Brief Recommendations for Preventing Omission Errors in Hang

[Nobody]

http://www.nzhgpa.org.nz/docs/do_hareparsonssummary.pdf

[Bob Kuczewski]

Thanks for this post. Here's the text (note that some formatting such as bold, italics, etc may be missing in this quick translation). Please let me know if you see any formatting errors. Thanks.   

Brief Recommendations for Preventing Omission Errors in Hang Gliding
Associate Professor David O’Hare, University of Otago, Dunedin, New Zealand

Background

In the middle of last year (2003) I was contacted by the New Zealand police and asked to carry out an analysis of a fatal hang glider accident at the Remarkables, Queenstown on March 29th 2003. The analysis indicated that the likely cause of the fatal injury to the passenger on a commercial dual hang glider flight was that the pilot omitted to attach the passenger’s carabiner to the hang loop. As the hang glider became airborne it was immediately apparent that the passenger was not hooked on to the structure. The pilot’s attempt to hold on to her whilst flying the hang glider to the designated landing area was not successful.

The analysis of the circumstances leading up to the launch indicated the presence of several factors known to increase the likelihood of omission errors. Most significantly, the launch procedure was interrupted several times by changes in wind direction requiring a change in launch position. This was exacerbated by a failed launch attempt where the hang glider was tipped over. The normal procedure required the pilot to attach himself to the hang glider and then attach the passenger and then to conduct a ‘hang test’ to verify that the weight of the passenger was taken by the hang glider.

Any procedure such as this is vulnerable to interruptions. Following an interruption the pilot must correctly recall the point reached in the procedure and re-commence the procedure from that point. Two kinds of error are logically possible: the pilot might recall the procedure as having proceeded further than it actually has and thus miss out a step or else recall that it hasn’t proceeded as far as it has and thus repeat a step. Unfortunately, in this case it appears to have been the former error.

This particular procedure is also vulnerable to error because of a lack of any direct functional connection between one action and the next. In other words, attaching the passenger’s carabiner does not have to occur for the next action (takeoff) to become possible in the way that turning the key in a car’s ignition has to occur before the engine can be started.

Approaches to Safety

There are several different approaches to improving human performance in safety-critical systems. In roughly descending order of priority these are: Design, Training, Education, Regulation/Enforcement. I will discuss the first three approaches as there is little that can be done in the area of regulation and enforcement for the reason that this kind of failure is an entirely inadvertent and unintentional one that no amount of general regulation can affect. As enforcement occurs post hoc (after the fact) it will not affect the future likelihood of these unintended failures.

Design

Modern aircraft have numerous safety features that have been designed to provide additional layers of defense against the effects of human error. For example, shape coding of controls was introduced after World War II to minimize errors of control selection. The altimeter has been significantly redesigned to reduce errors in reading altitude. The ‘stick shaker’ was developed to provide additional tactile feedback in the event of a stall and so forth. Visual and auditory displays have been designed to provide warnings to the pilot. For example, if a light aircraft reaches a certain angle of attack then an auditory (buzzer) warning is provided. If the undercarriage is correctly down and locked then three green lights illuminate on the control panel.

Modern cars have simple warning systems to alert the driver if oil pressure is low or if a door or seat-belt are unfastened. All of these systems are, of course, powered by the vehicle’s electrical system and this poses a problem with an unpowered device such as a hang-glider. It might be technically possible to design a simple alerting device utilizing a small battery, a buzzer and some kind of strain gauge that would provide an auditory alert if there was no weight on either of the hang loops. Apart from the technical problems and necessity of carrying additional equipment on the hang glider, such a device would suffer from the same human factors problem as the existing system in that the pilot would need to remember to activate it at some point during the launch sequence. This is not a problem in cars or aircraft as powering up the system is a pre-requisite step to achieving the operator’s goal of moving the vehicle. As there is no such functional link in the hang glider it would be very easy to forget to turn on the system. The only way around this would be a system that automatically activated (e.g. based on movement sensors) and then provided an auditory warning that the hang loops had no load on them. This combination of simple components (movement sensor, strain gauge and battery) seems technically feasible and might be a worthwhile exercise for an engineer or engineering student to consider.

A more low-tech solution would be to have say a red ribbon or flag hanging down from each hang loop that has to be removed as the carabiner is attached. This would provide an external visual confirmation that this critical step had actually been performed. This might not have guaranteed that the pilot in this case would have secured the passenger as the ribbon would have been removed initially when the carabiner was first attached. Unless the ribbon was re-attached to the hang loop every time the carabiner was removed the system would not be foolproof.

A better solution would be to have two ribbons attached (e.g. by Velcro) to the control bar in front of the pilot. Once the carabiner has been attached to the hang loop then a ribbon must be removed from the bar and wrapped around the carabiner. The presence of the highly visible ribbon in front of the pilot on the control bar would be an unmissable warning that this had not been done. The system would be effective so long as the ribbons were either on the control bar in direct view of the pilot or wound around the carabiner in the hang loop. In order to unclip the carabiner from the hang loop the ribbon would first have to be removed and placed back on the control bar. If the pilot forgot to replace the ribbon on its Velcro attachment on the control bar he/she would still be left holding it. The presence of a ribbon on the control bar would indicate that the carabiner might not be attached and would thus act as an abnormal condition warning in the same way as traditional electronic visual warnings are provided on aircraft flight decks.

Training

Ideally errors are made impossible by design. For example, the video tape used in video cassette recorders has been designed so that there is only one way (the correct) way to insert it in the video recorder. However, the design solution is not always possible or practicable. Neither the automated electronic warning system nor the use of warning flags, as described in the previous section, would be completely foolproof. It is necessary to supplement design changes with improved training.

To prevent the initial error of omission, pilots should be trained to manage interruptions and distractions. One suggested procedure (Dismukes, Young & Sumwalt, 1998) is to apply a simple mnemonic in response to any interruptions or distractions. The mnemonic is IAD for: IDENTIFY the interruption; ASK “what was I doing before I was interrupted” and DECIDE what action to take to get back on track. This is helpful for situations where the pilot is following a procedure or sequence (for example, going through a checklist).

A simpler, and potentially more effective procedure, would be to regard any interruption during the launch procedure as a RED FLAG with a mandatory requirement to stand down and stop for a defined period (e.g. 1 minute). After the mandatory period the operation should be resumed from the beginning.

The existing procedure could also be strengthened by incorporating a second person into the sequence. A ‘challenge and response’ procedure is used in commercial flight operations with one person calling items from the checklist (e.g. “Fuel Pumps”) and another responding with the appropriate status report (e.g. “ON”). In this case the pilot could call “Carabiners attached and locked” (or whatever is considered appropriate) with a required response from the launch assistant. Alternatively, in tandem operations the passenger could be asked to give a tug on their harness to confirm that it was connected.

Education

Much could be done to increase operators’ awareness of the nature of human errors, particularly of the nature and causes of unintended actions. Basic courses in human factors are required for pilot certification in most countries. The NZHGPA should look at mandating training in human factors as a means of increasing awareness of the vulnerability of human performance to certain factors and situations. Proper training in human factors should be mandatory for commercial operators in my view. Any pilot operating any kind of aircraft (from hang glider to B747) should understand the origins of human error and should be able to recognize situations conducive to error. While this kind of educational effort is important, it must be supplemented with training in specific procedures to apply in critical situations, and accompanied by appropriate design changes where possible.

Conclusion

Two things are indisputable. Firstly, human beings are prone to certain forms of error that occur in predictable ways and circumstances. Secondly, whilst human nature cannot be changed, the way equipment is designed and tasks carried out can be modified to reduce the incidence of error and to trap errors that do occur and prevent them having undesirable consequences.

I have made a number of suggestions that individually or collectively would almost certainly have prevented the fatal error that occurred in this accident. From a safety engineering point of view it is almost always preferable to directly modify the equipment or situation to make the error less likely or to trap it before the consequences become manifest. Thus design changes are the first priority. Training to deal with the possibility of error is the next best approach. Training must involve the ability to recognize hazardous situations and provide a clear and unambiguous response to that situation. Finally, education to increase awareness has a place in the scheme of things but in itself is unlikely to be completely effective.

The response by most organizations to events such as this is to follow exactly the reverse order of priority and generate some sporadic educational efforts (e.g., articles in safety magazines, discussion at meetings etc) instead of delivering the targetted training and design solutions required.

Reference:
Dismukes, K., Young, G., & Sumwalt, R. (1998). Cockpit interruptions and distractions. ASRS Directline No 10, 1-7.

David O’Hare
28 May 2004