The human mind is fallible and error can occur for many reasons, for example, from a misheard message, from memory slip, or from incorrect appreciation of the situation.
Error is particularly likely in certain circumstances, especially when there is pressure to complete a task quickly (e.g. to expedite departure or during an emergency or abnormal situation), but may also occur in normal everyday situations.
Error in aviation can have severe consequences and the cross-checking process is used wherever possible to eliminate error.
Cross-checking and the Pilot
The cross-checking process is a vital element of a pilot's duties, particularly in a multi crew situation where the roles of the two pilots are defined as Pilot Flying and Pilot Not Flying. The Pilot Not Flying (PNF) - alternatively referred to as the Pilot Monitoring - has responsibility for monitoring the actions and awareness of aircraft control of the Pilot Flying (PF).
Whilst the monitoring role of a PNF must not be limited to specific parts of flight crew duties, Company SOPs should include a minimum list of defined actions which are to be cross-checked, for example:
- One pilot calculates aircraft performance and makes mass and balance calculations; the other pilot closely monitors, cross-checks or duplicates the calculations.
- A Load and Trim Sheet prepared (exceptionally) by a member of a flight crew must be subject to meaningful cross checking before acceptance.
- ATC clearances will normally be monitored by both pilots and consequent action including readback taken by one pilot will be confirmed/monitored by the other.
- Equipment settings such as altimeter pressure settings, cleared altitude, frequency change and navigation routings, are set by one pilot and cross-checked by the other.
- Adherence to defined Stabilised Approach gates and to calculated Reference Speeds and AFM Limitations
Cross-checking and the Controller
Cross-checking is equally important for the ATCO, and comprises two elements:
Cross-checking the actions of pilots
Where possible, the controller should monitor the actions of the pilot, either by reference to the radar screen or by visual observation, to ensure that instructions are followed correctly.
The extent to which a controller can cross-check the actions of pilots depends on his/her workload; however, every effort should be made to do so in situations where error is likely to occur. For example, when the pilots are dealing with an aircraft unserviceability, or when the pilot appears to be inexperienced, confused, or have limited language ability. A particular example of a situation where monitoring by radar or directly may be conducive to safety is the execution of issued VFR clearances in airspace such as Class 'D'; in this situation, loss of separation against IFR traffic can occur due to poor situational awareness of the IFR aircraft flight crew, who might wrongly assume that they benefit from ATC-controlled separation from VFR traffic as well as from other IFR traffic.
Controllers should pay particular attention to aircraft manoeuvring on the ground near runway hotspots and to potential conflicts which can arise in the air when intersecting runways are in use simultaneously and this involves intersecting approach, missed approach or take off flight paths.
System support can be used to help controllers with performing this task. Examples of this are various monitoring tools, e.g. for a potential or actual level bust, horizontal deviation, the downlink of Mode S selected level, etc. Nevertheless, controllers should be aware that such tools are not supposed to replace the existing ATC procedures.
Cross-checking the actions of colleagues
Cross-checking is a normal part of the duties of an ATC Assistant if these exist; otherwise, controllers rarely have the free capacity to monitor the duties of other controllers and such action could not be expected to form part of their duties. Nevertheless, the following areas are important:
- When there are two controllers assigned to a sector, the communication with aircraft is normally done by the executive controller. The planner controller however also monitors the radio exchanges (to the extent possible) so that they can detect lapses, incorrect readbacks, etc.
- Also not official and subject to personal workload, a tower and an approach controller (or a tower and a ground controller) may monitor the other controller's frequency e.g. to make sure an agreed coordination is appropriately communicated to the aircraft.
- Controllers taking over responsibility for a sector have much information to absorb and the potential for error or oversight is high. The controller going off duty should monitor the actions of their replacement for a few minutes after hand-over to ensure that neither has overlooked any significant aspect of the prevailing traffic situation and to be available to deal with any questions that might arise;
- Inexperienced controllers or controllers who are new to their positions may not become fully proficient for some time. Appropriate mentoring procedures should be in place until their unaided performance is assessed as satisfactory.
- When a controller is dealing with an abnormal situation, e.g. an aircraft emergency or very high density traffic, the enlistment of any off-duty controllers to assist can be an important safety net.
Accidents & Incidents
Events in the SKYbrary database which include Ineffective Monitoring as a contributory factor:
On 10 June 2018, a Boeing 737-800 departing Amsterdam with line training in progress and a safety pilot assisting only became airborne just before the runway end. The Investigation found that the wrong reduced thrust takeoff performance data had been used without any of the pilots noticing and without full thrust being selected as the end of the runway approached. The operator was found to have had several similar events, not all of which had been reported. The implied absence at the operator of a meaningful safety culture and its ineffective flight operations safety oversight process were also noted.
On 2 May 2015, a Boeing 777-200 deviating very significantly north of its normal route from Malabo to Douala at night because of convective weather had just turned towards Douala very close to 13,202 feet high Mount Cameroon whilst descending through 5000 feet, when an EGPWS TERRAIN AHEAD alert and ‘PULL UP’ warning prompted an 8,000 foot climb which passed within 2,100 feet of terrain when close to and still below the summit. The Investigation attributed the dangerous event primarily to a gross absence of the augmented crew’s situational awareness and the operator’s failure to risk-assess the route involved.
On 20 December 2019, an Airbus A318 making a tailwind ILS approach to Toulon-Hyères with the autopilot engaged and expecting to intercept the glideslope from above had not done so when reaching the pre-selected altitude and after levelling off, it then rapidly entered a steep climb as it captured the glideslope false upper lobe and the automated stall protection system was activated. Not fully following the recovery procedure caused a second stall protection activation before a sustained recovery was achieved. The Investigation noted Captain's relative inexperience in that rank and a First Officer's inexperience on type.
On 7 September 2019, the crew of a Boeing 737-800 completed a circling approach to runway 18R by making their final approach to and a landing on runway 18L contrary to their clearance. The Investigation found that during the turn onto final approach, the Captain flying the approach had not appropriately balanced aircraft control by reference to flight instruments with the essential visual reference despite familiarity with both the aircraft and the procedure involved.It was concluded that the monitoring of runway alignment provided by the relatively low experienced first officer had been inadequate and was considered indicative of insufficient CRM between the two pilots.
On 29 February 2020, an Airbus A320 inbound to Delhi lost separation against an outbound A320 from Delhi on a reciprocal track and the conflict was resolved by TCAS RA activation. The Investigation found that the inbound aircraft had correctly read back its descent clearance but then set a different selected altitude. Air Traffic Control had not reacted to the annunciated conflict alert and was unable to resolve it when the corresponding warning followed and it was noted that convective weather meant most aircraft were requesting deviations from their standard routes which was leading to abnormally complex workload.
On 18 September 2018, an Airbus A320 crewed by a Training Captain and a trainee Second Officer departing Sharjah was cleared for an intersection takeoff on runway 30 but turned onto the 12 direction and commenced takeoff with less than 1000 metres of runway ahead. On eventually recognising the error the Training Captain took control, set maximum thrust and the aircraft became airborne beyond the end of the runway and completed its international flight. The Investigation attributed the event to the pilots’ total absence of situational awareness noting that after issuing takeoff clearance, the controller did not monitor the aircraft.
On 3 November 2019, a Boeing 787-8 descending towards Barcelona experienced an unanticipated airspeed increase and the unduly abrupt manual pitch response which resulted in a large and rapid oscillation in vertical acceleration during an otherwise smooth descent resulted in two serious injuries, one to a passenger and the other to one of the cabin crew. It appeared that the cause of the airspeed increase was an unexplained vertical mode reversion from VNAV SPD to VNAV PTH about 20 seconds prior to the upset caused by the response to it.
On 22 August 2019, a Boeing 737-800 positioning visually from downwind after accepting clearance to make an approach to and landing on runway 03L at Hyakuri instead lined up on temporarily closed runway 03R and did not commence a go around until around 100 feet agl after seeing a vehicle on the runway and the painted runway threshold identification. The Investigation concluded that the event occured due to the captain not thoroughly performing the visual recognition of runway, and the FO not adequately monitoring the flight status of the aircraft thus failing to correct the runway misidentification made by the Captain.
On 3 March 2021, a Boeing 737-800 departing Lisbon only just became airborne before the end of runway 21 and was likely to have overrun the runway in the event of a high speed rejected takeoff. After a significant reporting delay, the Investigation established that both pilots had calculated takeoff performance using the full runway length and then performed takeoff from an intersection after failing to identify their error before FMS entry or increase thrust to TOGA as the runway end was evidently close. This was the aircraft operator’s third almost identical event at Lisbon in less than five months.
On 2 March 2018, a Cessna 441 conducting a single-pilot scheduled passenger flight to Broome suffered successive failures of both engines due to fuel exhaustion and a MAYDAY was declared. Unable to reach the destination or any other aerodrome by the time this occurred, an uneventful landing was made on the area’s main highway. The Investigation found that the fuel quantity was over-reading due to water in the fuel tanks, that cross-checking of fuel used versus indicated fuel in tanks was not done and that when the possibility of fuel exhaustion was first indicated, an available diversion was not made.
Flight Safety Foundation ALAR Briefing Notes: