On the Design of Flight-Deck Procedures - Intelligent Systems ...

coordination of tasks between agents. If the same SOP, used in different situations, yields asignificantly different outcome, then this should raise a warning flag to the procedure designer. Thefollowing example illustrates such ambiguity.The SOP for starting engines of a twin-jet for one U.S. carrier is for the ground-crewmember to call the cockpitand say, “Cleared to start engines.” During line operations, however, most experienced ground-crewmemberswill give this clearance per a specific engine, i.e., “cleared to start No. 1,” or “cleared to start No. 2.” It ispreferred to start the No.1 (left engine) first, because the bags/cargo are loaded from the right side of the aircraft.Another reason for this sequence is that the tow-bar pin is extracted from the right side. Therefore, it isrecommended not to have the right engine operating while the ground crew is disconnecting the tow bar.In one reported incident a ground-crew trainee called the cockpit and told the captain “cleared to startengines” (exactly as SOP dictates). What he should have said was “cleared to start No. 1,” as otherground crews were loading bags on the right side of the aircraft. The captain later stated that the callout“just did not sound right.” He did not start the engine and called the ground crewmen to verify if he wascleared to start any engine, or just one of them.The procedure, apparently, led to an ambiguous situation. As our definition of procedure in Section2.1.1 stated, the outcome of a procedure must be a product which is unambiguous to all agents involved.If the same procedure can yield significantly different outcomes, then the procedure must be modified orchanged (e.g., “Cleared to start engine number [one, or two]”).Likewise, in spite of the best efforts of standardization departments, flight crews can also make aprocedure or callout ambiguous by taking shortcuts. We observed a captain who, upon being given aheading, altitude, and airspeed to make good while descending for a landing at San Diego, replied toATC, “We'll do it all.” Note that by not repeating the information, he short-circuited the checkingprocess, denying both ATC and his fellow crew persons the opportunity to be sure that he operating oncorrect information.Guideline #15: If the same procedure can yield significantly different outcomes, then theprocedure must be modified in order to eliminate its embedded ambiguity. In brief, aprocedure should lead to a totally predictable outcome.6.2.4 Resources and DemandsIf the procedure places an unrealistic demand on the crew, then some pilots will very quickly developcreative “tricks” to bypass these procedural restrictions. These creative “tricks” may be even moredangerous than the situation which the procedure attempted to regulate. For example, ACARS pushback time is sensed automatically when the captain releases the brakes. This information is then used todetermine on-time performance. To bypass this, some crews have developed a technique in which theyrelease the brakes and then set them again before they are ready to go, so that the push back signal willenter into the ACARS. Besides the fact that the crew is deliberately falsifying data, if this practice is notwell coordinated with the ground crew, it can result in an injury.In summary, all the above design issues cannot be extracted from the system by management only. Theawareness and cooperation of flight crews is required in order to point to an existing problem. A formalfeedback loop, such as previously advocated in Section 3.2.4, should be in place to obtain, collect,analyze, and rectify problems encountered on the line.6.3 CALLOUTSCallouts are aids in maintaining awareness of the crew as to the status of given tasks. They areextremely important in aiding situational awareness of a dynamic task, such as flight-path changes,engine starts, etc. There are several advantages and disadvantages to this form of status reporting. Itallows the controlling entity to have full information on the status of each system component. Likewise,each component in the system also knows the state of other components. This, however, is purchased ata price -- constant chatter. But even repetitious chatter is not always a disadvantage, as the experiencedhuman operator may detect departure from the monotonous sing-song as an indication of a problemstarting to develop (Rochlin, La Porte, and Roberts. 1987).38