28TH INTERNATIONAL CONGRESS OF THE AERONAUTICAL SCIENCES

CATEGORIZATION OF UNRELIABLE AIRSPEED

EVENTS USING RASMUSSEN’S HUMAN
PERFORMANCE MODEL
Sathya S. Silva*, Roger K. Nicholson**
*MIT, ** The Boeing Company
[email protected]; [email protected]

Keywords: Unreliable Airspeed, Human Performance

Abstract non-normal checklists, and flight crew

training.
Recent cases indicate that inappropriate crew
response to unreliable airspeed continues to be
a problem despite technological advancement of 1 Introduction
the flight deck. The purpose of this analysis is to
categorize a subset of reported unreliable Accidents and serious incidents where improper
airspeed events in order to uncover common crew reaction to unreliable airspeed indications
themes to determine where the breakdown in is a primary cause has common occurrence
crew response occurs. Thirty-one accidents and throughout aviation history. Recent cases
serious incidents were categorized based on indicate that crew response to unreliable
Rasmussen’s Human Performance Model airspeed continues to be a problem despite
[HPM]. Data were gathered capturing the technological advancement of the flight deck.
crew’s detection of an airspeed anomaly,
understanding of the unreliable airspeed, action
selection in reaction to the erroneous 1.1 Airspeed Calculation
information, any deviation from the plan, and Before analyzing unreliable airspeed, it is
execution of the plan. Results suggest that important to understand how airspeed is
despite high instance of detection of an airspeed calculated and displayed to the crew. Airspeed
anomaly, crews show a lack of understanding of is calculated using the difference in total
the problem in roughly 30% of the total detected pressure (measured by a pitot probe) and static
cases. One possible reason for this gap between pressure (measured by a static port or a
detection and understanding is the potential for combined pitot-static probe).
apparently conflicting alerts in the cockpit and In transport category aircraft, these two
multiple warnings annunciated as a measurements are typically sent to an air data
consequence of unreliable airspeed leading to computer (ADC) or air data module (ADM)
crew confusion. Cases where the crew exhibited which interfaces to the flight deck instruments.
proper response in all five phases of There are usually two redundant systems with
Rasmussen’s model led to a successful independent pitot and static sources for each
completion of the flight with no instance of flight crewmember. Many aircraft also
flight outside of the aircraft envelope. The incorporate standby or backup pitot sources,
analysis indicates that the largest breakdown in static sources, and ADC’s in the event of failure
human performance occurs in the of the primary system. These redundant systems
understanding stage, suggesting that mitigation vary by aircraft model. Figure 1 is a notional
strategies for undesirable outcome of unreliable pitot-static system depicting the general flow of
airspeed events should be targeted to this phase information for airspeed calculation and
of the HPM. This analysis may serve to focus depiction to the crew.
future development in flight deck indications,

1
 SILVA S., NICHOLSON R.

systematically analyzes flight crew support in

performing necessary recovery actions from in-
flight anomalies. Fucke et. al. breaks decision
making and action into six phases: Detection,
Understanding, Prioritization, Action Selection,
Intentional Deviation, and Execution [4].
The analysis described in this paper stems
from Rasmussen’s Step Ladder Model and
derives the “States of Knowledge” from the
previous work of Fucke et. al.

• Detection: Indication that the crew

recognized an airspeed anomaly
• Understanding: Indication that the crew
understood the implications and
limitations resulting from an unreliable
airspeed
• Prioritization: Indication that the crew
properly prioritized the unreliable
airspeed reaction in lieu of other failure
Fig. 1. Diagram of typical airspeed measurement and
depiction to crew.
indications
• Appropriate Action Selection:
Indication of the crew taking the correct
measures to counter the unreliable
1.2 Rasmussen’s Human Performance airspeed
Model • Execution: Indication that the crew
executed the action plan properly
Rasmussen defined the Step Ladder Model, a
symbolic processing model derived from his
Human Performance Model. It defines a
sequence of mental activities that are used
between initiation of a response and the manual
action. This sequence is based on rational,
causal reasoning that connects “states of
knowledge.” Rasmussen originally defined
these states as activation, observation,
identification, interpretation, task definition,
procedure formulation, and execution [1].
There have been a number of
applications of this Step Ladder Model. One of
which is the nuclear power industry’s derivation
of the model into a “Cognitive Demands
Checklist” to model the cognitive demands
imposed on control room operators who would
be most involved in selection and execution of Fig. 2. Rasmussen’s Human Performance Model
severe accident control actions [2, 3]. applied to unreliable airspeed analysis.
Fucke et. al. used the basis of the
“Cognitive Demands Checklist” to develop a
Cockpit-Operations Reliability Evaluation
Worksheet (CREW) Tool for aviation that

2
 CATEGORIZATION OF UNRELIABLE AIRSPEED EVENTS USING
RASMUSSEN’S HUMAN PERFORMANCE MODEL

2 Method airspeed, the source was recorded and

categorized as aircraft, environmental, or
A qualitative analysis was completed on thirty- human.
one accidents and serious incidents involving an • System Affected
unreliable airspeed indication. These events The source of failure was further
were categorized based on Rasmussen’s Human narrowed into which system was
Performance Model (Figure 2). Data were affected. These were categorized into
gathered capturing the crew’s detection of an pitot system, static system, Air Data
airspeed anomaly, understanding of the Computer, and indicator.
unreliable airspeed, action selection in reaction • Type of Obstruction (if applicable)
to the erroneous information, any deviation Where the cause of the unreliable
from the plan, and execution of the plan. The airspeed was pinned to an obstructed
information extracted from each event related to pitot or static probe, the type of
general conditions, alerting, crew detection, obstruction was recorded. These range
crew understanding, plan formation, and from icing to insects.
execution. • Loss of Control
General information for each event Whether a loss of control occurred and
included: the method of LOC was recorded and
categorized into stall or overspeed
• Flight Conditions conditions.
Time of event indicating day or night • Time from Recognition to Loss of
was noted as well as the meteorological Control
conditions at the time of the event. Time between recognition of airspeed
• Phase of Flight anomaly and loss of control was
Two phases of flight were noted for each recorded. Also recorded was time from
event. The first reflected the time of loss of control to recovery if applicable.
recognition of the airspeed anomaly. The
second reflected the phase of flight In terms of alerting, a number of parameters
where loss of control occurred (if were collected.
applicable).
• Manifestation of Unreliable Airspeed • Indication Type
It was recorded whether the event was a Whether the crew received an alert for
single channel failure, multi-channel the unreliable airspeed and whether the
failure, or total loss of instruments. indication was direct or indirect. Direct
Single channel failure refers to an indications may include “AIRSPEED
unreliable airspeed indication affecting UNRELIABLE” messages while an
only one airspeed indicator. A multi indirect annunciation may be a
channel failure refers to an indication “MACH/SPD TRM” message which is
affecting 2 or more indicators. A total annunciated due to unreliable airspeed
loss of instruments refers to all input.
indicators failing to show any airspeed • Indication
information. The indication received by the crew is
• Affected Indicators also recorded. These could include
It was recorded whether the captain, first messages or events such as autopilot
officer, and/or backup airspeed disconnects.
indicators were reflecting the anomalous • Overspeed and Stall Warning
airspeed. Annunciation and validity of any stall
• Source of Failure and overspeed warnings was recorded. It
Where there was sufficient information was also noted whether any of the
regarding the source of unreliable indications were temporary.
3
 SILVA S., NICHOLSON R.

• Reversion to Non-Normal Flight Execution of the plan was tied to the response of
Control Modes the crew.
It was noted whether the aircraft ever
reverted to alternate flight control modes • Crew Resource Management (CRM)
during the event. CRM was assessed and any deficiencies
in CRM were noted. It was also noted
In terms of detection, it was first analyzed whether an authority gradient inhibited
whether the failure was detectable to the crew. the crew from executing the proper plan.
In certain failure cases, all airspeed indicators • End of Flight
on the plane could deteriorate at the same time Outcome of the flight was noted in terms
providing no cue to the pilot that a problem of whether the crew decided to perform
exists. a rejected takeoff, air turn back,
diversion, or continue and it was
• Detected assessed whether the decision was
Assuming an event was detectable, it appropriate. It was also noted whether
was then noted whether the crew any of these resulted in an accident.
recognized the airspeed anomaly. • Pitot Heat Deployment (if applicable)
• Crew Crosscheck of Instruments If the cause of the unreliable airspeed
Where the information was available, it was determined to be pitot icing, it was
was noted whether the crew cross- noted whether the crew deployed the
checked the other airspeed indications in pitot heat.
the cockpit. • Alternate Data Source Switch
It was noted whether the crew attempted
In terms of flight crew understanding of the to switch to an alternate air data source
airspeed anomaly, actions were observed and (if applicable).
inference made about the state of understanding
of the flight crew. Using the extracted data tabulated for each of
the events, trends were sought in terms of where
• Pilot Flying and Exchange of Flight the crew breakdown in response occurs with
Controls respect to Rasmussen’s Human Performance
It was recorded who was pilot flying at Model.
the time of recognition of the airspeed
anomaly and whether an exchange of
flight controls was performed. It was 3 Results
also recorded whether the exchange of
flight controls was appropriate. 3.1 General Trends
• Activation of Autopilot for Recovery Results paint a varied picture as to the general
Any attempt to activate the autopilot for environment and causes of unreliable airspeed
recovery signified a lack of (Figure 3). A majority of events occurred in
understanding of the unreliable airspeed instrument meteorological conditions (IMC).
and its effect on the autoflight system. All seven accidents occurred when the crew had
Any indications of autoflight mode no external visual cues either in IMC or visual
confusion were also recorded. meteorological conditions (VMC) over water.
With regards to the manifestation of
Plan formation was tied to checklists and unreliable airspeed, the events were relatively
procedures utilized by the crew. It was noted evenly distributed between single channel and
whether the crew identified, began, and/or multi-channel failures. The events that involved
completed any checklists. It was also identified a loss of control were also distributed between
whether the crew selected the appropriate single and multi-channel, despite the crew
procedure and performed it correctly. having a good source of airspeed information in
4
 CATEGORIZATION OF UNRELIABLE AIRSPEED EVENTS USING
RASMUSSEN’S HUMAN PERFORMANCE MODEL

the single channel cases. The two total loss

cases did not include a loss of control.
The source of failure was 29% aircraft,
48% environmental, and 13% human related.
The systems affected include pitot (52%), static
(16%), Air Data Computer (19%), and indicator
(3%).
The crew was alerted to an airspeed
malfunction in 80% of the cases analyzed. The
majority of these alerts were indirect.

3.2 Human Performance Model

Results suggest that despite high instance of
detection of an airspeed anomaly, crews show a
lack of understanding of the problem in roughly
30% of the total detected cases (Figure 4). One
possible reason for this gap between detection
and understanding is the potential for apparently
conflicting alerts in the cockpit and multiple
warnings annunciated as a consequence of
unreliable airspeed leading to crew confusion. It
can also be seen in Figure 4 that all fatal
accidents analyzed were associated with
breakdowns earlier in the model in the detection
and understanding phases. The less severe
accidents and incidents were associated with
breakdowns later in the model. Cases where the
crew exhibited proper response in all five
phases of Rasmussen’s model led to a
successful completion of the flight with no
instance of flight outside of the aircraft
envelope.
Further analysis was done probing the
apparent barriers between detection and
understanding. These cases fell into two main
categories.

• Systems Knowledge or Training

Deficiency
• Cognitive Tunneling or Confirmation
Bias

Of the eight cases exhibiting appropriate

Fig. 3. General trends in analyzed events.
detection and inappropriate understanding, five
were identified as having systems knowledge or
training deficiency.

5
 SILVA S., NICHOLSON R.

• Three crews were unaware of autopilot overspeed and stall warnings. Six of these
limitations flights resulted in flight outside the normal
• One crew relied on air traffic control flight envelope of the aircraft (Figure 5).
altitude readouts fed by their airplane’s Further analysis was done breaking
erroneous transponder signals down the individual warnings for all the events
• One crew failed to exhibit stall into valid and invalid warnings (Figure 6). Over
recognition or recovery skills all of the events analyzed, both the overspeed
and stall warnings were valid in half of the
Three out of the eight cases were identified as cases. Looking only at the accidents, the stall
exhibiting cognitive tunneling or confirmation warning was valid in all the cases while the
bias. overspeed warning was invalid for most of the
cases. For the incidents analyzed, there were
• Two crews did not put trust in the valid more invalid stall warnings cases compared to
airspeed indicator the overspeed warning cases.
• One crew believed their circumstance Depending upon the cause and
was due to turbulence. subsequent flight dynamics, an unreliable
airspeed event may exhibit combinations of
Using this type of information, mitigation valid and invalid warnings for both overspeed
strategies can be targeted for the understanding and stall. Typically, the overspeed warning is
phase of the Human Performance Model. driven by airspeed sensed by the pitot-static
system. An erroneously low airspeed arising
from a blocked or leaking pitot-static system
3.1 Opposing Alerts may not trigger the overspeed warning in the
presence of an actual overspeed. The stall
Nine of the thirty-one events analyzed (29%)
warning is driven by angle of attack (AOA)
involved simultaneous annunciation of

Fig. 4. Breakdown of unreliable airspeed events into Rasmussen’s Human Performance Model.

6
 CATEGORIZATION OF UNRELIABLE AIRSPEED EVENTS USING
RASMUSSEN’S HUMAN PERFORMANCE MODEL

less than the low airspeed threshold for valid

AOA.
For all the valid warnings for events
with simultaneous overspeed and stall warnings
annunciated, the number of cases for each was
tabulated. Five out of nine were valid stall
warnings while two out of nine were valid
overspeed warnings. The remaining two events
did not have enough information recorded for
the investigator to determine which was the
valid warning.

4 Conclusions
The more severe accidents and incidents were
associated with breakdowns earlier in
Rasmussen’s Model. Detection of an airspeed
Fig. 5. Simultaneous stall and overspeed warning
relation to flight outside normal flight regime.
anomaly was prevalent in most accidents and
incidents analyzed. The analysis indicates that
the largest breakdown in human performance
occurs in the understanding stage, suggesting
that mitigation strategies for undesirable
outcome of unreliable airspeed events should be
targeted to this phase of the Human
Performance Model. This analysis may serve to
focus future development in flight deck
indications, non-normal checklists, and flight
Fig. 6. Overspeed and stall warning annunciation. crew training.

General observations from the analysis identify

a number of underlying issues needing attention
to meet commercial aviation safety goals.
Enhanced automation in the flight deck has been
shown to increase the reliability and safety of
commercial aviation, however along with this
progress introduces problems such as
deterioration of manual flying skills,
desensitization to normal operating envelopes,
unfamiliarity with operation in degraded modes
of flight control, as well as excessive
Fig. 7. Valid warnings for simultaneous overspeed and annunciation of nuisance alerts. Without careful
stall warning annunciation consideration of these issues, advancement in
terms of automation safety may be hindered.
sensed by vanes. To avoid nuisance warnings
caused by dynamic inertial and aerodynamic
effects on the AOA sensors on the ground, stall References
warning systems may be inhibited at low
[1] Rasmussen J. Information Processing and Human
airspeed (e.g., 60 knots). In some airplane
Machine Interaction: An Approach to Cognitive
implementations, a valid stall warning may be Engineering. Elsevier Science Publishing Co.,Inc.,
inhibited in flight because the sensed airspeed is New York, 1986.
7
 SILVA S., NICHOLSON R.

[2] Mumaw R, Swatzler D, Roth E, Thomas W.

Cognitive kill Training for Nuclear Power Plant
Operational Decision Making. Westinghouse Electric
Corporation 1994.
[3] E. Roth, R. Mumaw, Preliminary Draft of a
Cognitive Demands Checklist, Internal Research
Report, Westinghouse Electric Corporation, 1992.
[4] Fucke L, Mumaw R, Kennedy R, Nicholson R.
Assessment of Risk from Human Performance on the
Flight Deck – Driving Sound Design Decisions.
Boeing, 2011.

Copyright Statement
The authors confirm that they, and/or their company or
organization, hold copyright on all of the original material
included in this paper. The authors also confirm that they
have obtained permission, from the copyright holder of
any third party material included in this paper, to publish
it as part of their paper. The authors confirm that they
give permission, or have obtained permission from the
copyright holder of this paper, for the publication and
distribution of this paper as part of the ICAS2012
proceedings or as individual off-prints from the
proceedings.