1

Pilot error: even skilled experts make mistakes

Loukia D. Loukopoulou
NASA Ames Research Center, USA San Jose State University Research Foundation and ErrorManagement, Athens, Greece

ABSTRACT Between 1987 and 2001, 27 major airline accidents occurred in the United States in which crew error was found to be a causal or contributing factor. In five of these, inadvertent omission of a normal procedural step by pilots played a central role. Professionals in other work settings involving high risk have been shown to be vulnerable to similar errors. Why do highly skilled, highly motivated pilots make errors that cause accidents? The answer to this question is complex. Attributing errors to carelessness or complacency is trivializing and misleading. Finding meaningful answers requires careful analysis of the nature of cockpit tasks, of the demands those tasks place on human cognitive processes, and of the inherent vulnerability of those processes to characteristic forms of error in particular situations. Our analysis based on a detailed examination of flight manuals and observations from the cockpit jumpseat shows that omissions during task performance stem from the same underlying and contextual factors. Crews accomplish many tasks, most of which involve multiple procedural steps. The high degree of familiarity with these tasks and the standardization of operating procedures usually keep the workload within human capabilities. During even the most routine of flights, the difficulty arises not so much out of the total

volume of work required as out of the concurrent nature of competing task demands. Like other operators in complex environments, both pilots in the cockpit of a modern airliner must often manage multiple tasks concurrently, interleaving performance of several tasks, deferring or suspending some tasks while performing others, responding to unexpected interruptions and delays and unpredictable demands imposed by external agents, and keeping track of the status of all tasks during these events. The need for concurrent task management is not explicitly portrayed in flight manuals, nor incorporated in the training, when it fact it is responsible for exposing natural human vulnerability to errors of omission.

1. INTRODUCTION On a March evening in 1994, the crew of an airliner prepared for takeoff. The taxiways and runways were covered with snow and slush. The two pilots was highly experienced in flying this type of aircraft, and very familiar with operating in these weather conditions. Beginning with the preflight preparations at the gate, and until they reached the runway, they took all the required precautions to ensure that the airplane wings remain clean of ice a dangerous possibility due to the prevailing weather conditions. They requested de-icing

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

service, visually inspected the wings twice from the cabin windows, and kept the flaps retracted during the taxi to the runway to keep them clean. Their takeoff briefing included a review of procedures for a possible rejected takeoff. A short while later the aircraft started developing speed down the runway. One minute later the crew noticed erratic readings on their airspeed indicators and aborted the takeoff. By this time the aircraft speed was 145 knots and could no longer be brought to a safe stop within the confines of the runway. During the investigation of the accident, it was determined that the crew had failed to turn on the pitot-static heating system. Lacking heat, the external probes that provide air pressure information to determine airspeed were blocked by ice, which in turn caused the erroneous indications that the crew observed during takeoff (NTSB, 1995). Crews use scripted instructions, in the form of written procedures and checklists, to perform the exact actions the exact same way within each phase of flight, on every flight. Turning the pitot-static heat system on and verifying its status were highly familiar actions, whose execution and timing were explicitly prescribed in the airlines checklists. Specifically, with the airplane parked at the gate before starting the engines, the crew was expected to perform a checklist, one item of which called for the pitot-static system heat to be turned on (by rotating a switch) and checked (by noting an indication next to the switch). As protection, an amber warning light illuminated on a panel in front of the two pilots to indicate that this system was off. Checking this annunciation panel was an item on another checklist to be performed right before takeoff. Why and how this did experienced crew bypass all these safeguards and commit such a near-fatal string of mistakes?

2. WHY DO SKILLED EXPERTS MAKE MISTAKES? It is tempting to attribute mistakes to complacency and argue that the pilots were not as careful as they should have been. Such an approach would suggest that this crew must either be trained again or never be allowed to fly again a misleading solution to an inadequately understood problem that does nothing to help explain why inadvertent omission of a normal procedural step by pilots play a central role in many aviation accidents (Dismukes, et al. 2007) and incidents (Loukopoulos, et al. 2009). Flight crews are by no means the only human operators vulnerable to such errors. Similar findings are shown for practically every type of complex work setting, such as air traffic control, aviation maintenance, surgery, health care administration, the pipeline industry, and nuclear power plant operations (ibid). This paper refers to an attempt towards a deeper and more meaningful explanation of why skilled experts occasionally make mistakes when performing highly familiar tasks, based on an analysis of the nature of cockpit tasks, the demands those tasks place on human cognitive processes, and the inherent vulnerability of those processes to characteristic forms of error in particular situations. Our approach is multi-faceted. One component is ethnographic, involving participation in airline flight training, analysis of airlines operating manuals, and observation of normal flight operations from the cockpit jumpseat. We develop an ideal, nominal description of tasks during normal operations, compare it with task demands observed to occur in reality, and conclude that the prevailing feature of the operational environment is that it makes concurrent, often conflicting demands of the operator. Another component involves the analysis of aviation incident reports describing errors associated with concurrent task demand situations similar to those observed. The third

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

component draws upon the existing research literatures in cognitive psychology and in human factors to help organize the observational data and guide the analysis of cognitive processes involved in the management of the concurrent tasks. 2. THE IDEAL Our initial goal was to examine the nature and timing of individual tasks and develop a sense for the total work load expected of pilots in the course of a flight. This ideal perspective of flight operations is based on what is presented in manuals, and the way it is transmitted to pilots during training. 2.1 Analysis of Flight Operations Manuals Tasks expected of airline pilots during a flight are highly scriptedthe steps, sequence and timing of each are described in detail in a Flight Operating Manual (FOM). Tasks in the FOM are organized in procedures (and checklists) largely based on design features and performance characteristics of the specific airplane type. This builds standardization and ensures that aircraft equipment systems are operated correctly, and allows pilots who have never flown together to coordinate their work effectively. Pilots are required to follow procedures closely, so training is heavily based on the rote memorization and repeated execution of procedures in flight simulators. With practice, the performance of procedures become automatic, thereby minimizing the load on cognitive resources such as working memory. Qualification in the airplane requires pilots to demonstrate not just that they can fly the airplane but also that they can execute the large volume of detailed procedures quickly, accurately, and mostly from memory. Consider the taxi phase of flight during which the aircraft is steered from the ramp area to the departure runway (for an extended

discussion of all phases of flight, see Loukopoulos et al. 2009). The flight crew (captain and first officer) have already configured and tested the aircrafts systems (e.g., electrical, hydraulic, pressurization), and the aircraft has been pushed back out of the gate by a tug. With the parking brake set, the tug safely out of the way, and both engines started, the captain directs the first officer to extend the flaps (wing devices that help give an aircraft the lift it needs for takeoff) and to obtain permission (clearance) to taxi from the ground traffic controller. The controller assigns a specific route that the crew must follow to reach the departure runway. The captain controls the airplanes movement with a steering tiller for the nosewheel, engine thrust levers, and brakes. Both pilots are expected to have airport layout charts available for consultation, and are responsible for following the assigned route and avoiding runway incursions and collisions. The first officer handles radio communications, but both pilots must monitor the radios. Once the aircraft is underway, the crew is expected to perform the Taxi procedure. Procedures are essentially lists of actions. Each line in the list specifies the physical component (switch, lever, or gauge), the action to be performed on it, and the specific setting or outcome expected from that action. Actions differ in complexity, ranging from simply verifying a gauge indication or pushing a button, to multi-step calculations and programming activities. Depending on the airline, as many as a dozen actions may be listed in the Taxi procedure. Each pilot separately performs them from memory as a flow. Performing the flow always in the same order enables pilots to execute the actions quickly, without losing track of what has been done, and helps reduce vulnerability to inadvertently omitting actions or steps within actions.

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

Upon completing the procedure, the captain calls for the Taxi checklist. Checklists list those actions of the preceding procedure that are considered absolutely critical and therefore warrant extra verification. The first officer challenges each item in the checklist, one at a time, and waits for the captain to verify that the corresponding action has been taken and to respond as such before announcing the checklist complete. As the airplane approaches the departure runway, the crew completes another short procedure from memory so that when the Tower controller gives permission for the airplane to takeoff, the captain calls for and the crew accomplishes the associated Before Takeoff checklist. Figure 1 provides a high-level graphic summary of crew tasks during the taxi phase, presented in the form of a time-activity graph, with the time axis running from top to bottom.

middle (e.g., Before Takeoff checklist). External agents and required pieces of information are also listed (e.g., Taxi clearance delivered by the ground controller). Horizontal arrows depict points of communication and other interaction among pilots (e.g., the line linking the captain and first officer beginning with the captains request Ask for checklist and the first officers response Begin checklist). This figure is labeled Ideal because it represents the theoretical, ideal manner in which cockpit tasks are to be accomplished during the taxi phase of flight. 2.2 Characteristics of the ideal operating environment Looking at the picture of flight operations as described in the FOM it is possible to discern three central characteristics of pilots work load: it is linear, predictable, and controllable. Linearity, shown by the two vertical arrows in Figure 1, refers to the fact that tasks always follow a prescribed order in a fixed sequence. Each item is to be accomplished as soon as the previous one is completely finished. For three tasks A, B, and C, for example, the pilot finishes Task A before moving on to complete task B and only then handles task C. Linearity builds the expectation that completion of one task automatically signifies that all preceding tasks have also been completed. It also suggests that only one activity is performed at a time. If a pilot is involved in one task, he or she does not have to handle any other task in parallel. Predictability refers to the fact that tasks and events can all be exactly anticipated (both in nature and timing), and is conveyed by the lack of discussion in the FOM of the possibility that operating circumstances might force changes in the timing or sequence in which tasks are performed. In the ideal world, whenever the crew requires certain information or is expected to coordinate activities with another person, that

Figure 1. Ideal taxi phase of flight. Tasks assigned to the captain or first officer individually are listed on the left and right columns, respectively, and include both specific procedural action items depicted in text boxes (e.g., left side: Taxi procedure), and more general monitoring requirements depicted in cloud-shapes (e.g., Monitor Ground frequency). Checklists are shown in the

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

information is complete and that person is always immediately available. Controllability implies that the execution of tasks is under the moment-to-moment control of the crew. Crews appear to be in charge of the timing, pace, and manner of execution of their tasks because sufficient time is always available, and pilots can plan their activities for whenever they can devote full attention to them and can execute those plans in the manner anticipated. The FOM does not discuss the possibility of having to balance competing goals (e.g., weather avoidance vs. on-time arrival) and make choices with uncertain outcomes. 3. THE REAL To what degree does this characterization of operations accurately capture the reality of flight operations? To help answer this question we conducted a series of jumpseat observations, focusing on events that forced the crew to alter the sequence of execution of tasks as those are described in the FOM, disrupted the flow of work, or generally increased the complexity of work. 3.1 Observations of flights Observations were carried out from the cockpit jumpseat during scheduled, passenger-carrying flights on board Boeing 737 aircraft at two U.S. airlines. The observer, who had studied the airline FOM and participated in that airlines training, took note of any event that perturbed the ideal, expected flow of tasks and activities. A qualitative analysis of these perturbing events showed that, in reality, flight operations are far more complex and dynamic than portrayed in the FOM. Although all of the observed flights followed the general schema of the FOM, no two flights were the same. Flights varied dynamically because of unscripted perturbations, differences in the nature of the competing demands that arose from these

perturbations, and differences in the ways pilots responded to these demands. Consider the following instance of an observed perturbation: Context: The aircraft was halfway down the assigned taxi route to runway 7. The crew had extended flaps for takeoff, and was just about to initiate the Taxi checklist. Perturbation source: Due to a shift in winds, the airport started using another runway for departures, so the ground controller issued an instruction directing the crew to taxi to and depart from runway 14 instead. Consequences: By this time, the crew would normally already have performed the Taxi checklist. In this instance, the crew realized they would have to give precedence to the task demands generated by the unexpected change in the departure runway. The checklist would therefore have to be performed later than usual (but still, no later than reaching the runway). Accordingly, the first officer responded to the new task demands by first acknowledging the instructions (repeating them back to the controller) and by mentally assessing how immediate a response was required to comply with the new taxi route instructions which required them to turn at taxiway D. He estimated they would reach that intersection within a minute and realized there was barely enough time to perform the weight calculations necessary to verify that the aircraft was within limits to take off from runway 14. The first officer knew that while responding to the new task demands, he must not neglect his normal duty that also required his primary attention, to monitor the taxi in progress and to conduct the Taxi checklist before the aircraft arrived at the runway. Because these were all familiar activities, he probably did not regard it difficult to interleave them and concurrently perform them by switching attention back and forth between the head-down calculation task, and the head-up monitoring task. At the same

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

time, he also monitored the radio frequency for additional changes that might require further action. The change in departure plan before the aircraft reached the takeoff runway was certainly not an unusual occurrence, as dynamic weather conditions at airports often require runway changes. When the operational situation changes, crews have no choice but to compress the tasks they normally accomplish and to integrate these tasks with new task demands generated by the changed situation. At a time when they might usually be performing only one task and devoting full attention to it, they may be required to accomplish several tasks concurrently. 4. THE IDEAL VS. THE REAL 4.1 Perturbations The sources and effects of the much larger set of observed perturbations to pilots FOMprescribed tasks in all phases of flight are numerous and variable (Loukopoulos et al. 2009). Some perturbations are momentary interruptions that can be acted upon quickly, but others require time-consuming actions. Some can be dealt with by briefly suspending an ongoing activity, whereas others must be deferred until later. Perturbations may be single events, or they may be compound strings of events, each incrementally imposing additional demands on the crew. The source of perturbations is often external to the cockpit since multiple human agents within the same operational environment interact with the crew, or to ambient situational factors (e.g., weather changes). The timing and pattern of perturbations are unpredictable, and multiple perturbations sometimes occur simultaneously or in rapid succession.

4.2 Characteristics of the real operating environment We return to the time-and-activity figure of the ideal taxi phase of flight (Fig. 1) and populate it by overlaying observations of perturbations from different flights (Fig. 2). Each perturbing event is denoted by a rectangular text box describing the source and nature of the event. The cognitive demands associated with responding to a perturbation are indicated below each event box. The events depicted on this figure did not all occur on any one flight they are the aggregate of many events noted in all the flights observed.

Figure 2. Real taxi phase of flight. Comparing the two figures, it becomes apparent that the real flow of activities is much more convoluted than its ideal counterpart. Perturbations are generally not anticipated and are mostly acted upon as they appear, disrupting the habitual, practiced, flow of anticipated activities structured based on the FOM. Each perturbation entails additional cognitive demands that must be integrated with the demands of anticipated tasks. The divergence between the real and the ideal time-activity graphs suggests that instead of linear, predictable, and controllable, cockpit operations are better described as dynamic, semipredictable, and semi-controllable.

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

Dynamic operations imply that tasks do not always follow a prescribed order and pilots must often deviate from the linear flow. The situation sometimes makes performing B impractical after completion of A, and the pilot must move on to C with the intention of returning to B when the situation permits. Also, pilots must often respond to unplanned demands, inserting new tasks, e.g.: inserting task X after completing A but before initiating task B. Finally, tasks often must be performed concurrently, so the real sequence consists of alternating between elements of all tasks. That operations are semi-predictable implies that tasks and events can not all be exactly anticipated (neither their nature nor their timing). Predictability hinges upon the absence of unexpected events. Our observations make it clear that real-life flights are inundated with unpredictable demands that generate unscheduled tasks for crews. Note that most of these events are unpredictable, but not truly unexpected. Because these events occur with some frequency in the course of operations, pilots have moderate to extensive experience handling them. However, pilots do not know when a given perturbation will occur or what tasks they will be performing when it happens, and thus cannot plan ahead how to manage the perturbation. The availability of information necessary to performing specific tasks is also not entirely predictable and its absence also disrupts the ideal flow of execution of tasks. Further, because each of the two pilots must juggle multiple tasks, they are not always immediately available to each other when they come to tasks that require them to collaborate. Finally, semi-controllable operations imply that the initiation of tasks is not entirely under pilot control. Circumstances or external agents often require tasks to be initiated earlier or later than anticipated, at a time when other activities might be in progress and a pilot is not ready to

devote his or her full attention. The lack of scheduling control and the unanticipated additional task demands substantially increase time pressure and workload, especially in critical phases of flight when pilots are already quite busy, and crews are pushed from a role that is ideally proactive toward a more reactive mode of operating. 5. POTENTIAL FOR ERRORS It is clear from the preceding discussion that actual flight operations are much more complex than portrayed by the FOM. The real operating environment is far more interactive, with a wide range of human agents that provide and require critical information from the crew, and impose demands that affect the structure and timing of the crews other tasks. Weather conditions and air traffic conditions also greatly increase the dynamic complexity of the crews work. As a result, even routine flights require pilots to deal with multiple task demands concurrently, improvising, rearranging, and interleaving planned tasks with unexpected tasks. One may wonder whether this is a problem, considering pilots reported not finding perturbations in any way extraordinary or threatening and were observed to deal with them effectively and without adverse outcomes. Reports from pilots who found themselves inadvertently committing errors when dealing with such perturbations suggest otherwise. A search of one incident database (Aviation Safety Reporting System (ASRS)) was conducted. The ASRS consists of several hundred thousand reports submitted by pilots and other aviation users about incidents in which safety was potentially compromised. Perturbing events and circumstances observed from the jumpseat were used as search terms. For example, runway changes during taxi were observed to occur often and to present crews with multiple additional task demands that had

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

to be integrated with normal tasks, so runway change was used as one of the search terms. The search produced a list of reports describing pilot errors associated with perturbations similar to those observed from the jumpseat. Examination of the reports confirmed that, as concluded from the observations, the nature and timing of perturbations is variable, ranging from momentary interruptions to more attention-consuming monitoring demands. The reports also revealed that the perturbations consequences also vary in nature and severity, mostly leading to errors of omission, some of which are noticed immediately, before generating an undesired situation and others only after the error has caused a subsequent problem. The amount of time before problems become apparent also varies greatly (e.g., one taxi error had immediate consequences, while another did not become apparent until the flight had reached its cruise altitude). Regardless, finally, of whether errors are caught by crews, revealed by an external source (e.g., a warning device), or fortuitously do not combine with other factors to cause harm, the potential for adverse outcome is present in every one of the cases. 6. CHALLENGES To help make sense of the nature of challenges posed by perturbations, observations were grouped into four prototypical situations. These are not four mutually exclusive categories; rather, they are prototypical situations with both overlapping and distinct features. 6.1 Interruptions Interruptions occur whenever some event diverts attention from an ongoing task, causing it to be suspended, at least momentarily. Interruptions are so common they may seem unremarkable. They are, however, extremely variable in their content, duration, and in the demands they impose on an individual already

engaged in a task. Ongoing tasks also vary greatly in the degree to which they can be interrupted without disruption. Many interruptions are unexpected. The exact timing and nature of even the expected interruptions, however, is generally unknown and unpredictable and this prevents planning other tasks to accommodate them. What is common among diverse forms of interruption is that they divert attention from the task at hand and require the individual to decide whether to suspend the ongoing task in order to address the interruption or continue with the ongoing task to reach a natural stopping point before handling the interrupting event. In either case the individual must remember to perform a deferred task (the interrupted task, or the response to the interruption). Deferring tasks poses a challenge to human operators and often leads to inadvertent omissions. 6.2 Tasks cannot be executed in their normal, practiced sequence The operational situation, or the fact that information or a person expected to supply this information or with whom a task must be coordinated is not available when needed, may not permit a task to be performed in its normal sequence. Like interruptions, such situations lead to task deferral, often with additive effects when postponing one task implies deferring related tasks too. When tasks must be postponed, for whatever reason, it is rarely practical to simply wait without performing other tasks until the opportunity arrives to perform the deferred task. In competition with this continuous flow of ongoing task demands, an individual must attempt to remember at the appropriate time that a previous task was not performed in its normal sequence.

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

6.3 Unanticipated new task demands arise Unanticipated task demands often arise while the crew is executing procedures in the prescribed manner and sequence. The new task may either have to be performed immediately or at a later time. Either way, the individual must add it to the existing task requirements and attempt to integrate it into the normal sequence of activities. Like interruptions, the situation of integrating unpracticed tasks involving novel aspects with habitual activities also requires deferring tasks, thereby creating a challenge that may lead to errors of omission. 6.4 Multiple tasks must be interleaved In yet other situations a task cannot be deferred long enough to complete an ongoing task. Because each task makes substantial cognitive demands it is not possible to perform them simultaneously, so the two (or more) tasks must be somehow interleaved. In this situation, individuals must switch attention back and forth among concurrent tasks, trying to avoid becoming preoccupied with one task to the neglect of the other(s). When attention is switched away from one task, that task is momentarily suspended while another task is addressed. However, in contrast to interruptions, interleaving requires repeatedly suspending one task momentarily, engaging another task to perform a few steps, then suspending the new task, and re-engaging the previous task (or engage a third task) to perform a few more steps until all tasks are completed. Such a situation poses a serious challenge that also sometimes leads to errors of omission. 7. COGNITIVE ASPECTS The reasons and mechanisms by which each of the four prototypical perturbations create the potential for errors of omission are better understood by examining the cognitive aspects involved when individuals attempt to responding to these situations. From the

preceding discussion it has become apparent that typical responses to the concurrent task demands arising from the various perturbations involve either deferring one or more tasks, or interleaving multiple tasks. Fundamental cognitive mechanisms are involved when individuals attempt to engage in either deferrals or interleaving. 7.1 Prospective memory Suspending a task with the intention to return to it later, or forming an intention to add a new task at a later time, requires prospective memory (Brandimonte, et al. 1996). Remembering to perform a deferred task means forming an intention to execute that task when circumstances become appropriate and retaining that intention while attention is directed to performing other tasks. Generally, this intention cannot be maintained continuously in awareness; it must thus be retrieved from longterm memory at the appropriate moment. Ideally, whenever deferring a task, the individual would mentally note that the task is being deferred, decide when the task should be resumed, and identify or create environmental cues that will help support remembering. However, interruptions are often so salient and abrupt that individuals may not have time to encode an intention to resume, or even think to do so, much less to create conspicuous cues to serve as reminders (Dodhia and Dismukes, in press). Furthermore, even normally effective cues may fail, if attention is heavily occupied by demanding ongoing tasks. In fact, because retrieving deferred intentions must compete with the cognitive demands of ongoing tasks, the probability of remembering to perform deferred tasks decreases with workload (Stone, et al. 2001). Further complications may arise because the goals of the ongoing tasks provide substantial activation to actions associated with those goals and do not support retrieval of the intention to perform a deferred task.

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

10

7.2 Automatic processing Habitual tasks that are consistently practiced in the same fashion and in the same sequence become largely automatic. An essential aspect of automatic processing is that performing one task automatically triggers the next task to come to mind, thus forming a chain of actions that requires little mental effort to execute. External events also serve as triggers, as does the environmental context. Triggering events and contextual cues are highly reliable when events occur in their normal sequence and context. When tasks are deferred or otherwise performed out of their normal sequence and context, however, the action chain links become rearranged and critical triggers that have become subconsciously associated with specific actions and which normally serve to initiate those actions are removed. The deferred task is detached from the preceding actions and events that normally trigger it, and, conversely, the deferred task can no longer trigger the tasks that normally follow it. Rearranging the sequence of tasks also means that the deferred task must be executed at a time when it may have to compete with other tasks normally performed during this period. These other tasks are supported by their normal context and associated triggers, but the deferred task is not. 7.3 Switching attention Two tasks that are practiced together consistently and frequently eventually merge into a single integrated task, the performance of which is normally quite reliable. In many situations, however, individuals must interleave tasks that have not been practiced together consistently, if ever. This is done by performing a few steps of one task, interrupting oneself, switching attention to the other task to perform a few steps, and back and forth in this fashion.

Self-interrupting is problematic because of the lack of good cues that it is time to switch attention from one task to the other. In situations that require interleaving tasks with novel aspects, individuals are vulnerable to becoming absorbed in one task and forgetting to switch attention to the other task (Dismukes et al., 1998). This is especially true with tasks that demand a great deal of attention, as do programming and communication tasks, and monitoring which is commonly interleaved with other activities. Switching tasks requires conscious effort and thus makes demands on limited cognitive resources, thereby increasing the subjective experience of workload and the total amount of work that must be accomplished in a set period of time. This situation leads to rushing, which further increases vulnerability to error.

8. CONCLUSIONS FOMs depict operations in an idealized manner, suggesting that they are linear, predictable, and controllable. In reality, a large number and variety of perturbations occur in all phases of even a routine flight and such events necessitate managing concurrent task demands, achieved mainly through deferring and interleaving tasks. Pilots, like all individuals may drastically underestimate the challenges of performing habitual tasks that are interrupted, deferred, or performed out of sequence, or to inserting novel tasks among habitual tasks because, in their experience, execution of habitual tasks seems simple and reliable, and requires little mental effort. Consequently, they may not think to take precautions, such as creating conspicuous reminder cues, when interrupted or when forced to defer tasks, because such precautions are not necessary when habitual tasks are performed in the practiced fashion, context, and sequence.

Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.

11

All this is not meant to suggest that FOMs should be written to describe every possible eventuality during a flight. It is understood that FOMs only serve as a backbone to operations, and are written to provide basic guidance about how to operate the aircraft in a manner that achieves the carriers operational, financial, and safety goals. To the extent that training is exclusively based on FOMs, however, and in the absence of a separate Training Manual, the work described here lays the foundation for an argument that the design and training of procedures may not be sufficiently robust to deal with the complexities of real-world operations and to help minimize natural human vulnerability to error. Specific suggestions regarding solutions that both individuals and organizations can implement to better address the challenges of the operational environment are suggested elsewhere (Loukopoulos et al., 2009).

Stone, M., Dismukes, R. K., & Remington, R. (2001). Prospective memory in dynamic environments: Effects of load, delay, and phonological rehearsal. Memory, 9(3), 165-176. ACKNOWLEDGMENTS This research was conducted with Key Dismukes and Immanuel Barshi of the Human Systems Integration Division at NASAs Ames Research Center California, USA, and funded by the NASA Aviation Safety Program, the FAA, and the US Navy Aerospace Experimental Psychology program. The support of pilots and instructors at participating U.S. airlines is gratefully acknowledged.

REFERENCES
Brandimonte, M., Einstein, G. O. & McDaniel, M. A. (1996). Prospective Memory: Theory and Applications. Mahwah, NJ: Lawrence Erlbaum. Dismukes, R.K., Berman, B., & Loukopoulos, L.D. (2007). The Limits of Expertise: Rethinking Pilot Error and the Causes of Airline Accidents. Aldershot: Ashgate. Dismukes, K., Young, G., & Sumwalt, R. (1998). Cockpit interruptions and distractions: Effective management requires a careful balancing act. ASRS Directline, 10, 49. Retrieved January 4, 2005 from http://asrs.arc.nasa.gov/directline_nf.htm Dodhia, R. & Dismukes, R.K. (in press). Interruptions create prospective memory tasks. Applied Cognitive Psychology. Loukopoulos, L.D., Dismukes, R.K., & Barshi, I. (2009) The Myth of Multitasking: Managing Complexity in Real-world Operations. Aldershot: Ashgate. National Transportation Safety Board. (1995). Runway overrun following rejected takeoff. Continental Airlines flight 795, McDonnell-Douglas MD-82, N18835, LaGuardia Airport, Flushing, New York, March 2, 1994. (Report No. NTSB/AAR-95/01). Retrieved 10 October, 2007, from http://amelia.db.erau.edu/reports/ntsb/aar/AAR95-01.pdf Working on Safety 2008 - 4th International Conference Prevention of Occupational Accident in a Changing Work Environment, Crete, Greece, 30 September 3 October, 2008.