If you wish to contribute or participate in the discussions about articles you are invited to join SKYbrary as a registered user
From SKYbrary Wiki
The human mind is fallible and error can occur for many reasons, for example, from a misheard message, from memory slip, or from incorrect appreciation of the situation.
Error is particularly likely in certain circumstances, especially when there is pressure to complete a task quickly (e.g. to expedite departure or during an emergency or abnormal situation), but may also occur in normal everyday situations.
Error in aviation can have severe consequences and the cross-checking process is used wherever possible to eliminate error.
Cross-checking and the Pilot
The cross-checking process is a vital element of a pilot's duties, particularly in a multi crew situation where the roles of the two pilots are defined as Pilot Flying and Pilot Not Flying. The Pilot Not Flying (PNF) - alternatively referred to as the Pilot Monitoring - has responsibility for monitoring the actions and awareness of aircraft control of the Pilot Flying (PF).
Whilst the monitoring role of a PNF must not be limited to specific parts of flight crew duties, Company SOPs should include a minimum list of defined actions which are to be cross-checked, for example:
- One pilot calculates aircraft performance and makes mass and balance calculations; the other pilot closely monitors, cross-checks or duplicates the calculations.
- A Load and Trim Sheet prepared (exceptionally) by a member of a flight crew must be subject to meaningful cross checking before acceptance.
- ATC clearances will normally be monitored by both pilots and consequent action including readback taken by one pilot will be confirmed/monitored by the other.
- Equipment settings such as altimeter pressure settings, cleared altitude, frequency change and navigation routings, are set by one pilot and cross-checked by the other.
- Adherence to defined Stabilised Approach gates and to calculated Reference Speeds and AFM Limitations
Cross-checking and the Controller
Cross-checking is equally important for the ATCO, and comprises two elements:
Cross-checking the actions of pilots
Where possible, the controller should monitor the actions of the pilot, either by reference to the radar screen or by visual observation, to ensure that instructions are followed correctly.
The extent to which a controller can cross-check the actions of pilots depends on his/her workload; however, every effort should be made to do so in situations where error is likely to occur. For example, when the pilots are dealing with an aircraft unserviceability, or when the pilot appears to be inexperienced, confused, or have limited language ability. A particular example of a situation where monitoring by radar or directly may be conducive to safety is the execution of issued VFR clearances in airspace such as Class 'D'; in this situation, loss of separation against IFR traffic can occur due to poor situational awareness of the IFR aircraft flight crew, who might wrongly assume that they benefit from ATC-controlled separation from VFR traffic as well as from other IFR traffic.
Controllers should pay particular attention to aircraft manoeuvring on the ground near runway hotspots and to potential conflicts which can arise in the air when intersecting runways are in use simultaneously and this involves intersecting approach, missed approach or take off flight paths.
System support can be used to help controllers with performing this task. Examples of this are various monitoring tools, e.g. for a potential or actual level bust, horizontal deviation, the downlink of Mode S selected level, etc. Nevertheless, controllers should be aware that such tools are not supposed to replace the existing ATC procedures.
Cross-checking the actions of colleagues
Cross-checking is a normal part of the duties of an ATC Assistant if these exist; otherwise, controllers rarely have the free capacity to monitor the duties of other controllers and such action could not be expected to form part of their duties. Nevertheless, the following areas are important:
- When there are two controllers assigned to a sector, the communication with aircraft is normally done by the executive controller. The planner controller however also monitors the radio exchanges (to the extent possible) so that they can detect lapses, incorrect readbacks, etc.
- Also not official and subject to personal workload, a tower and an approach controller (or a tower and a ground controller) may monitor the other controller's frequency e.g. to make sure an agreed coordination is appropriately communicated to the aircraft.
- Controllers taking over responsibility for a sector have much information to absorb and the potential for error or oversight is high. The controller going off duty should monitor the actions of their replacement for a few minutes after hand-over to ensure that neither has overlooked any significant aspect of the prevailing traffic situation and to be available to deal with any questions that might arise;
- Inexperienced controllers or controllers who are new to their positions may not become fully proficient for some time. Appropriate mentoring procedures should be in place until their unaided performance is assessed as satisfactory.
- When a controller is dealing with an abnormal situation, e.g. an aircraft emergency or very high density traffic, the enlistment of any off-duty controllers to assist can be an important safety net.
Accidents & Incidents
Events in the SKYbrary database which include Ineffective Monitoring as a contributory factor:
- A124, Zaragoza Spain, 2010 (On 20 April 2010, the left wing of an Antonov Design Bureau An124-100 which was taxiing in to park after a night landing at Zaragoza under marshalling guidance was in collision with two successive lighting towers on the apron. Both towers and the left wingtip of the aircraft were damaged. The subsequent investigation attributed the collision to allocation of an unsuitable stand and lack of appropriate guidance markings.)
- A306, vicinity London Gatwick, 2011 (On 12 January 2011, an Airbus A300-600 being operated by Monarch Airlines on a passenger flight from London Gatwick to Chania, Greece experienced activations of the stall protection system after an unintended configuration change shortly after take off but following recovery, the flight continued as intended without further event. There were no abrupt manoeuvres and no injuries to the 347 occupants.)
- A310 / B736, en-route, Southern Norway, 2001 (On 21 February 2001, a level bust 10 nm north of Oslo Airport by a climbing PIA A310 led to loss of separation with an SAS B736 in which response to a TCAS RA by the A310 not being in accordance with its likely activation (descend). The B736 received and correctly actioned a Climb RA.)
- A310, Irkutsk Russia, 2006 (On 8 July 2006, S7 Airlines A310 overran the runway on landing at Irkutsk at high speed and was destroyed after the Captain mismanaged the thrust levers whilst attempting to apply reverse only on one engine because the flight was being conducted with one reverser inoperative. The Investigation noted that the aircraft had been despatched on the accident flight with the left engine thrust reverser de-activated as permitted under the MEL but also that the previous two flights had been carried out with a deactivated right engine thrust reverser.)
- A310, Khartoum Sudan, 2008 (On 10 June 2008, a Sudan Airways Airbus A310 made a late night touchdown at Khartoum and the actions of the experienced crew were subsequently unable to stop the aircraft, which was in service with one thrust reverser inoperative and locked out, on the wet runway. The aircraft stopped essentially intact some 215 metres beyond the runway end after overrunning on smooth ground but a fuel-fed fire then took hold which impeded evacuation and eventually destroyed the aircraft.)
- A310, Ponta Delgada Azores Portugal, 2013 (On 2 March 2013, the crew of an Airbus A310 mishandled a night tailwind touchdown at Ponta Delgada after a stabilised ILS approach had been flown and, after an initial bounce, the pitch was increased significantly and the main landing gear was fully compressed during the subsequent touchdown resulting in a tail strike and substantial related structural damage. The mishandling was attributed to deviation from the recommended 'light bounce' recovery technique. The absence of an instrument approach to the reciprocal (into wind) direction of the runway was noted and a recommendation that an RNAV procedure be made available was made.)
- A310, Vienna Austria, 2000 (On 12 July 2000, a Hapag Lloyd Airbus A310 was unable to retract the landing gear normally after take off from Chania for Hannover. The flight was continued towards the intended destination but the selection of an en route diversion due to higher fuel burn was misjudged and useable fuel was completely exhausted just prior to an intended landing at Vienna. The aeroplane sustained significant damage as it touched down unpowered inside the aerodrome perimeter but there were no injuries to the occupants and only minor injuries to a small number of them during the subsequent emergency evacuation.)
- A310, vicinity Abidjan Ivory Coast, 2000 (On 30 January 2000, an Airbus 310 took off from Abidjan (Ivory Coast) at night bound for Lagos, Nigeria then Nairobi, Kenya. Thirty-three seconds after take-off, the airplane crashed into the Atlantic Ocean, 1.5 nautical miles south of the runway at Abidjan Airport. 169 persons died and 10 were injured in the accident.)
- A310, vicinity Birmingham UK, 2006 (On 24 November 2006, an A310 descended significantly below cleared altitude during a radar vectored approach positioning, as a result of the flight crew's failure to set the QNH, which was unusually low.)
- A310, vicinity Moroni Comoros, 2009 (On 29 June 2009, an Airbus A310-300 making a dark-night visual circling approach to Moroni crashed into the sea and was destroyed. The Investigation found that the final impact had occurred with the aircraft stalled and in the absence of appropriate prior recovery actions and that this had been immediately preceded by two separate GWPS 'PULL UP' events. It was concluded that the attempted circling procedure had been highly unstable with the crew's inappropriate actions and inactions probably attributable to their becoming progressively overwhelmed by successive warnings and alerts caused by their poor management of the aircraft's flight path.)
- A310, vicinity Paris Orly France, 1994 (On 24 September 1994, lack of understanding of automatic flight control modes, by the crew of an Airbus A-310, led to a full stall. The aircraft was recovered and subsequently landed without further event at Paris Orly.)
- A310, vicinity Quebec Canada, 2008 (On 5 March 2008, an Air Transat A310-300 was unintentionally mishandled by the flight crew during and shortly after departure from Quebec and effective control of the aircraft was temporarily lost. Whilst it was concluded that the origin of the initial difficulties in control were a result of confusion which began on the take off roll and led to a take off at excessive speed followed by subsequent mismanagement and overload, the inappropriate steep descent that followed was attributed to the effect of somatogravic illusion in respect of aircraft attitude control in conjunction with a singular focus on airspeed.)
- Checklists and Monitoring in the Cockpit: Why Crucial Defenses Sometimes Fail, July 2010
- A Practical Guide for Improving Flight Path Monitoring, November 2011
- Monitoring Matters: Guidance on the development of Pilot Monitoring Skills, CAA Paper 2013/02.
Flight Safety Foundation ALAR Briefing Notes: