On the Design of Flight-Deck Procedures - Intelligent Systems ...

6. ISSUES IN PROCEDURE DESIGN6.1 COMPATIBILITY OF PROCEDURESPhilosophies, policies, and procedures must not be developed and designed without consideration of theoperational environment in which they will be used. Commercial aviation procedures, in this regard, arecomplex because of the ever-changing environment (weather, other traffic in vicinity, airport limitations,etc.). In addition, the necessity to coordinate so many different agents and entities, which are allinvolved in dispatching and maintaining control over the aircraft during flight, requires compatibility withthe operational environment. When elements of the system, in this case the procedures, tasks, devices,equipment, are compatible, the process of conducting the task is more efficient -- the pilots have to exertless mental and physical effort. We define compatibility here as the orderly and efficient integration withother elements in the system. We will now attempt to describe the basic structure of airline operationsthat may cause an incompatibility of procedures.6.1.1 Environment and ProceduresMany cockpit procedures are dependent on the activities of external agents such as flight attendants, gateagents, fuelers, and others. When designing a procedure, the influence of these entities on proceduredesign, implementation, and task completion must be considered (Degani and Wiener, 1990).For example, one company's SOP requires a check of log books for open maintenance items prior toactivating any controls or switches in the aircraft. The logic is that this check will prevent a flight crewmember from activating a system that may be inoperative, thereby causing more damage (e.g.,attempting to start an inoperative APU). At most stations, the aircraft log books are in the cockpit whenthe flight crews come on board. However, at some remote stations, due to maintenance procedures thelog book is brought to the aircraft five minutes before push-back. Therefore the procedure cannot beaccomplished in those remote stations. A change in the procedure, so that this information can beobtained from another source, or a change in maintenance procedure is required to defeat thisincompatibility.Let us examine another example. One company was considering a change in their SOP so that flapsextension would be performed as soon as the aircraft leaves the gate. Pilots raised the concern of hittinga truck or other obstacles under the wing (as the crew cannot see the wing from the cockpit). Althoughthe ground crew's salute is an indication that all is clear, there was still a concern that this gesture is notdependable. The argument was made that when a widebody leaves the gate, there are many groundpersonnel around the aircraft. When a salute is given, the flight crew is assured that the area below thewing is clean. In contrast, when a medium size twin-jet is departing from a remote station, where thecompany has only a part-time ground crew who may be less experienced, flight crews are less certainthat a salute is truly an indication that all is clear. In one incident, a cargo cart reached the aircraft afterthe salute, and the ground crew opened a cargo door. The only way the cockpit was aware of theintrusion was that the cargo bay light illuminated on the panel.These are two examples of what we call “system procedures.” The system in these cases involves notonly the cockpit crew and the aircraft, but also ground crew, their management, and ATC (handling rampcongestion and taxi clearances). Such system procedures must be developed using a systems approach-- developing a common definition of the task and involving all the components of the system in thedesign of the procedures and policies. If system procedures are designed piecemeal, then the productmay be an inefficient procedure, unbalanced set of responsibilities, and complicated dependencies -- allare the foundations of a potential system breakdown.Compatibility between components in the system is not restricted to matching cockpit procedures to theoperating environment; it can also be the other way around. For example, we once observed a flight inwhich the ground controller cleared the aircraft (a narrow body twin-jet) toward a runway intersection.The controller tried to schedule the taxi clearances so that the approach-end of the runway would beutilized by heavy jets, with smaller jets making intersection takeoffs. After the aircraft taxied to theintersection, the controller communicated to the flight to expect an intersection takeoff. The crew,however, insisted that they use full runway. The reason: the company's policy prohibited the flight30