Altitude Deviations: Breakdowns of an Error Tolerant System

008418431991PDFTech ReportDOT/FAA/RD-92/7Human machine systemsHuman errorHuman factors engineeringAircraft pilotageAltitudeFlight control systemsAttentionRecommendationsAltitude deviationsAutomation-assisted altitude-change taskDatalinkError detectionIntelligent feedbackPilot and automatic-systems interactionsPrimary flight displaysAmes Research CenterPalmer, Everett A.Hutchins, Edwin L.Ritter, Richard D.vanCleemput, IngeUniversity of California, San DiegoWellesley CollegeNTL-AVIATION-Air Traffic ControlNTL-AVIATION-Aviation Human FactorsNTL-AVIATION-Aviation Safety/AirworthinessNTL-SAFETY AND SECURITY-Human FactorsUS Transportation CollectionPilot reports of aviation incidents to the Aviation Safety Reporting System (ASRS) provide a window on the problems occurring in today's airline cockpits. The narratives of 10 pilot reports of errors made in the automation-assisted altitude-change task are used to illustrate some of the issues associated with pilot and automatic-systems interactions. These narratives are then used to construct a description of the cockpit as an information processing system. Describing the cockpit as a single information processing system is useful because the system behaviors of interest are not determined solely by the behavior of the humans in the system. Altitude deviations in transport aircraft are usually the result of several small problems. The information processing analysis also highlights the variety of languages and media used in the cockpit to describe the flight path as clearance information is processed by the cockpit system. The analysis concentrates on the error-tolerant properties of the system and on how breakdowns can occasionally occur. An error-tolerant system can detect and correct its internal processing errors. The cockpit system consists of two or three pilots supported by autoflight, flight-management, and alerting systems. These humans and machines have distributed access to clearance information and perform redundant processing of information. Errors can be detected as deviations from either expected behavior or as deviations from expected information. Breakdowns in this system can occur when the checking and cross-checking tasks that give the system its error-tolerant properties are not performed because of distractions or other task demands. The report concludes with recommendations based on the analysis for improving the error tolerance of the cockpit system