures (SOPs) can break mental flow patterns, create false memories and even mask or eliminate initiating cues.”
Experience and repetition threats
So, how do experienced pilots omit entire checklists? Clearly, experience has many benefits, but experience can also undermine even the most seasoned experts when they are conducting repetitive tasks such as running a checklist. The first critical concept is that, as experience is gained, repetitious tasks such as conducting checklists become cognitively ingrained as simple flow patterns. Consequently, a pilot can automatically move from checklist item “A” to item “B” to item “C” with minimal mental engagement.
The second important concept is that each subsequent checklist item (A, B, C, etc.) is mentally cued to be accomplished by the perception that the preceding item has been completed.
And third, initiation of a repetitious task such as a checklist must be prompted by a cue. This initiating cue can come from a verbal command (“flaps 20, taxi checklist”), a condition (engine fire) or even an environmental indicator (proximity to the runway). And here is where the threat lies. Interruptions, distractions and deviations from standard operating procedures (SOPs) can break mental flow patterns, create false memories and even mask or eliminate initiating cues. As demonstrated by the flap-setting omission by both flight crews, the end result may be a significant failure that goes untrapped.
In the DC-9 and CRJ scenarios, each crew encountered immediate interruptions as they began to taxi. This is significant because taxi initiation and proximity to the gate are typical conditional and environmental cues prompting pilots to execute the taxi checklist. In effect, the interruptions of having to obtain ATIS information and clarify taxi instructions masked those cues, leading to omission of the checklist that called for flap extension. Then, as the aircraft continued toward their departure runways, the crews continued to move even farther away from the environment, which could have reminded them to perform the taxi checklist.
Furthermore, as each crew approached the runway, new cues were encountered prompting them to execute other checklists. For the CRJ crew, nearing the runway was an environmental cue to run the before-takeoff checklist. By now the crew was mentally so far from the earlier taxi check that there was little hope that the omitted checklist would be remembered.
There is another elusive human factors threat associated with repetitive tasks that can harmfully influence human memory. Specifically, when presented with cues that are frequently associated with conducting a particular task—such as entering the runway cues the line-up checklist—the brain can actually plant false memories of events that never occurred. This phenomenon is especially prevalent after interruptions.
“Another human weakness related to memory is that, generally, humans are not good at remembering to perform tasks that have been deferred for future execution.”
For example, it is highly likely the CRJ crew intended to perform the taxi checklist after sorting out their taxi instructions. In fact, the CA originally called for the checklist as the aircraft began to move. But then he immediately interrupted the FO from initiating the checklist to clarify the taxi routing. In interruption scenarios like this, the mind can create false memories based on previous experiences. So, later, when running the before-takeoff checklist, the errant crew may have falsely “remembered” completing the taxi checklist. That false memory was created out of the hundreds of other flights in which a checklist would have been completed at that point in the taxi.
This concept is known as source memory confusion. Humans are especially susceptible to source memory confusion when interrupted or rushed, variables that existed for both the CRJ and DC-9 crews.
Another human weakness related to memory is that, generally, humans are not good at remembering to perform tasks that have been deferred for future execution. Known as prospective memory failure, a deferred task is often forgotten until an overt indication—for example, a “config flaps” aural warning—alerts us to our omission. A simple example is when a controller requests a pilot to advise him when “proceeding direct” following a course deviation for weather. This deferred task often is forgotten until the pilot is queried by air traffic control, “Are you direct now?”
Obviously, both FOs made a decision to delay extending the flaps; clearly, the deferred task was not remembered. The CRJ crew received an overt indication of their omission when the “config flaps” aural warning sounded; the DC-9 crew was less fortunate.
Expectation bias threat
Another threat that lurked on both the CRJ and DC-9 flight decks is known as expectation bias. In simple terms, expectation bias is “seeing” what you expect to see even when it is not there. In the case of the CRJ departure, the final item on the line-up checklist is verifying that the “T/O CONFIG OK” advisory message is posted on the electronic display. Among other things, the message confirms that flap settings are appropriate for takeoff. Even though it was not posted, the FO revealed in a postincident debrief that he “thought” he saw the message.
Understanding such an aberration is difficult, but one explanation provides a plausible answer. Experience conditioned the FO because he always saw “T/O CONFIG OK” displayed when taking the active runway. With an established 100 percent success rate of always seeing the message, expectation bias may have led him to believe that it was present. Perhaps a casual glance at the electronic display was adequate for expectation bias to take place—the FO “saw” the message he was expecting to see.
Checklist discipline threat
Aircraft and procedures are designed with multiple layers of defences to prevent errors from developing into accidents. The DC-9 CVR recording concludes with the sound of the stick shaker, another layer of defence. Under normal circumstances, a crew receiving a stick-shaker warning would decrease pitch and increase thrust to rectify a slow-speed encounter. However, not realizing the aircraft’s insufficient lifting capabilities, the DC-9 CA increased the pitch angle, assuming the reason for the stick shaker was a wind shear encounter. His decision in a time-critical environment was not unfounded, as the ATIS noted that low-level wind shear advisories were in effect. However, post-accident investigation revealed no wind shear involvement.
So, although the aircraft’s stall warning system functioned properly, the captain’s misperception of a wind shear event negated the aircraft’s built-in defences. This outcome highlights the extreme importance of the layer of defence existing just prior to the aircraft’s defences—the human layer. It also exposes how human error and limitations can readily defeat multiple, robust layers of defence.
And, like aircraft defensive systems, human defensive systems function through sophisticated algorithms. On the flight deck, one of those algorithms is the checklist.
From the narrative, it is apparent that the DC-9 CA never requested the taxi or before-takeoff checklists in accordance with SOPs. By not following standard checklist protocols, the CA became reliant upon the FO to ensure that necessary procedures were accomplished. Because of this SOP deviation, it is conceivable that the FO was task-saturated, having to obtain the new ATIS information, confirm take-off data, perform his normal functions and anticipate checklists the CA failed to request.
Additionally, the CA’s reliance on the FO to conduct checklists on his own accord negates a critical two-pronged safety factor associated with checklist design. When correctly applied, the proper method is for a pilot to call for a checklist based upon the flight phase and which pilot is flying the aircraft. As a backup, if the designated pilot fails to call for a checklist, the other pilot should issue a challenge. By transferring checklist initiation to one pilot, that critical safety backup is nullified.
A CA can transfer responsibility for checklist initiation passively or actively. He or she can actively promote the transfer by telling the FO to “run the checklists at your leisure.” Alternatively, the CA can passively transfer checklist responsibility by allowing an overly assertive FO to simply run checklists without being commanded. Either way, the practice is not acceptable because it greatly undermines a critical layer of defence. Both pilots must retain their shared responsibility to ensure that checklists are completed.
Maintaining a “sterile cockpit” merits discussion here as well. The human brain has amazing capabilities. But, like a computer, each task accomplished and each variable assessed places cognitive demands on the brain. When these demands exceed an individual’s capacity, newly presented information may not be perceived or understood.
This situation is referred to as cognitive saturation and its occurrence prevents the accomplishment of further tasks. Even the act of ignoring nonpertinent conversation requires mental effort, which may compromise safety. For example, while listening to a CA speak about his weekend plans, an FO may fall victim to source memory confusion, causing him to incorrectly believe he’s completed a checklist.
Some argue that light conversation serves to facilitate crew bonding. While this is true, the timing of such conversation must respect cognitive limitations and the safety advantages of adhering to sterile-cockpit regulations.
These threats represent inherent weaknesses associated with the flight deck environment and the professionals who strive to perform flawlessly within it. Unfortunately, a minor slip or deviation from SOPs can put crew and passengers in harm’s way. Individually, some violations are seemingly inconsequential—an incomplete taxi briefing or a minor violation of the sterile cockpit rule. But when combined with other lost layers of protection, sometimes unknown to the crew, the margin of safety can rapidly erode, causing the flight to slip closer to an accident.
When presented with threats, professional pilots want to know how to counter them. The following mitigation strategies outline proven techniques to overcome normal human limitations that may erode safety margins:
Recognize that interruptions can alter human behaviour and seriously erode safety margins. Interruptions are threats and should be regarded as accident precursors. Treat any interruption with caution.
Overcome prospective memory failure by clearly informing your flying partner if interruptions or operational necessity dictate delaying a checklist. When doing so, also verbalize a specific plan detailing when the delayed task will be accomplished. This can enable the other crew member to confirm that the task will be performed.
Understand that memory is heavily influenced by cues. A memory aid recognized by both crew members can serve as a reminder to perform a delayed task.
If interrupted while performing a checklist, re-run the entire checklist. Doing so greatly reduces the probability of succumbing to source memory confusion.
To overcome expectation bias, use the say-look-touch confirmation technique. For example, when confirming proper flap settings while conducting a checklist, say what the setting should be, look at the flap position indicator and touch the flap handle. By incorporating multiple sensory inputs, a higher level of task attentiveness is achieved.
Slow down. Rushing is a primary initiator of human factors-related failures, including those associated with repetitive tasks.
- Checklists should be specifically called for by the appropriate pilot in accordance with SOPs. Doing so ensures that the check-and-balance philosophy built into them remains intact. It also enhances situational awareness, as both pilots can remain apprised of the aircraft’s status. Do not advocate the idea of executing checklists “at your leisure.”
Alan Dean is Chief of Safety for a large corporate aviation flight department. He also has extensive air carrier experience as an airline captain, line check airman and flight safety manager. For nearly a decade, Dean served as a flight safety investigator for the Air Line Pilots Association, International (ALPA).
Shawn Pruchnicki, a CRJ200 captain with Comair Airlines, is a former accident investigator and director of human factors for ALPA and has participated in numerous accident investigations. He teaches classes related to system safety, human factors and accident investigation at Ohio State University.
2. Dismukes, R.K.; Berman, A.B.; Loukopoulos, L.D. The Limits of Expertise. Aldershot, Hampshire, England : Ashgate Publishing.
3. Pruchnicki, S. “Raising Awareness for All.” Professional Pilot. Volume 42, no. 4 (2008) 72–74.