Generating Design Requirements for Flight Deck Applications: Applying the Perceptual Cycle Model to Engine Failures on Take-off

Figures & data

Figure 1. Representation of the PCM adapted from .Plant and Stanton (2012)

Table 1. PCM processes for the single and dual engine failure, coded to the phases on the incident

Incident Phase	Single Engine Failure	Dual Engine Failure
Pre incident	WORLD: 0. Emergency turn procedure briefing (PF+PM) 0. Weather update on the ground (PF+PM)
Onset of incident	WORLD: 1. Bird-strike to engine (PF+PM) SCHEMA: 2. Startle/surprise effect (PF+PM) ACTION: 3. Fly the aircraft (PF)
Immediate response	ACTION: 4. Monitor engine indicators (PM+pf) WORLD: 5. Evidence of bird-strike (PM+pf) SCHEMA: 6. Assess information and generate expectations (PF+PM)
	ACTION: 7. Cross confirmation between pilots (PM+PF)	ACTION: 7. Captain takes over flying the aircraft (PF) 8. Action Emergency Turn procedure – if required, or appropriate intervention of aircraft path (PF) 9. Call ATC- May Day (PF)
Decision Making	ACTION: 8. Determine the severity of the damage and required actions (PM+PF) WORLD: 9. Information on engine failure severity (PM + pf) (Engine indicators, ECAM/EICAS, message, Visual from cabin crew) SCHEMA: 10. Knowledge of what indicator determine about engine failure severity (PF+PM) 11. Response to single engine failure on take-off is regularly trained (PF+PM)	ACTION: 10. Determine the severity of the damage and required actions (PF+PM) WORLD: 11. Information on engine failure severity (PM+pf) SCHEMA: 12. Knowledge of what indicators determine about engine failure severity (PF+PM) 13. Limited training for dual engine failure on take-off (PF+PM)
Subsequent Actions	ACTION: 12. Action Emergency Turn procedure – if required (PF) 13. Run through memory checklist items (PF+PM) 14. Call ATC- MayDay/Pan (PF) 15. (a) Run through physical checklist items (ECAM/QRH) actions (PF+PM) WORLD: 15. (b) Physical checklist (ECAM/QRH) (PF+PM) SCHEMA: 16. Use any knowledge on local environment/airports for landing (PF+PM)	ACTION: 14. (a) Run through checklist actions (PM+pf) WORLD: 14. (b) Physical checklist (ECAM/EICAS) (PM+pf)
Incident Containment	ACTION: 17. Decide to shut engine down and turn back (T-DODAR) (PF+PM) 18. Communication to ATC (PM) 19. (a) NITS briefing (PM) WORLD: 19. (b) Landing space (PF+pm) ACTION: 20. Calculate landing distance (PM+pf) 21. Review Brief and prepare for landing (PF+pm)	SCHEMA: 15. Use any knowledge on local environment/airports for landing (PF+PM) ACTION: 16. T-DODAR: Time, Diagnose, Options, Decide, Assign, Review (PF+PM) 17. Land the aircraft in best possible location (PF+pm) WORLD: 18. Landing Space -Window, Nav display, ipad (PF+pm)

Table 2. Frequency of pilots that reported recommendations coded to the SAW subtypes across each of the incident phases

SAW Subtype	Incident Phase
	Pre-incident	Onset of incident	Immediate response	Decision Making	Subsequent Actions	Incident containment
Severity of problem				6	2
Display indicators				4	1
Communicated information					3
Aircraft status				1
Technological conditions					1

Table 3. Specific user design recommendations for the functionality of the engine monitoring tool

Recommendation	User Quote (participant number in brackets)	SAW subtype
Decision Making phase
Information on where the damage is and the state of damage. Assistance telling you which engine is more severely damaged in the dual engine scenario and if one can still be used. Prioritization of engine failure for the dual engine scenario Less ambiguity on state of damage.	“It’s sometimes a little bit ambiguous as to if there has been damaged, so really something to say yes, there’s been damage or no, there hasn’t been damaged and just sort of put that in a box for you” (P2) “All decisions are based on assumptions at this point because you don’t know what has happened for sure (where it has happened, what it has hit, strength of impact etc).we would want to know where it has hit and some form of severity” (P1)	Severity of problem
Present as a message on the status page or engine parameters page. A single button, on the EICAS/ECAM existing system would bring up the information on a separate page Camera view of the engine to see the extent of the damage	“I would think it would be part of the normal EICAS” (P5) “there is a little console with a few buttons you can push and you can bring up the engine parameters page and probably just presented there somewhere, somewhere on either the ECAM status page or the engine on the engine page.” (P6) I would have a little camera at the side of my plane pointing toward the engine that I can just see at my screen … then I know if I’m on fire or if part of my engine is falling off” (P3)	Display indicator
Information on deformation of the fan blade could let you determine if that was causing vibration and if it was severe damage	“If you’ve got the same amount of fan blade, but it’s deformed and that’s causing the vibration … or if you lost anything, you can probably monitor the mass of the of the fan blades. Then that will be an indicator to if you have caused any severe damage and lost anything weight wise um then you know that there was severe damage to your engine rather than just a deformation which would be causing vibration” (P5)	Aircraft status
Subsequent Actions phase
Information on safe to relight would be useful so know if you can continue.	“maybe just as a message that says … this part of the engine is damaged beyond repair. That would give you a good indication of whether it would be wise to attempt to restart … with the information we’ve got right now the key is to give you enough without overloading you” (P6)	Severity of problem
Indicators inform if engine is still usable when faced with the dual engine scenario	“give you a warning that actually turning off an engine that it’s on fire, but it’s still kind of still kind of works is not necessarily the desired result” (P2)	Display indicators
Inform on the best cause of action e.g., bring up a checklist of what to do	“it could say it is severe damage … .and then it would bring up the severe damage checklist or it could say over temp and brings out the checklist to throttle it back … all I want it to do is tell me what checklist.” (P4)	Communicated information
Status message on what the systems are processing and place it on the EICAS/ECAM	“if the system told you that: engines failed, we are attempting to do a relight of this particular engine. A status message to that effect would be quite useful, I think” (P8)	Technological conditions

Figure 2. PCM of an engine failure due to bird-strike showing the placement of user design recommendations.

Table 4. General design recommendations for the presentation of the information from an engine monitoring tool

General Recommendation	User Quote (participant number in brackets)
Keep it simple	“Pilots don’t want to be overwhelmed with engineering information” (P1)
Give guidance on what actions to take next	“If manufacturers were to put it in, it would have to then specify what they want [us] to do” (P1)
Has to be trustworthy	“It would have to be like EICAS a totally trustworthy thing” (P4)
Any additional information system would have to associated training, especially in these high workload scenarios	“I think if you start introducing a lot more information to the cockpit, there’s got to be a corresponding training element and by training that, it becomes something else to do in a fairly high workload scenario” (P8)
Do not overload with too much information	“I actually don’t think in this situation that more information is of any benefit … One more decision to try and make about whether or not I should keep the engine limping along or not” (P8) “too much information isn’t necessarily good thing” (P2) “remember I want to have a clear mind. I don’t want to be bamboozled with a lot of information” (P4)
Don’t tell them what to do, only guide	“you need to think, so if you get too much information … If it would say like shut down engine now … It would stop people thinking completely” (P3)
Don’t make it too technical	“The thing is the problem, if you make it too computerized, it makes it less usable” (P3)

Table

Taxonomy subtype	Description
Schema Subtypes
Vicarious past experience	Statements relating to experiencing something in the imagination through the description by another person (e.g., hearing a colleague recall an incident they were involved with) or documentation (e.g., reading about a certain event in an industry magazine or incident/accident report)
Direct past experience	Statements relating to direct personal experience of similar events or situations in the past. This covers events experienced in live, operational contexts as opposed to those experienced through training.
Trained past experience	Statements relating to knowledge developed by direct personal experience of a specific task, event or situation, experienced within the confines of a training scenario (e.g., ground school training, simulator training or training sorties) Statements relating to a schema that manifests as a descriptive knowledge of facts, usually as a product of the world information available
Declarative schema	Statements relating to comparisons between things for the purpose of explanation and clarification. Typically these analogies will be structural analogies of physical objects or states of affairs in the world (akin to mental map or mental model)
Analogical schema	Statements relating to inadequate or lacking knowledge, i.e. a schema is not developed for a certain situation
Insufficient schema	Statements relating to experiencing something in the imagination through the description by another person (e.g., hearing a colleague recall an incident they were involved with) or documentation (e.g., reading about a certain event in an industry magazine or incident/accident report)
Action Subtypes
Aviate	Statements relating to direct manipulation (handling) of flight controls in order that the aircraft can be flown and safety is maintained
Navigate	Statements relating to the process of accurately ascertaining position and planning and following a route or desired course
Communicate	Statements relating to the sharing or exchange of information
System management	Statements relating to the processes of making an input into technological systems in order that the interaction or manipulation has an explicit output
System monitoring	Statements relating to looking at (observing, checking) displays to gain an understanding of the situation
Environment monitoring	Statements relating to observing or checking the internal or external physical environment in order to establish the current state-of-affairs
Concurrent diagnostic action	Statements relating to the process of determining, or attempting to determine, the cause or nature of a problem by examining the available information at the time the incident is occurring
Decision action	Statements relating to a conclusion or resolution that is reached after considering the available information
Situation assessment	Statements relating to actions that relate to the evaluation and interpretation of available information
Non-action	Statements relating to actions that were not performed, either because the situation didn’t warrant a particular action or because equipment faults did not allow a particular action to be performed or because the pilot made an error or omission.
Standard Operating Procedure	Statements relating to following the prescribed procedure that ought to be routinely followed in a given situation
World Subtypes
Natural environmental conditions	Statements about natural environmental conditions (e.g., weather, light, temperature, noise)
Technological conditions	Statements relating to the state of technological artifacts (e.g., with regards to appearance and working order)
Communicated information	Statements relating to information available to the pilot from other people (e.g., other crew members, ATC, coastguard etc.)
Location	Statements relating to particular places or positions
Artifacts	Statements discussing physical objects, including written information, symbols, diagrams or equipment
Display indications	Statements relating to the information elicited from the physical artifacts
Operational context	Statements relating to the routine functions or activities of the organization (e.g., Search and Rescue, Police search, military training etc.). This can include statements about the importance of being serviceable for the operational context or crew familiarity with the aircraft and how this effects decision making.
Aircraft status	Statements relating to the current status of the aircraft’s integrity or performance (e.g., how good or bad it is flying, the current configuration of the aircraft, autopilot activation etc.)
Severity of problem	Statements relating to how bad (or otherwise) the critical incident is
Physical cues	Statements relating to external cues that provide information of conditions
Absent information	Statements relating to information that was missing, not present or lacking.

Table

Incident Phase	PCM Category	SAW Subtype	Process	Actors	Quote (participant number in brackets)
Pre-incident	World	Artifact	0. Emergency turn procedure briefing	PF+PM	“this again would have been part of our pre-departure briefing, we would need to know what our emergency turn procedure is” (P5)
Pre-incident	World	Artifact	0. Weather update on the ground	PF+PM	“Because you’ve done your preflight briefing, you’ve already seen the weather” (P6)
Onset of incident	World	Physical Cue	1. Bird-strike to engine	PF+PM	“OK um first one then … you basically cleaned up, you’re in the initial part of the plan … and bang it’s usually quite attention getting” (P4)
Onset of incident	Schema	Insufficient schema	2. Startle/surprise effect	PF+PM	“and you will have an element of startle and then surprise” (P7)
Onset of incident	Action	Aviate	3. Fly the aircraft	PF	“First thought is flying the aeroplane, so you are not interested in what has happened, but how it has affected the flight initially” (P1)
Immediate response	Action	System Monitoring	4. Monitor engine indicators	PM+pf	“So, the things that we would normally be looking at … your damage indications are determined at the moment by like high vibrations on the engine or just a lack of rotation so that is you N1, N2 numbers giving your rotation on the different spools.” (P5)
Immediate response	World	Display indications	5. Evidence of bird-strike	PM+pf	“[if] you hit a bird somewhere you think … did it hit the engine and an if it did hit the engine, if it is a small bird sometimes you don’t even get an increase in temperature or burning smell, it just goes through … I think if you hit a large bird you would get that increase in temperature … . you could smell it and you could get a little bit of vibration.” (P3)
Immediate response	Schema	Analogical Schema	6. Assess information and generate expectations	PF+PM	“For instance, if there was a large bang, you’d expect to be some sort of like structural damage to the engine.” (P2)
Immediate response	Action	Communicate	7. Cross confirmation between pilots	PM+PF	“We look at our modes on the screen. And we basically just read them out and confirm that they are what we want them to be” (P6)
Decision Making	Action	Concurrent Diagnosis	8. Determine the severity of the damage and required actions	PM+PF	“So obviously having had the engine failure, have we had to do any vital actions, and if so, which vital actions? Obviously if we had to do some of the memory drills from the vital actions, it’s probably quite a big problem” (P8)
Decision Making	World	Display indications	9. Information on engine failure severity	PM+pf	“you would probably at that point have a red ECAM which is basically in an alert from the system saying that there’s been an engine failure.” (P6)
Decision Making	Schema	Declarative Schema	10. Knowledge of what indicator determine about engine failure severity	PF+PM	“Have we lost, any hydraulics and have we got sort of severe vibrations stuff like that and have we got a really high EGT is another thing we look for, again that would imply an there’s serious damage to the core of the engine.” (P2)
Decision Making	Schema	Trained past experience	11. Response to single engine failure on take-off is regularly trained	PF+PM	“we train this like every year, you have the engine failure after take-off they called a FATO (failure after take-off … and you have to pass that so if you don’t pass it, you have to redo the whole thing.” (P3)
Subsequent Actions	Action	Navigate	12. Action Emergency Turn procedure – if required	PF	“There’s also things called emergency turn that are built in which are company specific and if you had to follow an emergency turn you would notify air traffic off that emergency turn” (P7)
Subsequent Actions	Action	SOP	13. Run through memory checklist items	PF+PM	“We agree what we think the problem is, that could lead into a vital action. Some people call it memory drill, (COMPANY) were quite unique in calling it a vital action, but it was just basically emergency procedure that you carried out from memory on the spot given a certain set of circumstances for things such as engine failure, things that were endangering the safety of the flight.” (P8)
Subsequent Actions	Action	Communicate	14. Call ATC- May Day/Pan	PF	“There is an argument to be had that you can just declare a pan. I personally wouldn’t. Because you can declaring a MayDay and actually downgrade to a Pan, so I’d be inclined to the declare the MayDay ‘cause that gets everyone aware of what’s happening.” (P6)
Subsequent Actions	Action	System management	15. (a) Run through physical checklist items (ECAM/QRH) actions	PF+PM	“If it’s all contained and everything is fine even after doing vital actions, we still might have to do a checklist that involves pulling up the QRH. The big book at the back of the cockpit which has got loaded checklists in and then following a prescribed drill for a set of events which could be secure an engine even just conducting a single engine landing that requires, it’s not so much a checklist, but it’s more a procedure that you run through to make sure you’re doing the right thing to go back.” (P8)
	World	Artifact	(b) Physical checklist (ECAM/QRH)	PF+PM
Subsequent Actions	Schema	Declarative Schema	16. Use any knowledge on local environment/airports for landing	PF+PM	“So assess the situation. I know that if I fly from Gatwick, there’s no [terrain issues] Surrey hills are as high as it goes … so if I’m at 3000 feet, I would be above minimum safe altitude in Gatwick.” (P5)
Incident Containment	Action	Decision Action	17. Decide to shut engine down and turn back (T-DODAR)	PF+PM	“So that’s the situation where you’ve got to have a conversation between yourselves and say, well, do you think there is damage? I think there is OK yeah me too so we won’t try and relight the engine. … And then we do a T-DODAR at (COMPANY)” (P2)
Incident Containment	Action	Communicate	18. Communication to ATC	PM	“Ideally, once you run out of the essential things to do, you speak to air traffic. And they would probably see something going on on the transponder … ” (P4)
Incident Containment	Action	Communicate	19. (a) NITS briefing	PM	“I’m gonna do a NITS briefing. Got a pen and paper? they say yes to take out pen and paper and you say right the nature of the issue is we had an engine problem. You try and just keep it really concise and not complicated.” (P2)
	World	Natural Environment	(b) Landing space	PF+pm
Incident Containment	Action	System management	20. Calculate landing distance	PM+pf	“you’d want to use an in flight landing distance calculation, which is in the quick reference handbook QRH and that will help you determine how much landing distance you need … Based on one engine you know there’s obviously going to be an increase in landing distance because you have half the reverse capability and you might even have further failures … ” (P6)
Incident Containment	Action	System management	21. Prepare aircraft for landing	PM+pf	“on a single engine landing you normally be using less flap. So that you have got the capability in the event of a go around, you’re not as draggy, so you have got the performance. But other than that increases your landing distance … ” (P5)

Table

Incident Phase	PCM Category	SAW Subtype	Process	Actors	Quote (participant number in brackets)
Pre-incident	World	Artifact	0. Emergency turn procedure briefing	PF+PM	There’s also things called emergency turn that are built in which are company specific and if you had to follow an emergency turn you would notify air traffic off that emergency turn” (P6)
Pre-incident	World	Artifact	0. Weather update on the ground	PF+PM	“You’re aware that at times of dawn and dusk then this higher bird traffic, sometimes at different airfields … you get a report at the end of the weather like high bird activity in the area … So you include it on your take-off briefing. (P5)
Onset of incident	World	Physical Cue	1. Bird-strike to engine	PF+PM	“you use sort of an assessment of the vibration or any smells … so smells would be obviously clue that something’s gone down the engine” (P2)
Onset of incident	Schema	Insufficient schema	2. Startle/surprise effect	PF+PM	“It’s a total surprise situation, it’s happened. Now and we gotta deal with it, and you’re very near the ground” (P4)
Onset of incident	Action	Aviate	3. Fly the aircraft Activate max power in engines to determine thrust	PF	“ … if you have power in one engine or the other, the first thing would be to try and handle the aircraft – asking for maximum power and seeing what you get. If one or both engines give you enough power for to keep on going you can limp for as much as you can.”(P1)
Immediate response	Action	System Monitoring	4. Monitor engine indicators	PM+pf	“Then I would look at the engine and I would think, oh, I might want to shut it down, but I’m not gonna do that because if I’m not on fire and it’s not and it’s not massively vibrating or doing too crazy stuff … I want to maintain that power and not lose any time on you know, shutting extra things down or giving it a chance to create a fire.” (P3)
Immediate response	World	Display indications	5. Evidence of bird-strike	PM+pf	“If you see that birds have gone down the sides, you suspect they hit both engines. If you could clearly see that one engine was OK and one had taken severe damage, then you possibly think about shutting down the damaged one. It is the fact you can’t guarantee that the other one isn’t damaged you’d be looking at those indications I already said about, the rotation and vibration.” (P5)
Immediate response	Schema	Analogical Schema	6. Assess information and generate expectations	PF+PM	“suppose you probably wouldn’t want to shut either of them down, but you would keep monitoring them very closely. And assuming you’ve got some indication … You know there’s higher vibration or or probably just higher vibration indicating some damage. ‘cause obviously if the rotation drops then then you got seized engine anyway.” (P5)
Immediate response	Action	Communicate	7. Captain takes over flying the aircraft	PF	“The captain would likely take over the flying, or maybe in the short term … but he would definitely make snappy decisions” (P2)
Immediate response	Action	Navigate	8. Action Emergency Turn procedure	PF	“So the first thing you do is turn back to the airport.” (P3)
Immediate response	Action	Communicate	9. Call ATC- May Day/Pan	PF	“The communication with air traffic control in the dual engine failure would probably be a lot briefer but happen a lot sooner in the process than it would with a single engine failure.” (P8)
Decision Making	Action	Concurrent Diagnosis	10. Determine the severity of the damage and required actions	PF+PM	“One of the decisions you have gotta make has the actual engine fallen off. Key evidence there for example, was that you got blank boxes in N1 and N2 were just went blank box instead of a low reading or a red reading that again that’s an interpretation. That is knowledge of ah, I know that engine is separated if there was blank boxes.” (P4)
Decision Making	World	Display indications	11. Information on engine failure severity	PM+pf	“It (ECAM) basically prioritizes failures in what it thinks is a serious order, and it would tell you if you had engine 1 + 2 failure” (P2)
Decision Making	Schema	Declarative Schema	12. Knowledge of what indicator determine about engine failure severity	PF+PM	“You know there’s higher vibration or or probably just higher vibration indicating some damage. ‘cause obviously if the rotation drops then then you got seized engine anyway. So you are a bit stuck.” (P5)
Decision Making	Schema	Trained past experience	13. Limited training for dual engine failure on take-off	PF+PM	“there is no certification for a 2 total power losses. You’re in the whole unknown world” (P4)
Subsequent Actions	Action	System management	14. (a) Run through checklist actions	PM+pf	“ … having had the engine failure, have we had to do any vital actions, and if so, which vital actions? Obviously if we had to do some of the memory drills from the vital actions, it’s probably quite a big problem actually” (P4) “we have an emergency checklist for dual engine failure. And that is actually on the back of our normal checklist so all our emergency checklist are on the QRH … ” (P3)
	World	Artifact	(b) Physical checklist (ECAM/QRH)	PM+pf
Incident Containment	Schema	Declarative Schema	15. Use any knowledge on local environment/airports for landing	PF+PM	“Really was are making very snappy decisions then yeah, so 2800 feet. Again, you’re kind of going to use your local knowledge.” (P2)
Incident Containment	Action	Decision Action	16. Decide to shut engine down and turn back (T-DODAR)	PF+PM	“in that situation you try and workout which one is giving you something power wise and go from there because shutting both of them down doesn’t really solve … well it solves one problem but creates worse problems really. You’re powerless at 2000 feet … Yeah, so as far as taking appropriate action goes, well obviously got no power then, then you’re forced into trying to return to where you just left with no engines which you may or may not make.” (P2)
Incident Containment	Action	System management	17. Land the aircraft in best possible location	PF+pm	“I just be asking to go to something like 10 mile final as soon as possible … You be considering lots of lots of things that you wouldn’t in the first situation.” (P5)
Incident Containment	World	Natural environment	18. Landing Space	PF+pm	“If you have a dual engine fire it is completely feasible that you’ll end up landing in a field so. And that’s just a case of looking outside and picking … A nice looking field.” (P2)

Plant, K. L., & Stanton, N. A. (2012). Why did the pilots shut down the wrong engine? Explaining errors in context using schema theory and the perceptual cycle model. Safety Science, 50(2), 300–315. https://doi.org/https://doi.org/10.1016/j.ssci.2011.09.005

 Web of Science ®Google Scholar