Judgemental errors in aviation maintenance
- 192 Downloads
Aircraft maintenance is a critical success factor in the aviation sector, and incorrect maintenance actions themselves can be the cause of accidents. Judgemental errors are the top causal factors of maintenance-related aviation accidents. This study asks why judgemental errors occur in maintenance. Referring to six aviation accidents, we show how various biases contributed to those accidents. We first filtered aviation accident reports, looking for accidents linked to errors in maintenance judgements. We analysed the investigation reports, as well as the relevant interview transcriptions. Then we set the characteristics of the actions behind the accidents within the context of the literature and the taxonomy of reasons for judgemental biases. Our results demonstrate how various biases, such as theory-induced blindness, optimistic bias, and substitution bias misled maintenance technicians and eventually become the main cause of a catastrophe. We also find these biases are interrelated, with one causing another to develop. We discuss how these judgemental errors could relate to loss of situation awareness, and suggest interventions to mitigate them.
KeywordsJudgemental error Heuristics Aviation maintenance Situation awareness
Although their work is mostly “behind the scenes”, aircraft maintenance technicians have an invaluable role in safe aircraft operations, and their errors pose a significant and continuing threat to aviation safety. Maintenance errors have been the cause of numerous tragedies over the course of aviation history. Maintenance technicians are frequently required to make decisions, and “judgemental error” is a leading factor in unsafe maintenance and maintenance-related aviation accidents (e.g. Schmidt et al. 2000, 2003; Krulak 2004; Rashid et al. 2013; Illankoon et al. 2019a). For example, Krulak (2004) found around 60% of the aircraft mishaps due to maintenance could be traced to errors in human judgement. Studies use Human Factors Analysis and Classification system-Maintenance Extension (HFACS-ME) (Schmidt et al. 1999) and refer to Generic Error-Modelling System (GEMS) (Reason and Hobbs 2003) and skill-based–rule-based–knowledge-based (SRK) models (Rasmussen 1983) to explain causal factors. Although these methods find judgemental errors leading to maintenance errors, they do not uncover the underlying cognitive mechanisms.
Number of recent studies in various domains such as critical disasters (Murata et al. 2015; Brooks et al. 2019; Kinsey et al. 2019), financing (Taylor 2016; Zhang and Cueto 2017; Mittal 2019), scientific research (Baddeley 2015; East 2016), process hazard analysis (Baybutt 2016), clinical practices (Ryan et al. 2018; Dobler et al. 2019), tourist travel (Wattanacharoensil and La-ornual 2019), artificial intelligence (Nelson 2019), traffic accidents (Liu et al. 2019), and project management (Virine et al. 2018) discuss the biases those influence judgements, but none of the studies addresses maintenance domain. This study aimed to fill the gap by focusing on reasons for judgemental errors, and their connections to aviation maintenance errors. We also recommend interventions, drawing on the concept of situation awareness (SA) (Endsley 1995), which is a prerequisite for better decisions. Ultimately, our findings make an important contribution to aviation maintenance and to the field of human–machine interactions.
2 Literature review
2.1 Background to judgements
People often make judgments with limited information, and biases influence them. Reflective thinking can help eliminate the biases. But information limitations may not permit it. Certain situations may require careful analysis, but people may make automatic responses (Reason and Hobbs 2003), even when the information is available. Two types of automatic thoughts are skilled intuition and heuristic bias (Kahneman and Klein 2009): former is provoked by the prolonged opportunities to learn regularities (Klein 2008), the latter is triggered by simple rules that ignore information (Marewski et al. 2010); therefore, it is less likely to be accurate (Kahneman et al. 1982). People are generally unable to identify the type that dominates the judgements, and judgemental accuracy and confidence do not correlate consistently (Griffin and Tversky 1992).
2.2 Judgemental biases during maintenance
Three important phases in maintenance are anomaly detection, diagnosis, and prognosis. Once an anomalous behaviour is detected, diagnosis seeks the root cause, and prognosis predicts future behaviour. A suitable prescriptive action comes next. Judgemental bias offered in the literature can be related to all these phases.
An anomaly comes in the form of an outlier signal. Its detection is influenced by two types of “response bias” (Wickens 2002): detecting most of the signals but making false alarms (being liberal), and making few false alarms but missing many of the signals (being conservative) (e.g. Dube et al. 2010; Chen 2017). Excessive false alarms and subsequent no fault founds (NFF) can lead to the “cry wolf syndrome” (Wickens et al. 2015), where an individual neglects a genuine alarm, believing it to be faulty. “Inattentional blindness” is the inability to perceive what is sighted; the attention is paid to something else (Mack and Rock 1999). Although many other constructs such as “cocktail party effect” (e.g. Getzmann et al. 2016) and “change blindness” (O’Regan et al. 1999) influence anomaly detection, their connection to heuristics has been found not significant (e.g. Schoenlein 2017). A number of other factors can affect anomaly detection (see Illankoon et al. 2016).
Correct diagnosis requires weighing information and establishing their integrated meaning. However, people often do not weigh information based on their reliability; in fact, the reliability is less accessible (Tversky and Kahneman 1974). Affected by “Representativeness heuristics”, people match observed patterns with one of the possible symptoms learned from experience (Kahneman and Frederick 2002). More attention is paid to salience than to reliability and probability. With “availability heuristics”, more frequently or recently experienced events are associated to current event more easily (Kahneman et al. 1982). “Anchoring heuristics” is a phenomenon whereby people make incorrect estimates because of previously primed information (Tversky and Kahneman 1974). With “substitution bias” (Kahneman and Frederick 2002), people substitute and diagnose a less complex problem instead of estimating the probability of a more complex problem. With “confidence over doubt” (Kahneman 2011), people suppress ambiguity by constructing stories, suggesting causality where none exists. Once the cause of the anomaly is judged, “confirmation bias” (Fischhoff 1982) seek only the information that confirms the tentative judgement.
Prognosis requires making predictions about the behaviour of an anomaly. People are generally not very good at extrapolating non-linear trends and understanding the randomness in the environment. The “law of small numbers” (Tversky and Kahneman 1971) suggests people disregard the fact that small samples are more prone to extreme outcomes than large ones. Causality assumptions can imply coherent explanations of anomalies that are nothing more than coincidences. The “illusion of validity” (Rabin and Schrag 1999) makes people confidently believe their predictions that may be based on subjective experience rather than objective facts. On the other hand, if only the objective facts are trusted, a brief experience of an extreme outcome may lead to incorrect predictions.
Action selection often involves choices; therefore, heuristics play a role. “Temporal discounting” (Doyle 2013) leads people to choose options that maximize short-term gains. Some authors (e.g. Murata et al. 2015) use “loss aversion” as a substitution for temporal discounting. A different view of loss aversion comes from Tversky and Kahneman (1991); losses appear larger than gains when losses and gain are directly compared. “Theory-induced blindness” (Kahneman 2011) suggests that once someone has accepted a theory and used it as a tool of thinking, it is extraordinarily difficult to notice its flaws, so the same action will be chosen in another instance, disregarding the possible ineffective outcome. “Cognitive dissonance” (Festinge 1962) is the simultaneous existence of knowledge elements that do not agree; the result is an effort from the individual to make them, one way or another, better agree. The emotions of cognitive dissonances potentially destroy the drive for knowledge, thus can cause negative consequences. Authors discuss the dissonance effect in human–machine interactions when they encounter unprecedented situations (e.g. Vanderhaegen 2017; Vanderhaegen and Carsten 2017). “Hindsight bias” (Wood 1978) refers to a different type of retrospection of a choice of action; actions that seem careful, wise, and far sighted in foresight may appear irresponsible in hindsight. People affected by this bias often think they understand the past which implies the future should be knowable.
2.3 Taxonomies of judgemental biases
A taxonomy that remains influential today identifies 15 biases under three general heuristics: availability, representativeness, and anchoring (Tversky and Kahneman 1974). To assist the development of decision support systems, a latter taxonomy classifies 37 biases into memory, statistical, confidence, adjustment, presentation, and situation (Arnott 1998, 2006). Recent work presents 37 judgemental biases, classified according to key characteristics: heuristics and biases, biases under overconfidence, biases when making choices, and biases that hinder the self-reflection of a person’s thinking style (Kahneman 2011). These biases are driven by priming effect, cognitive ease, associative coherence, confirmation, halo effect, substitution, and affect. Recently presented general heuristics are representativeness, availability, and confirmation (affect) (Murata et al. 2015). Most recent review classifies heuristics and judgemental biases in five main categories: availability, representativeness, affect, familiarity, and excessive optimism and overconfidence (Peón et al. 2017).
2.4 Interventions for judgemental biases
Because the cognitive mechanisms are mostly hidden, reflective thinking can help avoid judgemental bias. However, naturalistic decision-making (NDM) researchers argue that humans cannot be perfectly rational (e.g. Klein 2008, Endsley 1988). Studies also find heuristics are sometimes both economical and effective (Gigerenzer and Todd 1999; Gigerenzer et al. 2008; Illankoon et al. 2018). Therefore, it is more appropriate to argue for a balanced intervention approach.
Heuristics prompt default “mental models” that imply default responses, inferences, or decisions (Gauffroy and Barrouillet 2009). Authors discuss the possible effects of the maintenance technician’s mental model of what should happen next (e.g. Reason and Hobbs 2003). An adequate mental model is a prerequisite for situation awareness (SA) (Sarter and Woods 1991). Schemata guide our attention to what is informative in a situation, rather than what is self-evident; they also guide our inference at the time of recall (Plant and Stanton 2013). Based on schemata and mental models, SA acknowledges a wide range of cognitive mechanisms (see Illankoon et al. 2019b) including deliberate thinking and autonomous thinking (Endsley 1995, 2015); therefore, decisions with SA may not be perfectly rational. While yet, SA demands explicit awareness for active information seeking (Endsley 2000), integrating and comprehending their meanings to project the future (Endsley 1988). This suggests that SA can help self-reflection about the underlying mechanisms of judgements.
Many environment elements give more or less impact to eight “demons” that hinder SA (Endsley 2004): attentional tunnelling, requisite memory traps, workload–anxiety–fatigue–stressors, data overload, misplaced salience, complexity creep, errant mental models, and out-of-the-loop syndrome. To defeat these demons, the system design should not be limited to hardware and software but consider human interactions (Endsley and Jones 2012). Previous studies have shown SA applicability in maintenance (e.g. Illankoon et al. 2019c). In this paper, using case studies, we tested the hypothesis “SA intervention can rectify the judgemental errors in maintenance”.
3 Data and methods
When the focus is on how and why questions in real-life context, such as in this study, case studies are useful (Yin 2009; Mills et al. 2010). Intrinsic and instrumental features of case study method allow a focus on the uniqueness or the generalizability of the case study results (Stake 2000). One single result can be released through multiple sources of evidence converging in a triangulating fashion.
3.1 Data source
We conducted an in-depth analysis of the hidden biases in few typical cases from the United States National Transportation Safety Board (NTSB); we do not intend to conduct a probability or cluster analysis (Gerring and Cojocaru 2016). The NTSB’s detailed investigations include those involving accidents or incidents that result in significant loss of life or physical damage, involve issues of importance to public safety, or have generated particular public interest. Investigation dockets contain factual information, conditions, circumstances, analysis, conclusions, most probable cause, and supporting information such as interview transcripts. We read the summaries and searched the word “maintenance” of the 89 NTSB reports published during 2000–2018, and found maintenance error contributing to 12 (13.5%). Further analysis was needed about judgemental errors.
3.2 Data analysis
Case analysis allows number of methods: constant comparative analysis (Lewis-Beck et al. 2004), classical content analysis (Bauer 2000), domain analysis (Kelly et al. 1996), pattern matching (Almutairi et al. 2014), explanation building (Mills et al. 2010), and taxonomic analysis (Onwuegbuzie et al. 2012). First, we read the 12 reports fully, and the maintenance errors were classified using HFACE-ME taxonomy: six cases were related to judgements and others were related to attention in recognizing conditions, task knowledge, and skills.
Third, we classified the contents according to the SA level failed: perception, comprehension, and projection (Endsley 1995) by comparing with the respective maintenance phases failed: anomaly detection, diagnosis, and prognosis (see Illankoon et al. 2019a). The exercise was independently carried out by two researchers. Finally, we selected applicable SA interventions from Endsley’s (2004) Designing for Situation Awareness: An Approach to User-Centered Design that provides a systematic methodology and 50 design principles to improve system users’ SA.
4 Results and discussion
We organized the case analysis of each accident in five stages. First, we selected a few potential heuristics. Next, we build an explanation using the case evidence matching each heuristic. We determine the underlying cognitive mechanism using triangulated evidence and graphically illustrate our conclusions. Finally, we explain what SA level was affected, and discuss the applicable SA interventions, those we mention within quotation marks.
4.1 Chalk’s Grumman G-73T flight 101 wing separation
On 19 December 2005, Chalk’s Grumman G-73T Turbo Mallard aeroplane, flight 101, crashed after its wings separated from the fuselage during the initial climb. The NTSB investigation (NTSB 2007) found pre-existing fatigue fractures and cracks in the lower skin of the wing and the wing structure. Chalk’s Ocean Airway’s maintenance program failed to identify the correct root cause of the crack; the cause was repetitively misjudged, and ineffective solutions had been applied. What underlying cognitive mechanisms led to this repeated misjudgement?
4.1.1 Evidence of substitution bias
Second, the maintenance supervisor recalled seeing the doubler repair several times during inspections, but he did not recall the repair being instructed or completed. The maintenance supervisor said NTSB that he thought the repair “must have been done prior to Chalk’s getting the aeroplane”; instead of trying to reach a detailed understanding, he was satisfied with a substitution. In general, such substitution takes place automatically. Because the question is difficult, an individual unknowingly substitutes the difficult question with a related but different question. This substitution is not evaluated using self-aware reflective thought. Notably, other evidence from the investigation suggests this was not an isolated substitution, but repeated substitutions. Therefore, the underlying cognitive mechanism may go beyond “substitution bias”.
4.1.2 Evidence of theory-induced blindness
People can become blind to the faults of a theory if they accept it as a thinking tool. They might even come across observations that do not seem to fit the theory, but still assume there is a missing but perfectly good explanation. By doing so, they give the theory the benefit of the doubt. In this case study, we find evidence of theory-induced blindness. First, NTSB’s review of maintenance work cards for the accident aeroplane from 2001 to 2005 found eight references to fuel leaks on the right wing. The director of maintenance held the position that fuel leaks were addressed before the plane was released. However, the flight logs showed the fuel leak discrepancies often took several attempts to resolve but recurred. The repetition of the issue was not considered as an indication of inaccurate diagnosis or ineffective solutions.
Second, NTSB observed sanding marks around the rear Z-stringer, indicating an attempt to remove the cracking. The cracking was not completely removed, and the crack continued to propagate over time. When the doubler was removed by NTSB during the investigation, three stop drill holes were found along the crack on the skin. This is a strong evidence that the skin crack was detected at least three times before the doublers were applied. Despite the repeated stop drill holes, the crack kept extending. Instead of using this observation to conduct a proper diagnosis, the maintenance technician selected the doubler solution. Apparently, he assumed there was a missing explanation for the continuing crack and theorized that the crack was constrained to the skin. Instead of considering the complexity of an on-going issue, a simplified problem (skin crack) was repeatedly addressed by applying stop drill holes and doublers. The theory-induced blindness was so strong, as the maintenance supervisor stated during the investigation that Chalk’s took a systematic approach to solve the discrepancies. This example shows that biases can persist even after the subject is made aware of them.
4.1.3 Evidence of temporal discounting
NTSB suggested that not properly addressing the structural failure was not an isolated issue. The airline’s financial difficulties have led to a reduction in operational and maintenance safety measures. Therefore, this case also provides evidence of management’s higher sensitivity to the financing required for proper maintenance actions than the long-term benefits of a safety culture. The evidence of the judgements from maintenance technician and supervisor suggests they were affected by the degraded safety culture.
4.1.4 Concluding judgemental bias
4.1.5 Relevance to SA
First, we recognize the dynamics involved in this accident: the repetitive failures (fuel leakages), maintenance requirements, and the demand to put the plane back into service (driven by financial instability) introduced dynamics to the problem. Second, frequent changes of aircraft status (i.e. introducing drill holes, sanding, applying doublers) introduced more dynamics. Therefore, SA is applicable; major issue is in diagnosing (level 2 SA—comprehension). Although the technician perceived the anomaly (the crack) and its behaviour (propagation), he did not develop a correct mental model. As a result, the technician failed to make a correct judgement about future behaviour. But how SA interventions can help?
SA recommends several interventions to develop a correct mental model. In this case, the interventions “presenting level 2 information directly” and “providing assistance for projection” are applicable. In fact, NTSB recommended developing and implementing a system of continuous analysis and surveillance. The intervention “providing system transparency and observability” would have reduced the complexity to understand the issue. Another SA intervention applies on supervisor’s failure to comprehend the purpose of the doublers; if the “transmission of SA within positions” was supported by “making status of elements and states overt,” this failure would have been avoided.
4.2 American Airlines DC-9-82 in-flight engine fire during departure
4.2.1 Evidence of temporal discounting
As we noted in “Sect.1”, loss aversion and temporal discounting are different. In loss aversion, people work harder to avoid losses than to achieve gains, whereas temporal discounting is about compromising long-term benefits in favour of short-term gains. This case study provides evidence of temporal discounting that is distinguishable from loss aversion. During the post-accident interviews, the maintenance personnel said the approved manual starting procedure was very time consuming, and the required specialized wrench had to be found because it is not a part of the standard tool kit. Therefore, the technicians usually chose to use a prying device to reach, depress, and hold down the ATSV’s manual override button. This ultimately caused bending of the internal pin in the left engine ATSV’s override. Execution of this unapproved procedure, disregarding the long-term damage, can be seen as an indication of “temporal discounting”. This case does not align with the notion of working harder to avoid losses than to achieve gains, thus not about loss aversion. In the absence of a suitable category in Kahneman’s taxonomy, we stick to “temporal discounting” as the underlying drive.
4.2.2 Evidence of theory-induced blindness
During the review of maintenance reports, NTSB found that the left engine ATSV had been replaced six times before the accident, in an effort to solve an on-going problem in starting the engine. However, none of the valve replacements solved the engine-start problem; maintenance personnel repeatedly used an unapproved starting procedure. The maintenance technician held the “theory” that the starting issue was inherent to the ATSV, but nothing beyond that; even the failure to solve the issue by repeatedly replacing the ATSV did not suggest an alternative proposition. The repeated attempts to manually override the ATSV were connected with the assumption of a missing explanation of an issue related to ATSVs: in other words, theory induced blindness. The NTSB investigation revealed the actual cause of the engine no-start condition: the disintegration of the air-filter element that blocked the airflow. All the troubleshooting efforts incorrectly focused on the ATSV and engine-start system wiring. Furthermore, the maintenance technician did not follow the procedure of cleaning the ATSV air filter, another example of temporal discounting. Overall, the maintenance technician missed the opportunity to identify the root cause of the engine no-start condition, held the induced, incorrect theory, leading to damage the internal pin of the starter valve.
4.2.3 Evidence of substitution bias
There was no troubleshooting guide for failure in the filter element. This increased the complexity of the issue, leading to the “substitution” with an alternative cause. Substitution bias leads to an estimation of the probability of a simpler issue. The engine ATSV issue that was tackled by replacing and forcing the override button was not essentially a simpler issue than the air-filter issue. However, the absence of the troubleshooting guide and lack of adherence to the correct filter cleaning procedure made it a complex issue.
4.2.4 Evidence of confidence over doubt
The repeated attempts to solve an issue perceived as constrained to the ATSV suggest “confidence over doubt” as a potential cause. Although a starter valve issue was doubtful because replacements did not solve the issue, the confidence was such that the problem was continually handled by manually overriding it. As Kahenman (2011) says, “confidence over doubt” is central to spontaneously constructed stories that are coherent enough to suppress the ambiguities. This confidence leads to errors of making connections where none exists. On the other hand, such confidence needs the ATSV replacement to solve the issue, at least by chance, but it did not. Therefore, we can question confidence over doubt, whether it is the real bias behind this error.
4.2.5 Evidence of representativeness heuristic
The ATSV had a history of electrical circuit issues, so their representativeness may be considered. When making a diagnosis, the human tendency is to match an observed case pattern against possible patterns of symptoms learned from experience. As Kahneman (2011) says, one key aspect of representativeness is the excessive willingness to predict the occurrence of unlikely events, driven by their (rare) occurrences. NTSB suggested that the intermittent nature of the fault, the history of previously occurring ATSV electrical circuit problems, and the lack of history of ATSV air-filter failures resulted in the misjudgement. The history of the ATSV electrical problem led to a representativeness heuristic, masking the possibility of the air-filter failure, which is the central cause of the failure.
4.2.6 Concluding judgemental bias
4.2.7 Relevance to SA
The filter issue was not a simple change of status; rather, it showed dynamic behaviour at an intermittent stage. It is also clear that the service environment was dynamic, demanding the fastest possible recovery of the faulty aeroplane. Therefore, SA is applicable. Comprehension of the cues was not successful; thus, level 2 SA was affected. An incorrect mental model was formed based on previous experiences with the electric circuit failure. “Attention tunnelling” restricted workers from looking beyond the ATSV, so they missed the opportunity to detect the issue with the air filter. In the absence of previous experience, this problem required detailed troubleshooting. In fact, NTSB recommended incorporating information about the relationship between the ATSV and handling the engine fire in the company’s training programs and also providing written guidance to facilitate the development of a correct mental model during such incidents. The real issue did not appear salient enough; there was no troubleshooting for the apparently simple yet complex filter problem. While too much information can cause data overloading, SA recommends “taking care in filtering information.” Absence of information should not imply a natural state. “Explicitly identifying missing information” would have helped avoid misdiagnosis. “Providing system transparency and observability” by creating some means to observe the filter element from the outside would have been helpful.
4.3 Alaska Airlines MD-83: loss of pitch control
4.3.1 Evidence of temporal discounting
Prevention of acme nut thread loss depends on two maintenance actions: regular application of lubrication, and recurrent inspections of the jackscrew assembly. These actions have deviated. First, we find deviations in the lubrication method. During the NTSB interviews, the mechanic indicated that the current lubrication task takes about 1 h. However, Boeing documents and testimony indicated that when properly done, the lubrication task should take more than 4 h. If the mechanic believed that lubricating only the acme nut fitting was adequate, the acme screw and nut would receive insufficient lubrication. Second, we find deviations in the lubrication interval. NTSB noted that Alaska Airline was using a lubrication interval of 8 months for the horizontal stabilizer trim system jackscrew assemble, which is more than 4 times longer than what it was in 1987. The originally recommended lubrication interval has not been considered during the decision-making process to extend the lubrication interval. NTSB also found that Alaska was the only US airline to have a calendar-time lubrication interval with no accompanying flight-hour limit and no specification “whichever comes first.” These facts suggest “temporal discounting”.
The NTSB statement supports temporal discounting: “Alaska Airlines expanded rapidly in the years before the accident. With the goal of becoming more profitable, as they became bigger and busier the pressures to keep their planes on schedule put increasing stress on their maintenance facilities” (NTSB 2002). In sum, the time spent on lubrication was four times shorter, and the lubrication interval was four times longer; this caused a severe lack of lubrication and excessive wear of the jackscrew. Thus far, the cognitive mechanism driving the misjudgement of the lubrication interval seems to be a case of “temporal discounting”. However, it is not clear whether the motivation for this dramatic reduction of lubrication was a short-term gain. Therefore, we consider a few more heuristics.
4.3.2 Evidence of optimistic bias
Besides the degraded lubrication, we find evidence that airline maintenance was optimistic about the condition of the jackscrew assembly. As mentioned above, the inspection period is an important criterion to monitor wear. However, Alaska Airlines extended the end play check interval, and the extension was approved by the FAA (Federal Aviation Administration). This allowed excessive wear of the acme nut threads of the jackscrew assembly without the opportunity for detecting it before the failure. While this seems to be influenced by optimistic bias, we could question the overall driving factor in the decisions to shorten the time of lubrication, to extend the lubrication interval, and to extend the inspection interval. Compromising standards to such extreme needs a very high level of confidence. Therefore, we continue to look for other biases.
4.3.3 Evidence of omitting subjectivity
NTSB assumed both Alaska Airlines and the FAA considered the absence of any significant maintenance history as a sufficient justification to extend the end play check interval. Thus, it is more likely that the absence of any previous issues led to the decision to extend the lubrication interval. Here, we find strong evidence of subjectivity being omitted in the decision to degrade lubrication. Omitting subjectivity provokes the kind of thinking whereby an object has only intrinsic objective value. The investigation revealed that another airline had acme nut wear rates up to 15 times greater than expected, attributed by inadvertent contamination of foreign particles in the lubrication. NTSB suggested it could be possible to have other unprecedented and unanticipated wear rates, and these could cause even more excessive or accelerated wear. The maintenance decision leading to degraded lubrication ignored this subjectivity. NTSB recommends in general, the absence of maintenance history should not justify an extended maintenance interval. Any significant maintenance change associated with a critical flight control system should be independently analysed and supported by technical data demonstrating that the proposed change will not present a potential hazard.
4.3.4 Concluding judgemental bias
Before concluding, we briefly consider a few more probable heuristics. Although the “availability heuristic” seems to be a candidate, it best explains an over-estimation based on what information is available. But the Alaska incident shows a lack of availability of previous issues. Incorrect estimation based on previous knowledge seems another possibility; however, the decision to extend the lubrication interval was consciously done based on a lack of previous occurrences.
4.3.5 Relevance of SA
The vital fact that was disregarded—the inconsistent behaviour of the jackscrew assembly—makes this case applicable to SA. The extended inspection interval prevented the opportunity to develop level 3 SA: predicting the useful life. The absence of inspection and subsequent lack of information led to a perception of a neutral situation; lack of previous occurrences led to an optimistic mental model of the jackscrew assembly. Global SA is about being aware of what is beyond the main action; however, in this case, we recommend “supporting global SA” as an applicable intervention; maintenance staff would have been made aware of the inconsistent jackscrew behaviour in other airlines. If someone questioned about the degraded lubrication, it would have been a useful representativeness of the excessive wear rates of other airlines. The degradation of the lubrication practice occurred gradually, over 13 years; if this gradual lubrication change had been “represented in timelines”, an observer might have questioned it.
4.4 Cessna Aircraft Company Cessna 310R in-flight fire
On 10 July 2007, a Cessna Aircraft Company 310R plane crashed while performing an emergency diversion. A day before the crash, an anomaly in the weather radar system developed into in-flight smoke, and the situation was brought under control by pulling the circuit breaker; incident had been formally documented. The NTSB determined that the probable causes of the accident were the decisions of management and maintenance personnel to allow the aeroplane to be released with the known and unresolved discrepancy in the weather radar, and the pilots’ decision to operate the aeroplane with that known discrepancy (NTSB 2009b).
4.4.1 Evidence of optimistic bias
Although neither diagnosis nor maintenance action was taken to address the discrepancy reported the day before, the aeroplane had been released for flying. The investigation also found that, during the accident flight, one of the pilots reset the weather radar circuit breaker, which is consistent with the routine checklist. Apparently, there was no discussion or decision about any precautions when resetting the circuit breaker of the (faulty) radar system. Ultimately, NTSB found that the restored electrical power to the weather radar system is what resulted in the in-flight fire. Despite the known discrepancy in the radar system, a high level of optimism may have downplayed the severity of the issue. Optimistic bias is mainly driven by neglecting what is not known. Interestingly, the case evidence suggests the information was simply neglected even though it was available. Furthermore, this case is unique because the judgemental error was made collectively, so we consider heuristics that apply to a group of decision-makers.
4.4.2 Evidence of trusting expert intuition
Experts often overlook what they do not know (Kahneman 2011). In this case, several experts overlooked the information that was available to them. The potential for an error usually increases when someone is misled by rest of the “experts”. We find evidence supporting both overlooked information and mutual misleading. As per the interview transcripts, the director of maintenance (DoM) said that on the day before the accident, the pilot told him that he smelled something; he pulled the radar circuit breaker and continued uneventfully. However, the DoM did not recall seeing the written discrepancy form for this, and he did not have the document in his office; he did not know whether the chief pilot of the accident ever saw the discrepancy form. Apparently, the DoM’s knowledge of the discrepancy of the radar system was limited to what he heard from the previous pilot.
The technician had verbally informed the pilot involved in the accident about the radar problem. The technician said that the pilot replied, “I know about the radar, I know about the circuit breaker, I don’t give a (expletive deleted) about that, I’m taking the aeroplane.” Although the pilot implied he knew about the problem, the level of his knowledge was incomplete. Although he did not have a discrepancy form, it is clear that the DoM knew about the smoke incident, and it was the disconnection of the circuit breaker that temporarily resolved the issue. However, the accident pilot’s narrative does not indicate that he precisely knew about the smoke; this information seems to be not available to him. The DoM said that when the chief pilot asked if the aeroplane could be flown, the three of them (DoM, pilot, technician) collectively made a decision: “The group agreed it was good to go.” The intuitive decision to use the aircraft seems to have been influenced by agreement among experts who overlooked the available information.
4.4.3 Concluding judgemental bias
4.4.4 Relevance of SA
This case represented a failure to diagnose an issue and project the near future. Comprehending the relevant information was challenged by the dynamic conditions imposed by service demands and changing aircraft behaviour. Therefore, SA is applicable. Three “experts” seemed to be driven by strong intuitions; there is no evidence of enough deliberation to build a correct mental model of the situation. Attention tunnelling was strong, and the information known to be available was disregarded. Misplaced salience about the previous fire played a key role in this accident. An auxiliary system issue was not perceived as a potential cause for a disaster. Despite the recent occurrence, no schema was activated about the risk of resetting the weather radar circuit breaker. Therefore, the central issue is the absence of data salience. SA theory suggests the need to “support the right trade-off between goal-driven and data-driven” interventions; in this case, to create the right balance between the flight goals, and airworthiness. The reason for the previous fire was uncertain, so the data should have been interpreted as “salient in support of uncertainty”. If the circuit breaker had been labelled for caution after the previous in-flight fire, making the “critical cues salient for schema activation”, resetting of the weather radar circuit breaker might have been avoided.
4.5 Sundance Eurocopter AS350-B2: loss of control and unexpected descent
4.5.1 Evidence of theory-induced blindness
FAA regulates that any removable fastener whose loss could jeopardize the safe operation of a helicopter must incorporate two separate locking devices. For the helicopter in question, the first locking device is the self-locking nut, and the second is the split pin (Fig. 9). Although Eurocopter’s standard practice does not require that the nut always be replaced when the bolt is replaced, the standard practice requires this be done if the nut does not meet the torque limits. After the accident, NTSB found half of the self-locking nuts from the 13 helicopters examined had no locking capability. At the time of the accident, the maintenance personnel seem to be reusing self-locking nuts that did not meet the minimum prevailing torque value, but why?
The case evidence suggests that “theory-induced blindness” had affected the nut checking process. The mechanic seemed to be referring to a theory of airworthiness that deviated from FAA and Eurocopter recommendations. During the post-accident interviews, he indicated that when determining whether a nut can be reused, he removes it, cleans it, and then inspects it for cracks, damage, or discolouration. The mechanic said he then threads the nut on the bolt to see if it will thread all the way down, and if he is able to turn the nut down to where the shank is visible, he replaces the nut. Driven by this theory, the mechanic deemed the hardware of the helicopter to be airworthy. However, there was no evidence that he properly assessed the minimum prevailing torque value. The quality control inspector was endorsed by the same theory. As might be explained in a situation of theory-induced blindness, the possible difference between the subjective and objective torque values was neither expected nor studied. Apparently, the technician and the inspector gave this theory the benefit of the doubt and accepted it.
4.5.2 Evidence of temporal discounting
NTSB also concluded that the split pin was likely incorrectly installed. Evidence from the investigation suggests this failure was an effect of compromising long-term safety benefits to make short-term financial gains. A review of Sundance records revealed some previous events supporting temporal discounting; for example, the QC inspector (acting as a mechanic) failed to properly re-install a component of Sundance’s helicopters. A contributing factor was the perception of the need to expedite the repair to avoid aircraft downtime.
4.5.3 Evidence of overconfidence: an illusion of validity
The evidence about the ice shield also suggests hindsight bias: “People who know the outcome of a complex prior history of tangled, indeterminate events, remember that history as being much more determinant, leading inevitably to the outcome they already knew” (Weick 1993). The mechanic would have assumed the missing or improperly installed split pin as much more determinant. However, we exclude a further discussion of hindsight bias, because no evidence suggests that mechanic had former experiences of missing split key for him to assume it as a determinant.
A second example of the illusion of validity comes from the DoM. His understanding was that the operators must meet the experience and factory training requirements “collectively,” rather than having them individually meet the requirements; NTSB noted this as a misinterpretation. The DoM showed confidence in his belief, saying the safety audits did not identify any issue. As Kahenman (2011) says, the confidence a person has in opinion reflects the coherence of the story; in this case, the (mis)interpretation was related to the audit results, as it did not find a deviation.
4.5.4 Concluding judgemental bias
4.5.5 Relevance to SA
Expedited repairs with extended work hours suggest dynamic work situations, thus the applicability of SA. This case points to a loss of SA on different levels at two distinct stages. The insecure split pin was a failure to detect the anomaly. Reusing the inferior lock nut was a failure to project the remaining useful life. The mental model on the reusability of the nut was not correct; what was shared within the team, thus reducing an opportunity to question it. The intervention “support transmission of SA within positions by making the status of elements and states overt” is applicable to this case; instead of simply deciding to tighten the nut by hand, measuring the minimum prevailing torque value could objectively assess the nut.
The split pin is a critical component, so information on its secure installation should have been salient. The insecure installation of the split pin and the later inability to remember how the ice shield obstruction was overcome are both indications of misplaced salience. The intervention “make critical cues for schema activated salient” would have secured the critical installing of the split pin. For example, a caution displayed at the installation point could activate schema related to criticality of the split key. As NTSB saw it, this case was affected by the mechanic’s and inspector’s fatigue; along the same lines, the SA demon “workload, anxiety, fatigue, and stressors” recognizes the negative impacts of fatigue on developing the correct SA.
4.6 Air Midwest Beechcraft 1900D Flight 5481: loss of pitch control
On 8 January 2003, Air Midwest flight 5481 crashed shortly after taking off from Charlotte, North Carolina. NTSB established that after taking off, the pilots were unable to control the pitch of the aircraft. NTSB found two major reasons for the crash (NTSB 2004): the aircraft was overloaded, and the elevator control system did not have the full range of operation (nose-down travel). Further investigation revealed that before the maintenance check, the aeroplane’s full range of downward elevator travel was available. However, evidence showed that after the maintenance check, the aeroplane’s downward elevator travel was limited to about 50% of what was specified. Therefore, NTSB concluded the aeroplane’s elevator control system was incorrectly rigged during the maintenance check, restricting about one-half of the downward travel. NTSB found several causes for the maintenance error; our interest is in finding the underlying mechanisms of the decisions to skip maintenance steps and the quality assurance inspector’s failure to detect the incorrect rigging of the elevator control system.
4.6.1 Evidence of theory-induced blindness
During the maintenance check, the mechanic determined that the aeroplane’s cables needed to be adjusted because their average tension was too low. However, there were no provisions for adjusting the cable tension as an isolated task; the complete procedure for the elevator control system rigging should have been followed. Here, it seems the mechanic and the quality inspector were driven by a theory of simplified tension adjustment. Regardless of the standard complete rigging procedure, the mechanic decided to adjust the cables as an isolated task. He said he adjusted the cables and performed some, but not all, of the steps of the elevator control system rigging procedure. The mechanic also stated that he and the quality inspector discussed the low cable tension, the need to adjust the tension, and nine steps that could be skipped. But what was the driving mechanism for this judgement?
During a post-accident interview, the quality inspector said he did not think the manufacturer intended mechanics to follow the entire rigging procedure, and the entire procedure had not been followed when past cable tension adjustments were made. The gains and losses of this simplified method were not evaluated against those of the standard process. As Kahneman (2011) says, in theory-induced blindness, the impact of gains and losses is assumed not to matter, so they are usually not examined. When someone changes his or her mind about a previously believed error, he/she can not remember why the obvious was not seen (Kahneman 2011); NTSB report shows closely related evidence. The step of calibrating the flight data recorder (FDR) would likely have alerted the mechanic or the quality inspector that the elevator control system was not properly rigged. However, the mechanic said he skipped this step because he thought the FDR calibration did not need to be done; the quality inspector said he did not think an FDR was installed on the aeroplane. However, NTSB provided several reasons why the inspector should have known the aeroplane was equipped with an FDR, suggesting the possibility of mechanic’s blindness to a theory of the simplified process.
Moreover, it is apparent that the mechanic and the quality inspector were “blind” of their authority levels; they were not permitted to decide whether a specific step given in the maintenance manual could be skipped. We also find evidence of “stories” attempting to justify the theory. During a post-accident interview, the mechanic said he moved the trim tabs through a full range of motion using the electric and manual systems and observed no anomalies. However, NTSB said without a detailed procedure to ensure trim tabs are moving in the proper direction, it is possible that the trim tabs could move in a reversed direction and remain unnoticed.
4.6.2 Evidence of optimistic bias
As suggested by the case investigation, the quality inspector was optimistic about the mechanic’s skills. The mechanic had previously done flight control rigging work, but not on a model of the accident aircraft, he was receiving on-the-job training, under the quality inspector. After they decided to skip the steps, the mechanic indicated that the quality inspector left to attend to other duties. During the NTSB interview, the quality inspector stated that he did not think he needed to supervise the mechanic closely, because of his previous flight control rigging experience. As per NTSB, when a quality inspector provides on-the-job training for a required inspection item and then inspects that same task, the independent nature of the inspection is compromised. Therefore, one of the NTSB recommendations was to prohibit quality inspectors from performing required item inspections on any maintenance task for which they have provided on-the-job training to the mechanic accomplishing the task.
4.6.3 Concluding judgemental bias
4.6.4 Relevance of SA
Neither the inspector nor the mechanic had a correct mental model about the pitch control mechanism; they missed the chance to detect the anomaly because they skipped the procedure, including FDR calibration. Operators may organize their knowledge of system components and interrelationships on different levels of detail; these may differ considerably from the actual system and may even constitute wrong knowledge (Moray 1990). The inability to see several cues about the presence of FDR might be connected with attention tunnelling, as the focus was limited to the tension adjustment. “Mapping system functions to the goals and mental models of users” looks like a potential SA intervention. This intervention suggests providing direct support to help the user to create a mental model of the system. However, in understanding the system behaviour, the mechanic’s role goes beyond the user’s role; it is comparatively more difficult to design provisions for mechanic’s mental model than for operator’s mental model. This points to the inherent cognitive challenges of maintenance. Ultimately, “providing system transparency and observability” is a better SA resolution. In addition to the schematics in the maintenance manual, designers could make the interconnections of the elevator control system more visible, to avoid isolated tension adjustments.
4.7 Summarized findings
Summary of judgemental errors in aviation maintenance and underlying biases
Respective SA level failed
Type of judgemental error (HFACS-ME)
Biases for judgemental errors (Kahneman’s taxonomy)
Chalk G-73T wing separation
Diagnosing the wing crack
Level 2 (comprehension)
American Airline DC 9-82 engine fire
Diagnosing the engine starting issue
Level 2 (comprehension)
Alaska airline MD-83 loss of pitch control
Predicting the useful life of the jackscrew assembly
Level 3 (projection)
Cessna 310R in-flight fire
Diagnosing the smoke
Level 2 (comprehension)
Predicting the reusing effects
Level 3 (projection)
Trusting expert intuition
Sandance AS350-B2 helicopter main control rod separation
Predicting the locknut’s useful life
Level 3 (projection)
Detecting the missing split pin
Level 1 (perception)
Illusion of validity
Air Midwest Beechcraft 1900D loss of pitch control
Detecting the rigging issue
Level 1 (perception)
Exceeded ability to judge
As far as we know, there are no previous studies about the underlying cognitive mechanisms driving the judgemental errors in maintenance. Our study bridges this gap. Previous studies in other domains identify the heuristics of judgemental error, but they do not propose interventions, and their conclusions usually imply human-centric issues. In this respect, our study has further implications. We propose interventions by linking judgemental errors and heuristics with the SA concept. SA suggests interventions to improve explicit awareness, thus helping reflectivity and reducing erroneous thinking shortcuts. We also showed SA “demons” are closely related to heuristics and judgemental bias. For example, data overload and complexity creep can lead to thinking shortcuts; attention tunnelling can be a result of confirmation bias; misplaced salience is connected with representativeness and availability; an errant mental model is related to theory-induced blindness. Therefore, SA interventions are useful to avoid heuristics bias and judgemental errors. In some cases, maintenance has inherent challenges for SA interventions, such as mapping system functions to the mechanic’s goals and mental models. We conclude that although human judgements can be misled by mental shortcuts, there are ample possibilities for system intervention to ease cognitive demand and encourage more reflective thinking. Avoiding judgemental errors is not only about human, but also how the system is designed.
Open access funding provided by Lulea University of Technology. This project is a part of the human factors research at the Division of Operations and Maintenance, Luleå University of Technology, funded by the Luleå Railway Research Centre (JVTC).
- Arnott D (1998) A taxonomy of decision biases. Monash University, School of Information Management and Systems, CaulfieldGoogle Scholar
- Brooks B, Curnin S, Owen C, Bearman C (2019) Managing cognitive biases during disaster response: the development of an aide memoire. Cognition, Technology & Work, pp 1–3Google Scholar
- Chen T (2017) Not just noise: individual differences in cognitive ability and response bias. Dissertations, University of Massachusetts, AmherstGoogle Scholar
- Doyle JR (2013) Survey of time preference, delay discounting models. Judgm Decision Mak 8(2):116–135Google Scholar
- Endsley MR (1988) Design and evaluation for situation awareness enhancement. In: Proceedings of the human factors society 32nd annual meeting, human factors society, Santa Monica, pp 97–101Google Scholar
- Endsley MR (2000) Theoretical underpinnings of situation awareness: a critical review. In: Endsley MR, Garland DJ (eds) Situation awareness analysis and measurement, Mahwah, NJ, pp 3–32Google Scholar
- Endsley MR (2004) Situation awareness: progress and directions. In: Banbury S, Tremblay S (eds) A cognitive approach to situation awareness: theory, measurement and application. Ashgate Publishing, Aldershot, pp 317–341Google Scholar
- Endsley MR, Jones DG (2012) Designing for situation awareness: an approach to human-centered design, 2nd edn. Taylor & Francis, LondonGoogle Scholar
- Gigerenzer G, Todd P (1999) Simple heuristics that make us smart. Oxford Univ. Press, OxfordGoogle Scholar
- Illankoon P, Tretten P, Kumar U (2018) Identifying significance of human cognition in future maintenance operations. In: International conference on intelligent human systems integration. Springer, Cham, pp 550–556Google Scholar
- Kahneman D (2011) Thinking, fast and slow. Macmillan, LondonGoogle Scholar
- Kahneman D, Frederick S (2002) Representativeness revisited: attribute substitution in intuitive judgment. Heuristics Biases Psychol Intuitive Judgm 49:81Google Scholar
- Kahneman D, Klein G (2009) Conditions for intuitive expertise: a failure to disagree. Am Psychol 80:237–251Google Scholar
- Kelly TP, Lam W, Whittle BR (1996) Diary of a domain analyst: a domain analysis case-study from avionics. In: Proceedings of IFIP Working Groups 8.1/13.2 Conference, Domain Knowledge for Interactive System Design, Geneva, pp 8–10Google Scholar
- Krulak DC (2004) Human factors in maintenance: impact on aircraft mishap frequency and severity. Aviat Space Environ Med 75:429–432Google Scholar
- Mack A, Rock I (1999) Inattentional blindness. MIT Press, CambridgeGoogle Scholar
- Nelson GS (2019) Bias in artificial intelligence. N C Med J 80(4):220–222Google Scholar
- NTSB (2002) Accident Report NTSB/AAR-02/01, PB2002-910402. https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR0201.pdf. Accessed 14 Nov 2018
- NTSB (2004) Accident Report NTSB/AAR-04/01, PB2004-910401. https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR0401.pdf. Accessed 11 Feb 2019
- NTSB (2007) Accident Report NTSB/AAR-07/04, PB2007-910405. https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR0704.pdf. Accessed 27 Nov 2018
- NTSB (2009a) Accident Report NTSB/AAR-09/03, PB2009-910403. https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR0903.pdf. Accessed 16 Jan 2019
- NTSB (2009b) Accident Report NTSB/AAR-09/01/SUM, PB2009-910401. https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR0901.pdf. Accessed 16 Nov 2018
- NTSB (2013) Accident Report NTSB/AAR-13/01, PB2013-103890. https://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1301.pdf. Accessed 27 Nov 2018
- Reason J, Hobbs A (2003) Managing maintenance error: a practical guide. Ashgate Publishing Company, BurlingtonGoogle Scholar
- Schmidt JK, Figlock RC, Teeters CD (1999) Human factors analysis of naval transport aircraft maintenance and flight line related incidents (No. 1999-01-2981). SAE Technical PaperGoogle Scholar
- Schmidt JK, Lawson D, Figlock R (2003) Human Factors Analysis & Classification System–Maintenance Extension (HFACS–ME) Review of Select NTSB Maintenance Mishaps: An UpdateGoogle Scholar
- Schoenlein M (2017) Assessing the Relationship Between Change Blindness and the Anchoring Effect. Honors Projects. 245. https://scholarworks.bgsu.edu/honorsprojects/245. Accessed 5 Mar 2019
- Stake RE (2000) Case studies. In: Denzin NK, Lincoln YS (eds) Handbook of qualitative research. Sage, Thousand Oaks, pp 435–453Google Scholar
- Taylor J (2016) Cognitive biases are bad for business: industry insights. Prof Account 1(27):24–25Google Scholar
- Virine L, Trumper M, Virine E (2018) Heuristics and biases in project management. PM World J 7(1):1–11Google Scholar
- Weick K (1993) Sensemaking in organizations: small structures with large consequences. In: Mumingham J (ed) Social psychology in organizations: Advances in theory and research. Prentice-Hall, Englewood Cliffs, NJGoogle Scholar
- Wickens TD (2002) Elementary signal detection theory. Oxford University Press, OxfordGoogle Scholar
- Wickens CD, Parasuraman R, Simon B, Hollands JG (2015) Engineering psychology and human performance, 4th edn. Routledge, LondonGoogle Scholar
- Yin RK (2009) Case study research: design and methods, 4th edn. Sage, Thousand OaksGoogle Scholar
Open AccessThis article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.