Human errors in emergency situations: cognitive analysis of the behavior of the pilots in the Air France 447 flight disaster

Abstracts

Abstract

On June 1st 2009, the Airbus 330 of Air France that left from Rio de Janeiro to Paris, falls into the Atlantic Ocean killing 228 people on board. One of the causes of the accident mentioned by official agencies were the mistakes made by the pilots, which combined with technical failures led to the loss of control of the plane. Human error was again appointed as the last link in the chain of events leading to the accident and, therefore, as its immediate cause. In this paper it is proposed an alternative explanation, which is not limited to the identification of mistakes made by the crew but proposes an explanation of mistakes. In a cognitive analysis of accidents based on the concept of action and situated cognition, the error is not the point of arrival of the diagnosis of the causes of an accident, but it is its starting point. Like this, resumed the official results of the accident, the specific reference to the expected behavior of pilots in relation to evolving unforeseen and breach of aviation rules during the four minutes leading up to the fall of the aircraft in the ocean. This critical analysis makes room for a more comprehensive explanation of the pilots behavior, based on another frame of reference - the cognitive analysis of accidents - not yet incorporated in the official models of analysis of human factors in safety, and allows to speculate on other actions for prevention.

Keywords:
Human behavior in organizations; Human factors at work; Cognitive psychology; Ergonomic analysis of the work; Hygiene and safety

Resumo

No dia 1º junho de 2009, o Airbus 330 da Air France que saía do Rio de Janeiro com destino a Paris se choca com o Oceano Atlântico matando as 228 pessoas que estavam a bordo. As causas do acidente apontadas pelos órgãos oficiais foram os erros cometidos pelos pilotos, os quais, combinados às falhas técnicas, levaram à perda de controle do avião. O erro humano foi, mais uma vez, apontado como o último elo da cadeia de eventos que levaram ao acidente e, portanto, como sua causa imediata. Neste artigo, propomos uma explicação alternativa, que não se limita à identificação dos erros cometidos pela tripulação, mas propõe uma explicação dos próprios erros. Em uma análise cognitiva de acidentes fundamentada no conceito de ação e cognição situadas, o erro não é ponto de chegada do diagnóstico das causas de um acidente, mas seu ponto de partida. Assim, retomamos os resultados oficiais do acidente, no que se refere especificamente ao comportamento esperado dos pilotos em relação aos imprevistos surgidos e ao descumprimento das regras de aviação, durante os 4 minutos que antecederam a queda da aeronave no oceano. Essa análise crítica abre espaço para uma explicação mais compreensiva dos comportamentos dos pilotos, com base em outro quadro de referência – a análise cognitiva de acidentes – ainda não incorporado aos modelos oficiais de análise dos fatores humanos em segurança, e permite refletir sobre outras ações de prevenção.

Palavras-chave:
Comportamento humano nas organizações; Fatores humanos no trabalho; Psicologia cognitiva; Análise ergonômica do trabalho; Higiene e segurança do trabalho

1 Introduction

On 1 June 2009, at 2:14 a.m., the AF447 flight from Rio de Janeiro/Paris with 216 passengers and 12 crew members, crashed into the Atlantic Ocean without leaving survivors. The first wreckage of the plane, an Airbus 330, are found on 6 June 2009. Almost two years later, the black boxes were recovered, one containing records of conversations between the pilots and the other with hundreds of technical parameters.

As usual after serious accidents, a technical investigation was opened by the BEA ( Bureau d'Enquêtes et d'Analyzes) - French authority responsible for analyzing the civil aviation accidents - to clarify the causes and propose preventive measures. This survey generated four official reports, published between July / 2009 and July / 2012. In the last one, it was presented the result of a review conducted in the Human Factors (HF) of the BEA, created in July / 2011 in order to complement the analysis performed to date. As is common in air accident analyzes or other professional activities, the causes disclosed officially point out the mistakes made by pilots, which, combined with technical failures led to the loss of control of the plane. Human error is pointed out as the last link in the chain of events that led to the accident and therefore as its immediate cause.

In this paper we propose an alternative explanation, which is not limited to identifying errors by the crew, but proposes an explanation of mistakes. Cognitive analysis of accidents based on the concepts of action and situated cognition, human error does not explain the accident, even when it is presented as its immediate cause, or the last link in a chain of events. This error has happened is that it requires explanation. In the case of Flight 447, starting from the same data from official reports but reconsidered with the help of another analytical framework, it is possible to explain the accident in more depth, clarifying the failures of cognitive representations that the pilots, under the circumstances, have devised. These are representative failures that led to the decisions and misguided actions of the pilots.

To support this alternative explanation, briefly describe the documents produced by BEA, highlighting its main conclusions (and also the inconclusions) at every stage of analysis (item 2). A brief discussion of human error in the safety management systems (item 3) will provide a framework for structuring reflection on the rest of the article. Based on official documents, we reconstitute the chronology of the events preceding the accident (item 4). This material, we emphasize more detail the analysis and conclusions of the latest report by the group Human Factors BEA, concluding with a critical assessment of the limits of this approach (item 5). Based on cognitive accidents in emergency situations analysis, we propose an alternative explanation line (item 6), which allows to show the gaps in the official explanations on the behavior of the pilots, leading to preventive actions different from the official recommendations.

2 The materials of the official investigations

Three years separate the crash of the final report published by the BEA. During this period, more or less conclusive analyzes were produced ( Chart 1 ) that after the recovery of the black boxes of the plane, crystallized in a diagnosis.

Chart 1
Chronological order of the accident analysis.

Date	Event
01/06/2009	Flight 447 Air France crash
06/06/2009	First wreckage of the plane found by French navies and Brazilian
02/07/2009	Publication of the 1st stage of the BEA report
	goal	key findings
	Document the first elements of the accident from a description of the known facts and a visual examination of the first wreck.	The plane was not destroyed during flight and “[…] seems to have reached the surface of the water with a strong vertical acceleration […]” ( BEA, 2009a , p. 40).
17/12/2009	Publication of the 2nd progress report
	goal	key findings
	Understanding the accident through the recovery of the wreckage, the weather, messages with air traffic control and airworthiness certification of speed probes.	The “[…] entire plane was when it reached the water with the inclined angle of incidence up and with significant vertical speed […]” ( BEA, 2009b , p. 34). Recommendations relating to flight recorders and equipment certification processes.
01 and 02/05/2011	Recovery of the two black boxes, one containing the records of the flight parameters and the other with the dialogues and sounds produced in the cockpit
29/07/2011	Publication of the 3rd Progress Report
	goal	key findings
	Understanding the accident from the recordings and flight data recorded in the black boxes of the aircraft and propose other security measures.	Misunderstanding about the behavior of the pilots during the crash and survey questions by BEA officials. To answer them, the BEA creates a study group in FH, consisting of seven experts who worked between July 2011 and July 2012.
05/07/2012	Publication of the 4th (and final) report
	goal	key findings
	Clarify the reasons of the accident from detailed surveys of the wreckage and bodies, the analysis of the black boxes and the study of the Human Factors group.	The pilots did not understand the crash and commit a series of errors that led to the fall of the aircraft. Are released 41 security recommendations that bear on flight records, the formation and training of pilots, to replace the flight commander, the search and rescue, the air traffic control, simulators and ergonomics of piloting stations .

Among these results, we will discuss only those related to the expected behavior of riders in relation to the vagaries of flight and breach of aviation rules during the four minutes leading up to the fall of the aircraft. This critical analysis makes room for a more comprehensive explanation of the behavior of drivers, based on another frame of reference - cognitive analysis of accidents and situated action - not yet incorporated into the official models of analysis of human factors in safety.

3 Human error in safety management: human factors and cognition located

If mistakes are inevitable, the most effective prevention should act on its consequences and not only eliminate errors (item 3.1), requiring the active contribution of the workers themselves (item 3.2), whose conditions are clarified by concepts of situated action (item 3.3).

3.1 Avoid errors or consequences?

The “human error” is omnipresent in the theories and accident analyzes, as well as in the discourse of managers, the employees themselves and the general public. Of course mistakes happen, but its relationship with accidents that succeed is far from established unequivocally.

The error, when there is no complication of any unexpected event can be defined as an unintentional failure of the actions planned to achieve a desired goal ( Reason, 1990 ).

Errors occur frequently in any human activity, but the detection rates and recovery of these errors by the actor himself are also high, hovering around 80% ( Amalberti, 1996 ). The problem arises only when the error causes unintended consequences ( Amalberti, 2013 ). The literature shows a convergent manner ( Allwood, 1984 ; Rasmussen, 1997 ; Reason, 1990 ; Rizzo et al, 1987 , etc.) that are not more competent operators who make fewer mistakes, but those that detect and recover the more mistakes. Since man can not work without error, management systems security should not seek to suppress them. It is necessary, instead, seek to reduce the consequences of the error may cause, for work implies, besides producing goods and knowledge, also make some mistakes ( Amalberti, 2013 ).

3.2 Rule-based safety and Managed safety: a necessary joint

The daily work is a confrontation between what is anticipated by the work organization, from general knowledge and models, and activity that comes situations and events that were not anticipated in their singularities ( Lima, 2005 ). In business, trying to anticipate situations occurs, in most cases, through standards, rules and procedures developed by experts and board members. This accumulation of rules, however, does not guarantee they will be respected by the workers and does not prevent the occurrence of incidents ( Dekker, 2003 ). The super-proceduralizing ( Amalberti et al, 2004 ) can even be counterproductive: excessive security rules can generate insecurity, preventing workers create new rules appropriate to each situation.

In this sense, Morel et al. (2008) distinguish two forms of security: Rule-based safety (or Sécurité Réglée), which is based on safety procedures and scientific knowledge that allows the anticipation of unwanted situations; and Managed safety (or Sécurité Gérée), based on relevant response and real-time given by the employee due to the particularity of the situations encountered in the field. An integrated security management system ( Daniellou et al., 2010 ) rests thus on the ability of workers to judge the applicability of the procedures according to real situations, and to make the necessary adjustments to maintain safety during production.

The rule-based safety is an effective resource for action in that it provides references to “act”, registering the difficulties encountered in the past in order to prevent future situations ( Rocha et al., 2015 ). Managed safety is the confrontation of the rules depending on the context and the way to develop cooperation networks to manage tensions found in action ( Terssac et al., 2009 ). The rule-based safetyis not enough, because, like all prescription system, it behaves before unforeseen limits that should be handled by the operators themselves, possibly breaking some existing rules in order to respond to the particular characteristics of the situation. Reason (1990) names as “violations” violations of the rules and define them as volunteers deviations practices deemed necessary. An extensive study on more than 3,500 flight segments showed that the intentional breach of rules represented 45% of all deviations (intentional and unintentional), but only 6% of them led to an unwanted condition of the aircraft (Helmreich, 2001 apudAmalberti et al., 2004 ). The same study points out that in situations where the rules are perceived by workers as contradictory or paradoxical, most offenses originates good results from the point of view of performance and system security. In such cases, violations of the rules are a legitimate act and can not be seen as a way to undermine the system because they prevent harmful consequences that could occur if the operators had complied with ( Amalberti, 1996 ).

3.3 A new approach to accident analysis: the situated action and distributed cognition

In the years preceding the creation of the Swiss cheese model ( Reason, 1990 ) and psycho-organizational model ( Llory, 1999 ) accident analysis revealed also some jobs that have developed concepts of cognitive anthropology of modern situations ( Lave, 1988 ; Scribner, 1986 ; Hutchins, 1995 ) showing the inadequacy of human models as a symbolic information processing system.

Suchman (1987) introduced the concept of situated cognition, giving priority to action in relation to the dominant cognitive concepts by showing how an operator interacts with interactive and sophisticated photocopiers. The author proposes, in contrast to the action-oriented plan, the notion of “situated action”, evoking the need to consider the “live trial” at any moment, the meaning of the particular circumstances and to explore the dynamic relationship between knowledge, action and circumstances. In this line, Theureau (2004) states that cognition is not located at the head of an actor, but between him and the situation in which part of the other actors and tools.

Cognition and intelligence are not purely individual capacities: there is a collective intelligence, distributed among the group members. Hutchins & Klausen (1996) give, to this concept, the name “distributed cognition” and propose analytical models that allow us to describe and explain the cognitive properties of the system as a whole and not the ability of a single individual. The focus of distributed cognition, and the situated cognition, is opposed to a Cognitivism centered on the individual, where the brain would be the central point of data processing system, culminating in mental representations that would drive the action ( Hutchins, 2000 ).

Theureau (2004) deepens these reflections within the course of action theory, emphasizing the notions of “corporate action” and “pre-reflective consciousness” as supplementary hypothesis to characterize the lived experience. According to the author,

[…] human activity is accompanied at all times a pre-reflective consciousness (or experience), which includes what we know as consciousness, but also all the implicit activity defined at every moment [...]. This pre-reflective consciousness is the dynamics of the surface effect of structural against actor with their environment, including social ( Theureau, 2004 , p. 21).

Thus, the possibility of an adequate description of the practical activity does not depend only on the researcher who observes and interprets the behavior of the actors, but also, first, on the implementation of methods of explicit pre-reflexive consciousness of the actors that is present in each of their practical activities.

These theories of activity, to consider other dimensions such as the organization of work, situated action, distributed cognition, corporate action and pre-reflective consciousness, allow us to escape the reductionist view inherent in the behavioral approach in accident analysis. The unit of analysis should be not only the behavior (behaviorism) or the mental representation (cognitivism), but the interaction between these elements of the action with the environment ( Theureau, 2004 ). Behavior or human factors, therefore, should not be seen as the cause of unwanted events, but as the result of an interactive construction process, which comprises the man (through their actions and their cognitive development), the organization of work and the technical environment in which it is inserted.

These theories help us to better understand human reactions in emergency situations. Action, perception and cognition are intertwined and mutually supportive. The speed detection of the signs of an anomaly is associated with our ability to modify the representation of the current situation and are often out than expected as a previous representation. In this way, unexpected or surprising reactions may arise according to the context ( Jouanneaux, 1999 ). Commonly, these actions are inadequate when they are classified as “human error”, and are present in approximately 80% of aircraft accidents analysis ( Foushee, 1984 ). After reconstituting the events that preceded the accident (item 4), we will see the potential of these analysis of action and cognition situated to propose an alternative explanation to the conclusions of the BEA that the pilots made banal mistakes.

4 Reconstitution of the accident flight 447 of Air France

To explain how it produced the accident flight 447, divide reconstitution in two stages: first, to have an overview, we present the chronological sequence of what happened in the previous minutes to shock; then to a finer understanding of the situation in detail present the records of the black boxes.

4.1 Chronology of the accident

Flight 447 Air France took off from Rio de Janeiro at 21h29 the day of May 31 bound for Paris, carrying 228 people. The riding team consisted of two co-pilots, one with 6000 hours of flight, referred to in this article Copilot 1 (Co1), the other with 3,000 hours of flying, called Copilot 2 (Co2) and the Trip Commander with 11,000 hours of flight. As soon leaves the Brazilian coast, the Airbus A330 enters a turbulent area, common in the Atlantic region. The aircraft is on automatic pilot in command. Shortly before 2 am, the Commander will rest, leaving two co-pilots in the cockpit. About ten minutes after departure, a technical incident occurs: the freezing of the third external speed sensors (or probes Pitot) of the aircraft.

As a result of the freezing of the Pitot probes, the speed indicator falls brutally by turning off the autopilot, and the control system automatically switches to manual mode. The flight operation is now the responsibility of the co-pilot. At this point, the Co2 pull the lever (or joystick), increasing the plane's attitude angle ( Figure 1 ).

Figure 1
Incidence angle and attitude angle of the aircraft.

Moments after this action of Co2, the plane goes into sustaining loss (or stall), which can occur with the plane in different configurations. In the case of Flight 447, the plane goes out of its flight envelope cone ( Figure 2 ), second horizontal thrust force. In other words, the aircraft begins to fall. About 4 minutes after the start of stall, the plane crashes into the sea, a vertical speed of nearly 200 km / h. There was no distress message sent by the crew.

Figure 2
The flight cone and the coffin corner scheme (or coffin zone), border region from which the aircraft sustaining loss becomes next (Adapted from IASA Program) ( IASA, 2006 ).

4.2 Records of the black boxes in each of the phases of the accident

From the data from the black boxes, the BEA accident divided this into three phases. A summary of each of them, with the events in chronological order and dialogues at the time they occurred. The caption below ( Figure 3 ) facilitates understanding of events.

Figure 3
Legend of symbols for description of the aircraft flight phases.

4.2.1 Phase 1: from the start of recording the CVR (Cockpit Voice Recorder) to disengage the autopilot

The first records of the cockpit voice recorder (CVR or) the cockpit occur from midnight. The autopilot is turned on, the pilot team is in contact with the control center of Recife and flight passes without unforeseen. The plane's cockpit are the Commander and Co2, while the Co1 is in her period of rest, in a suitable location outside the cabin. When he returns, the Commander assists co-pilot performing the briefing - at which point the driver who is in charge transmits the relevant information about the flight to another who has just arrived - and leaves the cockpit to make your rest. The Co2 is a warning to the crew of possible turbulence that will find in the next moment. Shortly after, the autopilot stops working and the speed indicator shows a sharp drop this parameter ( Chart 2 ).

Chart 2
Chronological order of events, utterances of the pilots and aircraft position in phase 1 of the accident.

Hour	Events	verbalizations associated	Position and direction of the aircraft
1h55min	Commander wakes Co1 for shift change.	Commander: “It will take my place.”
1h59min	Beginning of the briefing between the co-pilot.	Co2: “Small turbulence that you just saw […] you must find something just ahead.”
2h01min	Commander leaves the cockpit to rest.	Commander: “Well, that's it. I'm going”.
2h06min	Co2 connects to the flight crew, warning them of the coming turmoil.	Co2: “In two minutes we should enter an area where we will probably swing a little more than now and it is necessary to pay attention.”
2h08min	Route deviation due to weather conditions.	Co1: “You may possibly follow a little to the left.”
2h10m	Freezing of pitot probes; autopilot to function; stall alarm sounds followed x 2; speed indicator shows a “brutal fall of 275 kt to 60 kt” ( BEA, 2011 , p. 10).	Co2: “I'm with the commands.”

4.2.2 Phase 2: from disengage the autopilot to support loss alarm

Soon after the shutdown of the autopilot, the Co2 pulls the joystick, redirecting the aircraft to the left and “nose-up” (term civil aviation equivalent to “climb”, ie movement in which the pilot pulls the stick and the plane directs nose up). As a result, the aircraft gained altitude and its attitude angle ( Figure 1 ) increases. The Co1, repeatedly calls the Commander. During this period, Co2 continues to pull the joystick, bringing the plane to a support loss condition. Immediately after leaving its flight envelope, the stall alarm will sound ( Chart 3 ).

Chart 3
Chronology of events, utterances of the pilots and aircraft position in phase 2 of the accident.

Hour	Events	verbalizations associated	Position and direction of the aircraft
2h10m	Freezing of pitot probes; autopilot to function; stall alarm sounds followed x 2; speed indicator shows a “brutal fall of 275 kt to 60 kt” ( BEA, 2011 , p. 10).	Co2: “I'm with the commands.”
From 2h10m05s	Co2 pulls the stick, lifting the nose; artificial horizon ECAM (Electronic Centralized Monitoring Aircraft) indicates the position nose-up; Co1 gives many advices to Co2.	Co1: “Pay attention to your speed, pay attention to your speed, pay attention to your speed Stabilize […]. You have to go down, you have to go down, you're going up, you have to go down ! […] slowly”.
2h10m16s	Inconsistency between recorded speeds and increased aircraft attitude angle to just over 10.	Co1: “We lost the speed.”
2h10m50s	Co1 sends electronic signal to the commander, calling him urgently; stall alarm again.	Co1: “It comes or does not come ?!”.
2h10m51s	Loss of support of the airplane; early loss of altitude and buffeting (turbulence or vibration caused by movement of the layers of air around the aircraft).	Co2: “I have no more control over the plane.”

4.2.3 Phase 3: from sustaining loss alarm activation until the end of the flight

Almost one minute after the activation of the support loss alarm, the captain back to the cockpit. The Co2 keeps the commands to raising the nose of the aircraft. In the following seconds, all recorded speeds become invalid (or near zero) and the alarm to. At one point, the Co2 performs actions to poke (synonymous with “down”; movement in which the pilot pushes the joystick and directs the nose down), which makes the aircraft reduce their incidence angle ( Figure 1 ). Speeds then return to be valid and the support loss alarm reactivates. The Co1 tries to take over the commands, and from there, simultaneous actions of the two co-pilots on the joystick levers are recorded in the black boxes. Records end in 2h14min28seg ( Chart 4 ).

Chart 4
Chronological order of events, utterances of the pilots and aircraft position in phase 3 of the accident.

Hour	Events	verbalizations associated	Position and direction of the aircraft
2h10m51s	The plane support loss. Early loss of altitude and buffeting.	Co2: “I have no more control over the plane.”
2h11m42s	Commander back to the cockpit.	Commander: “What's going on here?”
From 2h11m42s	recorded speeds become invalid and the stall warning to.	Co2: “I do not have any indication.” Co1: “We have no indication that it is valid […] we are not understanding anything. What you should do? “ With “I do not know.”
2h12m17s	The Co2 takes action to prick the plane. With this, the speeds are again valid, the angle of incidence decreases and the support loss alarm reactivates.	Co1 “. Now it's good It's back to zero level […] no, no, he does not want.”
2h13m32s	Altitude reference reached worries Co2. Again, actions to nose-up the aircraft are registered and sustaining loss alarm for.	Co2, “Let's get to the hundred level.”
2h13m47s	Co1 tries to take over the controls and the records indicate simultaneous actions of the two co-pilots on the levers.	Co2: “Go on, you have the controls.”
Among 2h13m48s and 2h14m28s (order of the records)	The aircraft has a vertical speed of nearly 200 km / h hardly moves horizontally. Orders are given controversial in recent dialogues inside the cockpit.	Co1, “Go down, you have to come back down.” Commander: “No, you have to climb.” Co2: “I'm going up.” Commander: “Okay, now get off. Place the wings horizontally. “ Co2: “But what am I trying to do? I'm doing this as much as possible. “ Co1: “I have control?”. Co2: “Why do we continue down the bottom?”. Co1: “Go up, up, up.” Co2: “I'm ordering the background nose-up.” Commander: “No, no, no, do not go! No, no, come down! […] be careful, you have to raising the nose of the aircraft “. Co2: “I am! We are less than 4,000 feet. “ Commander: “go up.” Co1: “Go up, up, up! […] we'll hit! This is not true!”. Co2: “What's going on?”.

5 The investigation of the accident by the BEA and the limits of this approach

The final diagnosis of BEA (2012) suggests that the pilots did not respect some basic safety rules in civil aviation. In A330, the ECAM proposes actions to be performed in most cases of failure or emergency during the flight. From information provided by the monitor, “[…] the team must review and confirm the nature of the fault before starting any breakdown of corrective action […]” ( BEA, 2012 , p. 110), or, in cases where the monitor does not identify the anomaly, the “[…] expected appropriate response team assumes immediate action memory to stabilize the situation […]” ( BEA, 2012 , p. 108).

The plane begins to leave its flight envelope, the stall alarm sounds and sounds 74 times in 54 seconds. The BEA report ( BEA, 2011 , p. 79) recalls that despite this, “none of the pilots made reference to support loss alarm”. There were, however, other signs in the cockpit in addition to this alarm, which could indicate that the aircraft had stalled: the loss of altitude, an artificial horizon showing the position nose-up and buffeting. According to the BEA (2012) , these signs do not seem to have been sufficiently clear to the pilots, since no standard ad on the attitude angle differences and vertical speed was made. Thus, according to the BEA (2012) , the pilots did not understand that the aircraft had stalled and, consequently, possible recovery maneuvers were not applied.

The group Human Factors (HF) BEA sought then “[…] examine the subsets of related devices to behaviors and skills expected of flight crews on the situation encountered […]” ( BEA, 2012 , p. 107), also seeking to elucidate the reasons why anomalies were identified. The HF team BEA evokes the appearance of visual-auditory conflicts strong workload situation mobilizes selective attention, leading the pilots to a “[…] certain hearing insensitivity to the appearance of rare and contradictory audible alarms with information cockpit […]” ( BEA, 2012 , p. 111), as other alarms (eg, loss of altitude or shutdown automatic pilots) also sounded in the cabin during the fall of the aircraft.

Failure to stall alarm ID is associated, by FH group BEA, the absence of further training on this.

Recognition of the stall alarm, associated with the same buffeting, assumes that the staff assigned to the alarm a minimum legitimacy. This presupposes, however, a sufficient prior experience, a minimum of cognitive availability and understanding of the context, knowledge of the aircraft (and their protection modes) and on the physics of flight ( BEA, 2012 , p. 206).

In addition to non-identification of the stall alarm, Co2 action to pull the joystick or instead of pushing it was also justified by the FH group:

[…] the excessive nature of pilot actions (CO2) can be explained by surprise and the emotional charge the disconnection of the autopilot, amplified by the lack of practical training of staff in high-altitude flights […] ( BEA, 2012 , p. 179).

The justification of the BEA and its FH group is therefore based on human sensory limits, the emotional charge of the situation and the lack of proper training for the identification and management of occurring anomalies, whether the failure to identify the support loss alarm, not to support loss identification itself, the fact that the Co2 pull the lever rather than push it and realized diversion. Are these reasons, according to the BEA, leading the pilots to commit driving errors considered primary. But it is not strange that a team with great experience to have committed?

Classically, research in laboratory conditions “double-tâche” or overhead showed a reduction in performance when attention should be divided. These selective attention mechanisms establish even different weights between the senses. A recent study electrophysiology on a piloting task confirms that the appearance of such visual-auditory conflicts strong workload situation is reflected by a selective attention mechanism that favors the visual information and lead pilots to neglect critical audible alarms ( Scannella, 2011 ).

Similarly, training plays a key role in the recognition and control of risk situations or heavy workload. The construction of an answer from previous knowledge is assumed in real time the event occurs, an embodiment of the anomaly to the mental representation of the situation, which can undergo a construction or reconstruction of the representations previously assigned. Thus, the correct perception of the situation by a team, which can improve the reliability and speed of diagnosis and the decision is linked not only to the way in which this situation is presented to this team, but also to their training and previous experience ( Jouanneaux, 1999 ).

However, it is necessary to clarify in addition to these physiological mechanisms or lack of training, as in the course of action, operates selective perception. The conclusions of the BEA FH group on very little accident added to the explanations published in previous reports because they do not take into account the action set and the interaction between the set of parameters that make up the context.

After the accident, several publications (eg BEA, 2011 , 2012 ; Otelli, 2011 ) considered the action of Co2 to pull the stick as unacceptable, and said that some basic safety rules have not been respected.

The actions of Copilot (CO2) can be described as sudden and excessive [...]. They are inappropriate and do not correspond to an expected pilot phase of flight at high altitude […] ( BEA, 2012 , p. 179).

Otelli (2011) points out that, according to the laws of aerodynamics in support loss situations is necessary to push the joystick (not vice versa), exercising actions to poke the aircraft to regain their support. According to the author, are basic rules of aerodynamics apply to all types of aircraft.

Explanations like these are clear, but only because they represent the view of an outsider, which occupies a privileged asymmetrical position in relation to the co-pilot inside the cockpit: the post-accident analyst knows for sure what position was the plane at that point, so what rule should have been applied to keep it under control. Only in retrospect is that the situation seems to be simple and manageable from a “basic rule of aerodynamics”. There is no point, however, reaffirm this rule as an explanation (and also strengthen it as a safety procedure) because jumps up one step - the most crucial - in the course of actions and events that led to the crash: why the co-pilot not can build an adequate representation of the aircraft condition. Likewise, recommending that “the team should analyze and confirm the nature of the failure before initiating any corrective action” assumes an ideal situation that rarely occurs in practice.

Analyzes based on expected behaviors depending on the planned anomalies are insufficient because it does not take into account the representation of the current situation, only the known context of the data, of course, after many hours of analysis and with the help of several experts. This is what Bergson called “Illusion Background” or “Retrograde True Motion”, ie the construction of a diagnosis by the researchers in which is believed to be true a past event using this data ( Bergson, 1934 ). This retrospective illusion, typical of the official examination continues resisting criticism from several authors in accidents ( Reason, 1990 ; Bourrier, 1996 ; Vaughan, 1996 ; Llory, 1999 ; Collins & Pinch, 2010 ; Amalberti, 2013 ).

Thus, the judgment of the behavior of the drivers in previous moments shock should be suspended until they understand the cognitive processes of their decision-making inside the cockpit, as they are not fully pre-designed but are built as the flight it develops, according to the possibilities offered by the meteorological situation and relations with the flight control ( Jouanneaux & Clot, 2002 ). As discussed above, the error should not be the conclusion of an investigation, but its starting point ( Dekker, 2003 ). Item 6 of this article will develop these issues more deeply.

6 The crash of flight AF447 from the perspective of situated action/cognition

The final conclusion is that the BEA pilots committed a series of serious errors, for not understanding that the aircraft had lost support. However, the question to be answered should be why, when they were in, the pilots did not understand the situation and committed the primary errors identified in the investigations? The inconsistency between the information coming from the automatic system and those perceived and interpreted by the drivers is the key to answering this question and understand their behavior, being necessary to consider the immediate situation between team-cockpit-plane in flight and their interrelationships dynamics. To understand the situation, not enough to confront the world's state at any given time (the plane position information available in the cockpit [...]) to the actions of the pilots (behavior, speech and commands). Human operators perceive and act according to the mental representations and perceptions that mediate the relationship with the situation and not on the basis of an exhaustive copy of the external reality.

Based on the approaches of situated action and distributed cognition, in item 6.1 will be sought to clarify the reasons, different times and misunderstanding levels of riders, or rather of “representation failures” ( Daniellou, 1986 ), proposing another explanation of their behavior, characterized as trivial errors in relation to the signals received by the aircraft. After this comprehensive analysis, in item 6.2 will be offered different preventive action elements in relation to those published by the BEA, demonstrating the practical potential of the analysis proposed here for the prevention of accidents.

6.1 The (mis) understanding of the situation and behavior of drivers

Why pilots did not understand the actual condition of the plane? Why not recognize the signals emitted by the aircraft for the loss of support, such as alarm and the buffeting? Why Co2 pulls the stick and worsening support loss condition? Why the Commander does not have a more forceful reaction and directly assumes the command to return to the cockpit? Answering these questions only from our descriptions of context or even explanations of actions based on the theory of action located in can lead to errors of interpretation and an untrusted analysis from the point of view of the own pilots. Thus, to try to fill the absence of the main actors - the pilots - we confronted possible explanations supported by the action theory situated with explanations of pilots and ex-pilots, given in official interviews about the accident, in particular as to the meaning that may have been assigned by the team, in the heat of action, to the signals provided by the aircraft during the crash.

The immediate sequence of events that led to the accident begins with the freezing of Pitot probes. From this fact, depending on the context in which this occurrence was inserted and the subsequent actions of the pilots, a sequence of events generates various signals in the cockpit, not all perceived or properly interpreted by the pilots: the autopilot disconnects; the speed indicator shows a sharp decline; various alarms sound in the cabin, while at times and separately in others; the altitude indicator shows a rapid and progressive decrease, while the artificial horizon shows a position nose-up of the aircraft wings; the buffeting begins and continues until the clash with the water.

The misunderstanding of the context was not reduced by the warning signals from the ECAM, which contributed to the unreliable signs, which lasted from the start of the crash until the end of the flight. Several contradictory orders were issued by the pilots in the final moments of tragedy: Co1 Rules “Get off, you have to come back down!” But then the captain verbalizes “No, you have to climb.” Seconds later, the captain himself says “ok, now come down, put the wings horizontally” while the Co1 verbalize “Go up, up, up.” The Commander at last orders “No, no, no, no, go! No, no, come down! [...] be careful, you have to raising the nose of the aircraft” and then he says, “go up”( Chart 3 ).

Much has been said about the lack of understanding of the drivers on the stall condition of the aircraft. It is necessary, however, that there is a previous level of misunderstanding, which is determining the sequence of events: that the speed of the aircraft had not changed, despite the electronic indicator shows otherwise. When the autopilot stops working, the cockpit of the information system provides them with a disparate information from the actual plane situation.

6.1.1 Explanation of the 1st level of misunderstanding and the consequences on the behavior of drivers

None of the alerts issued by the aircraft identified the direct cause of the anomaly occurred, ie the freezing of Pitot probes. Only the immediate consequence of this anomaly (sudden reduction in speed) is displayed by the trip computer, but not its cause. Once the probes are frozen, the pilots see an abnormal speed on the panel and act according to this sign, believing it to be true. However, this signal is not real, because the speed of the plane had not been changed, only your statement. The initial malfunction is in the speed sensor and not the speed itself. All operations from this are carried out according to this interpreted situation and not to an actual situation.

This is how Gérard Arnoux, company Air France pilot, recalls that the Pitot probes had not given false indications of speed, the accident would not have occurred. He said the Co2 pulls the stick and takes the plane to loss of support because “it has a very low speed under the eyes” (France 3, 2012).

Pilots do not know the actual speed at which they are. During a trip so far without incident, the first available abnormality signal is the speed indicator. However, they are unaware of the anomaly in the Pitot probes. The shifting speed displayed by the panel not to say necessarily had an abnormality in the speed of probes, as this anomaly could be any other system component. The failure of the Pitot probes is only obvious after the accident occurred. In this sense, a hypothesis formulated by Co2 could have been a real change in the speed of the aircraft, not just the change in the electronic indicator. No information of the actual speed and without knowing the technical incident, pull the stick may have been an attempt to resume the speed Co2, whose notes are presented below the normal speed.

6.1.2 Explanation of the 2nd level of misunderstanding and the consequences on the behavior of drivers

The Co2 then pulls the stick to gain speed, and places the aircraft in a condition that leads to loss of support. The aircraft begins to fall and some signals are issued by it: begins the buffeting and the ECAM will indicate a zero speed, altitude gradually decreasing and an artificial horizon outside the stable position when the wings are not on horizontal axis. For pilots, these signs are incomprehensible and this situation lasts until the clash with the water.

The buffeting, according Gérard Arnoux, is perceived in a clear and calm sky, but when we are in a turmoil, notice the physical difference between the stall and such turbulence is extremely difficult, or impossible, especially across a geographical area known to be of great turbulence and under strong storm (France 3, 2012). Thus, by itself, the sense of turmoil was not an abnormality indicator and could be considered as the result of external conditions.

From the moment the plane goes into sustaining loss, the altitude indicator shows a progressive loss and riders constantly make reference to it. “Let's get to the hundred level”, says Co2, referring to the proximity to the sea level. At the same time, the artificial horizon indicates that the wings are not in horizontal position, which demonstrates instability of the aircraft. “Put the wings horizontally”, verbalize the Commander in order to stabilize the aircraft.

At that moment (and until the end of the flight), the riders have no doubts that the plane is falling. The misunderstanding revolves around the fall of reason and not the fall itself: the same state can be caused by different circumstances in the world and the complex system of subsystems is a plane.

Two main points thus seem to be a priority for drivers: gain altitude and stabilize the aircraft's wings. Multiple alarm sounding at the same time, an indicator showing the altitude falls continuously, and another showing the instability of the aircraft, the biggest concern of the pilots was not to analyze all alarms, identifying which were real to eliminate information system ambiguities, but before that, it was to understand why the plane was out of control and why the altitude be gradually decreasing. So it is not essential to understand the alarms that sound if these signs do not make sense to understand and guide the altitude control resumption actions.

The priority, then, is to regain altitude and control the wings of the aircraft. It is for this reason that the CO2 continues to pull the stick. This action is usually effective in elevation gain, but not in support loss situations. At this point, you must do the opposite, that is, push the joystick to recover support and, from there, gain speed and altitude to recover. Pierre Henri Gourjeant, Executive General Manager of Air France at the time of the accident and former fighter pilot, said the biggest misunderstanding is exactly at this point. He said the pilots did not understand why they were in raised position (with the stick pulled and the artificial horizon showing the position nose-up) and yet, they were down (France 3, 2012).

Lack of knowledge about the situation, therefore, was widespread. It is not known the origin of anomalies (freezing of Pitot probes) and also unknown whether the loss of the aircraft support. Inside the cockpit, the information received is of inconsistent speed, altitude gradually decreasing and aircraft wings in unstable position. Without realizing that the plane is without support, seeing the indications inconsistent speed panel and the altitude progressively decreases, continue pulling the joystick levers it seems to be the most reasonable solution to be taken to recover the altitude of the aircraft.

At one point, the Co1 tries to take over the controls, but records show the black-box simultaneous actions of two pilots on the levers ( Chart 3 ). An important detail should here be clarified: the Airbus of sight does not allow a pilot to view the actions of the other. The Airbus, unlike other aircraft such as the Boeing, has the joystick levers on the outer side of both drivers, so that the pilot positioned to the right of the cockpit handles the stick with his right hand while the pilot on the left to juggle with his left hand. With the field of vision of the pilots limited in relation to the action of the colleague on the Airbus joke, actions taken by a pilot are hardly observable by the pilot beside ( Amédéo, 2010 ).

6.1.3 The behavior of Commander in situated action

In addition to the actions and behaviors adopted by Co2, many were the questions raised about the captain's behavior during the crash: why he left the cockpit at a time considered delicate flight and did not return because as was soon called by Co1? And why, when you arrive, do not immediately took command? The following discussion will reflect on these issues.

BEA (2011) makes it clear that, when there is a disconnection of the autopilot, the captain was resting outside the cockpit. But the plane is falling more than 1 minute, it was called by Co1 4 times on an emergency basis and remains absent from the cockpit. Only about 1'30 ” after switching off the autopilot, it returns. Herve Labarthe, maple former commander of Air France, said the commander is not required to remain in place for the rest during the whole period you are entitled. It can, for example, go to the bathroom, drink water or talk to someone from the crew and thus to leave the resting place (France 3, 2012), which may explain the relatively long time for him to return.

When it comes to the cockpit and realizes that the situation is not normal, the commander “[...] should have asked the co-pilot, necessary procedure due to urgency and the stress transmitted by the voice of the non-functional pilot (Co2) [...]” ( BEA, 2012 , p. 186). However, according to Herve Labarthe, the information is extremely confusing to the captain when he is faced with the situation. It does not have the “situation” in the head and therefore need some time to “enter” the context. However, both drivers do not give you any reliable information, which explains the lack of a more objective attitude on the part of the commander to take control. Under these conditions, without having lived the complete history of the sequence of events, it was extremely difficult for the commander to establish a diagnosis and take control of the plane (France 3, 2012). In fact, rather than having the “situation in the head”, to act in consonance with a situation, an actor needs to be in a “body and soul” situation ( Dreyfus, 2012 ).

7 Conclusion: the return of experience of everyday situations in order to prevent

Cognitive analysis that formed the basis for reconsidering the flight of the accident AF447 leads to different prevention actions, seeking to develop the team's ability to understand and act appropriately in such incidental situations, acting both in training and in the configuration of the information in the cockpit. Analysis of BEA draws conclusions that show failures of equipment and team riders, whose corrections lead to the classical measures to strengthen both the technical reliability of aircraft, through recommendations on flight records and on equipment certification processes, as human reliability, via training to adopt attitudes and behaviors in certain emergency situations. We resume here one of the recommendations is significant how the approach to human factors handles cognition. The BEA confirms that “[...] from information available at ECAM, the team must review and confirm the nature of the fault before starting any breakdown of corrective action [...]” ( BEA, 2012 , p. 110). As shown in this article, the monitor of the aircraft did not identify the source of the crash, or the freezing of Pitot probes. In cases where the monitor does not identify the anomaly, the expected reaction team “[...] assumes immediate action memory to stabilize the situation [...]” ( BEA, 2012 , p. 108). The BEA, however, does not explain how to do this, making visible the assumption of memory as a stock, acquired and accumulated during trainings in simulators. The practical interest of the cognitive analysis used here is that, when we understand differently what happened in the cockpit, we can also propose preventive measures differentiated from the recommendations of the official reports.

To move forward in systems security management, it is necessary to know the representations of workers and way in which they deal with the variability of the environment. It is undeniable technical contribution in the evolution of security levels, but the technical choices are ambivalent: they help to reduce the frequency of accidents, but at the same time, generate other accidents, to create obstacles to cognitive activities of the operators. The question that comes up is how we can move forward in a concrete way on security issues when the automation more complex the technology, making it obscure the causes of technical failures with which faced by pilots and flight situations?

The introduction of automation technologies brings some paradoxes that create difficulties for the development of human activities still needed to control the equipment. It's what Bainbridge (1982) calls the “ironies of automation”: the design logic adopted by engineers, who believe they are the operators the weak link of the human-machine system, induces errors of the pilots, to them to reduce the decision margins and autonomy. Automated technical systems have become increasingly sophisticated and are made up of different sub-systems not integrated yet, whose informational interfaces can induce difficulties while driving. The introduction of computerized airplanes, by adopting the logic of substitutive automation of the human operator, constituted a rupture in the professional culture of the pilots, leading to a formalization of all segments of the flight in the language of the machine to the detriment of the pilots' own thinking ( Jouanneaux & Clot, 2002 ).

In practical terms, it is initially to reverse the logic of the automation process, adopting the principles of instrumental theory: automation should serve as an instrument inserted into an activity whose and development favor and not as a substitute operator considered unreliable. Currently, it automates what is possible, and the employee, the responsibility to manage what can not be automated is given, as exemplified in crash situations or when the autopilot stops working. However, all the information automatically processed may, in certain situations, be missed in the construction of process status representations, especially in breakdown or emergency situations. From the analysis of the course of action, some of these elements can be evidenced, revealing the necessary coupling between experience and the course of events, adequately mediated by the information system.

Today when the technical reliability continuously perfect, but accidents continue to occur as a result of minor faults that spread unpredictably in a complex system, prevention becomes even more dependent on subjective perceptions and not formalizable not formalized. The chill or “butterflies” ( Dreyfus, 2012 ) is announcing the possibilities to improve safety: extreme situations that are perceived by the body in action, the practical intelligence before they can be understood consciously or verbalized, which It requires approaches based on the theory of action set to be highlighted. In the case of flight AF447, the freeze failures Pitot tube were already known: what we do not know is how the pilot teams found themselves to make this diagnosis in various configurations in which this occurred, and continues to happen, without having generated accidents. Indeed, in some of them, to understand what is going on and regain control of the aircraft is easy and others more complicated. But the approach to recognize critical situations need not only be focused on the failure of a component (Pitot tube) that defines a specific case. The failure of the sensor is difficult to be diagnosed by another second-order difficulty: how to eliminate inconsistencies between information presented in the ECAM? In this degree of generality, several other situations of instability and momentary outages components could be identified, from the situations experienced by the pilots, as critical situations to be used in simulators. Thus, the training simulators may be more diverse and realistic.

A management system based only on past situations that have generated visible accidents or incidents can become ineffective for not offering conditions to anticipate all risk situations. Everyday security in action, is a key component of systemic safety, and to develop it is necessary to know the representations of workers not only on past situations of risk, but also on the everyday work situations ( Hollnagel et al., 2006 ) that had some type of difficulty, but that did not necessarily have serious consequences. In this sense, not enough to develop reaction capabilities from training on simulators, but we must also recognize and socialize diffuse collective experience that teams accumulate in real situations flight. For this, the return procedures of experience (REX) existing should be revitalized from what is already known about the workings of memory situation ( Hutchins, 1991 ). Rocha et al. (2015) show that the development of a practical approach based on the return of everyday situations experience not only brings benefits in the security field, as well as on productivity and the organization's innovation potential.

So one of the keys to advance the safety of air systems is the organization of a return experience able to feed effectively the development of simulations of air and emergency training. This will be possible only if this experience of return is based on real situations, ie from situations experienced daily and controlled in practice, but in which the driver or the team encountered some difficulty. This practice can help redesign and automation interfaces (alarms, shape and projection of the data ...) and also to redefine the necessary and relevant information to feed the simulations. This would be a way to make visible the managed safety of workers and the organization make progress due to the inherent learning to real activity and its ongoing development.

• Financial support: None.

Referências

• Allwood, C. M. (1984). Error detection processes in statistical problem solving. Cognitive Science, 8(4), 413-437. http://dx.doi.org/10.1207/s15516709cog0804_5.
  » http://dx.doi.org/10.1207/s15516709cog0804_5
• Amalberti, R. (1996). La conduite de systèmes à risques . Paris: Press Universitaires de France.
• Amalberti, R. (2013). Piloter la sécurité (141 p.). Paris: Springer-Verlag France. http://dx.doi.org/10.1007/978-2-8178-0369-2.
  » http://dx.doi.org/10.1007/978-2-8178-0369-2
• Amalberti, R., Auroy, Y., & Aslanides, M. (2004, octobre). Understanding violations and boundaries. In: The Canadian Healthcare Safety Symposium (pp. 14-16). Edmonton: Alberta editora.
• Amédéo, F. (2010). La face cachée d’Air France . Paris: Flammarion.
• Bainbridge, L. (1982). Ironies of automations. In Duncan K. & et Leplat J. New technology and human error (pp. 271-286). Chichester: Willey & Sons. http://dx.doi.org/10.1016/S1474-6670(17)62897-0.
  » http://dx.doi.org/10.1016/S1474-6670(17)62897-0
• Bergson, H. (1934). La pensée et le mouvant Paris: PUF.
• Bourrier, M. (1996). Organizing maintenance work at two american power plants. Journal of Contingencies and Crisis Management, 2(4), 104-112.
• Bureau d'Enquêtes et d'Analyses – BEA. (2009a). Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France (127 p., Rapport d’étape). Paris: BEA.
• Bureau d'Enquêtes et d'Analyses – BEA. (2009b). Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France (105 p., Rapport d’étape 2). Paris: BEA.
• Bureau d'Enquêtes et d'Analyses – BEA. (2011). Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France (117 p., Rapport d’étape 3). Paris: BEA.
• Bureau d'Enquêtes et d'Analyses – BEA. (2012). Accident survenu le 1er juin 2009 à l’Airbus A330-203 immatriculé F-GZCP exploité par Air France (230 p., Rapport final). Paris: BEA.
• Collins, H., & Pinch, T. (2010). O golem à solta Belo Horizonte: Fabrefactum.
• Daniellou, F. (1986). L'opérateur, la vanne et l'écran, l'ergonomie des salles de contrôle Paris: Editions de l'ANACT.
• Daniellou, F., Simard, M., & Boissières, I. (2010). Fatores humanos e organizacionais da segurança industrial (Traduzido do original Facteurs humains et organisationnels de la sécurité industrielle por R. Rocha, F. Duarte, F. Lima). Toulouse: ICSI. Recuperado em 5 de novembro de 2013, de http://www.FonCSI.org/fr/cahiers/
  » http://www.FonCSI.org/fr/cahiers/
• Dekker, S. W. A. (2003). Failure to adapt or adaptations that fail: contrasting models on procedures and safety. Applied Ergonomics, 34(3), 233-238. http://dx.doi.org/10.1016/S0003-6870(03)00031-0. PMid:12737923.
  » http://dx.doi.org/10.1016/S0003-6870(03)00031-0
• Dreyfus, H. L. (2012). A internet: uma crítica filosófica à educação a distância e ao mundo virtual Belo Horizonte: Fabrefactum Editora.
• Foushee, M. C. (1984). Dyads at 35,000 feet: factors affecting group processes and aircraft performance. The American Psychologist, 39(8), 885-893. http://dx.doi.org/10.1037/0003-066X.39.8.885.
  » http://dx.doi.org/10.1037/0003-066X.39.8.885
• France 3. (2012). Pièces à conviction Recuperado em 5 de novembro de 2013, de http://www.youtube.com/watch?v=kXMsmPQKaps
  » http://www.youtube.com/watch?v=kXMsmPQKaps
• Hollnagel, E., Woods, D. D., & Leveson, N. (2006). Resilience engineering. Aldershot: Ashgate.
• Hutchins, E. (1991). How a cockpit remembers its speed La Jolla: University of California.
• Hutchins, E. (1995). Cognition in the wild Massachussets: Institute of Technology.
• Hutchins, E. (2000). Distributed cognition San Diego: IESBS, University of California.
• Hutchins, E., & Klausen, T. (1996). Distributed cognition in an airline cockpit . In Y. Engeström, D. Middleton (Eds.), Cognition and communication at work Cambridge: University Press. http://dx.doi.org/10.1017/CBO9781139174077.002.
  » http://dx.doi.org/10.1017/CBO9781139174077.002
• International Aviation Safety Association Program – IASA. (2006). Stroking the Razor’s Edge – a possible explanation for Air France Flt 447? USA: Federal Aviation Administration. Recuperado em 6 de novembro de 2013, de http://www.iasa-intl.com/folders/belfast/AF447.htm
  » http://www.iasa-intl.com/folders/belfast/AF447.htm
• Jouanneaux, M. (1999). Le pilote est toujours devant. Reconnaissance de l’activité du pilote de ligne Toulouse, Octarès Editions.
• Jouanneaux, M., & Clot, Y. (2002). Pilotes de ligne: deux accidents et une question de métier. Cliniques Méditerranéennes, 66(2), 55-63. http://dx.doi.org/10.3917/cm.066.0055.
  » http://dx.doi.org/10.3917/cm.066.0055
• Lave, J. (1988). Cognition in practice Cambridge: Cambridge University Press. http://dx.doi.org/10.1017/CBO9780511609268.
  » http://dx.doi.org/10.1017/CBO9780511609268
• Lima, F. (2005). Norma e atividade humana: modelos dinâmicos da prescrição e historicidade das situações de trabalho. In Departamento Intersindical de Estatística e Estudos Socioeconômicos – DIEESE, Centro de Estudos Sindicais e Economia do Trabalho – CESIT (Org.), Trabalho e abordagem pluridisciplinar: estudos Brasil, França e Argentina (pp. 51-68). São Paulo: DIEESE.
• Llory, M. (1999). Acidentes industriais: o custo do silêncio. Rio de Janeiro: Multimais.
• Morel, G., Amalberti, R., & Chauvin, C. (2008). Articulating the differences between safety and resilience: the decision-making process of professional sea-fishing skippers. Human Factors, 2008(1), 1-16. http://dx.doi.org/10.1518/001872008X250683. PMid:18354967.
  » http://dx.doi.org/10.1518/001872008X250683
• Otelli, J. P. (2011). Erreurs de pilotagem (No. 5, Crash Rio-Paris, 285 p.). Levallois-Perret: Editions Altipresse.
• Rasmussen, J. (1997). Merging paradigms: decision making, management, and cognitive control. In R. Flin, E. Salas, M. E. Strub & L. Marting. Decision making under stress: emerging paradigms and applications Aldershot: Ashgate.
• Reason, J. (1990). Human error Cambridge: Cambridge University Press.
• Rizzo, A., Bagnara, S., & Visciola, M. (1987). Human error detection processes. International Journal of Man-Machine Studies, 27, 555-570.
• Rocha, R., Mollo, V., & Daniellou, F. (2015). Work debate spaces: a tool for developing a participatory safety management. Applied Ergonomics, 46(Pt A), 107-114. PMid:25109248.
• Scannella, S. (2011). Bases cérébrales du conflit visuo-auditif spatial et sémantique: études en IRM fonctionnelle et EEG (Thèse). Université de Toulouse, Toulouse, França.
• Scribner, S. (1986). Thinking in action: some characteristics of practical thought. In R. J. Sternberg & R. K. Wagner. Practical intelligence (pp. 13-30). Cambridge: Cambridge University Press.
• Suchman, L. (1987). Plans and situated actions: the problem of human/machine communication. Cambridge: Cambridge University Press.
• Terssac, G., Boissieres, I., & Gaillard, I. (2009). La sécurité en action Toulouse: Octarès, Coll MSH-T.
• Theureau, J. (2004). L’hypothèse de la cognition (ou action) située et la tradition d’analyse du travail de l’ergonomie de langue française. Activités (Vitry-sur-Seine), 1(2), 11-25. http://dx.doi.org/10.4000/activites.1219.
  » http://dx.doi.org/10.4000/activites.1219
• Vaughan, D. (1996). The challenger launch decision: risky technology, culture and deviance at NASA Chicago: Chicago UP.

Publication Dates

• Publication in this collection
  21 June 2018
• Date of issue
  Jul-Sep 2018

History

• Received
  23 Nov 2016
• Accepted
  01 May 2017