F ACTORS A FFECTING 2
2.4 Classical Performance Models in Aviation
4 8 COGNITIVE ENGINEERING AND SAFETY ORGANIZATION
FACTORS AFFECTING ATM PERFORMANCE 4 9
• D Diagnose the problem :What is the problem?
• O Organize options :What are the options available?
• D Decide what to do :What are we going to do?
• A Allocate tasks :Who does what?
• R Review the situation : What has happened and how will we continue?
Other airlines use similar mnemonics to support decision-making in abnormal situations. For example, some airlines have adopted the acronym FOR-DEC (Hormann 1995):
• F Facts :What are the facts?
• O Options :What are the options?
• R Risk and Benefits : What are the risks/benefits for each option?
• D Decision :What will be the decision?
• E Execution :How can it be executed?
• C Check : What has happened and how will we continue?
DODAR and FOR-DEC are two simple decision-making models that follow the same principle of providing flight crews with a simple linear process of steps for making decisions in normal and abnormal situations.
2.4.2 Navigate
In an emergency, the second element of the aviation axiom corre-sponds to answering the question “where to go next?” In this stage, flight crews decide whether to continue the flight to its original des-tination or initiate a diversion to a suitable airport. This decision depends on several factors, such as the following:
• Nature of emergency: This may become the most critical fac-tor in the selection of a diversion airport. In a cabin fire, for instance, the crew may be compelled to land as soon as possible at the nearest airport, regardless of any other considerations.
• Functionality status of the aircraft systems: In general, the more critical the systems that fail, the more critical the emergency is. Sometimes, a seemingly innocent failure may result in a
5 0 COGNITIVE ENGINEERING AND SAFETY ORGANIZATION
serious emergency due to high coupling, mode proliferation, lack of redundancy, and high complexity.
• Length of runway: All flight crews would prefer a long run-way and, occasionally, this may be the overriding factor. For instance, in the case of a failure that prevents the flaps to be fully deployed during landing, the length of the runway is the main consideration.
• Airport distance and bearing from present position: Normally, flight crews would prefer airports that are close to their posi-tion and in their front quarter in order to avoid long turns.
• Airport navaids availability: In IMC conditions, an airport equipped with a precision approach navaid with vertical and lateral guidance is preferable to an ill-equipped airport.
• Familiarity with airport: Flight crews prefer airports that they have visited before and know their instrument approach pro-cedures, runway orientation, and surrounding terrain.
The time frame for making critical decisions may be restricted and sensitive to earlier assessments of the emergency. In many cases, deci-sions may involve extensive coordination with many other agents such as airline dispatchers and maintenance personnel.
2.4.3 Communicate
Finally, flight crews are expected to communicate the nature of an abnormal situation to all relevant agents and inform them of their intentions. In general, flight crews are expected to use the following mnemonic in their communications:
• N :Nature of the emergency
• I :Intentions of the crew
• T :Time available
• S :Supplementary information
Furthermore, flight crews can use one of the two classes of emer-gency messages that are defined in ANNEX 2: Rules of the Air (ICAO 2005a):
• Distress: When the crew and the passengers are threatened by grave and imminent danger that requires immediate assistance.
FACTORS AFFECTING ATM PERFORMANCE 51
• Urgency: When the safety of an aircraft or a person on board is at stake but it does not require immediate assistance.
It is not certain that flight crews will provide adequate informa-tion to controllers regarding the situainforma-tion they encounter. A crew may elect not to declare an emergency but instead request a certain amount of time to react (e.g., enter a holding pattern to carry out diagno-sis, or assess and stabilize the situation). The controller then faces a dilemma whether to carry out appropriate actions or not. In most cases, the controller can perform a minimal set of actions in anticipa-tion of a possible escalaanticipa-tion of the problem without informing the crew. For instance, the controller may inform the watch supervisor, estimate distances and bearings to the nearest airport, and coordinate with adjacent units with regard to the possibility of a route diversion.
During this period, the flight crew may continue to assess the situa-tion and carry out the appropriate checklists.
Rote following of aviation checklists cannot always guaran-tee success in handling an abnormal situation as indicated in the Swissair flight 111 incident (TSB 2003). The aircraft crashed in the sea of Canada after experiencing a rapidly spreading fire on board that quickly disabled all main systems. The crew chose to complete all checklists and delayed to proceed directly for landing. The cap-tain was an instructor, one of the most experienced flight crews of Swissair, who practiced the smoke in cockpit routine many times as an emergency drill in simulator training. The Swissair 111 crew won-dered whether the odd smell and the small cloud in the cockpit was an indication of fire or an innocent output from the air condition-ing system. As found later in the report, neither the Swissair nor the aircraft’s manufacturer checklist for “smoke/fumes of unknown ori-gin” required crews to start immediate preparations for landing. The option to consider emergency landing was addressed at the end of the checklist, which underplayed the risk that an unknown smoke condition in the cockpit could rapidly get worse (TSB 2003). The fire spread rapidly, leaving the crew with no options for a safe handling of the situation.
This particular accident triggered a considerable debate about the issue of rote following of checklists in managing flight emergencies.
Dekker (2003, 2005) argued that the flight crew of Swissair 111 faced a double-bind. People could be blamed for lack of flexibility in
5 2 COGNITIVE ENGINEERING AND SAFETY ORGANIZATION
applying procedures without any sensitivity to the context of events but they also might be blamed for violating procedures if earlier efforts to adapt have been unsuccessful. The actions in the checklist of the Swissair 111 crew could not deal with a rapid spreading of fire. On the other hand, the crew had no clear cues that they were facing a novel fire situation and no indication that the checklists did not account for this type of event. Cases where crews face complicated situations that are only partially covered in the procedures are becoming increasingly common in aviation in recent years.
2.5 Classical Performance Models in ATC