Human Factors and Safety Management Systems
Relevance of Human Performance and Safety Management Systems
The subject of human performance and error, and its subsequent evaluation post-aircraft accidents, will be discussed here in detail. Included is a background in factors that contribute towards mistakes, and how employees in the aviation sector have made errors. The three basic Human Factors (HF) models are presented, including their usage and limitations, and why Human Performance became an important discipline. This includes the effects on human physiology that have contributed to accidents or significant events.
In addition to understanding the importance of HF and Human Performance, it is important to include the principles of Safety Management Systems (SMS) that are mandated in the aviation sector, including their limitations. While the SMS is not a perfect system to prevent accidents, it is a useful tool or process in mitigating events.
The principal purpose of having an awareness of HF is to understand the industries' wants and needs in regards to learning from their past experiences. As history has demonstrated, aircraft have crashed and lives have been lost. The desire to prevent a similarly tragic outcome has always been the driving force for improvement. Within airline companies, the emphasis is equally placed on their own bespoke SMS, which supports staff in performing the job correctly the first time, every time. Naturally, this in turn provides a significant financial advantage to the operator.
References to accident events are based on the open-source accident reports that are freely available to review.
British European Airways Accident – A Turning Point
On 18 June 1972, an aircraft crashed close to Heathrow Airport, killing all occupants. This event would go on to change the way accidents would be evaluated. The fateful flight was a British European Airways (BEA) Hawker Siddeley Trident aircraft, bound for Brussels. It crashed very soon after takeoff, claiming the lives of all 118 passengers and crew (see Figure 6.1). The aircraft crashed at 1610 hrs (British Summer Time) some 133 seconds after the take-off roll began, crashing into the suburbs of Staines town, now known as Staines-upon-Thames, to the west of London, UK. All occupants succumbed to massive trauma upon an impact caused by a deep stall. The aircraft, having gone into superstall, reached significant vertical speed and 'pancaked' on impact.
This event has become a standard training scenario, known in the Aviation Industry as the Staines crash. An analysis of the crash, and the events leading up to it, explains how tragedies such as this one can be prevented. While this section is not a full precis of the (Air) Accident Investigation Board (AIB in 1970s, AAIB in later years) report, some of the causal factors are explained and considered in a modern context, including the emergence of an error model.
At the time of the event, there was a significant ongoing trade union dispute between the British Airline Pilot Association (BALPA) and BEA, with
FIGURE 6.1
Hawker Siddeley Trident aircraft in BEA livery at London Heathrow Airport. (Malcom Taylor.) the threat of strike action. It is helpful to consider the career backgrounds of the typical pilots that flew commercial aircraft at the time. The older, more experienced pilots had typically served in the military for considerable periods of time before transitioning to the commercial market. Many of these ex-military pilots had seen combat action in the various events between the 1940's and 1970s, and thus had a disciplined military thinking and attitude based on their personal military service experiences.
The younger generation of pilots entered the aviation sector having gained their private pilot's license flying in small 2 to 4 seat piston-engine aircraft. They transitioned to twin piston engine aircraft with 4 to 6 seats, built their flight experience with small aircraft before being recruited by airlines and gaining commercial experience. Naturally, the attitudes, beliefs and methodologies of the younger flight crew differed to the older, more military- focused ex-forces pilots. At the time of the Staines crash, the younger pilots were more aware of the possibility of potential strike action that was being threatened by BALPA in a dispute over pay and conditions because renumeration is the principal reason for many to go to work. Coming from a military background, the older pilots did not share this view, with strike action being something they were uncomfortable with. In short, there was a tense cultural division at the time between and young and old pilots.
This BEA 548 on the day in question comprised three flight crew member operating the aircraft: Captain Stanley Key, a veteran of the Second World War with strong, traditional views (left-hand seat PI); Second officer Jeremy Keighley (right-hand seat P2); and Senior First Officer Simon Ticehurst taking the role of flight engineer (Engineers seat P3). Additionally, the fourth jump seat was occupied by Captain John Collins. The relevance of the flight crew complement became apparent after the accident. From a skills perspective, the captain was the most experienced on the flight deck, but was feared by his colleagues. The junior members of the flight crew were keenly aware of captain Key's view of the impending industrial action. On the day of the crash, Key's was observed having a tremendously violent argument with another colleague regarding the impending strike action. Captain Key made his anti-strike views known, to the extent that this violent argument was witnessed by numerous other colleagues at Heathrow Airport. The working atmosphere during the briefing would have been tense, and was the first potential area for a problem to occur, as cited in the accident report.
The Trident aircraft is a T-tail jet aircraft that has traditional flight characteristics. The problems with T-tail aircraft are to do with the stall characteristics: namely if the aircraft enters a deep stall, the flight crew will be unable to recover the situation. This is because the elevator surface has become ineffective due to the stalling turbulent air passing over the tail section; thus the usual nose-down attitude required to recover is ineffective. To prevent this type of stalling event transpiring, the manufacturers added a stall warning system, comprising two angle of attack sensors on each side of the nose of the flight deck. In addition to the stall warning system, a stick push device is attached to the elevator control circuit, and this would typically activate after 10 seconds of continuous stall warning. An underlying problem with the Trident aircraft was that of false stall warnings during its previous operational service. A number of operational BEA crews experienced this spurious stall warning activation. Consequently, it was considered acceptable to cancel the warning and to continue flying, treating the warning system with some level of scepticism.
114 seconds after take-off, the stall warning system activated. At the time of the accident, flight deck data recorders were fitted to this model of particular aircraft, but the cockpit voice recorder was not a technology that was fitted at the time of the accident, as detailed in the AIB report. It is believed that as the stall warning sounded shortly after take-off, the flight crew cancelled this indication (the audible alarm, etc.) and attempted to fly the aircraft as per usual. Multiple stall warnings, stick shake indications and multiple stick push activations took place, yet the final outcome was the deep stall and impending crash.
Unfortunately, the aircraft was flying slower than it should have been. One contributing factor was the noise abatement procedures for aircraft flying close to the airport. These noise abatement procedures require the pilots to throttle back the engines, using less engine thrust as the aircraft passes out of the airport perimeter over the boundary fence. The logic behind this noise abatement procedure is to mitigate noise pollution for residents living close to the airport. Unfortunately, the reduction in thrust from the three engines resulted in a slower acceleration of the aircraft to the higher safe cruising speeds. In short, the aircraft was flying slower than intended, some 60 + knots slower than the action called for. Additionally, the leading edge and trailing edge devices were individually controlled: a characteristic unique to the Trident aircraft at the time. The accident investigation report determined that the leading edge droop flaps where retracted too soon into the flight (i.e. the surface was moved at an incorrect airspeed, being too low), and this premature action resulted in the loss of lift and the aircraft then entering a stall type condition, which later developed into a deep stall.
Large commercial aircraft have two or more members of the flight deck crew to better manage the workload. The Pilot Flying (PF) the aircraft, meaning the person controlling the autopilot heading, speed, altimeter, etc., in this case was PI Captain Key. Meanwhile, the Pilot Not Flying (PNF) was Second Officer Keighley as P2, who would be required to monitor the critical values of performance, such as airspeed, rate of climb, etc., and would call out to the colleagues the required performance values, so the PF can then perform an action. Additionally, the Flight Engineer, Ticehurst, would be monitoring the technical performance of the aircraft and engines, and would ensure that the system as a whole was performing correctly. He would also be in charge of trimming - making very minor adjustments to the aircraft to enhance performance.
To a lay person reading the Staines accident report, it would seem impossible that three highly trained professional pilots could make such poor decisions, regardless of their differing levels of experience. However, explaining this was the challenge that the AIB investigation team faced at the time. The investigation focused on all the typical aspects of accidents at that time, with additional focus on the aircraft systems. The crashed aircraft and engines were removed to Farnborough, UK, the headquarters of the AIB. Analysis of the physical evidence from the crash site indicated that the aircraft did not suffer a catastrophic mechanical failure immediately prior to the crash. Rather the culture, the attitudes and the hierarchy affected all the pilot's performances to the detriment of safety. Additionally, the post-mortem medical examination of all the occupants indicated that Captain Key had undiagnosed heart disease, recorded as atherosclerosis. Furthermore, the confrontation at the airport between Key and another pilot was recorded as being the most violent confrontation that other pilots had ever witnessed at work, thus putting Key and his heart condition under extreme stress. The coroner recorded the evidence from the pathologist showing Key would have suffered heart problems not more than 2 hours before the flight, and not less than one minute before the crash. One significant hypothesis that continues to this day is whether Captain Key was suffering a heart attack at the time of the take-off roll, and his deviation from the standard protocol (including Radio Transmission) was indicative of his extreme medical condition. Furthermore, the problematic cockpit culture indicated the levels of dislike between the junior ranking staff and Key, who was seen as an 'old-timer'. The crashed aircraft had evidence of graffiti written on the flight engineers' desk regarding Captain Key. Likewise, other BEA aircraft were found to contain similar graffiti in the flight decks, indicating the culture was not unique to the operational crew of BE 548. Again, the P2, P3 and possibly even the observer on the flight deck of BE 548 would know all too well that this aircraft was not accelerating to the required speed. The stall warnings should have been a very significant message to all occupants of impending danger, yet no radio transmissions were made. While the investigation and subsequent government enquiry attempted to explain why this terrible event transpired, in order to prevent accidents such as this event taking place a new approach was needed.
In the period leading up to the Staines crash, Dr. Elwyn Edwards was a psychology academic specialising in ergonomics at the University of Technology (now known as Loughborough University), Loughborough UK. Edwards was no life-long academic that exclusively based their life's work on publications within a university context. Edwards had performed his national military service with the Royal Canadian Air Force as a Pilot officer, training as a Navigator. He was a qualified flight crew license holder, and furthermore, he had an engineer's grasp of airframes and avionics. He was a member of the Royal Aeronautical Society, a member of the Royal Institute of Navigation and lastly was a London Liveryman of the Guild of Pilots and Air Navigators (now known as the Honourable Company of Air Pilots). All of these aforementioned professional bodies only admit persons who meet the professional criteria for membership, showing Edwards was well established in both Industry and Academia.
