Performance as Approximation

This next case study illustrates how cognition is distributed across systems and how operations can progress despite the crew having significantly flawed awareness of the situation. Again, the case study is a two-crew operation, but I want to focus, initially, on aspects of the captain’s performance. On 8 August 2003, an ATR-42-300 en route from London Luton Airport to Galway, in the Irish Republic, experienced an in-flight shut down of the right-hand (RH) engine as a result of fuel exhaustion (AAIU, 2005). Fog, earlier in the day, had delayed the departure of the flight from Galway. As a result, the rostered crew could not complete the four planned sectors in the remaining duty time, and an intermediate landing was made in Dublin to change crews. Inbound to Dublin the aircraft left-hand (LH) fuel gauge malfunctioned and was reading empty, an intermittent snag that the aircraft had been carrying for several days. Given the delay and the fact that the operating crew were confident that the maintenance response would be no more than to sign off the defect without rectification, no technicians were called and the aircraft was handed over to the new crew. Having, himself, encountered the fuel gauge problem with this aircraft, the on-coming captain was comfortable with the situation but, nonetheless, he decided to refuel in Dublin. The 962 kg of fuel requested were not recorded in the technical logbook. The flights to Luton and then to Waterford were uneventful, and the pilots found that by recycling the fuel panel they could occasionally get the LH gauge to give a fairly accurate reading. Fuel was taken on at Waterford, the process being supervised by the captain. The penultimate sector was back to Luton where the captain, again, supervised the fuelling. A combination of factors resulted in the captain inadvertently diverting all of the fuel taken on at Luton into the LH fuel tank. The crew detected a lateral imbalance after take-off, and an attempt to rectify the problem was made by feeding both the engines from the LH tank for 15 minutes. At the same time, the RH fuel gauge showed an unexpectedly low value, eventually dropping to empty. This was dismissed as simply the RH gauge failing as the LH tank gauge had done. At 23:06,40 miles west of Dublin, the RH engine stopped, and a precautionary landing was made at Shannon. The crew later discovered that the RH engine had, in fact, flamed out because of fuel starvation. The RH tank was empty.

This brief description of events serves as an introduction to a very complex episode. Although fuel was taken on during the crew handover at Dublin, the quantity of fuel loaded was not recorded. The on-coming captain, therefore, started his duty without an accurate fuel state for the aircraft. Technically, this was not an issue until the aircraft completed its second scheduled sector and landed at Waterford. At this point, the aircraft needed to take on additional fuel to complete the remaining two sectors. The process of loading fuel is controlled through the electrical refuelling control panel (ERCP) located on the LH wheel fairing. The panel allows the operator to insert the desired final fuel total into a numerical totaliser selector. The ERCP will distribute fuel based on the quantity in each tank at the start of fuelling, as measured by the fuel gauge, and the planned total quantity required at the end of fuelling. Blue lamps on the ERCP indicate that the valve to the respective tank is open, and fuel is distributed in such a way that both tanks will contain equal quantities. A refuelling point is located on the underside of the port (left) wing.

Because the fuel uplift at Dublin had not been recorded and given the problems with the LH fuel gauge, the captain had probably estimated a sensible quantity to load rather than planned an accurate figure based on prior consumption and the fuel required to complete the task. He entered 500kg into the ERCP intending that to be the volume of fuel to be put into each tank (i.e. total uplift would be 1000kg). Instead, the ERCP, as we have just seen, was configured to put up to 250 kg into each tank (i.e. the starting quantity plus the additional fuel) resulting in a final on-board quantity of 500 kg. The system was, of course, dumb and did not ‘know’ the captain’s intentions.

During the fuelling process, the captain noticed that the RH valve light quickly went out, indicating that the valve had closed. This was because the total quantity in that tank had reached 250 kg (i.e. half the 500 kg planned quantity). The LH valve light was still illuminated. He tried to open the valve using the electrical override switch on the ERCP, but this did not work. The captain then showed the fuel truck operator how to open the valve using the manual trigger located by the fuelling point on the wing. The captain was able to observe that a blue valve light illuminated. This episode is significant. The fuel tank valves are controlled by the fuel tank gauges. The failed LH gauge meant that, as far as the automatic system was concerned, the tank was permanently empty. As a result, the tank valve would remain open with the valve lamp lit irrespective of the actual tank contents. The RH tank was functioning correctly and, so, when the captain tried to override the system with the valve switch, it did not operate. The system logic dictated that it should be closed, given that the RH tank contents were already at the planned value. A total of 600kg of fuel was uplifted, less than the planned total of 1000kg. Once refuelling was finished, the captain estimated the quantity in each tank by inspecting the drip sticks. The drip stick is an electro-mechanical device that gives a numerical value representing the quantity of fuel in each tank. This value is used to enter a table in the aircraft manual to derive the actual fuel quantity. The value has to be factored for lateral inclination (the extent to which one wing might be higher than the other on uneven ground) and to do this, the pilot has to take a further reading from an inclinometer installed on the aircraft. Poor maintenance of the device made it difficult to read, but the captain estimated that the LH tank contained 600 kg of fuel, and the RH tank contained 720kg. A post-flight reconstruction of the fuel consumption suggests that the actual contents were 618 and 689 kg.

If we deconstruct this episode, we see that the captain started from an uncertain position, not knowing the exact quantity of fuel on the aircraft after landing at Waterford. Given that the aircraft should have had a balanced fuel load on departure from Dublin and that the fuel consumed by the two engines en route was similar, the tank contents at this point should have been more or less equal. His attempts to manage the refuelling process represent a set of goal-directed behaviours. He directly intervened in his working environment, first, by inserting a value into the ERCP and, second, by directing the action of the refueller. These interventions shaped the expectations of future actions and both coalesce around the behaviour of the valve lamp on the ERCP. I will have to make an assumption, at this point, but I believe that the captain was expecting both the valve lights to extinguish almost simultaneously, which suggests that he was unaware of the effect of a failed gauge. The use of the drip sticks was a formal, procedural requirement but, nonetheless, was goal-directed, and its purpose was to confirm the current status of the fuel state of the aircraft. The output from this activity was an approximation of the actual state but one that was sufficiently plausible not to trigger any concern on the part of the captain.

The next sector was from Waterford to Luton where the aircraft was again refuelled. The captain assumed that the quantity of fuel in each tank was the same (325 kg), and he planned to uplift 960kg of fuel, sufficient for the final sector, with 480kg to go into in each tank. Again, he supervised the process but did not change the 500 kg previously set in the totaliser selector panel. At the start of refuelling, the LH lamp was illuminated, for the reason discussed earlier, but the RH lamp was extinguished because the actual tank already contained more than 250 kg (actually estimated to be 277 kg). By now, it was getting late, and the visibility was fading. Because of his earlier experience with the electronic valve switch at Waterford, the captain chose to not bother with the electronic override switch, instead of moving straight to the manual triggers. This episode illustrates how prior experience shapes the way we choose to engage with the w'orld: action is created afresh with each encounter with the world. He initially asked the fuel truck driver to operate the trigger, but this was declined because it was not something the driver had been trained or approved to do. The captain then climbed onto the refuelling vehicle platform and opened the valve himself. The triggers are not labelled but are simply located on either side of the refuelling point in relation to the tank they operate, orientated in relation to the nose of the aircraft. The captain operated the valve on his RH side. Facing aft and using his right hand, he inadvertently pulled the trigger for the LH valve, which was already open. As a result, the entire fuel uplift was directed to the LH tank. Again, the captain observed a blue valve light, but, at such a distance and in the fading light, he could not see which tank is related to. It was later estimated that the distribution of fuel on departure from Luton was 1166 kg in the LH tank and 277 kg in the RH tank. A set of steps was needed to reach the drip sticks but none were available at Luton. Because finding a set would only add to the already considerable delay, the captain did not bother checking the contents of the tanks before departure. The crew noted that the RH fuel gauge was now indicating less than they were expecting, but this was explained away as being a second gauge failure.

The FO was the handling pilot on the final sector from Luton to Waterford. Soon after rotation, she detected that the aircraft was out of lateral balance, feeling left- wing heavy. She commented on this to the captain who took the controls to check for himself. In fact, at take-off, the difference in contents between the two fuel tanks was 889 kg, 339 kg above the maximum permissible lateral imbalance. There were three aspects of the operational environment relevant at this stage. First, the imbalance was immediately noticeable through the controls. Second, the imbalance was within the command authority of the autopilot, possibly indicating that the problem was not excessive. Finally, a light on the overhead panel was indicating that the starboard spoiler was occasionally being deployed to counter the imbalance. In response to this fragmented repertoire of clues, the crew decided to run both the engines from the LH tank for 15 minutes to reduce the imbalance. About 30 minutes after take-off, the RH tank was indicating empty, and both the fuel low warning lights were illuminated. These warning lights are triggered by the relevant fuel gauge indication and are not linked to an independent measure of tank contents. Thus, presumably, the LH light had been illuminated for most of the flight. One hour and 21 minutes after leaving Luton, the RH engine stopped, and the crew diverted to Shannon.

The captain attributed the failure to an engine technical problem and chose to remain slightly high on final approach in case the LH engine also failed. Meanwhile, the FO was attempting to reconstruct the aircraft’s fuel state and concluded that the RH gauge was accurate and that, in fact, the tank was empty. Not even after it landed on one engine at Shannon did the captain believe that lack of fuel was the problem.