Human Factors (HF) of the Selection of Parking Brake Instead of Speed Brake During a Hectic Approach
The UK Air Accidents Investigation Branch (AAIB) has reported in their January 2019 Bulletin on a runway excursion accident at Bristol Airport to BMI Regional Embraer ERJ145 G-CKAG on 22 December 2017.
The investigators explain that:
Occupying the left seat was a captain-under-training, new to both the operator and the aircraft type [the Pilot Flying (PF) for that sector]. Occupying the right seat was a company training captain, who was the commander of the flight [the Pilot Monitoring (PM)].
The crew anticipated that a Category II approach would be required and planned accordingly. However, on arrival in the Bristol area the expected holding was cancelled and the approach timeframe thereby shortened. Also, the approach briefing was delayed until after the ATIS was available and was then interrupted several times. Thus, although not unduly rushed, the crew requested additional track mileage and the approach briefing was conducted with numerous interruptions. Despite this the pre-landing checks were completed, the approach was stable, the required visual references for landing were acquired and a normal touchdown was achieved.
The graphic below shows some of the events during the approach:
The comments about opening of the speed brake are highly relevant to subsequent events (as discussed below).
The PF decided to deploy the speed brake to lose the excess height and announced: “speed brake coming on”. However, the speed brake parameter recorded on the FDR did not indicate that the speed brake had deployed.
The AAIB note that in the 13 or so minutes shown:
There was significantly more RT than shown due to the weather, and ATC vectoring and management of another aircraft with marginal capability given the runway visibility. There were also significantly more crew communications than shown relating to checklists, minima, alternate airports and other operational issues.
On touchdown the aircraft de-rotated sharply and the PF…
…noticed an unusually rapid de-rotation and then found he had difficulty in maintaining directional control despite using corrective rudder. The commander thought that the PF might be “riding the brakes”, a common error during training, and advised him to take his feet off the brakes. The PF, still unable to control the aircraft, attempted to use the steering tiller but when the commander noticed this he called out “no no don’t use the nosewheel steering”.
The PF recalled afterwards that he had considered using asymmetric thrust but did not think he had moved the thrust levers.
The aircraft ran off to the left side of the runway, at which point the commander realised the parking brake was on, and onto the grass, continuing for 120 m before coming to a halt.
In the confusion on the runway after touchdown, the thrust levers had been advanced and as the aircraft stopped the PF, realising they were forward, closed them.
The AAIB note that the throttle movement may have occurred inadvertently through an inadvertent coupled biomechanical reaction as the aircraft decelerated. Examination of the CVR and FDR confirmed that:
The autopilot was disengaged at about 80 ft aal and the aircraft touched down on the centreline. The aircraft started tracking right of the runway centreline and opposite rudder was used. The aircraft heading swung to the left of the centreline, skidding approximately along the centreline… Right rudder was applied but the yawing to the left continued. With a heading of between 15 and 30° to the left of the runway heading the thrust levers were advanced, slightly more left thrust than right. The aircraft carried on yawing to the left and the previous longitudinal deceleration was eroded. The divergence from the runway heading peaked at approximately 50° before starting to reduce, but with thrust applied the aircraft tracked to the left and went off the side of the runway with a groundspeed of approximately 45 kt. The aircraft was decelerating and as the groundspeed reduced to approximately 20 kt the thrust levers were brought back to IDLE.
The wheels were removed and examined on site:
The damage to all the main wheel tyres was similar and they were all deflated. The wear pattern on the tyres showed the tread surface abraded through leaving ragged edges and missing material. Abrasion then carried on symmetrically though the sidewalls over an approximately 140º arc down to the wheel rims.
There was also abrasion of some of the wheel rims where they had contacted the runway surface.
The interaction between the thrust, damaged wheels and the soft ground exacerbated the tendency of the aircraft to ‘fishtail’ before it eventually came to a stop.
The aircraft had been shut down and made safe by the crew with the parking brake left in the OFF position. During examination of the aircraft, the parking brake was operated and, with aircraft electrical power on, the parking brake indicator on the [lower right part of the] centre panel illuminated.
However, the nomenclature on the light did not appear to be as well defined as would be expected, consistent with one of its filaments having failed.
It was concluded that the parking brake had been selected instead of the speed brake and so the aircraft had landed with the parking brake ON.
Inadvertent application of the parking brake in flight is possible using the normal action of the handle, and there are no mechanical interlocks to prevent the wheel brakes locking the mainwheels.
The Emergency/Parking Brake handle has its own unique action and has a different appearance, feel and action to the nearby speed brake lever, and these characteristics should reduce the likelihood of inadvertent parking brake application in flight.
Once the parking brake has been inadvertently set, the extended position of the handle and the BRAKE ON indication light may alert crews to the condition. In this event, however, neither the extended handle nor the partially lit BRAKE ON light were noticed.
The aircraft manufacturer advised that within the ERJ family (E135/140/145) there had been two previous instances in which a landing occurred with the Emergency/Parking Brake set.
Neither of these incidents was investigated because neither resulted in a runway excursion.
In one incident the aircraft had the same panel layout as G-CKAG with the indicator situated out of the normal field of view of a pilot in the right seat. In the other case, the aircraft had a newer layout, with the indicator…
…higher on the centre panel, next to the landing gear selector lever and closer to the normal field of view, thereby providing an additional opportunity to notice that the light is on when lowering the landing gear”. Although this is likely to be a more effective position, the aircraft in one of the two previous events recorded had this configuration. Thus, there was insufficient evidence to draw conclusions about the effectiveness of the different panel layouts in preventing this type of accident.
In relation to certification:
The manufacturer’s aircraft systems safety case [sic: system safety assessment] classified the severity of landing with the parking brake on as major but the likelihood that it would happen due to a system fault was determined as 1 in 10-9 flight hours (extremely improbable) and therefore the risk was considered acceptable. The inadvertent selection of the parking brake while airborne was not considered…
The design requirement for FAA and EASA type certification is to consider possible system failure modes including the adverse effects of foreseeable errors during operation. This report has shown that inadvertent application of the parking brake does occur during operation, but there was not enough evidence to quantify the likelihood and, therefore, the risk associated with this type of operational error. Further, it was probably the application of power while the aircraft was on the runway which caused the aircraft to leave the paved surface, not the act of landing with the parking brake applied; in previous similar incidents, the aircraft have remained on the runway. The manufacturer stated that, in the circumstances, it did not intend to conduct a system review relating to the parking brake status.
The AAIB go onto discuss certain human factors concepts:
According to Harley (2014) there are many different types of speech error. Cognitive intrusion errors occur when material unrelated to the speech being produced intrudes into it. The names of objects or words noticed in the outside environment can intrude into speech. Internal thoughts not related to the intended speech can also intrude. People monitor their speech but not perfectly accurately. In many cases, when finishing speaking, a person may not be aware that they have made an error. Pincott (2012) stated that speech errors are very common. For every 1,000 words spoken, an individual may make one or two errors. Every day, most people make between 7 and 22 verbal slips. Stressors, such as distraction or time pressure, make verbal slips more likely.
Then specifically analyse:
The selection of the parking brake instead of the speed brake is an example of a slip, an appropriate action which is carried out incorrectly. There was a moment when the captain‑under-training might have resolved the situation, when he remarked on the speed brake having been ‘closed’, (comment, “who closed that”) but he did not explore the inconsistency further, perhaps because there were multiple interruptions on the flight deck and he was focussed on other tasks.
During the approach checklist the commander read out “park brake” instead of the second checklist item “seatbelt sign”. This is an example of a cognitive intrusion error and might indicate that on some level the commander had the parking brake in mind. The commander might have seen the illuminated parking brake indicator without consciously processing it and this unconsciously intruded into his speech. The speech error had the potential to trigger one or both crew members to check the status of the parking brake if they had noticed it. However, the checklist was interrupted immediately after this by an ATC instruction and this reduced the crew’s opportunity to notice the speech error. It was then not repeated the second time the checklist was carried out.
The accident arose as a result of the inadvertent selection of the Emergency/Parking brake instead of the speed brake. The levers are of similar shape and sited close to each other but with a different appearance and mode of action. There is also a brake on indicator light. These risk controls proved ineffective in preventing the inadvertent selection of the Emergency/parking brake both on this occasion and on at least two previous occasions. Once the parking brake had been set there were opportunities to detect and correct the error, but a busy flight deck environment together with a high workload contributed to it going unnoticed.
After touchdown, the aircraft may have remained on the runway surface but for the addition of forward thrust during the landing roll.
The operator has since revised the Landing Checklist in their Operations Manual to require the PF to confirm the parking brake is OFF.
UPDATE 16 February 2019: Unrelated Flybmi ceases operations
- British Midland Boeing 737-400 G-OBME Fatal Accident, Kegworth 8 January 1989
- AAIB: Human Factors and the Identification of Saab 2000 Flight Control Malfunctions
- Procedural Drift at Saab 340 Operator Leads to Taxiway Excursion
- Improvised Troubleshooting After Cascading A330 Avionics Problems
- Challenge Assumptions: ATSB on A330 with a u/s GPS
- Gulfstream G-IV Take Off Accident & Human Factors
- Confusion of Compelling, But Erroneous, PC-12 Synthetic Vision Display
- ATR 72 In-Flight Pitch Disconnect and Structural Failure
- C-130J Control Restriction Accident, Jalalabad
- B777 in Autoland Mode Left Runway When Another Aircraft Interfered With the Localiser Signal
- Distracted B1900C Wheels Up Landing in the Bahamas
- HF Lessons from an AS365N3+ Gear Up Landing
- B737 Speed Decay, Automation and Distraction
- UPDATE 17 March 2019: Easyjet A320 Flap / Landing Gear Mis-selections
- UPDATE 13 April 2019: Wrong Engine Shutdown Crash: But You Won’t Guess Which!: BUA BAC One-Eleven G-ASJJ 14 January 1969
- UPDATE 22 June 2019: Premature A319 Evacuation With Engines Running
And in particular:
Also see our review of The Field Guide to Understanding Human Error by Sidney Dekker presented to the Royal Aeronautical Society (RAeS): The Field Guide to Understanding Human Error – A Review
The first officer’s inadvertent activation of the parking brake in flight, which led to the airplane abruptly stopping and all four of its main landing gear tires deflating, and his use of a nonstandard procedure to cancel the airplane’s monitoring alert system.
On the A320 there are more indications when the brakes are ON:
The Electronic Centralized Aircraft Monitoring (ECAM) system is designed to monitor and advise the flight crew of the airplane’s status. According to the manufacturer, if the parking brake is engaged in flight, the ECAM illuminates the master caution light, a single chime audio associated with the master caution light is given after a 3 second delay, and a parking brake on advisory message is presented. At 800 feet above ground level (agl), the alerts associated with the parking brake selected on in flight, are reactivated by the ECAM, in the event the alert or master caution was cleared by the flight crew. The applicable hydraulic system also provides an indication that the parking brake was activated in flight by the braking pressure indicators becoming operational. However, normal checklists do not require an in flight check of the brake pressure indicators.
Unfortunately in this case:
On a follow up interview, the first officer described his personal technique where he would preempt the autopilot disconnect audio by selecting the ECAM emergency cancel pushbutton prior to disconnecting the autopilot and would hold it for several seconds afterwards. The autopilot disconnect warning audio (cavalry charge) is temporary and last a maximum of 1.5 seconds, if the autopilot is disengaged using standard procedures. Selection of the ECAM emergency cancel pushbutton would terminate the autopilot disconnect audio and any other present caution (master caution lights, ECAM alert message) for the rest of the flight. The alert would appear in the cancelled caution field on the status page and could be recalled if necessary. The operator’s procedure has a note to use the ECAM emergency cancel pushbutton only for spurious master cautions.
According to the manufacturer, if the ECAM emergency cancel pushbutton is selected prior to the parking brake on alert being displayed; the master caution light and single chime associated with the parking brake on alert would be inhibited. In addition, at 800 feet agl, the “parking brake on” alert message and master caution would not be reactivated. The ECAM emergency cancel pushbutton is not a parameter recorded by the DFDR.