How the cockpit manages anomalies: revisiting the dynamic fault management model for aviation

  • Guido C. CarimJr.Email author
  • Tarcisio A. Saurin
  • Sidney W. A. Dekker
Original Article


More than 20 years ago, Woods proposed a model that accounts for the inherent complexity faced by operators when managing abnormal and emergency situations in highly complex sociotechnical systems. The model was reviewed a decade later and only a few studies have applied it to aviation. This paper proposes adjustments to the original model, based on recent theoretical developments and empirical evidence on the anomaly management activity in aviation. The model was divided into five components; three of which—activity, types of reasoning involved, and resources—were revisited and further developed. The two other components—fault behaviour and unit of analysis—were not updated and only discussed in the aviation context. As a result, the revisited model descriptively clarifies how the activity of anomaly management emerges from the use of a wide repertoire of strategies, involving a spectrum of types of reasoning and a set of resources for action, which are not limited to those anticipated by designers, such as checklists and the warning system. An instantiation of the revisited model highlights the implications of false alarms, which trigger a cascade of disturbances that, in turn, requires adaptive strategies based on heuristics and analogies and supported by pilot’s experience. The revisited model can support a more accurate analysis of anomalous situations and the redesign of work systems to achieve a better performance.


Resources for action Dynamic fault management Quick reference handbook Checklist Procedures Aviation 



The first author would like to thank Captain Nicholas Carpenter for insightful contributions.


This study was funded by Capes (Brazil) in a format of Ph.D. scholarship awarded to the first author, while he was conducting this study as part of his Ph.D. research project at the Safety Innovation Laboratory, Griffith University.

Compliance with ethical standards

Conflict of interest

The authors declare that they have no conflict of interest.


  1. Abbott KH (1991) Robust fault diagnosis of physical system in operation. PhD Dissertation, State University of New JerseyGoogle Scholar
  2. Bliss JP, Dunn MC (2000) Behavioural implications of alarm mistrust as a function of task workload. Ergonomics 43:1283–1300. CrossRefGoogle Scholar
  3. Bliss JP, Gilson RD (1998) Emergency signal failure: implications and recommendations. Ergonomics 41:57–72. CrossRefGoogle Scholar
  4. Bliss JP, Freeland MJ, Millard JC (1999) Alarm related incidents in aviation: a survey of the aviation safety reporting system database. Proc Hum Factors Ergon Soc Annu Meet 43:6–10. CrossRefGoogle Scholar
  5. Burks AW (1946) Peirce’s theory of abduction. Philos Sci 13:301–306. CrossRefGoogle Scholar
  6. Carim Jr GC, Saurin TA, Havinga J, Rae A, Dekker SWA, Henriqson E (2016) Using a procedure doesn’t mean following it: a cognitive systems approach to how a cockpit manages emergencies. Saf Sci 89:147–157. CrossRefGoogle Scholar
  7. Cerbone DR (2012) Understanding phenomenology. Acumen Publishing Limited, Durham.
  8. Christoffersen K, Woods DD (2003) Making sense of change: the challenge of events in operations environments. Technical Report, The Ohio State University, Columbus, OHGoogle Scholar
  9. Christoffersen K, Woods DD (2006) Making sense of change: why recognizing events is special in cognitive work. Technical Report, The Ohio State University, Columbus, OHGoogle Scholar
  10. Christoffersen K, Woods DD, Blike GT (2007) Discovering the events expert practitioners extract from dynamic data streams: the modified unit marking technique. Cogn Technol Work 9:81–98. CrossRefGoogle Scholar
  11. De Brito G (2002) Towards a model for the study of written procedure following in dynamic environments. Reliab Eng Syst Saf 75:233–244. CrossRefGoogle Scholar
  12. De Keyser V, Woods DD (1990) Fixation errors: failures to revise situation assessment in dynamic and risky systems. In: Colombo AG, de Bustamante AS (eds) Systems reliability assessment. Springer, Dordrecht, pp 231–251.
  13. Degani A, Wiener EL (1990) Human factors of flight-deck checklists: the normal checklist. NASA Contractor Report, NASA AMES Research Centre, Moffett FieldGoogle Scholar
  14. Degani A, Wiener EL (1994) On the design of flight-deck procedures. NASA Contractor Report, NASA AMES Research Centre, Moffett FieldGoogle Scholar
  15. Degani A, Wiener EL (1997) Procedures in complex systems: the airline cockpit. IEEE Trans Syst Man Cybern A Syst Hum Publ IEEE Syst Man Cybern Soc 27:302–312. CrossRefGoogle Scholar
  16. Degani A, Heymann M, Barshi I (2005) A formal methodology, tools, and algorithm for the analysis, verification, and design of emergency procedures and recover. NASA Internal White Paper, NASA AMES Research Centre, Moffett FieldGoogle Scholar
  17. Dreyfus HL, Dreyfus SE (1986) Mind over machine: the power of human intuition and expertise in the era of computer. Free Press, New YorkGoogle Scholar
  18. Dreyfus HL, Dreyfus SE (2005) Peripheral vision. Org Stud 26:779–792. CrossRefGoogle Scholar
  19. Fields B, Wright P, Harrison M (1997) Objectives, strategies and resources as design drivers. In: Steve H, Judy H, Gitte L (eds) Human-computer interaction InterAct’97. IFIP—the international federation for information processing. Springer, Boston, MA, pp 164–171.
  20. Henriqson E, van Winsen R, Saurin TA, Dekker SWA (2011) How a cockpit calculates its speeds and why errors while doing this are so hard to detect. Cogn Technol Work 13:217–231. CrossRefGoogle Scholar
  21. Heymann M, Degani A, Barshi I (2007) Generating procedures and recovery sequences: a formal approach. In: Proceedings of the 14th international symposium on aviation psychology, The Ohio State University, Columbus, OHGoogle Scholar
  22. Hoffman RR, Crandall B, Shadbolt N (1998) Use of the critical decision method to elicit expert knowledge: a case study in the methodology of cognitive task analysis. Hum Factors 40:254–276. CrossRefGoogle Scholar
  23. Hollan J, Hutchins E, Kirsh D (2000) Distributed cognition: toward a new foundation for human-computer interaction research. ACM Trans Comput Hum Interact ACM Trans Comput Hum Interact 7:174–196. CrossRefGoogle Scholar
  24. Hollnagel E, Woods DD (1999) Cognitive systems engineering: new wine in new bottles. Int J Hum Comput Stud 51(2):339–356. CrossRefGoogle Scholar
  25. Hollnagel E, Woods DD (2005) Joint cognitive systems: foundations of cognitive systems engineering. CRC Press, Boca RatonCrossRefGoogle Scholar
  26. Holyoak KJ (2005) Analogy. In: Holyoak KJ, Morrison RG (eds) The Cambridge handbook of thinking and reasoning. Cambridge University Press, Cambridge, pp 117–142Google Scholar
  27. Holyoak KJ, Morrison RG (2005) Thinking and reasoning: a reader’s guide. In: Holyoak KJ, Morrison RG (eds) The Cambridge handbook of thinking and reasoning. Cambridge University Press, Cambridge, pp 1–9Google Scholar
  28. Hutchins E (1995) How a cockpit remembers its speeds. Cogn Sci 19:265–288. CrossRefGoogle Scholar
  29. Hutchins E, Klausen T (1996) Distributed cognition in an airline cockpit. In: Engestrom Y, Middleton D (eds) Cognition and communication at work. Cambridge University Press, Cambridge, pp 15–34.
  30. Johannesen L, Woods DD (1991) Human interaction with intelligent systems: trends, problems and new directions. In: Proceedings of the 1991 IEEE international conference on systems, man, and cybernetics, IEEE, Charlottesville, pp 1337–1341.
  31. Kahneman D, Frederick S (2005) A model of heuristic judgment. In: Holyoak KJ, Morrison RG (eds) The Cambridge handbook of thinking and reasoning. Cambridge University Press, Cambridge, pp 267–293Google Scholar
  32. Kahneman D, Klein GA (2009) Conditions for intuitive expertise: a failure to disagree. Am Psychol 64:515–526. CrossRefGoogle Scholar
  33. Klein GA (1993) A recognition-primed decision (RPD) model of rapid decision making. In: Klein GA, Orasanu J, Calderwood R, Zsambok CE (eds) Decision making in action: models and methods, Ablex, Norwood, pp 138–147.
  34. Klein GA (2009) How can we train pilots to make better decisions? In: O’Neil Jr HF, Andrews DH (ed) Aircrew training and assessment. Lawrence Erlbaum Associates, London, pp 165–195.
  35. Klein GA (2015a) A naturalistic decision making perspective on studying intuitive decision making. J Appl Res Mem Cogn 4:164–168. CrossRefGoogle Scholar
  36. Klein GA (2015b) Reflections on applications of naturalistic decision making. J Occup Org Psychol 88:382–386. CrossRefGoogle Scholar
  37. Klein GA, Calderwood R, Clinton-Cirocco A (1986) Rapid decision making on the fireground. In: Proceedings of the 30th Annual Human Factors Society, HFES, Santa Monica, CA, pp 576–580Google Scholar
  38. Klein GA, Calderwood R, Clinton-Cirocco A (1988) Rapid decision making on the fire ground. Technical Report 796, Army Research Institute for the Behavioral and Social Sciences, AlexandriaGoogle Scholar
  39. Klein GA, Calderwood R, MacGregor D (1989) Critical decision method for eliciting knowledge. IEEE Trans Syst Man Cybern 19:462–472. CrossRefGoogle Scholar
  40. Klein GA, Calderwood R, Clinton-Cirocco A (2010) Rapid decision making on the fire ground: the original study plus a postscript. J Cogn Eng Decis Mak 4:186–209. CrossRefGoogle Scholar
  41. McCarthy J, Wright P, Monk A, Watts L (1998) Concerns at work: designing useful procedures. Hum Comp Interact 13:433–457. CrossRefGoogle Scholar
  42. Papastavrou JD, Lehto MR (1996) Improving the effectiveness of warnings by increasing the appropriateness of their information content: some hypotheses about human compliance. Saf Sci 21:175–189. CrossRefGoogle Scholar
  43. Patel VL, Arocha JF, Kaufman DR (1994) Diagnostic reasoning and medical expertise. Psychol Learn Mot 3:187–252. CrossRefGoogle Scholar
  44. Patterson ES, Woods DD (2001) Shift changes, updates, and the on-call architecture in space shuttle mission control. Comput Support Coop Work 10:317–346. CrossRefGoogle Scholar
  45. Patterson ES, Watts-Perotti J, Smith PJ, Woods DD, Shattuck LG, Klein GA, Jones PM (1998) Patterns in cooperative cognition. Proc Hum Factors Ergon Soc Annu Meet 42:263–266. CrossRefGoogle Scholar
  46. Peirce CS, Turrisi PA (1997) Pragmatism as a principle and method of right thinking: the 1903 Harvard lectures on pragmatism. State University of New York Press, AlbanyGoogle Scholar
  47. Potter SS (1994) The development of temporal and functional information displays to support cooperative fault management. The Ohio State UniversityGoogle Scholar
  48. Råholm MB (2010) Abductive reasoning and the formation of scientific knowledge within nursing research. Nurs Philos 11:260–270. CrossRefGoogle Scholar
  49. Rajkomar A, Dhaliwal G (2011) Improving diagnostic reasoning to improve patient safety. Permanente J 15:68–73. CrossRefGoogle Scholar
  50. Rasmussen J (1993a) Analysis of tasks, activities and work in the field and in laboratories. Travel Hum 56:133–155Google Scholar
  51. Rasmussen J (1993b) Diagnostic reasoning in action. IEEE Trans Syst Man Cybern 23:981–992. CrossRefGoogle Scholar
  52. Rasmussen J, Jensen A (1974) Mental procedures in real-life tasks: a case study of electronic trouble shooting. Ergonomics 17:293–307CrossRefGoogle Scholar
  53. Rasmussen J, Nixon P, Warner F (1990) Human error and the problem of causality in analysis of accidents. Philos Trans R Soc Lond B Biol Sci 327: 449–460, 460–462.
  54. Roth W-M, Mavin TJ, Munro I (2014) How a cockpit forgets speeds (and speed-related events): toward a kinetic description of joint cognitive systems. Cogn Technol Work 17:279–299. CrossRefGoogle Scholar
  55. Singer G, Dekker SWA (2000) Pilot performance during multiple failures: an empirical study of different warning systems. Transp Hum Factors 2:63–76. CrossRefGoogle Scholar
  56. Soo K, Mavin TJ, Roth W-M (2016) Mixed-fleet flying in commercial aviation: a joint cognitive systems perspective. Cogn Technol Work 18:449–463. CrossRefGoogle Scholar
  57. Stefanov A (2012) Theoretical models as representations. J Gen Philos Sci 43:67–76. CrossRefGoogle Scholar
  58. Suchman LA (1985) Plans and situated actions: the problem of human machine communication. Final Report, Xerox Company, Palo Alto Research Centre, Palo AltoGoogle Scholar
  59. Upshur R (1997) Certainty, probability and abduction: why we should look to C.S. Peirce rather than Gödel for a theory of clinical reasoning. J Eval Clin Pract 3:201–206. CrossRefGoogle Scholar
  60. Vicente KJ (1999) Cognitive work analysis: toward safe, productive, and healthy computer-based work. Erlbaum, MahwahGoogle Scholar
  61. Wartofsky MW (1979) Models: representation and the scientific understanding. Boston studies in the philosophy of science, Vol. XLVIII. Springer, Dordrecht.
  62. Watts JC, Woods DD, Patterson ES (1996) Functionally distributed coordination during anomaly response in space shuttle mission control. In: Proceedings 3rd Annual Symposium on Human Interaction with Complex Systems, HICS’96, IEEE, Dayton, OH.
  63. Watts-Perotti J, Woods DD (2007) How anomaly response is distributed Across functionally distinct teams in space shuttle mission control. J Cogn Eng Decis Mak 1:405–433. CrossRefGoogle Scholar
  64. Woods DD (1984) Some results on operator performance in emergency events. In: The Institution of Chemical Engineers (ed.) Ergonomics Problems in Process Operations, Pergamon Press, Warks, pp 21–32.
  65. Woods DD (1994) Cognitive demands and activities in dynamic fault management: abductive reasoning and disturbance management. In: Stanton N (ed) Human factors in alarm design, vol 7. Taylor & Francis, Bristol, pp 63–92CrossRefGoogle Scholar
  66. Woods DD (1995) The alarm problem and directed attention in dynamic fault management. Ergonomics 38:2371–2393. CrossRefGoogle Scholar
  67. Woods DD (2015) Four concepts for resilience and the implications for the future of resilience engineering. Reliab Eng Syst Saf 141:5–9. CrossRefGoogle Scholar
  68. Woods DD, Hollnagel E (2006) Joint cognitive systems: patters in cognitive systems engineering. CRC Press, Boca RatonCrossRefGoogle Scholar
  69. Woods DD, Patterson ES (2000) How unexpected events produce an escalation of cognitive and coordinative demands. In: Hancook PA, Desmond PA (eds) stress workload and fatigue, Lawrence Erlbaum, Hillsdale, pp. 1–15.
  70. Woods DD, Sarter NB (2010) Capturing the dynamics of attention control from individual to distributed systems: the shape of models to come. Theor Issues Ergon Sci 11:7–28. CrossRefGoogle Scholar
  71. Woods DD, Johannesen L, Potter SS (1991) Human interaction with intelligent systems: an overview and bibliography. ACM SIGART Bull 2:39–50. CrossRefGoogle Scholar
  72. Woods DD, Johannesen L, Cook RI, Sarter N (1994) Behind human error: cognitive systems, computers and hindsight. Crew Systems Ergonomic Information and Analysis Center, WPAFB, Dayton OHGoogle Scholar
  73. Wright P, Mccarthy J (2003) Analysis of procedure following as concerned work. Human Factors and Ergonomics. In: Hollnagel E (ed) Handbook of cognitive task design. Lawrence Erlbaum Associates, Mahwah, NJ, pp 679–700.
  74. Wright P, Fields B, Harrison MD (1996) Distributed information resources: a new approach to interaction modelling. In: Proceedings of the 8th European conference on cognitive ergonomics, 10-13 September 1996, European Association of Cognitive Ergonomics, Granada, Spain, pp 5–10Google Scholar
  75. Wright P, Pocock S, Fields B (1998) The prescription and practice of work on the flight deck In: Proceedings of the 9th European Conference on Cognitive Ergonomics, 24–26 August 1998, European Association of Cognitive Ergonomics, Limerick, Ireland, pp 37–42Google Scholar
  76. Wright P, Fields B, Harrison MD (2000) Analysing human-computer interaction as distributed cognition: the resources model. Hum Comput Interact 51:1–41. CrossRefGoogle Scholar

Copyright information

© Springer-Verlag London Ltd., part of Springer Nature 2019

Authors and Affiliations

  1. 1.Griffith UniversityNathanAustralia
  2. 2.Federal University of Rio Grande do SulPorto AlegreBrazil

Personalised recommendations