Volume 13

Publisher ISASI (Frank Del Gandio, President) Editorial Advisor Air Safety Through Investigation Richard B. Stone Editorial Staff Susan Fager Esperison Martinez Design William A. Ford Proceedings of the ISASI Proceedings (ISSN 1562-8914) is published annually by the International Society of Air Safety Investigators. Opinions

40th Annual ISASI 2009 PROCEEDINGS expressed by authors are not necessarily endorsed or represent official ISASI posi- tion or policy. International Seminar Editorial Offices: 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA. Telephone: (703) 430-9668. Fax: (703) 450-1745. E-mail address: [email protected]. Inter­net website: http://www.isasi.org. ‘Accident Prevention Beyond Notice: The Proceedings of the ISASI 40th annual international seminar held in Orlando, Fla., features presentations on Investigation’ safety issues of interest to the aviation com- munity. The papers are presented herein Sept. 14–17, 2009 in the original editorial content supplied by the authors. Orlando Fla., USA Copyright © 2010—International Society of Air Safe­ty Investigators, all rights reserved. Publication in any form is prohibited with- out permission. Permission to reprint is available upon application to the editorial offices. Publisher’s Editorial Profile: ISASI Proceed- ings is printed in the United States and published for professional air safety inves- tigators who are members of the Interna- tional Society of Air Safety Investigators. Content emphasizes accident investigation findings, investigative tech­­niques and expe- riences, and industry accident-prevention developments in concert with the seminar theme “Accident Prevention Beyond In- vestigation.” Subscriptions: Active members in good standing and corporate members may ac- quire, on a no-fee basis, a copy of these Pro- ceedings by downloading the material from the appropriate section of the ISASI website at www.isasi.org. Further, active and corpo- rate members may purchase the Proceedings on a CD-ROM for the nominal fee of $15, which covers postage and handling. Non- ISASI members may acquire the CD-ROM for a $75 fee. A limited number of paper copies of Proceedings 2009 are available at a cost of $150. Checks should accompany the request and be made payable to ISASI. Mail to ISASI, 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA ISSN 1562-8914

ISASI 2009 Proceedings • 1 ISASI 2009 PROCEEDINGS 2

• rin Carroll ErinCarroll Corporate Affairs, Cabin Safety, JoannE.Matley([email protected]) ladislavMika(Co-Chair)([email protected]) Air Traffic ScottDunham(Chair) Services, W Seminar, BarbaraDunn([email protected]) Reachout, JohnGuselli([email protected]) Nominating, JaymeE.Nichols([email protected]) Membership, Tom McCarthy([email protected]) Code ofEthics,JeffEdwards([email protected]) Bylaws, DarrenT. Gaines([email protected]) Board ofFellows,LudiBenner([email protected]) TomBallot Certification, McCarthy([email protected]) Award, GaleE.Braden([email protected]) Audit, Dr. C Alaska, CraigBledsoe C U United States,Toby Carroll([email protected]) SESA-France Chapter, VincentFave Russian, VsvolodE.Overharov ([email protected]) New Zealand,PeterWilliams([email protected]) Latin American,GuillermoJ.Palacia(Mexico) European, DavidKing([email protected]) Canadian, BarbaraM.Dunn([email protected]) Australian, LindsayNaylor([email protected]) S N United States,Toby Carroll([email protected]) New Zealand,PeterWilliams([email protected]) CajFrostell([email protected]) International, European, AnneEvans([email protected]) Canadian, BarbaraDunn([email protected]) Australian, LindsayNaylor([email protected]) C Treasurer, Tom McCarthy([email protected]) ChrisBaum([email protected]) Secretary, Vice-President, RonSchleede([email protected]) Executive Advisor, RichardStone([email protected]) President, FrankDelGandio([email protected]) O Government AirSafety,Government WillaimL.McNease General Aviation, Flight Recorder, M RobertRendzio([email protected]) Southeastern, San Francisco,Peter Axelrod Rocky Mountain,DavidHarper KevinDarcy([email protected]) Pacific Northwest, DavidW.Northeast, Graham([email protected]) Mid-Atlantic, RonSchleede([email protected]) Los Angeles, Inactive Great Lakes,MatthewKenner([email protected]) Tim Logan([email protected]) Dallas-Ft. Worth, Arizona, BillWaldock ([email protected]) Unmanned AerialSystems, Tom Farrier ([email protected]) Graham R. Braithwaite Investigators Training & Education, Human Factors,RichardStone([email protected]) ISASI 2009 ISASI OCIETY OMMITTEE HAPTER OUNCILLORS ATIONAL AND NITED ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) FFICERS ORKING M ichael K. Hynes P S ichael R. Poole Randall S. Proceedings TATES P G RESIDENTS RESIDENTS ROUP

C

HAIRMEN R M

R ainquist EGIONAL EGIONAL

C

EGIONAL

HAIRMEN

ISASI Information

Federal Aviation Administration Exponent, Inc. EVA Corporation Airways European Aviation SafetyAgency Era Aviation, Inc. Emirates Airline AeronauticalUniversity Embry-Riddle Embraer-Empresa BrasileiradeAeronauticaS.A. EL ALIsraelAirlines Dutch Transport SafetyBoard Dutch AirlinePilotsAssociation Dombroff GilmoreJaques&FrenchP.C. Directorate ofFlyingSafety—ADF Directorate ofFlightSafety(CanadianForces) Directorate ofAircraftAccidentInvestigations—Namibia Delta AirLines,Inc. Defence ScienceandTechnology Organization(DST) DCI/Branch AIRCO Curt Lewis&Associates,LLC Cranfield Safety&AccidentInvestigationCentre C Continental Express Continental Airlines Comair, Inc. Colegio DePilotosAviadores DeMexico,A.C. Civil Aviation SafetyAuthorityAustralia Cirrus Design China Airlines Charles Taylor Aviation, Singapore Centurion, Inc. Cavok Group,Inc. Limited Cathay PacificAirways CAE-Flightscape, Inc. Bundesstelle furFlugunfalluntersuchung—BFU Bombardier AerospaceRegionalAircraft Boeing CommercialAirplanes Board ofAccidentInvestigation—Sweden BEA-Bureau D’nquetesetD’Analyses Avions deTransport Regional(ATR) Aviation SafetyInvestigations,UK Aviation SafetyCouncil Australian Transport SafetyBureau Atlantic SoutheastAirlines—DeltaConnection Association ofProfessionalFlightAttendants ASPA deMexico Aramco AssociatedCompany AmSafe Aviation Search&Survey,American Underwater Ltd. American EagleAirlines Allied PilotsAssociation CompanyLimited All NipponAirways Allianz Aviation Managers,LLC,USA Alitalia Airlines—FlightSafetyDept. Alaska Airlines Airways New Zealand AirTran Airways Australia Airservices Aircraft &RailwayAccidentInvestigationCommission Aircraft MechanicsFraternalAssociation Aircraft AccidentInvestigationBureau—Switzerland Airclaims Limited Airbus S.A.S. Air NewZealand,Ltd. Air LinePilotsAssociation Air CanadaPilotsAssociation Air Astana(Kazakhstan) Air AccidentsInvestigationBranch—U.K. Air AccidentInvestigationUnit—Ireland Air AccidentInvestigationBureauofSingapore Aerovias DeMexico,S.A.DeC.V. AeroVeritas Aviation SafetyConsulting,Ltd. Aeronautical &MaritimeResearchLaboratory Administration desEnquêtesTechniques (Luxembourg) Accident Investigation&PreventionBureau Accident InvestigationBoard/Norway Accident InvestigationBoard,Finland ofTransportAAIU Ministry Bulgaria C O ORPORATE Aviacion Comercial PAC/Colegio O ficial de Pilotos de la M EMBERS

WestJet ◆ Volvo AeroCorporation University ofSouthernCalifornia University ofNSWAviation UND Aerospace U.K. CivilAviation Authority Transportation SafetyBoardofCanada Transport Canada State ofIsrael Star Navigation Systems Group, Southwest AirlinesPilots’Association Southwest AirlinesCompany Southern CaliforniaSafetyInstitute South AfricanCivilAviation Authority South AfricanAirways SNECMA oteurs Singapore Airlines,Ltd. Airlines, Ltd. Skyservice Sikorsky AircraftCorporation SICOFAA/SPS Saudi ArabianAirlines SAS Braathens Sandia NationalLaboratories RTI Group,LLC Royal NewZealandAirForce Royal NetherlandsAirForce Rolls-Royce, PLC Republic ofSingaporeAirForce Raytheon Company Qwila Air(Pty),Ltd. Qatar Airways Limited Qantas Airways Pratt &Whitney Phoenix International,Inc. Parker Aerospace Northwest Airlines ofAviation andAccident Nigerian Ministry NAV Canada National Transportation SafetyBoard National BusinessAviation Association National AirTraffic ControllersAssn. National AerospaceLaboratory, NLR MyTravel Airways Lufthansa GermanAirlines Lockheed MartinCorporation Learjet, Inc. L-3 CommunicationsAviation Recorders Kreindler &Kreindler, LLP Korea Aviation&RailwayAccidentInvestigationBoard Korea AirForceSafetyCtr. KLM RoyalDutchAirlines Jones Day JetBlue Airways Jeppesen Japanese Aviation InsurancePool Japan AirlinesDomesticCo.,L Irish Aviation Authority Irish AirCorps Interstate Aviation Committee Int’l Assoc.ofMach.&AerospaceWorkers Independent PilotsAssociation IFALPA Hong KongCivilAviation Department Hong KongAirlinePilotsAssociation Honeywell Hellenic Air Accident Investigation Hall &Associates,LLC Gulf FlightSafetyCommittee,Azaiba,Oman Global Aerospace,Inc. GE Transportation/Aircraft Engines General Aviation M anufacturers Association Galaxy ScientificCorporation Flight SafetyFoundation—Taiwan Flight SafetyFoundation Flight AttendantTraining InstituteatMelvilleCollege Aviation Authority Finnish Military Finnair Oyj Investigation Bureau & Aviation SafetyBoard TD L td.

Table of Contents

62 Closing the Loop on the System Safety Process: The Human Factors Intervention Matrix (HFIX) 2 ISASI Information By Dr. Scott Shappell, Professor, Clemson University, Clemson, S.C., and 3 Table of Contents Dr. Douglas Wiegmann, Associate Professor, University of Wisconsin, 4 Preface: Accident Prevention Beyond Investigation Madison, Wisc. By Frank Del Gandio, President, ISASI 68 At What Cost? A Comprehensive and Statistical Analysis of EMS 6 Keynote Address: What Is Next? Helicopter Accidents in the United States from 1985 to 2007 By Deborah Hersman, Chairman, U.S. National Transportation Board, By Christine Negroni(FO5208) and Dr. Patrick Veillette Washington, D.C., USA 72 Sifting Lessons from the Ashes: Avoiding Lost Learning Opportunities By Ludwig Benner, Jr., Principal, Starline Software Ltd., Oakton, Va., USA, and 10 Lederer Award: Two Receive 2009 Jerome F. Lederer Award ISASI 2009 PROCEEDINGS By Esperison Martinez, Editor, ISASI Forum Ira J. Rimson, Forensic Engineer, Albuquerque, N.M., USA 76 Using the Best Cost Analysis for Effective Safety Recommendations Tuesday, September 15 By Dr. Simon Mitchell, Aviation Director, RTI Ltd, London, U.K., and Visiting 14 Closing the Gap Between Accident Investigation and Training Fellow, Cranfield University, U.K., and Professor Graham Braithwaite, Director, By Michael Poole, Executive Director and Chief Investigator, and Lou Németh, Cranfield University Safety and Accidents Investigation Centre, U.K. Chief Safety Officer, CAE Flightscape 80 Safety: A Function of Leadership 19 How Significant Is the Inflight Loss of Control Threat? By Gary D. Braman, System Safety Engineer; Sikorsky Aircraft Corporation, Huntsville, Ala., USA By Capt. John M. Cox, FRAeS, and Capt. Jack H. Casey, FRAeS, Safety Operating Systems, L.L.C., Washington, D.C. Thursday, September 17 23 Reducing the Risk of Runway Excursions 84 A Review of Fly-by-Wire Accidents By Jim Burin, Director of Technical Programs, Flight Safety Foundation By Dr. R.L. (Dick) Newman, Seattle, Wash., and A.A. (Tony) Lambregts, Chief 27 Developing Investigations to Enhance Safety Worldwide Scientist-Advanced Controls, FAA, Renton, Wash., USA By Marcus Costa, Chief, Accident Investigation and Prevention Section, ICAO 89 Simulation of Emergency Evacuation Factors in Transport- 29 A Comparison Study of GPS Data and CDR Radar Data Using a Category Aircraft Fully Instrumented Flight Test By Dr. Eric Robert Savage, Assistant Professor, ERAU, Prescott, Ariz., and Erich Skoor, Graduate Student, ERAU, Prescott, Ariz., USA By Ryan M. Graue, Aeronautical Engineer, AvSafe, LLC; Jean H. Slane, Senior Consultant, Engineering Systems Inc.; Dr. Robert C. Winn, Principal 93 The Accident “CAUSE” Statement—Is It Beyond Its Time? Engineer, Engineering Systems Inc.; W. Jeffrey Edwards, President, AvSafe, LLC; By Robert MacIntosh (MO0996), Chief Advisor, International Safety Affairs, and Krista B. Kumley, Consultant, Engineering Systems Inc. U.S. National Transportation Safety Board, Washington, D.C, USA 34 Safety Strides Foreseen with Lightweight Flight Recorders for GA 97 Accident Prevention: Pushing the Limits By Bernard Bourdon, Accident Investigation Manager, European By Philippe Plantin de Hugues, Ph D., Bureau d’Enquêtes and d’Analyses pour Aviation Safety Agency, EU the sécurité of l’aviation civile, Head of Flight Recorders and Avionic Systems Division 100 Seminar Summary of ISASI 2009: Accident Prevention Beyond Investigation 38 Using ADS-B for Accident Investigation and Prevention, an Embry-Riddle Aeronautical University Perspective By John Guselli, JCG Aviation Services and Chairman of ISASI’s Reachout Committee By David Zwegers, Director of Aviation Safety, Embry-Riddle Aeronautical University, Daytona Beach, Fla., USA Guest Speakers Wednesday, September 16 102 Communication Challenges After the Air France Flight 447 Accident 43 Human Error Prevention: Using the Human Error Template to Analyze By Marine Del Bono, Head of Public Affairs Division, Bureau d’Enquêtes et Errors in a Large Transport Aircraft for Human Factors Considerations d’Analyses (BEA), France 104 The United Kingdom Experience By Wen-Chin Li, Head of Graduate School of Psychology, National Defense By David Miller, U.K. Deputy Chief Inspector of Air Accidents, Air Accidents University, Taiwan; Don Harris, Director of Flight Deck Design and Aviation Division Branch Safety Group in Human Factors Department, Cranfield University, United 106 Initial Investigation of Serous Accidents: The JTSB’s Experience Kingdom; Neville A. Stanton, Chair in the Human Factors of Transport, School of Civil Engineering and the Environment, University of Southampton, By Ikuo Takagi, Investigator General for Aircraft Accident, the Japan United Kingdom; Yueh-Ling Hsu, Professor in the Department of Air Transportation Safety Board Transportation, Kainan University, Taiwan; Danny Chang, Head of Training 109 The Continuous Challenge for U.S. Air Safety Investigators Assisting Division, China Airlines, Taiwan; Thomas Wang, Director of Flight Safety in International Investigations Division, Aviation Safety Council, Taiwan; Hong-Tsu Young, Managing By Dujuan B. Sevillian, 2009 Rudolf Kapustin Memorial Scholarship Winner Director of the Executive Yuan, Aviation Safety Council, Taiwan 111 Caring for the Mental Health of Air Safety Investigators 50 An Analysis of Human Factor Aspects in Post-Maintenance Flight Test By Brian Dyer, 2009 Rudolf Kapustin Memorial Scholarship Winner By Capt. Claudio Daniel Caceres, Senior Safety Advisor, Continuous 113 Challenges to ASI Investigations Safety®, Switzerland By Murtaza Teyla, 2009 Rudolf Kapustin Memorial Scholarship Winner 57 Findings of Using Human Factors Analysis and Classification System (Editor’s note: Text unavailabe for presentations by Paul Arsianian, (HFACS) as a Tool for Human Factors Investigation Robert Sumwalt, and Mark Clitsome.) By Yung-An Cheng, Engineer Flight Safety Division, Aviation Safety Council 115 ISASI 2009 Pictorial Review (ASC), Taiwan; Thomas Wang, Director of Flight Safety Division, ASC, Taiwan; Photos by Esperison Martinez Jenn-Yuan Liu, Engineer Flight Safety Division, ASC, Taiwan; Chi-Liang Yang, Associate Engineer, Flight Safety Division, ASC, Taiwan; Dr. Wen-Chin Li, Head of Graduate School of Psychology, National Defense University, Republic of China

ISASI 2009 Proceedings • 3 ISASI 2009 PROCEEDINGS 4

• E. Martinez cultures, and different national systems and aviation markets. cultures, anddifferentnationalsystemsaviationmarkets. a rich mixture of prospectives from different continents, different professionals here safety aviation thishave We Halifax. weekand Australia fromin seminars allthe over the world. ISASI held recently bringswe and Asia, in time second the for meet will nar from all over the world. Next year, for example, the annual semi- revolves aroundaccidentsandaccidentprevention. workwhose othersaccidentinvestigators forforsociety and and a few close friends. Today ISASI is the premier professional Jerry only fact, in was, ISASI as presumptuous bit a was Investigators.When ISASI started, Safety Air of the Society adjective International the “international” of seminar annual 40th thishallinaretodayweand in ties of a particular aircraft system, or broader questions about the a question about the details of a particular accident, or the subtle- they do not overlook the chance to learn something. If you have Professionals with extensive experience should also make certain als should take advantage of the expertise that is all around you. profession- entry-level or students Any different. no is year this W ISASI 2009 ISASI E ISASI now is truly international, with chapters and members opens ISASI2009. President DelGandio veryyear Ipoint out that the room is full of expertise, and fun, and excitement. We are all characters of our own, and his friends—land of adventure, magic, imagination, to elcome Proceedings Accident Prevention Beyond rlando, hometown of our famous our of hometown Orlando,

O rlandoparticipateto thein Investigation By FrankDelGandio,President Preface ederer Lederer ickey Mickey and one third of the remaining fatal accidents now involve amateur- year we expect to end up at around 260; again, down by nearly half, fatal accidents a year in general aviation and air taxi operations. This representative.Just 15years ago, wewere still having close The to500 aviation. general in have numberslikethat. to thrilled be would economy world the in industry other any in with the important exception of sub-Saharan Africa. Safety officials two decades, but fatal accidents have gone down by more than half to moveinthatdirection. permanent zero accident rate is premature nearly rhetoric, a but we about continue talk any and away, gone not have accidents major regions of the world than they were just a decade ago. I realize that number of fatal accidents are much lower today for airlines in most fatalaccidents. Boththerate for fatal accidents andtheabsolute is changing rapidly and in multiple ways. Start with the bottom line: tion.” It is a timely theme because the entire field of aviation safety own knowledge. take advantage of the expertise that is here this week and share your room can provide encyclopedic answers to your questions. In short, overall state of aviation safety, or some other topic, someone in this M past the in doubled than more has industry world’sairline The Investiga- Beyond Prevention “Accident is year this theme Our ostregions theofworld alsoareseeing rapid improvements .S. experience in recent years is fairly fairly is years recent in experience U.S. more anddata. tems that continue to capture sys- on based laboratories, in scene off conducted is M work. our do we that way addition,changedhasitthe In simple. that is It services. reduced the demand for has our technology accidents, of frequency the reducing gation. For starters, by greatly investi - accident changing is explanation. Technology also primary the is technology but improvements, these has beendramatic. years recent in improvement the significant stake, a have governments which in fleet the among short, In aircraft. builtand other experimental ore and more of the workthe of more andore L ots of factors explain factors of ots

On-scene work will always be important, and we will continue by understanding and documenting new outcomes, such as the to examine wreckage paths, impact foot prints, engine damage, simultaneous failure of two jet engines at Heathrow. and so on. But even in general aviation, more of our analysis is The bottom line for accident investigation is both complicated moving off scene, and that trend will continue for the foresee- and simple. It is complicated because we must recognize the able future. Technology has driven an even greater change in changes that are taking place in the broader field of accident the broader field of accident prevention. prevention. It is complicated because we need to become much For several years now, we have had the benefit of systematic more active with that broader safety community, and it is compli-

analysis of flight operations data, or “FOQA.” We now are at a cated because, to be honest, we have to show more intellectual ISASI 2009 PROCEEDINGS point where we can monitor well-documented precursors to respect for what that broader community brings to aviation safety several categories of accidents and take action before an acci- and to accident prevention. In short, it is complicated because we dent occurs. For example, in the United States, we have begun need to recognize more directly a basic idea that we have always to identify specific arrivals and approaches into specific airports understood at some level: accident investigation is but one ele- where GPWS alerts and TCA resolution alerts are abnormally ment, albeit a key element, in the ultimate mission of preventing high. Similarly, we have identified areas in which unstable ap- and reducing accidents. proaches are more common and in which long landings are Yet, the bottom line for accident investigation also is quite more common, and so on. More to the point, we have been simple. It is simple because accident investigation will remain able to use these data to change local air traffic procedures, to the primary source for understanding accident scenarios about change training and procedures within particular airlines, and which we had known little or nothing, such as at Heathrow. It also to change emphasis areas within our safety inspection programs. will remain the primary source for documenting the frequency at All these efforts have reduced the risk of CFIT accidents, mid-air which well-known risks continue to rear their ugly heads and lead collisions, undershoots, runway excursions, etc. to serious outcomes. In short, your work and the well-documented These monitoring efforts are based largely on exhaustive ana- reports that you produce will continue to be the source material lytical efforts that have examined hundreds of well-documented from which analysts begin to understand what questions they accidents from around the world in order to identify those need to ask of the data. parameters that we should and can measure, and these meth- In the end, our profession is changing as we speak. We will find odologies are changing accident prevention in a fundamental ourselves working more and more actively with a broader safety way. Few of the people who have conducted the analyses or who community that often will bring a different perspective to the have undertaken the necessary analyses are accident investiga- table. Yet, as we say in this country, the more things change, the tors, but they understand accidents, concepts of risk, and overall more they remain the same. In the end, accident investigation safety performance. will remain at the front end of accident prevention. This is the broader community and the intellectual frame- Before I close, I urge you to enjoy Florida while you are here. work in which accident investigation must work if we are to The Atlantic Ocean is just an hour away to the east, and the Gulf continue to make our contribution. Yet, at the same time, that of Mexico is just an hour away to the southwest. In addition, of broader community understands that it cannot avert every ac- course, we have Orlando, which can keep you busy and enter- cident. My own country has had a rash of major accidents in the tained all week. You can start right here with the Disney property past 18 months or so. Most of those accidents have involved the and work you way down. usual suspects, like failure to monitor flight instruments, poor Finally, ISASI extends its thanks to everyone who volunteered basic flying skills, maintenance issues, unstable approaches, to put this seminar together. Special thanks go to Jamie Nichols management practices, and so on. Nevertheless, these data and Antony Brickhouse, but we also thank those who worked on efforts have documented in detail the nature of those events the Technical Committee, those who organized the Companions’ and have reduced the risk and frequency of those events Program, and those who handled the demanding work of sorting Yet, analysis of selected parameters, even hundreds of param- out the details for hotel rooms, catering, audio visuals, and the eters, will never anticipate accidents like the B-777 at Heathrow, million other things that sponsoring a seminar like this demands. or even the wrong runway takeoff at Lexington, because that We extend our thanks to everyone. work relies fundamentally on knowing what questions to ask I encourage everyone to thank members of the Committee of the data. That is where accident investigation will continue whenever you have an opportunity to do so and, again, I en- to play a fundamental role in the system, by documenting and courage you to participate in the seminar, to learn and to share providing basic knowledge about the frequency with which well- your knowledge while you are here, and, most of all, to enjoy understood failures continue to produce serious outcomes and the seminar. ◆

ISASI 2009 Proceedings • 5 ISASI 2009 PROCEEDINGS 6

• G utmost respect for you—the professional my express to me Allow coaches. motor and buses, school boats, recreational rail trains, freight trains, container ships, light aircraft, private jets, business ters, helicop- sightseeing and service medical emergency airliners, transportation: of modes all covered have events These investigations. accident transportation our NTSB staff investigators on 17 major accompanied I’ve Board, the at time my isa bona fide member of ISASI. During [Robert] Sumwalt, who many of you know Board alongside my colleague, Safety Transportation National States lege to serve as a member of the ity, Iwillalso focusoncooperation. addition to transparency and accountabil- over to the international arena. Today, in cross - themes same the of some believe internationalourwith counterparts?” I “What’s next for the NTSB’s relationship three oftheseimportantareas. challenging myself, to raise the bar in all groupfirstchallenged thefortime. astaffI asam I them, as integrity. and accountability, critical totheNTSB’s missionandwork.Theyaretransparency, are believe I that attributes three are There tenure. my during so let me give you a little glimpse of “what is next” for the NTSB NTSB. one, “Whatisnextforyou,me,us?” decisions in the seconds before a disaster. So the theme is a great or improved, be can design a how puttingthepieces back together puzzles, tofiguresolving time out what their failedspend and who people of full room a is themeais that encourages pondertous “Whatnext?” is This It Investigation.” Beyond Prevention “Accident theme year’s preparing for my speech, I spent some time thinking about this September 15inOrlando,Fla.,USA.—Editor) on delegates seminar investigation accident air 2009 ISASI the to dress ad- opening keynote her in Hersman Chairman by presented (Remarks ISASI 2009 ISASI For the past 5 years I have had the privi- wondering, be may you of Some Sevenweeksagotoday, becameI the12th chairman theof It is my privilege to kick off ISASI’s 40th annual seminar. When any of you, well, maybe most of you, don’t know me, me, know don’t you, of most maybe well, you, of Many members and to our international attendees. members andtoourinternationalattendees. morgen, ni hao, and bonjour guten konichiwa, special a And everyone. morning ood to the International Council Proceedings By DeborahHersman,NationalTransportation SafetyChairman ast week, I addressed the NTSB NTSB the addressed I week, Last M U ember why people made the wrong wrong the made people why nited KEYNOTE Address What IsNext? her address isnext?” byasking“What Chairman Hersman, keynote speaker, opens we hadtodialanoperatormakeinternationalcall. Bob ago, typewriter.years a Forty and pad, legal a skills, investigator brilliant their only using themselves by reports accident their together put they you tell will Hendricks Bill and Schleede Ron ago, years snowmobile’sForty a eye. in mer glim- a just was aerospace Bombardier David. and Jimmy were as birthed, and conceived being were Thierry and Embraer,Airbus, ago, years Forty from. came we where at back look to next is what four decades old, I thought it mightISASI’s 40th annual seminar. beAnd since the NTSB is just worthwhilemore than before we discussFinch, one of ISASI’s founding members. I understand that this is encountered inyourinvestigations. aviation accidents and coming up with solutions to safety problems of causes the determining to careers your dedicated have you of the public face for the work they do. be to privilege the have today.I here alumni NTSB many the and Sedor,Joe Hilldrup, Frank (Bob stand audience—please the in with worked have industry.I would like to recognize the NTSB investigators whombusiness and educational I sectors associated with the transportation airsafety investigators and your peers who come from the various Today we are in a world that moves fast, communicates instanta- [Truman]with talk to “Lucky” opportunity the had I night Last

e. martinez asking ourselves, “What is next?” drastically. Therefore, we must constantlythe same, thebe world around remains usmission NTSB’shas the changedthough Even neously, and demands answers immediately. placestart.to agencyanAs funded theby perfect a is relations public and morning, this times several cooperation and ability, to hear me mention transparency, account- You’reaccident. the of causes going the on factual data to the public must without try to balance the equation speculatingof providing we Yet event. the about curiosity standable under an has public the and information, that the press has an insatiable appetite for Followingmajoraccident,recognizea we and more by international correspondents. by just local or even national press,youknow, butmajor accidents more of are many not covered As officers. affairs public Board’s Safety the of one included which relations, media news of subject the on tutorials the knowmany ofyou were here yesterday for relations?I medianews for next is What Transparency orenda Ward, and Scott Dunham)— Scott and Ward, Lorenda Like these investigators, many acIntosh has told me that that me told has MacIntosh acIntosh, MacIntosh, - public, the NTSB fully embraces transparency and the public’s right investigative hearings, one on the safety of helicopter emergency to know about our investigations. In fact, it is through the process of medical services (2008 was one of the worst years on record for showing the public that we are conducting independent, thorough the HEMS industry, with nine accidents resulting in 29 fatali- investigations that we derive our ability to influence decisions that ties), one on the US Airways dual-engine failure following an are made following an accident. encounter with multiple Canada geese and subsequent forced If the NTSB, as the government’s transportation accident investi- landing in the Hudson River; one on the fatal Colgan accident gation agency, does not provide credible information in a develop- in Buffalo, N.Y., on February 12; and finally, next week, I will be ing accident investigation scenario, other sources will attempt to fill chairing a hearing on the Empire Airlines domestic cargo flight the void. And in most cases, that void will be filled with information for FedEx that landed short of the runway in Lubbock, Tex., in that is unreliable, unverified, and sometimes just plain wrong.M any freezing drizzle conditions. of the people who talk to the news media have impressive creden- While all of this work raises the bar on transparency, we tials, and I do not begrudge them trying to explain to the general aren’t doing it alone. We had the participation of international public highly technical situations. However, if their opinions are representatives at each of our hearings. American Eurocopter the only information the public receives in the days following the and Canadian Helicopters were witnesses at our HEMS hearing. crash—and these opinions are rendered hundreds of miles from Airbus and EASA were witnesses at the Hudson hearing, with BEA the scene—then the public will be ill served. serving as an accredited rep on our technical panel. Bombardier ISASI 2009 PROCEEDINGS Even worse, depending on where the information comes from, and Transport Canada sat as witnesses at the Colgan hearing, with it may be self-serving to the originator and damaging to the other the TSB serving on the technical panel as an accredited rep. And participants in the investigation. For that reason, the NTSB spokes- next week, we will be joined by ATR and EASA at the hearing on person at the scene is the source of all publicly released factual the Empire accident. Even though our system may be different information about the investigation. We try very hard to provide from yours, we are working together to achieve a transparent and the public with reasonable details of the facts to assure them that seamless aviation system, and we rely on the support we receive the investigation is being conducted in a thorough and unbiased in our investigations from our partners that serve as accredited manner. In fact, many times we ask the public for support regard- representatives, and those who represent labor unions, regulatory ing witness information and other site details. Our purpose at an authorities, and manufacturers. Aviation is a global endeavor. If NTSB press briefing is not to provide the media with details to you take away one thing from my talk this morning, I want to solve the accident, but rather to demonstrate to the public that the make it clear that we recognize the value of working with and process of the safety investigation is being conducted in a profes- learning from our international counterparts—this is the only sional manner. way that we will succeed. We are working together to accomplish President Obama has committed to making his administration the this, so what’s next? most open and transparent in history. While the NTSB is an indepen- I’d like to briefly touch on the other subject of the tutorials, dent agency, I believe the President’s commitment is consistent with criminalization. I can be brief and to the point. The NTSB’s the NTSB’s long history of open and visible investigations. The value relationship with the U.S. Department of Justice is excellent we place on transparency in our investigations in order to meet the and well established. Unless the Attorney General and I, as the expectations of the public may be very different from the processes chairman of the NTSB, agree that circumstances reasonably in- in place in other nations, including some that are represented here. dicate that an accident may have been caused by an intentional In fact, you may personally disagree with our protocol, but it is hard to criminal act, our NTSB investigators have unimpeded authority contend that the NTSB’s open policy has not proven to be effective to conduct the investigation. The NTSB has priority over any over time. For international participants in investigations within the judicial or other agency’s investigation for aviation accidents. United States, we have published ICAO differences in ICAO Annex We control the accident site, and our investigators are free to 13 to keep all states advised of our policies regarding the release of pursue the fact-gathering process as necessary. We recognize factual information. that our position in accident investigations may be different What’s next regarding how we communicate with the public and from that of investigative agencies in other nations. Frankly, our stakeholders? we are grateful that the U.S. Congress provided the NTSB with The Internet and other electronic tools are changing and ex- primary jurisdiction over most aviation accident investigations. panding at breathtaking speed. I would like to see the NTSB make However, we all have to work within the system that exists in the better use of those tools to bring our message faster and with more state of occurrence. This demands effective coordination and content to the news media, to Congress, and, most importantly, to communication at every level of the investigation as well as un- our stakeholders. Recently we took the step of opening our dockets derstanding and respect for the conditions that our investigative to the public via our website. We not only hold our Board meetings counterparts are facing. and investigative hearings in full view of the public, but we webcast them so that anyone can watch. What this means is that these meet- Accountability ings are more transparent than ever before—available not just to When I asked our staff last week to raise the bar on our account- stakeholders and the news media, but also to international viewers ability, I know I was asking for a lot from a group of dedicated without any expensive travel costs or inconveniences. professionals whose work days are already very full. We investigate This year our Office of Aviation Safety has already scheduled four about 1,600 accidents per year. In 2008, the NTSB responded

ISASI 2009 Proceedings • 7 ISASI 2009 PROCEEDINGS 8

• final report? the No—inissue someto cases months we may needfor to Waitingact quicklynext? to is what then analyzed, addressit. If the failure has been identified, documented, and deficiency,safety a identify we can’t we to recurrence a for wait complete each step in our investigative process. Similarly, when reviewsslow-crawlmonthsandofweeksand responseswe as Weaccept speed. cannot Internet at investigation our to pants immediate follow-on activity. We will communicate with partici- to see our investigators conduct component examinations as an complete the field portion of an investigation,expectation you that will we can continue work better,commensurate a faster,come has improvements theseand stronger.with along As we enabled us to be more efficient and respond more quickly. But messages and access to the web. All of these developmentscan work internationally, haveand they provide us with content-filled Today blackberries pagers. our had we ago, years 5 than more just Board Safety the to came I When it. for antenna an have andbag a phone,inneededcarryyouit ahad to you if and started my professional career, we didn’t have e-mail addresses, demands that we do things with reasonable urgency. When I first noticed that today’s fast-moving and capacity-filled environment think aboutwhat’s next. 40 years ago. So with respect to technology, it is verybut excitingthey also hold tothe keys to solutions we couldn’t have imagined technology. The this rapid changes with in technology current provide challenges, stay to learning constantly are investigators participating other and staff technical our that requires maps, options,electronicthesuchas flight surfaceand bag moving and environmental engineering support systems; and navigation powerplant management; advanced composites; basic electrical ficiency intheirnewdesigns. ef- of levels highest the with only satisfied are manufacturers manufacturers now offer leading-edge technology, and engine Embraer, Bombardier, Gulfstream, and all the general aviation are a new breed, filled with these innovations. Boeing, Airbus, line production the off coming aircraft The management. cockpitheads-upavision ofdisplaytraffic airADS-Bforand aviationtheindustry,sectorof everylatedinto synthetic like assimi- being is technology new opening, his in mentioned Beech, and Piper designs of the 1980s. As Frank [Del Gandio] jet transports like the DC-9 and the B-737-200 and the Cessna, retain the investigative skills [needed for the] early-generation investigatorsforefrontthetechnology.at of Certainlywill we strengths of our very competent professional staff to place our national commitments. I would like to build on the technical inter our meet to and public traveling American the serve to orderinvestigationsaccident in its in nimble and strong be to assistthelocalinvestigationauthority. representative teams traveled to 27involving accidents in foreign countries received 178 foreign notifications of accidents or serious incidents received and read out more than 200 recorders. all, were fortunately, In service non-fatal. addition, scheduled in we 20 the events; carrier air 28 to ISASI 2009 ISASI In the past 5 years that I haveBoard,yearshavetheservedthatonpasttheI5I In Implementingelectronic flight control systems; optimized Raisingthebar onaccountability will require theNTSB to U.S. operators or products. As a result, NTSB accredited Proceedings Last year our vehicle recorders laboratory - agency that controlsreimbursementthatagencyH for to speak, and issued recommendations asking the government recentH In culture. safety poor a created causal, not while that, failures oversight and organizational identified they City, Oklahoma in accident strike bird Citation fatal a In factors. causal beyond Our investigators have recently showed us that they are looking view by the management team—this is our own version of SMS. re- efficiency, continuous their for increase calling to also am I SM environment. identification and mitigation safetyof deficiencies the in evenplay the in to continue will investigation accident that role key a is there recognize we accidents, many prevent will SM that hope we safety.While to approach performance-based more a toward move we as operators for accountability and sponsibility Safety of integration the for support of chorus the Wehear thinking. new requires way,it under and well is century 21st The will. we products?NTSBandaffectingourcan qualityYes, theof we without modernize we Can work? our of quality the affecting the question. next?” andthenactingontheanswersitreceivedwhenasked dations. But this is an example of the regulator asking, “What’sFAA’s action to see how closely they comport to our recommen- the Hudson River last month. The Safety Board willairspace analyzein the New theYork area following the mid-air collision over the to changes FAAannounced the ago, weeks of couple a Just Randy Babbitt’s recent efforts to act quickly on safety problems. completed. I have been encouraged by new FAA Administratorat the very least, a clear forecast of whencept correctiveis corrective action willaction be implementedregulating agency andabout a an identifiedfrom the safety risk.response Whatrisk wesatisfactory will a ac- mitigated—oras it” on working “we’re accept to raise their bar on their own accountability. We simply cannot investigative staffinthefuture. our byaction timelyencouragesuch continueto will I D.C. Washington, in trains transit two of collision the on mode, the crash of a corporate jet in South Carolina, and, collision, midair River Hudson the of ininvestigations on-going a surface immediateattention. to asafetyvulnerabilitythatdeserves we have determined the cause of the accident. They simply point we issue during the course of an investigation do not signal that may have played a causal role inmunity thetoacute safety accident.problems, whether Recommendationsornot the problems final report. forwardwithrecommendations evenbeforecomplete we the issue a recommendation; so if the situation merits it, we will go Vice-Chairman testifying you, bewillHudsonHartthe mid-airon with here am I Today, while constituencies. our to able countable to their obligation just as we are being held account- ac- investigations our to parties holding also are we that know also Youshould operators. audit and standards safety establish So what is next for us? While I am challenging staff members without posture nimble more and stronger a attain we Can I will also push recipients of our safety recommendation letters In recent weeks, we’ve issued recommendations on the still com- transportation the alert to obligation an has NTSB The ) n a elgmn o re- of realignment a and (SMS) Systems Management EM S recommendations,S “followedwe themoney” so

EM S operatorsto S collision before the Senate, and tomorrow morning I will be deavor in the next 2 years to further develop our relationships delivering the same testimony to the House. This reckoning on with family members and enhance our system of keeping them the status of our investigation comes approximately one month informed and also hearing what they have to say. I’m happy to after I launched to the accident with our team. We must provide see that other nations have been moving in a similar direction, some answers to lawmakers’ questions as they look to us with the and I sincerely hope that the trend continues. question of “What’s next?” This conference [ISASI 2009] is a perfect example of what After watching our staff members in action for the past 5 years, the next 40 years hold for global aviation and accident inves- I have every confidence they are up to the job, and I will support tigation. Although the U.S. is hosting this year, more than them in every way I can to raise the bar for both the NTSB and half of the attendees are guests from 32 other nations. This those who participate in our investigations. By ensuring that forum is a great opportunity to meet with and work with your investigators maintain their technical competence, issuing recom- colleagues; I saw impressive signs of cooperation last night mendations as soon as they are warranted, and improving our with Tom [Dolt] and Thierry [Thoreau] of rivals Boeing and internal processes, the NTSB will be a more nimble and more Airbus putting their heads together and residents of China, accountable organization. Hong Kong, and Taiwan discussing aviation safety at the same table. All kidding aside, I have shared some of my priorities Cooperation with you, so I ask our international partners, what’s next, how ISASI 2009 PROCEEDINGS Now to cooperation, coordination, and support between the can we support you? NTSB and accident investigation authorities from other coun- In the news media we’ve been hearing much about civil- tries. Our partnerships with multinational organizations such as ity—in the Congress, on the tennis court, but not here. To the European Aviation Safety Agency (EASA) and the Interstate the international community, I would like to recognize your Aviation Committee (MAK) of the former Soviet Union have graciousness. As many of you know, last Friday was the eighth provided many valuable contributions to worldwide safety im- anniversary of 9/11. My first meeting that morning was with provements. Some of these improvements reflect directly on our ICAO Secretary General Raymond Benjamin, then I met with U.S.-manufactured products. For example, we recently issued a delegation of air safety officials from Brazil, and later in the coordinated recommendations with the Spanish CIAAIC on the afternoon I had a phone call with representatives of ATR (who MD-80 takeoff warning system related to the Spanair accident will be participating in our hearing next week). One gentle- in Madrid, with the U.K. AAIB related to the British Airways man was French and the other was Italian. Each meeting was B-777 dual power loss at Heathrow, and with the Canadian TSB opened with an expression of remembrance and support (in and MAK of Russia on the issue of the Cessna 208 flight in icing English, I might add) for the American people on the anni- conditions. versary of 9/11. This acknowledgement was appreciated and It is no revelation to this body that aviation investigations so considerate. Danke, tak farid, muchas gracias, mange tak, are more and more becoming global affairs. The crash of Air and thank you. France Flight 447 in June involved a multi-nation search effort. In closing, I would like to express my personal appreciation for I will defer to Paul [Arsenault] to discuss their investigation the cooperation and support the aviation community has offered tomorrow, but our support and good will are extended to me. I am not an aviator, but I have been humbled by the many both the BEA and the people who have lost loved ones in this well wishes from each of you, as I know many of you care deeply accident. about this agency I am entrusted with. Thank you for inviting I would also like to note that we have been participating for me here today, and also for everything you’ve done to improve more than a decade with the U.S. Department of Transportation aviation safety around the world. I look forward to working with “Safe Skies for Africa” program. This initiative has now expanded you during my term as chairman. into the ICAO Safety Roadmap in Africa and we remain fully So, what do the next 40 years hold for ISASI and aviation engaged. We believe it is important to further our relationships investigations? Can we be more transparent, accountable, and with partners like EASA, MAK, and the regional safety initia- cooperative? International borders still exist, but they, too, are tives around the world because these relationships are critical becoming more transparent and are no longer boundaries. The to teamwork, consultation, and cooperation necessary in every Internet has connected us all. The world is preparing for the next investigation and ultimately to the overall credibility of the ICAO flu pandemic that can travel through time zones as rapidly as an Annex 13 process. overnight package. The aircraft that bring us together, whether Before I close, I would like to say a word about the families of designed by Embraer or Airbus, are made with parts that are accident victims, our most vulnerable stakeholders. Since 1996, manufactured all over the world. The people who rely on you the NTSB has been charged by the U.S. Congress to coordinate to do your work do not represent the U.S., South Africa, China, federal resources for family members. At an accident scene, or Britain, they represent humanity. In the end, as leaders, as our Office of Transportation Disaster Assistance has developed safety professionals, as human beings, we have been given a noble a system with the airlines to provide a dedicated location for charge; we are our brother’s keepers. I’m optimistic that, with those family members to gather away from the prying eyes of your support, we can build on the enthusiasm and dedication the press, as well as a process to keep them informed on the fostered here to continue the historic period of air safety we’ve progress of the investigation, even after we leave the accident experienced, and to strengthen the ties of the international air scene. This has been a positive development, and we will en- safety community. ◆

ISASI 2009 Proceedings • 9 ISASI 2009 PROCEEDINGS 10 T ueus aaiiy n ua factors, human in capability Bureau’s the developed specialists performance human of team core a Subsequently, specialist. performance human a recruit tionsafety investigation organizations to became one of the world’s first civil avia- in this field. He said: “In 1983 the Bureau Bureau’sachievementsthe“lifetime” of “Bureau.”) [BASI]. Herein both are referred to asInvestigation Safety Air of Bureau the thewas class.(Prior1999, toATSB’s predecessor nizational level, is acknowledged orga- and individual as world the both at factors, human of field the to contribution and accident investigation. in He competence said technical its and objectivity, expertise independence, operational its on based reau’s worldwide reputation for excellence, stage, President Del Gandio noted the Bu- two partieshadbeenselected. to accept the Award. Still, none in the audience were aware that its selection to ensure that it would have a representative present of word ATSB,advance however,The have selection. did his of last evening of the seminar. Indeed Stone, himself, had no inkling individual’s name until the awards dinner banquet,FrankDel Gandioheld also broke on fromthetradition andwithheld the on the opening day of the seminar; however, this year President Society’s annual seminar. Generally, the recipient is announced nate, orcontrolaviationhazardsbeforeaccidentsresult. of aircraft accidents or in prevention activities that identify, elimi- investigation the in engaged actively are who countries 57 from persons of up made is membership Toits techniques. end, this investigation accident air of improvement and development dedicatedto enhancing aviation organization an safety is through ISASI objectives. the Society continuing achieving and tion investiga- accident aviation furthering in excellence technical and theAustralianTransport SafetyBureau(ATSB). ents. Named as year 2009 recipients are Capt. Richard B. Stone • ISASI 2009 ISASI Del Gandio then went on to outline to on went then Gandio Del ATSBWith on Ross Stewart and Batt Richard representatives Presentation of the TheAward is given for outstanding lifetime contributions to its coveted Jerome F. has for only the second time in he itsInternational Society of 45-yearAir Safety Investigators (ISASI) history awarded Proceedings Jerome F. Award Lederer L ederer Award is a major highlight of the Lederer Aviation Award to two recipi- Two Receive 2009 Lederer A President DelGandio,andStewartRoss. Award recipients are shownlefttoright:Capt.Richard B.Stone,Richard Batt, By EsperisonMartinez,ditor and in its 1995 report of a fatal CFIT accident in 1993 involving and in its 1995 report of a fatal CFIT accident in 1993 involving Airport Sydney at 1991 in aircraft A320 an and aircraft DC-10 a this in its 1993 investigation report into a near collision between nizational factors into standard investigation methodology. It did worldwide to incorporate the formal analysis of human and orga- Safety AssistancePackage(ITSAP). TransportIndonesia the of part as Indonesia in training factors human delivering currently are personnel Bureau worldwide. participants external by after sought highly is and enhanced be professional development. This quality course hashuman continued factors awarenessto training as a component part of their using theReasonmodelofsystemssafetyasaguide. amination of relevant organizational and management aspects, of the requirement for air safety investigations to include an ex- and in the 1990s was highly influential in the adoption by ICAO active in the International Civil Aviation accident investigation. Subsequently, the Bureau becameaccident prevention moresafetyandenhancement, corewellasas head. As a result, the Bureau became a world leader in proactive nizationspecialisthavea to human factors practitioner itsas the Bureau became the first aviation safety investigation orga- the role of human factors in Australian aviation safety. In 1989, systems safety, and research and was instrumental in fostering “Further, the Bureau was the first accident investigation body “Sincethe mid-1990s, all Bureau investigators have received ward

Organization (ICAO),

e. martinez element of the Bureau’s Safety Inves- tigation Information Management System, introduced in 2007. Both have attracted the significant interest of the chairmen and CEOs of independent investigation body members of the International Transportation Safety

Association (ITSA). ISASI 2009 PROCEEDINGS “The Bureau’s ongoing commit- ment to the behavioral science of human and organizational factors in transport safety is at the heart of its credibility and underlies its reputation Monarch Airlines. These reports outlined the Reason model to as a leading safety investigation agency in the world arena. This highlight the role of systemic factors in the development of the reputation has enabled it to contribute strongly to the amend- occurrences. The Monarch Airlines report was a catalyst for major ments to Annex 13 recommended by the 2008 ICAO AIG Divi- structural changes within the then Civil Aviation Authority. sional Meeting and also to a new code for international marine “In 2003, the Bureau’s report into Ansett maintenance safety investigation agreed to at the IMO in 2008 and increasingly to deficiencies and continuing airworthiness issues worldwide was rail safety investigation.” awarded the 2003 Flight Safety Foundation Cecil A. Brownlow In accepting the Award, Richard Batt said: “It’s my great hon- Publication Award ‘for a significant contribution to aviation safety our to accept this Award on behalf of the Australian Transport awareness.’ This report reinforced the concept of ‘organizational Safety Bureau. It is a particular honour to accept the Award as it mindfulness.’ While the Bureau has since adapted the Reason commemorates the remarkable life and safety achievements of model to better suit its purposes, the use of this methodology’s Jerry Lederer, and it is a particular honour given the past recipi- principles continues to underlie all investigation analysis and ents of the Award, both individuals—some of whom are here this report writing. evening—and organizations. “At the same time as the Bureau was developing modern “As we know, in any air safety investigation the crucial first step methods of investigation analysis, it was also producing world- is a thorough operational and technical investigation to establish class research reports. Two such reports received the Chartered what happened in the accident or incident, but it is typically only Institute of Transport in Australia’s Qantas Award for Transport by then looking at human factors—at both the individual and Excellence. The first report to receive this Award was the Limi- organisational level—that we can understand how and why the tations of the See-and-Avoid Principle (1991). The second was the accident or incident occurred. Human Factors in Aircraft Maintenance report (1995). “More than 20 years ago, Dr. Rob Lee, a human factors specialist, “From its inception as a multimodal agency on July 1, 1999, the was appointed as director of the Bureau—the first time anywhere ATSB has continued to develop and apply improved methods of in the world that someone with a human factors background had accident investigation and analysis to enhance transport safety in been appointed to lead a national civil aviation safety body. And Australia and internationally. The ATSB website, with more than from that time, under successive directors, human factors has been 1 million new users and 40 million ‘hits’ in 2008, is a testament a prime focus of the ATSB. I think it is interesting, when we reflect to the Bureau’s influence. on the many excellent presentations we have seen this week, how “The quality of a safety investigation’s analysis activities plays a many of them have had a human factors theme. critical role in determining whether the investigation is success- “So, on behalf of the ATSB, I would like to express our sincere ful in enhancing safety. However, this has been a neglected area appreciation on receiving this year’s Jerome F. Lederer Award.” in most organizations that conduct safety investigations. One The seminar delegates showed their agreement with ATSB’s of the Bureau’s leading human factors specialists tackled this selection with a thunderous and standing applause. And as professional void and, through a process of benchmarking and the banquet hall quieted, President Del Gandio said into wide consultation, has developed a rigorous best-practice analy- the microphone, “Will Capt. Dick Stone please join me up sis framework for transport safety investigations. This approach here.” It was only then that Stone and the audience learned is detailed in the Bureau’s 2008 publication Analysis, Causality, that there were two recipients of the Lederer Award. Surprise and Proof in Safety Investigations and is a fundamental functional was evident in Stone’s demeanor, as was the gratitude he was

ISASI 2009 Proceedings • 11 ISASI 2009 PROCEEDINGS 12 which he retired in 1992. He has remained active in aviation as a a as aviation in active remained has He 1992. in retired he which Airlines in 1957, which was later absorbed by DeltaU.S. Air AirForce pilot and began his civil aviation career with Northeast accident investigation. aircraft in excellence technical to contributions outstanding his fied to be a recipient of the ISASI Jerome feeling forthehonorbestoweduponhimbyhispeers. • ISASI 2009 ISASI “He began his aviation career more than five decades ago as a as ago decades five than more career aviation his began “He President Del Gandio continued, “Capt. Stone is more than quali- spread over any three nominees. When there are3is worth three1point. orThus, moreeach member’s vote is worth 9points number and points, 3 worth is 2 number points, 5 worth is vote name ontheballot. tovote forthree nominees byplacing 1,2,abesideor3 their membereachremindingcoverlettertocriteria, them a and along with a ballot listing each nominee, a copy of the selection it mail then I consideration. 3rd or 2nd, 1st, a is it if indicating nating season closes, I copy each letter and add a notation to it Six are from the and makeitacceptable. letter the rewrite often will tor nomina the Award, the of focus gation activity. After explaining that accident investigation is the investi- accident of degree any discuss to fail letters rejected the nominator and explain the reason for the rejection. respondthe torejectI it,I criteria rejectIf acceptit. andor submit nominees. the is also available on the ISASI website. From time to time, through procedure in March the issue January- of the consideration now and to watch for the nomination submission prestigious Award. He urges members to begin their nomination hope that it will entice a greater number of nominations for the goes throughMay31ofanygivenyear. period, which begins with the close of the annual seminar and that begin with an early announcement of the open nomination The selection task is not taken lightly 12 member and ISASI Awards involves Committee, chaired by Gale multiple Braden. steps of a thorough consideration of a nominee’s experiences Presentation by of thethe Jerome F. “The votes are weighted in the following manner, a number 1 “Our Committee consists of 12 members, including the chair. “WhenI receive a nomination letter, I evaluate it against the ChairmanBradensharesselectionthe process thestepsin he reminds the membership of the opportunity to to opportunity the of membership the reminds he Forum, Proceedings USA and six are international. When the nomi- Lederer Award is the culmination Lederer AwardSelectionProcessLederer ederer Award owing to Lederer Award owing to which ISASI Forum, which L ost often Most often ines, from member of the A A establish to him led factors human in interest strong His volunteer.a as performed was which of most decades, two tion for the Air deeply involved in aircraft accident investigation and preven- until the present day. consultant for various government and industry aviation interests The • responsible.) ments,it is often- develop difficult many of to determine case (in an individual nominated group who is associated or could beappliedtotheaviationfield. that one endeavor, safety of field another from if or safety, Selection• members follows: andallowedthemultiplepresentations.” ties weredeserving which a tie vote occurred, the president determined both par prerogative of casting a tie-breaking vote. In both instances in nees, a tie can occur. In suchnominees, a tie is almost impossible; but with only two nomi- cases, the ISASI president has the In • creed, sex,orraceshallnotbeconsidered. popularity.of Nationality,lack of because eliminated be not standing among peers shall be considered. A nominee shall the duration and persistence of his (her) efforts, and his (her) accident investigation. The nominee’s manner of operating, shouldconsideredbe foranyoutstanding contributions to administrativetopotherstheandatnot researchor levels requirements. duty normal beyond on original and remarkable contribution and personal effort The • own initiative.Theseeffortsmaybemultifaceted. his (her) efforts to safety and accident investigation on his (her) in working beyond the requirements of his (her) job to direct investigation is a guiding criteria, such as his (her) imagination has improvedaccidentinvestigation. it as long so origin recent of be not need contribution The fective manner of pursuing accident investigation objectives. ef- particularly a from stem may and area investigative the to L “Throughout his civil aviation career, Capt. Stone was was Stone Capt. career, aviation civil his “Throughout Advancement should be clearly attributable to the person Committee by used selection for criteria scoring The PA’s Human Performance Project in 1977. He was a was He 1977. in Project Performance PA’sHuman general,

dedication contributions

of the

award Line Pilots Association (ALPA) for more than contribution of L

PA National Accident Investigation Board the should

recipient:

nominee have should

Emphasis to relatively

safety be ◆ echanics, engineers, engineers, Mechanics, important

and

broad should aircraft application

to be

accident aviation

placed -

(1977–1987), chairman of the ALPA Human Performance Technical Committee (1983–1987), and chief accident in- Past Lederer AwardWinners vestigator for the Delta Air Lines Master Executive Council (1984–1987). He also served as ALPA’s executive chairman 1977—Samuel M. Phillips for aeromedical resources for many years. 1978—Allen R. McMahan “He has been as deeply involved with ISASI, joining us in July 1979—Gerard M. Bruggink 1969, and has been extremely active in its programs every since. 1980—John Gilbert Boulding He has served as the ISASI U.S. councillor (1984–1988), ISASI 1981—Dr. S. Harry Robertson ISASI 2009 PROCEEDINGS president (1994–1996), ISASI Executive advisor (1996–present), 1982—C.H. Prater Houge and chairman of the ISASI International Working Group on 1983—C.O. Miller 1984—George B. Parker Human Factors (1996–present). He became a Fellow of ISASI in 1985—Dr. John Kenyon Mason 1994. As Executive advisor, Capt. Stone has provided extremely 1986—Geoffrey C. Wilkinson valuable guidance to the ISASI Council and acts as the ISASI 1987—Dr. Carol A. Roberts news media spokesman. 1988—H. Vincent LaChapelle “Capt. Stone represented ISASI at the International Civil Avia- 1989—Aage A. Roed tion Organization (ICAO) Accident Investigation and Preven- 1990—Olof Fritsch tion meeting in Montreal, Quebec, Canada, in 1999 (AIG/99). 1991—Eddie J. Trimble He also assisted the ISASI team with developing its input to the 1992—Paul R. Powers ICAO AIG/08 meeting in 2008 and has also participated as an 1993—Capt. Victor Hewes instructor for ISASI Reachout workshops. 1994—U.K. Aircraft Accidents Investigation Branch “He was the general and program chairman for the 1987 1995—Dr. John K. Lauber 1996—Burt Chesterfield ISASI annual international seminar held in Atlanta, Ga., and will 1997—Gus Economy duplicate that position for ISASI 2011 to be held in Utah. He has 1998—A. Frank Taylor served on several technical committees on various aviation safety 1999—Capt. James McIntyre topics, including human factors, and he has presented several 2000—Nora Marshal technical papers before a wide variety of audiences, including 2001—John Purvis and the Transportation testimony before the U.S. Congress. In summary, Capt. Stone Safety Board of Canada exceeds all of the requirements to be honored with the Jerome 2002—Ronald L. Schleede Lederer Award.” 2003—Caj Frostell The audience agreed and welcomed Capt. Stone to the lectern 2004—Ron Chippindale with great applause. 2005—John Rawson In his soft-spoken voice, he said: “I am humbled by this Award, 2006—Richard H. Wood 2007—Thomas McCarthy especially since it has Jerry Lederer’s name on it. Thanks to the 2008—C. Donald Bateman folks who, somehow, unearthed my experiences and put them 2009—Capt. Richard B. Stone and the Australian on paper in sufficient order to gain this honor. Transport Safety Bureau “When I look out at this audience I see many investigators I have worked with. They are some of my best friends. What we have in common is a strong connection to ethics in accident I asked, ‘What are we doing as investigators here?’ They quickly investigation. responded that we were here to try to prevent similar type acci- “I ran into this principle in one of my first accident investiga- dents. I asked, ‘Would hiding the bag help in finding the cause tions. I was helping the Mohawk pilots who were an interested of the accident?’ They all agreed that the proper action was to party in the Nov. 11, 1969, FH-227 accident at Glen Falls, N.Y. bring the bag into the accident investigation. Each night the pilot investigators gathered to share their findings “After the bag was bought in and thoroughly searched, it was that day. Before the meeting two of the Mohawk investigators ap- determined that it belonged to a passenger who was a physician. proached me with concern. They had found a pilot’s flight bag I was very proud of these pilot investigators who realized that all in the wreckage and it contained some medications. They had facts must be brought before the accident investigation body if hidden the bag in nearby woods and wanted to know what to do we are to protect safety of flight operations. about it. I said, ‘We ought to talk to the other pilot investigators “Thank you all for selecting me to receive the Lederer about it.’ When the subject was out in the open at our meeting, Award.” ◆

ISASI 2009 Proceedings • 13 ISASI 2009 PROCEEDINGS nology to pilot training. nology topilottraining. author, safetyadvocate,inventor, andspeakerontheapplicationoftech- member ofthePresident’s Board. Advisory Louisarecognized industry theUniversityasatrusteeand cal Universityandhascontinuedtoserve largest Learjetoperator. Aeronauti- LouisagraduateofEmbry-Riddle asdirectorserved offlightoperationsforFlightInternational,theworld’s is type rated in nine commercial and business aviation jet aircraft. He acquiredFlightscape, afterCAE FlightscapeinAugust 2007. and isanowmemberoftheexecutivemanagementteamatCAE from the TSB in late 2001 to Flightscape. Mike co-foundedtem (RAPS) forflightdataanalysis,whichhe successfully commercialized Flightscape AnalysisandPresentationdriving thedevelopmentofRecovery Sys- international accidents.In1985hewasresponsible forinitiatingand Group chairmanonallmajoraccidentsinCanadaaswellseveral laboratory, which he developed for the Board. He careerwas atTSB,hewastheheadofflight recorder the andperformance Flight Recorder the Transportation SafetyBoard ofCanada.For thelast15yearsofhis 14 gram results. This paper will explore pro- a FO QA few daily accidents to in demonstrate see we that or accidents cause that problems problemsthe typicallywe training insee often are samethenot that in training simulator and investigation accident between gap a arguably is There sentence. the of understanding different very importantly,More a have yet sentence same the read often people mation, their shortcoming is that they are time consuming to read. infor of wealth a supply reports accident written While outcome. human factors issues that can ultimatelyevents results in intimacy with many of the often subtle factors and culminate in a catastrophic should wealsotrainpilotstoprevent accidents? we, can we, do But fastidiously. procedures emergency out carry to and airplanes fly to pilots train to simulators flight full use We Abstract QA FOQA serious or and/or investigations accident with Intimacy • available Photo Photo ISASI 2009 ISASI not not Closing the Gap Between Accident Closing theGapBetweenAccident

tion in 1977 and worked for more than 20 years withHe startedinthefieldofaircraft accidentinvestiga- Civil Aviation Organization’s FlightRecorder Panel. the nationalexpertpanelmembertoInternational field offlightdataanalysis.He representedas Canada pilot’s licenseandisrecognized asanexpertinthe Mike Poole isaprofessional engineerwithacurrent Proceedings mulated more than25,000hoursofflighttimeand manager, andcourseware developer. Hehasaccu- served as a line pilot, instructor pilot, pilot trainingdistinguished 26-year career at US Airways where aftera aviation trainingbusiness.HejoinedCAE he ab-initio, helicopter,CAE’s business,andcommercial Lou Németh is Investigation andTraining By MichaelPoole,ExecutiveDirectorandChiefInvestigator, and

the chief safety officer (CSO) for Lou Németh,ChiefSafetyOfficer, CAEFlightscape - data todevelopfullflightsimulatortrainingscenarios. flight of use the and animations flight of use the through gleaned readily more be can intimacy of level this that believe authors The reports. written the from ascertainable is what beyond sequence consequently has firsthand knowledge of the details of the accident the paper were directly involved in the flight recorder analysis and programs promisestobringaccidentpreventionanewlevel. beyond the investigation report and beyond the statistics of FOQA situations based on improved intimacy with the in sequencethe cockpit. Augmenting simulator of training eventsto replicate real-world strophic situations is paramount to changing attitudes and vigilance the flightoperation. instructor pilot to focus on the subjective human factors aspects of measure and report on the training pilot’s allows the performance ations. oper flight daily in encountered problems with sessions simulator in encountered problems reference cross to airlines enable will based training, applying FOQA concepts to the full flight simulator scenario-based training. factorseffectively and consequently enable causal instructors subtle communicate can technologies toThese improve tools. analysis to all crewmembers through flight data animation visualization and quired through persistent analysis of crew behavior, is now extended practicing skills over and over again. This same instructor skill, as ac- instructorfunctionobservingskillcomesnaturallyofcrewsa as the outcome of even small omissions or lapses in procedures.behavior, predicting reliably of skill unique a have pilots instructor This of cockpit safety.observers flight Asexpert benefit may data flight howimproved intimacy about what happened based onobjective intended to take back to Zurich to conduct the analysis. People intimatePeople analysis. with the the process conduct ofto recovering Zurich to flight back data realizetake to that theintended IIC the which audio, the of transcript a with along data flight the of graphs and printouts prepared Consequently,TSB corders. the the aircraft’s CVR. state FDR, and 30 minutes of good quality audio were recorded on Approximately 50 parameters were recorded on the aircraft’s solid- CVR. and FDR the of analysis and readout the with (TSB) Canada of Board Safety Transportation the of assistance the requested AircraftAccidentInvestigationSwissinjured.BoardfatallyThe I crashed shortly after takeoff from Zurich’s Runway 28 498, during night Crossair as operated HB-AKK 340, Saab a 2000, 10, Jan. On Saab 340accidentexample M The following accidents are examples cases where the authors of cata- to lead can events benign seemingly how Understanding scenario- enhanced develop to data flight using to addition In The Swiss AAIB IIC originally requested a “readout” of the re- the of “readout” a requested originally IIC AAIB Swiss The C. The aircraft was destroyed, and all 10 persons on board were sing flight data from the simulator session to objectively objectively to session simulator the from data flight Using

- , SEPT. 15, 2009 , SEPT. Y

Figure 1. Saab 340 accident site. TUESDA original data are a sea of binary 1s and 0s that need to be converted into meaningful engineering units. Many investigators believe that Figure 2 (above). flight data are “factual,” but the process to convert the data is fraught Flight animation with the opportunity for error. Engineering conversion formulas, developed by the TSB documentation, wiring, acquisition unit programming, software to support the inves- used to convert the data, timing issues, resolution issues, replay tigation team (cour- options, etc., will all affect the quality of the outcome. In fact, if the tesy the TSB). Figure same source binary flight data are replayed with two different replay 3 (left). Planned systems, it is highly unlikely that the same results will be produced. route, instructed The data revealed that shortly after takeoff the aircraft, in night route, and flight path IMC, entered an increasing right turn apparently consistent with con- to crash site. trol inputs. As a flight data analyst, when you see this type of data, you immediately start to question if the data are being processed properly essentially believing he was in a left turn when in fact he was in a or are working properly (in this case if sign conventions are correct) right turn. During the standard instrument departure (SID ZUE because on the surface, the sequence does not appear to make sense. 1Y), ATC issued a change in clearance, essentially cutting the SID The TSB started to work on a flight animation immediately, in an short, and instructed the pilot to make a turn direct to VOR ZUE. effort to understand if the data were properly processed because The first officer confirmed by radio stating “turning left to Zurich animations are an excellent means to validate the correct behavior East.” The SID calls for a left turn as shown in Figure 3. The first of numerous interdependent parameters. The level of “validation” officer reprogrammed the LRN (long range navigation system) of any given parameter should be proportional to what you intend to from the present position to ZUE. At this point in the flight, the conclude. If you are putting a lot of weight on a given parameter, it is aircraft was more or less 180 degrees in the opposite direction of natural that you would check its validity more so than if it were a less ZUE. When reprogramming the LRN, if the operator does not important parameter. The IIC noticed the TSB was working on an explicitly select left or right, the LRN will choose the turn direction animation and asked if it would be OK if the investigation team was offering the shortest distance. It just so happens that the aircraft was brought to Ottawa to analyze the data interactively using the anima- a few degrees closer to a right turn at this point and it was apparent tion as opposed to trying to analyze printouts and plots. Indeed, in that the first officer inadvertently programmed a right turn by not this particular investigation, the early animation with the audio and explicitly selecting left. With both crewmembers believing they were transcript synchronized was very useful to conduct the analysis of the to turn left and both crewmembers believing the flight director was data and greatly expedited a common understanding of what likely programmed for a left turn, when watching the animation with the happened. The Swiss team came to the TSB and spent a few very CVR transcript integrated, it becomes relatively easy to understand fruitful days developing and studying the animation. how the commander could become disoriented and roll the aircraft Animations have two very distinct purposes. One is to assist in into a right turn into the ground. To further validate this early theory the analysis process and one is to communicate the findings.O ften in the investigation, the TSB derived the theoretical behavior of the display choices are different for each of these purposes. Some the command bars (since this was not a recorded parameter) and authorities still view animations as having little or no analytical value displayed them in the animation, which further supported the sup- and use them only for communication purposes. But in the case of position that the commander became disoriented. this accident, the animation had tremendous analytical value and it The Swiss AAIB report makes several excellent safety recom- would have been much more difficult to understand the sequence mendations to prevent a recurrence. While the Swiss report is very of events and gain confidence in the data quality without it. thorough and filled with excellent safety information, it is still ques- It is not the intent of this paper to go into the details of this ac- tionable as to whether this accident or similar accidents in which the cident; however, the key points related to the subject of this paper crew is essentially “tricked” into a situation by a series of seemingly are as follows. The pilot flying (commander) became disoriented, harmless events will effectively be prevented in the future. To the

ISASI 2009 Proceedings • 15 ISASI 2009 PROCEEDINGS 16 previous example, the authors know of no scripted simulator train- be done to ensure there is not a repeat of this accident? As with the can more what or enough done we up―have comes again question condition. waytoreach the crash site was tofly the aircraft in an “unstalled” stall (stickshaker) condition. Simulator tests confirmedthat the only went to “air.” No amount of forward control input could logic wheels on weight the avertas soon as trigger to system stall aircraft the the causing damaged been have must vanes attack of angle the of aircraft was essentially flown into the sea. It was concluded that one was not in a true stalled condition and in less thancontrol onecolumn to minuteeliminate the thestall condition. However, the aircraft theproblem, theflying pilot instinctively pushed forward theon surprisedthe flightcrew members. As they attempted to diagnose understanding theproblem. ever without ground the into aircraft the flew and “tricked” tially essen- was crew the which in case a of example good a perhaps is Although therewasnoflightdataavailableforthisinvestigation,it happened. what together piece to team investigation the enabled eventually events, of sequence the determine to cryptic although and, quality good of was CVR The FDR. the to data erroneous ing send- was and malfunctioned had (FDAU) unit acquisition data recorded alternating streams of steady 1s and 0s indicating the flight brought to TSB Canada for readout and analysis. The aircraft’s FDR IMC. aircraft’sThe were recorder voice cockpit and recorder data flight night in Abidjan in 21 Runway from takeoff after shortly crashed 5Y-BEN, as registered A310 Airbus an 2000, 30, Jan. On Airbus A310accidentexample environment. lessons directly by exposing them to the sequence in the simulator butit would arguably be much better if the recommendations, crews of could way by learn changes the implement and lessons the learned? The current approach is for the safety community to learn flight crews flying similar equipment benefiting from the lessons has benefited from the lessons learned from this accident,this accident but or are the specifics of what caused it. The safety community Even worse, there are many flight crews who have no knowledge of accident. this in identified events of sequence the to exposed are authors’knowledge, there is no simulator training whereby crews Figure 4.Undercarriage from A310accident. The French B which liftoff, on activated system warning stall aircraft’s The • ISASI 2009 ISASI E Proceedings A wrote a detailed report on this accident, but the of timebeforethisaccidentrepeatsitself. the same way as the crew in question did, so it is arguablythe same circumstances, ait is matterprobable that many crews would react Given situation. known real-life this to react they how see to IMC night in liftoff on warning stall false a given are crews which in ing to carry outanescapemaneuverinallcases. to carry need the reinforcing toward along go might terrain mountainous with airports the in flying frequently pilots for sequence this ing a matter of time before it repeats itself? Simulator training replicat- also accident this Is circumstances? same the in thing same the do would crews maneuver.many escape How an execute than rather when confronted with a GPWS their instinct was to tighten the turn mistake and had just corrected the mistake, it is understandable that turn radius to the right. In this case, given they knew they had made a their increased they climb, maximum level wings a requires which Instead of executing the escape maneuver in response to the GPWS, to be. During the right turn, they received a GPWS warning―pull up. supposed were they where regain to turn right a began mediately im- they late, were they realized they When terrain. mountainous toward flying consequently was and SID the by required as turn accident, out the a crewmembers right were a little late in carrying by theairtrafficcontroller.” nation and communication, and the slow responseairspeed decay during tothe initial theclimb, inadequate intra-cockpit premonitioncrew coordi- given unexpected briefing, departure incomplete an be to determined were factors Contributing terrain. of flight the warn to controllers the of failure the and the failure of the flight crew to adhere to a standard instrument departure (SID) NTSB website: the on found was following the however, Internet; the searching found be could Nepal of government the from report No Nepal. the by investigated was accident The IMC. in takeoff after minutes 5 approximately feet 7,550 at hills Champadev the into Kathmandu in crashed VT-LCI, registration B-727-243F a 1999, 7, July On accidentexample B-727-200 simulator training scenarios if we really want toto beprevent investigated them from andneed action wellsafety for understoodpotential high of events andFOQA end. ideallythe in used to develop events. It really does not matter FOQA if the serious aircraft hits to the ground apply or not can logic same The investigations. the in intimate details of the accident sequence, having not been involved because the people developing the training simply do not know the is this like scenarios real-world replicate not does environment ing presented. examples three the as such trainingthe environment doesreplicatebecause not part real-worldin is this scenariosthat opinion authors’ the is It trained. way numeroussimilaraccidents respondwhichnotcrews didinthe been have There way. same the respond well may scenario same understandable,whichmeans another crewconfronted withthe ofthe industry. It can be argued, however, that their response the crewmembers waswere competent, well-trained, and representative respond in a way that would have avoided the accident. In all cases, that the crew did not correctly diagnose the problem and/or did not in problems factors human similar exhibit cases these of three All Closing thegap Theflight recorders were replayed the at TSB Canada. thisIn “ The investigation determined that the probable cause of the accident was inistry of Tourism and Civil Aviation of the government of of government the of Aviation Civil and Tourism of Ministry ne reason that the train- the that reason One becoming an accident. Flight animations have the ability to disseminate complex infor- mation in a highly intuitive and entertaining manner in a fraction of the time it takes to read a report. Like any good movie, you tend to pick out details that you did not see before, each time you watch the movie. Written reports also do not lend themselves to assess- ing timing issues, while animations provide an immediate sense of timing, which can be important to the overall understanding of the accident. Finally, flight animations are an excellent means to communicate what happened to a wide cross-section of people. , SEPT. 15, 2009 , SEPT.

Without consensus as to what happened, there is little point of try- Y ing to understand why it happened. Further, the what happened is exclusive in that there are only one set of facts. The why, on the other hand, is not exclusive. For every what, there are many opinions as to why, and there is not necessarily a right answer. Despite the best efforts of the investigation community, unless you investigated the TUESDA accident, many people simply do not know the intimate details of the accident as it is impractical to glean this level of intimacy from a written report. Flight animations have a unique ability to quickly Figure 5: Simulator session animation replay using the same communicate what happened, which greatly facilitates determin- core technology as the accident investigation replay (courtesy ing why it happened and more importantly, how to prevent it from Oxford Aviation). happening to you. Simulator training today largely focuses on how to fly the air- provides automatic reports of problem areas in the flight, such as craft and how to respond to an emergency. It has not progressed out of sequence procedures, incorrect procedures, missed or late to “evidence-based” training in which we use objective flight data procedures, etc. This allows the instructor pilot to focus attention to develop explicit scenarios from known accidents, incidents, on the more subtle human factors aspects of the simulator sessions. and FOQA events. If you ask a simulator instructor pilot for a list The simulator brief-debrief system currently under development of problems training pilots experience in the simulator, you will at CAE to achieve the “close the gap” philosophy has the following discover that there is little or no correlation to the list of problems key attributes: that are known to cause accidents. This suggests that there is a gap • Simulator replay uses the same core animation analysis software between the flight safety community and the training community that was developed for accident investigation and FOQA event ani- and that there is benefit from a much closer relationship than exists mation, which allows for the replay of accident and/or FOQA anima- today in many airlines. It is timely for the industry to look at ways tions directly on the debrief system to enable instructors to develop to improve the ability for the training community to exploit lessons evidence-based scenarios. Simulator sessions can also be replayed learned by using actual flight data as the objective common base by the FOQA animation system fostering increased collaboration between the two communities. Coincidently, IATA within its ITQI between training and safety departments within the airlines. (IATA Training and Qualifications Initiative) is actively exploring • Interface from the FDR/QAR replay system to drive CAE full flight flight data from FOQA programs from volunteering airlines in an simulators with recorded flight data to replay accidents or serious effort to change the regulations regarding simulator training to FOQA events in the full flight simulator. allow for evidence-based training. The following is an extract from • Simulator record session control by the instructor to mark events the ITQI 2008 report from IATA’s website: of interest for quick navigation as well as potential for real-time “Progress in the design and reliability of modern aircraft has prompted an notification of problems during the simulator session. industry review of pilot training and checking requirements. In addition to • Automatic report of problem areas during the replay. the wealth of accident and incident reports, flight data collection and analysis • Ability for the crewmembers to have an electronic copy of their offer the possibility to tailor training programs to meet real risks. The aim is session plus real aircraft replay for self-study. to identify and train the real skills required to operate, while addressing any • Collection of data (with appropriate security and airline approvals) threats presented by the evidence collected. The IATA best-practice document across simulators to study regional differences. will facilitate regulatory change and enable more efficient, safety driven, and • Ability to begin to compare simulator session “flight data” to cost-effective training.” aircraft flight data to compare and ensure that simulator training continues to evolve to reflect real-world scenarios (evidence-based Simulator brief-debrief training). The TSB Canada was one of the first (if not the first) in the world to • Video and audio synchronized with the replay of the simulator use mini-computer technology to animate flight data in a true 3-D flight data. environment for the purpose of understanding and communicating an accident sequence. This same technology has been applied for Summary some time to the simulator community in which flight animation is Many people in the accident investigation business see the same used to replay “flight data” from the simulator to debrief the flight core human factors issues over and over again. A combination of crew after the session. CAE is actively pursuing applying FOQA individually benign events led to a situation “outside the box” of concepts to the full flight simulator whereby the analysis software current simulator training. It is, of course, impossible to train for

ISASI 2009 Proceedings • 17 ISASI 2009 PROCEEDINGS 18 benefit the to technology the leverage to instructors train Wecan flight data as an integral part of the training process, not an option. went wrong. We can include simulator what of details intimate the appreciate can they that so animations brief flight interactive andof form debriefthe in ideally usingevents FOQA serious actualand pilots and instructor pilots easy access to flight data from accidents batical at an investigation agency. What we can do is give these same accidents andisasaferpilotforit. out of that experience with acomes authority investigation safety a at year reala for works who pilot appreciation for what Any sequence. reallythe of subtleties the appreciate causesto begin they since would undoubtedly conclude that thisa good couldjob. If these same happenpilots participated on the to investigation, they them as well would not happen to them; that the pilots in question were not doing vigilance, communication,andastrongsafetyethic. for need the appreciate pilots ensure to data flight objective using events. objective aircraft flight data from past accidents and serious FOQA using train to possible technically is it but possible scenario every We cannot afford to send all the worlds pilots for a one year sab- M • anypilots read theaccident headline andconclude that this ISASI 2009 ISASI videnced-based training scenarios need to be developed developed be to need scenarios training Evidenced-based Proceedings investigations andtraining.◆ accident between gap the closing are we that know will we more dataand the simulator data match in terms of problem aircraft real the more The areas, this. do longer no theshould we say to not is This procedures. emergency out carry to and requirements tory reasons why airplanes crash. This is because we still train to regula- encountered duringflightsimulatorsessions. identified through investigation and FOQA programs to problems based training and allow evidence- the of creation industry the facilitate to will better This flight. of correlatesafety the of problems 5. 4. 3. 2. Final Report of the Aircraft Accident1. http://en.wikipe0dia.org/wiki/Crossair_Flight_498. Investigation Bureau on the accident toReferences

Initiative (ITQI)Report2008,IATA. 3D6625F93B56/0/ITQIReport2008.pdf,IATATraining Qualification and https://www.iata.org/NR/rdonlyres/AF49185 Foundation. http://aviation-safety.net/database/record.pho?id=19990707-0, Flight Safety Final report5y-n0000130a,BEAFrance. http://www.bea-fr.org/docspa/2000/5y-n000130a/htm/5y-n000130a.html.10, 2000,nearNassenwil,ZH.(FinalReportCRX498,AAIBSwitzerland). the Saab 340B aircraft, registration HB-AKK of Crossair flight CRX 498 on Jan. The main problems in the simulator are typically not related to E-8722-415F-9A4A- How Significant Is the Inflight Loss of Control Threat? By Capt. John M. Cox, FRAeS, and Capt. Jack H. Casey, FRAeS, Safety Operating Systems, L.L.C., Washington, D.C. , SEPT. 15, 2009 , SEPT. Y Capt. John Cox, retiring from the airlines after No. 1 cause of hull losses and fatalities in the worldwide air carrier flying 25 years, founded Safety Operating Systems, fleetif TAWS is functional. a Washington, D.C.-based aviation safety consulting Resources are finite in any business. Industry safety professionals firm. He has more than 14,000 flying hours with are tasked with determining the primary issues of concern, then ad- more than 10,000 in command of jet airliners. He dressing them in a planned and forthright manner with objective TUESDA holds an airline transport pilot certificate with type data and professional guidance. This is very difficult within a larger ratings in the Airbus A320 family, the Boeing 737 society that often decides issues with subjective data at best, “feelings” family, the Fokker F28, and the Cessna Citation. Cox is a Fellow of the at worst. Data clearly establish loss of control flight upset (LOC-I) as Royal Aeronautical Society. He served as an air safety representative the primary danger today in flight operations. Compare this with for the Air Line Pilots Association for more than 20 years, rising to the news media interest regarding runway incursions that has driven the position of Executive Air Safety Chairman, ALPA’s top safety job. FAA activity, rulemaking, and expense. A glance at the objective data ALPA awarded him its highest safety award in 1997. The Guild of establishes that, while runway incursions are a concern, as an issue Air Pilots and Air Navigator presented him with the Sir James Martin it pales compared to loss of control. Award for aviation safety in 2007. He is an experienced accident Industry statistical analysis shows 22 inflight, loss-of-control accidents investigator, having been involved in 13 major investigations (the best between 1998 and 2007. These accidents resulted in more than 2,051 known being the USAir 427 accident in Pittsburgh in 1994) and nu- fatalities. (Airplane Upset Recovery Training Aid, Revision 2). Data also merous smaller investigations. He holds an air safety certificate from suggest an even larger number of “incidents” in which airplanes the University of Southern California. experienced near or actual loss of control and qualified as upsets. There are several reasons such events occur: flight control prob- Jack H. Casey spent the 8 years prior to becoming a lems, environmental dangers, equipment, and pilot inattention partner at Safety Operating Systems as the pilot liaison or inaction. Investigation of pilot actions during these events for Embraer Aircraft Holdings, Customer Services suggest pilots require specialized training to cope with airplane USA, achieving a reputation as a worldwide expert in upsets. Research indicates most airline pilots rarely experience Embraer aircraft and their operations in line service. airplane upsets during their flying careers. It also indicates that Since leaving military service in 1975, he has been many pilots have never been trained in maximum-performance employed with airlines and has flown the BE18, DC-3, airplane maneuvering, such as aerobatic maneuvers. Addition- B-737 and has flown more than 11,000 hours and 2.8 million miles ally, those pilots who have been exposed to aerobatics lose their without accident. During his career, Casey has served in all air carrier skills as time passes unless such flying is a consistent hobby or required positions, been a designated examiner, type rating examiner, and second career. line check airman and gained considerable experience with the FAA, the This does not suggest training in aerobatics, although such NTSB, and numerous foreign regulators. training does improve an assortment of pilot skills. Indeed for our purposes aerobatic training may be counterproductive, producing This document reflects the ground-breaking work contained in the Fed- negative training outcomes, and possibly, as we will see, implanting eral Avaition Administration’s (USA) Flight Upset Recovery Document incorrect technique. The aircraft in question, transport-category Revision 2. It is consistent with the content and recommendations of that aircraft, are not designed nor intended for such flight. document, in addition to industry best-practice standards. For our purposes, airplane upset is defined as an airplane unin- tentionally exceeding the parameters normally experienced in line At all times manufacturer recommendations for proper aircraft operation operations or training. are controlling. While specific values may vary among airplane types, the following unintentional conditions generally describe an airplane upset: Introduction and history • Aircraft pitch attitude greater than 25 degrees, nose up. Airplane manufacturers, airlines, pilot associations, flight training • Aircraft pitch attitude greater than 10 degrees, nose down. organizations, and regulatory agencies are increasingly concerned • Aircraft bank angle greater than 45 degrees. with the incidence of loss of control events. Accidents resulting from • Within the above parameters, but flying at airspeeds inappropriate loss of airplane control have, and continue to be, major contributors for conditions. (Airplane Upset Recovery Training Aid, Revision 2) to fatalities in the commercial aviation industry. In fact, because of Significantly, these flight conditions often occur in combination. the decline of controlled flight into terrain (CFIT) accidents due Loss of control, flight upset (LOC-I) is established as the potential to technological breakthroughs, loss of control has become the event demanding immediate and decisive attention by the avia-

ISASI 2009 Proceedings • 19 ISASI 2009 PROCEEDINGS 20 without autoflight. mismanagementand lack of awareness of actual control crew flight possible of conditionsstatements public regulatory within signs others. In fact, recent tragedies, while investigations continue, show are There terms. unambiguous and clear in problem the illustrate West Flight708(MD-82),August 2005 CaribbeanAirways • PinnacleAirlinesFlight3701(CRJ200),October2004 • AmericanAirlinesFlight587(A300),November2001 • USAirFight427(Boeing737),September1994 • and aircraft, yettheydid. and safeoperations. training to related else anything as model business a much as be of when the inevitable will happen. Training for flight upset should equation an creates less Anything sufficient. longer no is program is meaningless, Anything less than a with. professionalBelief that “it won’t happen here,” andbecause it activehas not happened, training deadly accidentsthatillustratetheproblem. Training Aid, Revision 2 (2008). The need is established by a string of while remaining within the regulatory guidance of the aids, training existing already using approach, practical a demand the technology-resistant nature of the problem. The solution should understood aspartofthesolution. theyhave not prepared for. This “shock” or“stun” factor situation flight unfamiliar mustan with bedeal must then automation, on reliance to due atrophied have might skills flight individual whose crewmembers, challenge a such with Faced systems. same those of in which the parameters of flight upset result in the disconnection situation a facing are pilots possible, degree maximum the to aids flight sophisticated other and flight auto utilize to crews courage of parameters the beyond or at actions flight control and react can it which at point flight upset. Technology, especially autoflight, has not reached the installationanduse. and itsmandatory TAWS,of advent the until life of loss and accidents of cause major some mitigation of the problem, but CFIT did not cease to bepilots the regarding the seriousness of the matter. Such results produced and companies to regulations and directives issued have agencies regulatory and emphasis, in least at training, increased including losses and loss of life. The industry has responded in a variety of ways, results is obvious. CFIT reigned for years as the No. 1 cause of hull —TAWS —TCAS —weather radar technologicalimprovements. • proactivenotreactivesafetyprograms. • improvedtraining. • improvedandoperatorfriendlyavionics. • thejetengine. • increasing safetyhavebeen improvementsfor the industry. Generally accepted developments technology and improved training have resulted in significant safety decline of public confidence. In past years, several developments in and losses, financial vast life, of loss further avoid to industry tion These tragedies were selected for brief examination because they airlineNo operatoror expected these accidents occurto withtheir crews dispensed and examined be should barrier psychological One By necessity, flight upset becomes a training question because of Technology offers little assistance with the challenges inherent in The emergence of technology as the leading contributor to these • ISASI 2009 ISASI Proceedings C-I. In fact, in an era in which regulators en- regulators which in era an in fact, In LOC-I. Upset Recovery Upset Recovery billion indirectandindirectlosses. more than 4 years to complete and cost the industry more than $1.5 encountered, berecoverable. like event an training, for more sophisticated training of flight crews so that following such better. Prominent in the NTSB recommendations were suggestions previousexperience andtraining, future B-737 crews should fare their given chance little had crew this Although speeds. cross-over increased knowledge of more sophisticated aeronautical issues like This resulted in remodeled training for crews flying the B-737, and upset. flight unexpected of type this address to training pilot rier be plannedfor. plan. However, pilot training mitigation for such nasty surprises can versions for years. This cannot be planned for in a standard business under tragic circumstances. The B-737 had been in service in various discovered was design, original the since existing flight, to danger and flightdatarecorder(FDR)parameters.”(p.ix) rudder system design, unusual attitude training for air carrier pilots, malfunctions, including rudder reversals, the adequacy of the B-737 slide. overtravel oftheprimary valve housing offset from its neutral position and slide to the servo a jam of the main rudder power control valve unit secondary servo a direction opposite to that commanded by the pilots as a result of in deflected likely most surface rudder The limit. blowdown its to of the airplane resulting from the movement of the rudder surface probable cause of the NTSB statesthefollowing: killing allaboardoutsideofPittsburgh,Pa. USAir Flight 427 (ORD–PIT) descended out of control and crashed, 19:00 approximately At USAir 427 ness ofterrorism, buthumanerror. City again faced tragedy from the sky. This time it was not the mad - Barely one month following the attacks of Sept. 11, 2001, New York American Airlines587 Of interest to operators is the fact that this investigation required The report includes commentary on the inadequacy of air car air of inadequacy the on commentary includes report The significant a aircraft, series B-737 of thousands building After rudder 737 Boeing on focused report this in issues safety “The “The National Transportation Safety Board determines that the In the executive summary of the final report of this accident, the USAir Flight 427 accident was a loss of control SAir Flight 427 could be prevented, but if if but prevented, be could 427 Flight USAir astern Daylight Time on Sept. 8, 1994, 1994, 8, Sept. on Time Daylight Eastern - , SEPT. 15, 2009 , SEPT. Y TUESDA

At 09:16 Eastern Standard Time, American Airlines Flight 587, “On Feb. 6, 2003, American Airlines provided the Safety Board an Airbus A300-605 N14053, crashed into a residential area of Belle with a copy of a May 27, 1997, memorandum from the company’s Harbor, N.Y. Flight 587 was a regularly scheduled flight from JFK to managing director of flight operations technical to the company’s Las Americas International Airport, Danto Domingo, Dominican chief pilot and vice-president of flight. The memorandum stated Republic. Killed were 260 passengers and crew aboard the aircraft, that the managing director of flight operations technical had ‘grave and five people on the ground. concerns about some flawed aerodynamic theory and flying tech- Once fears of terrorism were eliminated, it was evident the aircraft niques that have been presented in the AAMP.’ The memorandum impacted the ground in an ominous fashion. The location of the also stated that it was wrong and ‘exceptionally dangerous’ to teach vertical stabilizer and rudder in Jamaica Bay was proof positive of a pilots to use the rudder as the primary means of roll control in structural breakup while in flight. recoveries from high AOAs.” (p. 89) During the investigation, it became apparent that the aircraft en- The memorandum continued to request a review of a number countered wake turbulence a few minutes after takeoff from a B-747 of concerns regarding the program, some raised by manufacturer that departed the same runway immediately before. The pilot flying test pilots. In addition to the propensity of the first officer to use of the aircraft was the first officer. This encounter is where the trouble excessive rudder, such instruction created a toxic combination that, started. Wake turbulence around busy traffic areas, mixing aircraft of under demands of the event, stressed the Airbus vertical stabilizer various sizes and capability, is hardly unknown. In fact, it is frequent. and rudder beyond design limits. The executive summary of the NTSB final report on the loss of This chain of events illustrates key issues regarding training for inflight Flight 587 says the following: upsets. This event brought the entire concept into question in some “The National Transportation Safety Board determines that the minds. Carriers developing such programs ceased their develop- probable cause of this accident was the inflight separation of the ment. The fact that American Airlines increased exposure and vertical stabilizer as a result of the loads beyond ultimate design that liability through such a program was not lost on the industry. It also were created by the first officer’s unnecessary and excessive rudder provided additional rationalization for those opposed to such train- pedal inputs. Contributing to these rudder pedal inputs were the ing for various reasons, such as cost, the effort involved, or simple characteristics of the Airbus A300-600 rudder system design and resistance to change. By any estimation, Flight 587 stands as a classic elements of the American Airlines advanced aircraft maneuvering program.” inflight upset event with tragic consequences. (p. xi) (authors’ italics) In effect, the report states that the flying pilot excessively loaded Pinnacle Airlines 3701 the rudder beyond design limits and the system was designed as to At approximately 2215 Central Daylight Time, Pinnacle Airlines allow him to do it. Flight 3701, a repositioning flight from Little Rock, Ark., to Min- For our purposes, the Board’s concentration on American Airlines neapolis-St. Paul International Airport in Minnesota, crashed near advanced aircraft maneuvering program is significant and troubling. the Jefferson City, Mo., airport, killing the crewmembers, who were It is clear that American Airlines made a strong commitment to ad- the only souls aboard the aircraft. dress the clear dangers present in loss of control flight upset events. The NTSB final report was scathing: The airline created an aggressive program designed to improve “The National Transportation Safety Board determines that their pilots’ awareness and skills. The design of the program was an the probable causes of this accident were (1) the pilots’ unprofes- “in house” training department effort that, at least initially, sought sional behavior, deviation from standard operating procedures, input from manufacturers and regulators. However, as time passed, and poor airmanship, which resulted in an inflight emergency disagreements on basic aerodynamic theory and technique began from which they were unable to recover, in part because of the to surface. While the program had the very best of intentions, it pilots’ inadequate training; (2) the pilots failure to prepare for an came under question by the company’s operations management. emergency landing in a timely manner, including communicat- The NTSB final report discussed one significant issue. ing with air traffic controllers immediately after the emergency

ISASI 2009 Proceedings • 21 ISASI 2009 PROCEEDINGS up position(12units). The • no signofpre-impactdamage. 22 The • rotation atthetimeofgroundimpact. Both • mately 205meterslongby110atthewidestpoint. Wreckage • attitude. Ground • Machiques, Venezuela, killingall160personsaboard. near crashed and attitude flight nose-up a in altitude cruise from (HK-4374X) charter an flight708, Flight fromAirways Caribbean West Panama 2005, 16, Aug. to On West 708 CaribbeanAirways knowledge containedininflightupsettrainingprograms. probably recovered sufficiently to save their lives and the aircraft with the behavior and the predicament that resulted, the crew could have their performance. removingpilots fromthesystem whocannot willornotimprove be, need if and, detecting for tool useful a is section, upset inflight an containing program, training monitored and taught priately appro- and well-designed a Additionally trained. be can namics, engine coresrotating.”(p.x) the importance of maintaining a minimum airspeed to keep the pilots to communicate not did which manuals, flight airplane the (2) and restarted, being from engine one least at prevented which condition, engine lock core the (1) were accident this to Contributingcondition. engine lock core the in resulted and failure checklist, which allowed the engine cores to stop rotating engine double the of management improper pilots’ the (3) and about the loss of both engines and the availability of landing sites; Investigation bytheCIAAofVenezuela showedthefollowing: of regardless that is 3701 Pinnacle by established issue key The aerody- basic as well as knowledge, aircraft and Professionalism • ISASI 2009 ISASI horizontal engine engines scarring was inlets, Proceedings exhibited distributed stabilizer indicated empennage, was indications over impact found a and triangle-shaped at in wing about of a nose-up, high-speed M leading artinique, descended the full slight edges area airplane compressor right approxi- showed D-82 MD-82 nose roll

proper trainingandeducation,thisriskcanbereduced.◆ to the fleet of transport aircraft is loss of control in flight. Through can, and should, be reduced. Accident data are clear the greatest risk loss of the aircraft and occupants. The number of this accident type unintendedinflight condition (upset or stall) has resulted in the occur, pilotsdiscoverdegradationinbasicflyingskills. to intention: we have arrived at the point that when airplane upsets ability continues to be a goal. Automation may have a result counter in airplane design and aerodynamic simplicity and equipment reli- Improvement others. than prevented easily more are events Some correct footing. training manual revisions and lessons to begin the process on the guidance useful, and but templates basic, for a provides training aid program, This as well experts. as sample industry other and Training Recovery Upset Airplane Aid, the develop to formed team industry an leading by challenge trainingin the subject. Airplane manufacturers responded to the agencies areagainencouragingairlinestoprovideeducationand programs, including academic and simulator training. Regulatory training pilot implementing and developing are operators of ber pressure of events and acceptance of the problem. A growing num- “buy in”bythepilotgroups. significantly and oversight, and understanding, regulatory ment, and enhancing non-automated pilot flying skills, corporate commit- the industry. Issues include the proper use of technology, preserving, ground impact. at cruise altitude before beginning a descent that did not cease until Upset Recovery DocumentRevisionOne.(2007).Retrieved2009,fromfaa.org. Upset Recovery Administration. Aviation Federal (2007). F.A. Administration, References 10, 2009,fromfaa.gov:www.faa.gov/doc/upset. In too many recent accidents, pilot inability to recover from an an from recover to inability pilot accidents, recent many too In As we have seen, airplane upsets happen for a variety of reasons. postTheAmerican syndrome587 finallyis waning under the The events discussed here demonstrate the challenge ahead for Additionally, while slowed had aircraft the that showed FDR the ) with the FAAthe with (2008) 2 Revision Retrieved June Reducing the Risk of Runway Excursions By Jim Burin, Director of Technical Programs, Flight Safety Foundation, Alexandria, Va., USA , SEPT. 15, 2009 , SEPT.

Jim Burin has 41 years of aviation experience and 33 Y years of experience in the aviation safety field. He is a graduate of Dartmouth College and has a master of science degree in systems analysis from the Naval Post- graduate School. His work in aviation safety includes controlled flight into terrain countermeasures, human TUESDA factors, safety program organization, accident inves- tigation, operations, administration, education, risk management, and organizational and leadership influences on safety. He is a retired Navy captain, having commanded an attack squadron and a carrier air wing during his 30-year career. Prior to joining the Flight Safety Foundation, he was the director of the School of Aviation Safety in Monterey, Calif., where he was responsible for the safety training of 650 Navy, Marine, Table 1. Total Commercial Transport Accidents, 1995-2008 Coast Guard, and international safety officers each year. As the direc- tor of technical programs, his duties include organizing and overseeing safety committees and managing safety-related conferences and research. He is the chairman of the Foundation’s international ALAR (approach and landing accident reduction) effort. He has frequently spoken at safety conferences, seminars, and workshops around the world.

Background At the request of several international aviation organizations, the Flight Safety Foundation initiated a project entitled Runway Safety Initiative (RSI) to address the challenge of runway safety. This was an international effort with participants representing the full spectrum of stakeholders from the aviation community. The effort initially Table 2. Runway-Related Accidents for Commercial Turbojet and reviewed the three areas of runway safety: runway incursions, runway Turboprop Aircraft confusion, and runway excursions. After a review of current runway safety efforts, specific data on the various aspects of runway safety excursion accidents per year for commercial aircraft, while runway were obtained. After reviewing the initial data, the RSI Group deter- incursion and confusion accidents combined have averaged one mined that it would be most effective to focus its efforts on reducing accident per year. the risk of runway excursions. All data used in this document are Figure 1 shows that the largest portion of runway-related accidents taken from the May 2009 report of the RSI (see Reference 1). is, by far, excursion accidents. A runway excursion was defined as when an aircraft on the runway Forty-one of the 431 runway accidents involved fatalities. Excur- surface departs the end or the side of the runway surface. Runway sion accidents accounted for 34 of those 41 fatal accidents, or 83% excursions can occur on take off or on landing. They consist of two of all fatal runway-related accidents. In general, the likelihood of types of events: 1. A veer-off is a runway excursion in which an aircraft fatalities in a runway-related accident is greater in incursion and departs the side of a runway. 2. An overrun is a runway excursion in confusion accidents. However, the much greater number of runway which an aircraft departs the end of a runway. excursion accidents results in a substantially greater number of fatal During the 14-year period from 1995-2008, commercial transport excursion accidents (see Figure 2). aircraft experienced a total of 1,429 accidents involving major or Only a small percentage of runway excursion accidents are fatal. substantial damage (see Table 1). Of those, 431 accidents (30%) However, since the overall number of runway excursion accidents is were runway related. The specific RSI focus on excursion accidents so high, that small percentage accounts for a large number of fatali- was driven by the fact that of the 431 runway-related accidents, 417, ties. During the 14-year period, 712 people died in runway excursion or 97%, were runway excursions. accidents, while runway incursions accounted for 129 fatalities and The number of runway excursion accidents is more than 40 times runway confusion accidents accounted for 132 fatalities. the number of runway incursion accidents, and more than 100 times the number of runway confusion accidents (see Table 2). During Discussion the past 14 years, there has been an average of almost 30 runway Who is responsible to address the challenge of runway excursions? The

ISASI 2009 Proceedings • 23 ISASI 2009 PROCEEDINGS 24 risk factor in landing excursions. primary a are approaches unstabilized that show clearly data the Operators must have and monitor stabilized approach criteria, since some landings have the potential of becoming physics experiments. under all runway conditions, data on how the aircraft will perform crews will need in most day-to-day operations. However, without good safe and reliable aircraft. They also provide data and procedures the management), airports,airtrafficcontrol,andregulators. answer is everyone aircraft manufacturers, operators (both aircrews and Figure 3.Runway excursions, bytype. Figure 2.Proportions runwayaccidents. offatalandnon-fatal commercial turbojetandturboprop aircraft. Figure 1.Proportions accidentsfor ofrunway-related The manufacturers do a great job of providing the operators with • ISASI 2009 ISASI Proceedings Operators also need to have a true

universal systemformeasuring andreportingrunwayconditions. operations under all conditions.vided with the best Regulatorspossible information from the manufacturers for should also requirestabilized approaches. They also enabling need someto in be sure assist that aircrews these are pro- since guidance, vertical with approaches timely manner. a in conditions runway and environmental on information able approach. Second, to ensure that aircrews are given the best avail- fic that services give flight crews the opportunity to fly astabilized in reducing the risk of runway excursions: first, to provide air traf- firefighting. and rescue aircraft and areas, safety end runway measurement, condition runway clearing, and cleaning runway signage, and aids,runwaydesign(e.g.,crowned, grooved, porous), markings area. These include issues such as airport design, lighting, approach excursions isfailuretogoaroundwhenwarranted. no-fault go-around policy because the leading risk factor in landing Figure 4.Takeoff excursions,bytype. are someofthe basicdatafromthestudy. Following areas. high-risk the identify to and accidents excursion runway of causes the investigate to 2008 1995-March from cidents ac- excursion runway all of conducted was study data in-depth An Data Figure 5.Landingexcursions,bytype. Finally, the regulator needs to encourage and provide moreprovide encourageand toFinally,regulator needs the Air traffic management/air traffic control has two primary roles excursion runway the in address to issues many have Airports , SEPT. 15, 2009 , SEPT. Y

Figure 7. Landing excursions, by fleet composition. Figure 6. Takeoff excursions, by fleet composition. TUESDA

Landing excursions outnumber takeoff excursions approximately 4 to 1 (see Figure 3). Almost two-thirds of the takeoff excursions are overruns (see Figure 4). Landing excursion overruns and veer-offs occur at nearly the same rate (see Figure 5). Among aircraft fleet types, turboprops are involved in the largest percentage of takeoff excursions, followed closely by jet transports (see Figure 6). For landing excursions, the proportions between jet transports and turboprops were approximately reversed—jets were involved in more excursions than turboprops (see Figure 7). Figure 8. Takeoff excursion risk factors. The data were analyzed to identify the most common risk factors, both in takeoff excursions (see Figure 8) and landing excursions (see Figure 9). More than one risk factor could be assigned to an accident. The most common risk factor in takeoff excursions was a rejected takeoff (RTO) initiated at a speed greater than V1. Loss of pilot di- rectional control was the next most common, followed by rejecting the takeoff before V1 is reached. This is of concern since aborting prior to V1 should result in a successful RTO. For landing excursions, the top risk factors were go-around not conducted, touchdown long, landing gear malfunction, and ineffec- tive braking (e.g., hydroplaning, contaminated runway). Three of the top 5 risk factors deal with elements of a stabilized approach.

Risk Factor Interactions The risk of a runway excursion increases when more than one risk Figure 9. Landing excursion top risk factors. factor is present. Multiple risk factors create a synergistic effect (i.e., two risk factors more than double the risk). Risk factor interactions associations between engine power loss and aborts initiated above present the possibility of many associations between various con- V1, as well as an association between these high-speed aborts and tributing factors, but determining whether any pair of associated the presence of runway contaminants. factors has a causal connection would require more detailed study and analysis. Summary As an example, risk factor interactions for landing overruns show The RSI team fully supports the many outstanding activities being strong associations between “go-around not conducted” and other conducted around the world by organizations like the FAA, ICAO, factors such as “unstabilized approaches,” “long/fast landings,” and Eurocontrol that have been responsible for the low number of “runway contamination,” and “hard/bounced landings.” Logically, runway incursion accidents. The specific goal of the RSI team was these factors may have a causal connection to each other that sig- to provide data that highlight the high-risk areas of runway excur- nificantly increases the probability of a runway excursion accident. sions and to provide interventions and mitigations that can reduce In looking at some risk factor interactions for takeoff excursions, those risks. The RSI effort brought together multiple disciplines that the risk factor interactions suggest that there might be interesting included aircraft manufacturers, operators, management, pilots,

ISASI 2009 Proceedings • 25 ISASI 2009 PROCEEDINGS CRM • tion. Training • the RTO decision. Training • —Flap andspoilerconfigurationissues. —Tire andothermechanicalfailures, —Sudden lossordegradationofthrust, sues: Operators• risk ofatake­ 2. Takeoff performance calculation errors increase the tions suchasRTOs. 26 Operators • takeoff excursion runway 1. A mishandled rejected takeoff (RTO) increasesConclusions andrecommendations the risk of to addressthechallengeofrunwayexcursions. zations. It used the expertise and experience of all the stakeholders regulators, researchers, airports, and air traffic management organi- Operators • balance, includingerrordetection. Operators • excursions 3. Unstableapproaches increase theriskoflandingrunway formance data. Flight • stabilized approach. ATC/ATM • factors leadingtolandingexcursions. major are touchdowns hard and long, fast, and threshold, at high Operators • not meetthestabilizedapproachcriteria. Operator • excursion accidents a majorcontributortorunway 4. Failure torecognize theneedforandtoexecuteago-around is approach criteria. condition information. Flight • excursions increase theriskofrunway 5. Contaminatedrunways Training should reinforcethesepolicies. • policies. • ISASI 2009 ISASI and crews crews should should policy

adherence off excursion runway should should should should should personnel should should Proceedings should emphasize emphasize

have have emphasize define, implement be recognize to should given

a a dictate SOPs

process process publish,

directional recognition accurate, assist and

are and that a

go-around to to train essential aircrews

and support fast ensure ensure useful, control for and train of

in accurate a proper in

if takeoff

no-fault high proper and meeting the an time-critical during approach timely elements on execution rejection

takeoff

weight

go-around approach, stabilized decelera- runway

situa- does

of per and of is- a -

1. Flight Safety Foundation (May 2009). Reducing the Risk of Runway References Flight • asymmetric deployment. Flight • excursions reverser issues increase theriskofrunway 6. Thrust of runwayconditionstheymightexperience. formance information to operators that accounts for the spectrum Manufacturersshouldprovideappropriateoperationalandper • should bedevelopedtoreducetheriskofrunwayexcursions. A • Flight • excursions issues) synergistically increase theriskofrunway taminated runways or unstable approaches plus thrust windspluscon- 7. Combinationsofriskfactors(suchasabnormal reverser speeds. All • nex 14specifications. data. ◆ performanceaircraft andreporting, and measuring condition All • any obstaclesitwillencounterpriortocomingastop and andtheterrain surface of theaircraft asitleavestherunway excursiondependsontheenergy ofarunway 9. Thesurvivability and flightcrewteam. SOPs • ManagementandflightcrewsshouldmutuallydevelopSOPs. • risk of runway excursions (SOPs) will enhance flight crew decision-making and8. reduceEstablishing the and adhering to standard operating procedures lead toarunwayexcursion. may that risks the of awareness their increase to landing each for Aircraft • (e.g., anarrestorbed). (R Regulators • excursions characteristics, helpreduce theriskofrunway comprehensive performance data related to aircraft andconditions, stopping10. Universalstandards related totherunway operations. flight during times all at available and trained Report oftheRunwaySafetyInitiative. E SA)asrequired byICA universal, areas runway should crews crew crews

rescue surrounding should ends application should easy-to-use be should

regularly and should develop be

use firefighting prepared the of method a have reviewed O reverse runway runway global, Annex 14orappropriate substitute a for certified

of (ARFF) and thrust uniform should excursion mechanical runway updated is runway

conform personnel most standards condition risk by malfunctions effective end awareness a management to

for safety should ICAO reporting xcursions, Excursions, runway at high area tool and An-

be -

Developing Investigations to Enhance Safety Worldwide By Marcus Costa, Accident Investigation and Prevention Section, ICAO , SEPT. 15, 2009 , SEPT.

Marcus A. Costa has been chief of the Accident accident and incident investigations to assist those States lacking Y Investigation and Prevention Section at ICAO the necessary means. headquarters since November 2004. He has been an air safety investigator since 1981. From 1985 d) public availability of final accident reports in the interest of ac- to 2004, he was a staff and faculty member with cident prevention. CENIPA/Brazil. He served as an accredited repre- TUESDA sentative of Brazil to accidents in the United States e) improved safety information sharing through the use of common in 1995 and 1996. In 1999, Costa was the Brazilian delegate to safety taxonomies. the ICAO AIG Divisional Meeting. He served as chief of CENIPA in 2002 and 2003 and in 2008 served as secretary of the AIG Divi- f) reporting of accidents involving unmanned aircraft systems (UAS) sional Meeting. A native of Brazil, he served with the Brazilian Air and very light jets. Force, retiring with the rank of colonel. He completed the U.S. Air Force Flight Safety Officer’s Course in 1985 and received a master’s g) endorsement of a framework model memorandum of under- degree in aviation safety from Central Missouri State University in standing for cooperation between States in accident and incident the United States in 1994. investigations.

Introduction h) improved guidance on the coordination of Annex 13 investiga- Thee Accident Investigation and Prevention (AIG) Divisional Meet- tions and judicial processes. ing 2008 (AIG/08) took place at the headquarters of the Interna- tional Civil Aviation Organization (ICAO) in Montréal from Oct. i) promotion of enhanced monitoring and resolution of safety 13-18, 2008, with the participation of some 225 participants from recommendations. 75 States and 12 international organizations. The theme of the meeting was “Developing Investigations to j) assessment of Annex 13-related shortcomings identified by ICAO’s Enhance Safety Worldwide.” The meeting addressed a number of Universal Safety Oversight Audit Program (USOAP). important provisions in Annex 13—Aircraft Accident and Incident Investigation—with a view to further improving and amplifying the Protection of safety information scope of investigations in a cost-effective environment. With regard to the protection of certain accident and incident re- cords, it is worth noting that the meeting participants unanimously Outcomes of the meeting agreed to recommend that ICAO undertake a study aimed at review- Participants at the eighth AIG Divisional Meeting put forth 24 ing and facilitating the implementation of Paragraph 5.12 and At- proposals to amend provisions in Annex 13 and another 23 recom- tachment E to Annex 13 with the assistance of an appropriate group mendations of general nature aimed at improving aircraft accident of experts. In this connection, it is further noted that a proposal was and incident investigation and prevention for the enhancement of made by the meeting participants to expand Paragraph 5.12 to ad- aviation safety worldwide. dress the protection of cockpit airborne image recordings. Among other issues, the meeting discussed the future of acci- dent and incident investigations, with the goal to assist some States Recommendations for amendments to Annex 13 through the development of regional investigation bodies. The 24 recommendations for amendments to Annex 13 can be Reflected in the meeting’s outcomes was the recognition that found in the report of the meeting (ICAO Doc. 9914). In March innovative approaches to accident and incident investigation are 2009, the Air Navigation Commission of ICAO reviewed the rec- needed given the current realities of evolving technologies and ommendations and agreed to seek the comments of States and resource constraints. Some of the important recommendations that international organizations. Following receipt of comments, the were agreed upon include the following: Commission will conduct a final review of the proposals, which will a) focusing investigations on those accidents in which safety lessons then be presented to the ICAO Council for adoption of amendments are expected to be learned. to Annex 13 in March 2010. b) stronger emphasis on the investigation of serious incidents which Recommendations on matters other than will provide additional safety data. amendments to Annex 13 The 23 recommendations other than amendments to Annex 13 c) development of guidance material on regional cooperation in considered the following: 2 recommendations addressed general

ISASI 2009 Proceedings • 27 ISASI 2009 PROCEEDINGS 28 and States to distributed were and meeting the of report the recommendations. 2 other the on action took and recommendations 21 on mission during USOAP. findings AIG-related 1covered and recorders, flight to related 2 recommendations, safety concerned 2 data, safety to related 5 training, and documentation AIG with dealt 11 policies, ICAO Those recommendations are presented in a supplement to supplement a in presented are recommendations Those Com- the by taken actions the noted Council the 2009, June In • ISASI 2009 ISASI Proceedings international organizationsinJuly2009. agenda items,isavailableonthewebsitewww.icao.int/aigdiv08. ◆ way foradditionalcooperationamongStates. investigation authorities to network and exchange ideas, accident paving of the members for opportunity rare a provided also it that The meeting fully achieved its Conclusion objective, and it was widely recognized Further information concerning AIG/08, including reports on all A Comparison Study of GPS Data And CDR Radar Data Using a Fully

Instrumented Flight Test 15, 2009 , SEPT. By Ryan M. Graue, Aeronautical Engineer, AvSafe, LLC, Chesterfield, Mo.; Jean H. Slane, Senior Consultant, Y Engineering Systems Inc., Colorado Springs, Colo.; Dr. Robert C. Winn, Principal Engineer, Engineering Systems Inc., Colorado Springs, Colo.; W. Jeffrey Edwards, President, AvSafe, LLC, Chesterfield, Mo.; and Krista B. Kumley, Consultant, Engineering Systems Inc., Colorado Springs, Colo. TUESDA Ryan Graue is an aeronautical engineer at AvSafe, founded AvSafe, LLC, an aviation safety consulting company that pro- LLC. His work involves determining aircraft flight vides consulting services to the insurance and legal industries. Edwards paths and flight parameters using recorded radar data, has consulted on more than 350 aircraft accident cases throughout his creating simulations of aircraft accident scenarios, career. planning flight tests, and analyzing flight test data. He also has experience in the Aviation Systems Group at Krista Kumley joined Engineering Systems Inc. Garmin International where he performed development Photo (ESI) in 2007. She has a master of science degree in work on the G1000 and G900X integrated avionics suites. He was re- not forensic science and is currently working on a master sponsible for leading a program to update the G900X from a two-display available of science degree in mechanical engineering with a unit to a three-display unit with dual sensors. specialization in dynamics and controls.

Jean Slane is an aeronautical engineer specializing Photo in modeling and simulation software in the Colorado not Springs office of Engineering Systems Inc. (ESI). Her I. Introduction available consulting work has included the design and develop- Aircraft accident investigators often use radar data provided by the ment of mathematical models for a variety of commer- Federal Aviation Administration (FAA) to aid in analyzing and recon- cial, general aviation, and military aircraft simula- structing accident scenarios. However, simply analyzing the raw radar tors. Slane served as an officer in the USAF with returns usually yields unsatisfactory results due to noise and resolution duties including lead flight control engineer for the Space Shuttle project limits in the recorded data. In order to obtain results that accurately at Vandenberg Air Force Base. While a project engineer for Honeywell reflect the flight path and give an accurate time history of the flight Defense Avionics System Division, she participated in the control system parameters of the accident flight, accident investigators must smooth software design for the C-17 aircraft. the data to reduce the noise. In recent years, experts in flight path reconstruction have developed several different smoothing and Dr. Robert Winn joined Engineering Systems analysis techniques to accomplish this goal (see References 1-6). Photo Inc. (ESI) in 1994 and is now a principal and Unfortunately, most general aviation aircraft are not equipped not the director of the Colorado operations for ESI in with flight data recorders. As a result, when an accident involving a available Colorado Springs, Colo. Dr. Winn served as a pilot general aviation aircraft occurs, recorded radar data are often the and engineer in the USAF for more than 22 years only evidence investigators can use to determine the accident flight and spent more than 15 years as a university professor path and gain an understanding of the manner in which other teaching aeronautical and mechanical engineering at parameters such as airspeed, altitude, bank angle, and heading the USAF Academy and Colorado Technical University. He is a Fellow changed throughout the flight. Experts analyzing data from the of the American Institute of Aeronautics and Astronautics. Dr. Winn has same accident flight may arrive at different conclusions regarding published more than 70 technical papers, technical reports, and articles. the nature of the flight due to differences in the smoothing and analysis techniques they choose. Since no other evidence may be William Jeffrey Edwards served in the United States available, these differing conclusions may lead the experts to have Photo Navy flying A-6 Intruders aboard the USS John F. differing opinions regarding flight paths and flight dynamics. The not Kennedy and USS Forrestal. He later served as an goal of this research is to try to eliminate some of the discrepancies available aircraft accident investigator with the U.S. Naval that result from differing interpretations of radar data. Safety Center where he investigated Navy and Marine Radar data analysis involves two major aspects in the context of Corps aircraft accidents around the world. Following aircraft accident investigation: flight path reconstruction and flight retirement from the Navy in 1993, he served as an parameter reconstruction. Flight path reconstruction is important aircraft accident investigator for McDonnell Douglas Aerospace and because it tells the investigator where the aircraft was located at spe- Boeing, investigating civil and military aviation mishaps. In 1997, he cific times throughout the flight. Flight parameter reconstruction

ISASI 2009 Proceedings • 29 ISASI 2009 PROCEEDINGS 30 flight necessary the all perform to ability its for chosen was aircraft The aircraft utilized for this testing was a and data recordingequipment A. Aircraft III. Flighttest magnetic heading,andturnrate. this study were ground speed, true airspeed, bank angle, load factor, in compared parameters flight The method. calculation and level smoothing of combination each for calculated were parameters flight The methods. calculation two and smoothing of levels four The recorded radar data from each maneuver were processed using turn. autopilot and approach, instrument chandelles, turns, steep ing maneuvers were flown: straight and level, climb, descent, S-turns, with theflightdatarecorderinformation. calculation methods were applied to the radar data for comparison and levels smoothing different while control, experimental the as obtained for the same flight. Flight data recorder information served continuousrecordingdata (CDR)radarreturninformation was with multiple flight data recorders on board. A file containing FAA flown was test flight instrumented fully a goal, Tothis accomplish data. flight all of indication “true” a against techniques smoothing different compare to devised was experiment an data, radar ing interpret- and analyzing in discrepancies the minimize to order In II. Experimental setup comparisons oftheflightpathsandparameters. craft accident investigation, the flight test data analysis will include accident flight. As both of these aspects are key components of air how the aircraft performed in order to generate the radar recorded of understanding an investigator the gives it because critical also is Figure 2.Flighttestground track. radar data. Figure 1. Sample from FAA CDR data file showing test flight To model various segments of accident flight scenarios, the follow- • ISASI 2009 ISASI Proceedings Lancair IV-P. This particular - stations wereused. two these between temperatures and winds average the analysis, 0 thebefore Springfield, and Ill., Lincoln, accident reconstructions. accident. However, this is the best approximation available in most an of day the on altitude at weather actual the of approximation the recorded weather data, it is likely that the data will only give an miles apart. Because of the geographic and temporal separation of nautical 200 approximately located typically are stations The day. eters at locations across at the 0 country param- other several and temperature, direction, and speed wind O National the by recorded data weather use to is approach best the meteorologist, experienced an of assistance the Without flight. a throughout profile temperature and wind true the know will ist recorded. In addition, it is very rare that an accident reconstruction- winds being encountered; however, they could not be automatically board the test aircraft were capable of on calculating and systems displaying acquisition the data The needed. are altitude at perature tem- and winds the method, calculation or level smoothing the of quadratic. moving squares least point 13 and quadratic, moving squares least point 9 quadratic, moving squares least point 5 smoothing, no used: were smoothing of levels following The smoothing. of levels different several for matrices position of sets generate and data radar the smooth to was data test flight the analyzing in step key A B. Smoothingdata ceanic and AtmosphericandceanicAdministration. recordsagency This The flight test occurred in an area nearly equidistant from the the from equidistant nearly area an in occurred test flight The To apply the least squares moving quadratic technique, the raw raw the technique, quadratic moving squares Toleast the apply U obtained fromtheflight. central St. of west area the in flown was and hours 2 approximately lasted flight The 2. Figure in shown is test flight entire the for path flight The C. Flightpath the CDRdatafileprovidedby FAA. HighlightedinFigure istest1a data sample from and antenna the to relative angle azimuth and range, returns, radar fromtheradar data file included the times of the (TRAC Control Approach Radar Terminal (KSTL) bert Radar data were gathered from the St. of radardata B. Radar facility and description Toperform flighta parameter analysis, regardless A. Wind andtemperatureataltitude IV. Anal AP 396. enabled GarminGPSMAP396. WAAS-a and Sport, Systems Flight Chelton a GPS, GA O ofairspeeds. range awide at fly and maneuvers TC weather recording. For the flight parameterflight weatherrecording.theTC For nboard equipment included an Appareo Systems U 1000A flight data recorder with WAAS-enabled M O N) ASR-9 antenna. Information obtained issouri. ysis o., stations approximately w hours hours w approximately stations Mo., M ore than 1,300 radar returns were ode C (pressure) altitude. altitude. (pressure) C Mode UTC and 1200

ouis in east east in Louis Louis/am- TC every UTC every based on the seminal work done for NASA by Bach and Wingrove (see Reference 1). In their work, the path between smoothed points is described by a straight line—a rectilinear approach. Recog- nizing that an airplane cannot abruptly change direction at a point, a curvilinear approach was developed by Slane and Winn (see Reference 5). Table 1. Average Position Error for All Maneuvers and Smoothing Levels In the curvilinear approach, a circular flight path is defined by three consecutive smoothed points. radar data points were converted to a position matrix in a Cartesian In both methods, the path between the points does not have to be , SEPT. 15, 2009 , SEPT.

coordinate system, using nautical miles east of the radar antenna for in the horizontal plane. Y the “x” coordinates and nautical miles north of the radar antenna To determine which smoothing level and calculation method for the “y” coordinates. The altitude was used as the “z” coordinate yielded the most accurate flight parameter reconstruction, the as recorded. In this smoothing technique, a least squares quadratic flight parameters that were logged on the flight data recorders were function was fit using a specified number of points for each set of interpolated to the same times as the radar returns. Next, the errors coordinates independently with time as the independent variable. between these logged flight parameter values and the calculated TUESDA As the number of points used to determine the quadratic function flight parameter values were determined for each maneuver, yield- was increased, the amount of smoothing applied to the radar data ing a set of error values. The error sets were compared by taking increased. the mean of the absolute values of the errors. The results shown in It should be noted that many additional data smoothing tech- Table 2 below give the mean absolute error for all flight parameters niques can be found in the literature (digital filter, weighted moving for each maneuver. The errors for each maneuver are shown in average, spline, etc.). For this study, only the least squares moving the columns of the table. The rows show the method (rectilinear quadratic technique was used. or curvilinear) and smoothing level used to calculate the flight parameters. The shaded values show the calculation method and C. Flight path comparison smoothing levels that had relatively low errors for that parameter The flight paths that were recorded by the onboard data acquisition and maneuver. equipment did not always exactly match the radar returns that were These results lead to several observations. As a general rule, nearly recorded by the FAA radar facility. In order to quantify the differ- straight flight is best analyzed using high levels of smoothing, while ences in the flight paths, the straight line distance was calculated maneuvering flight is best analyzed using low levels of smoothing. between each smoothed radar return location and the position This is consistent with the earlier finding regarding the smoothing information from the flight data recorder at the same moment in time. The distances between these points were calculated, yielding a set of position errors. The average position error was calculated for each of the eight flight maneuvers using both smoothed and un- smoothed data. An assessment of the error between the onboard recorded data and the smoothed flight path points is shown in Table 1. The smoothing levels that gave the closest agreement are shaded. The results shown in Table 2 lead to the following conclusions: • For straight flight (straight and level, climb, descent, and instrument approach), high levels of smoothing generally resulted in the best agreement with the onboard recorded position data. • For maneuvering flight (S-turns, steep turns, chan- delles, and autopilot turn), little or no smoothing generally gave the closest agreement.

D. Flight parameter comparison To compare the flight parameters, each param- eter was calculated using the smoothed and un- smoothed position matrices and compared to the logged flight data. Values of ground speed, bank angle, load factor, and turn rate were compared to data from the Appareo unit, while true airspeed and magnetic heading values were compared to data from the Chelton unit. The process of calculating the flight parameters is Table 2. Flight Parameter Mean Absolute Error Results

ISASI 2009 Proceedings • 31 ISASI 2009 PROCEEDINGS In • the calculatedheadingsarequiteaccurate. In nearly straight flight where heading could be an important issue, ing that the heading changed very rapidly during these maneuvers. in heading are quite large; however, this is expected when consider For • higher becauseoferrorsinthewindprofileataltitude. needed. were calculatetrueairspeed fromground speed, thewindsaltitudeat speed. ground of calculation To the than error larger significantly and turningabruptlyateachpoint. path straight a flying airplane the than reconstruction realistic more much a creating points, between path curved a in flying airplane the considers analysis curvilinear the that fact the to due is rectilinear.This to superior is analysis curvilinear turn, For • speed islowerthanactual. ground calculated the therefore, actual; than less be to travelled toward the inside of each turn. placed Thisbeing causespoints smoothed the thein calculatedresults generally smoothing distance smoothing. no than results better yielded ing of smoothing are preferred; however, in most cases, 5 point smooth- For • was slightlymoreinerror. of ground speed using rectilinear analysis with 13 point smoothing calculation the approach, instrument the For analyses. curvilinear and rectilinear both for smoothing point 13 and 9 with obtained In • findings: levels that resulted in the best flight paths. Here are some additional 32 Table 3.FlightParameter MeanAbsoluteError Results • almost general, ISASI 2009 ISASI

S-turns, S-turns, straight every

steep steep rrors in the calculation of true airspeed were likely likely were airspeed true of calculation the in Errors for and Proceedings case, S-turns,

level, turns, turns, the

climb,

chandelles, chandelles, steep calculation

and turns,

descent,

and and of chandelles,

true autopilot autopilot

the sing high levels of of levels high Using airspeed

best

turn, turn, and

results resulted

the autopilot low

errors

levels were in -

system, which produces a return approximately 4.6 every seconds. radar data that was recorded by an airport surveillance radar (ASR) smoothing levelsandcalculationtechniquestoeachsegment. different apply and characteristics similar of segments into flight the break to reconstructionist the for prudent be would it result, a cause some portion(s) of the analysis to have significant can flight accident entire an for smoothing of level one using that errors. As different for straight and maneuveringmaneuvering. Thisflight. study showed Therefore, thatisairplane thethe which insegments bestitother andsegments straight smoothingis possible levels are studying theradardatabeforeacceptingresults. critically of importance the shows example This turns. both from turn;however, the results presented inTable include3 the errors turn is reconstructed very accurately compared to the second steep bank for angle this history maneuver is shown. Notice that the first steep turns was two onlythe missingof southerly more onethe reason, return.unknown an For In airplane. Figure 4, the calculated between points is far less than the distance actually flown by the test radarstation. With several key radar returns missing, the distance due to the airplane’s transponder antenna being shielded from the turns, several radar returns are missing. These missing returnsshown. Notice that in arethe second (more northerly) of the two steep In Figure 3, the radar data and the ground track of the airplane are facility.radar the by missed were that returns radar the at looking by found be can finding this for explanation The high. rather still curvilinearapproach, butevenso, the calculated bankangle was or rectilinear the either with smoothing point 5 be to determined It shouldIt notedbethat theabove results wereobtained using someessentially of composed are paths flight accident Many To determine bank angle for steep turns, the best approach was so it may be appropriate to break the flight into into flight the break to appropriate be may it so maneuvering, is airplane the which in segments other and straightessentially are which ments seg- of composed are paths flight accident many flight. maneuvering for approach provided slightly better results than the rectilinear approach curvilinear the general, in that, found also was maneuveringIt flight. smoothing)for zero not (but smoothing minimal and flight straight nearly for smoothing of level high a use accuracy ofthewindprofilethatwasused. calculation of true airspeed and headingtatively wasevaluated. in the The largest sourcetion techniques and smoothing levels ofwere quanti- error in the and flight parameters of the test flight, the calcula- data were “true” representations of the flight path methodfor each maneuver. calculation Assuming best that and those smoothing of level optimal proved to be a valuableairplane test the toolboard toon recordedhelp data determineThe the V. Conclusions from ARTCC radarreturns. parameters flight and paths flight reconstructing when vary may Results seconds. 12 every mately approxi- return a frequency,producing and tion Traffic Control Center (ARTCC), has lower resolu- E nroute radar, which is recorded by an Air Route The results showed that, in general, it is best to Unfortunately, , SEPT. 15, 2009 , SEPT. Y

Figure 3. Ground track during steep turns. Figure 4. Calculated and measured bank angle during steep turns. TUESDA segments and use different smoothing levels in each segment. International Council of the Aeronautical Sciences, Melbourne, Australia, It is likely that some returns will be missing from a set of radar Paper No. ICAS-98-6,5,3, September 1998. 3. Slane, J.H., and Winn, R.C., “Accurate Flight Parameter Reconstruction from data, and those missing returns may result in calculations that have Smoothed ATC Radar Data,” Proceedings of the Annual Meeting of the Inter- significant errors. The solution to this problem will likely vary with national Society of Air Safety Investigators, Boston, Mass., August 1999. the unique aspects of each analysis; however, it is a bsolutely essential 4. Slane, J.H., and Winn, R.C., “Accurate Flight Parameter Reconstruction from ATC Radar Data–A New Approach,” Proceedings of the World Aviation Con- to use valid engineering judgment in assessing the significance of gress, San Francisco, Calif., SAE Paper No. WAC 99-61, October 1999. any missing returns. ◆ 5. Winn, R.C., and Slane, J.H., “A Curvilinear Approach to Flight Path Reconstruc- tion from Recorded Radar Data,” AIAA Paper 2001-0411, Aerospace Sciences References Meeting, Reno, Nev., January 2001. 1. Bach, R E., Jr., and Wingrove, R.C., “Equations for Determining Aircraft Mo- 6. Winn, R.C., Slane, J.H., and Morris, S.L., “Assessment of the Accuracy of tions from Accident Data,” NASA TM-78609, June 1980. Flight Path Reconstruction from ATC Radar Data Using Various Smoothing 2. Orloff, K.L., and Bruno, A.E., “An Improved Technique for Flight Path and and Reconstruction Techniques,” AIAA Paper 2002-0391, Aerospace Sciences Groundspeed Analysis Using Recorded Radar Data,” 21st Congress of the Meeting, Reno, Nev., January 2002.

ISASI 2009 Proceedings • 33 ISASI 2009 PROCEEDINGS the B the years, 2 than more For environment. GA the for recently available though low-cost audio, parameter and video recorders have become not fallendespiteinnovationsrelatedtotechnologicalevolutions. and the tion, and leisure activities. especially through flight data monitoring, instruction, flight simula- recorders, flight lightweight of use widespread more by improved under 5.7tonswillreferencethesespecifications. recorder systems. Any future regulations applicable to small aircraft countries which has now defined specifications for lightweight flight 34 BEA, BFU,and CAA) Figure 1.Numberof accidentsduringthelast10years.(Source: GAMA). EASA) and nearly three times as many in the in active are tons 5.7 under aircraft 79,000 Almost 2. Statistics Statistics on general aviation (GA)1. Introduction during the last 10 years in WG-77 thatpublishedED-155. andthechairmanofEUROCAE WG-50(ED-112), EUROCAE and French representative on the OACI /FLIRECP, the chairman of the At present, data are often insufficient during investigations, even Thispaper willshow howaccident prevention couldGAin be • Lightweight FlightRecorders for GA ISASI 2009 ISASI E A has chairedhasworkingA a specialists group120of from12 United States indicate that the number of fatal accidents has nquêtes and d’Analyses pour the sécurité By PhilippePlantindeHugues,Ph.D.,Bureaud’Enquêtesandd’Analysespourthesécurité Proceedings volving France sincethen.Hehasbeenthechairman pated inallthemajorinternationalinvestigations- 1993 tooverseeacousticanalysis.Hehaspartici- then joinedtheBEAEngineeringDepartmentin one yearattheNASAAmesResearch Centerand Ph.D. influidmechanics1991.In1992hespent Philippe PlantinofHugues was awarded his Safety Strides Foreseen with of l’aviationcivile,HeadFlightRecordersandAvionic SystemsDivision United States (source urope (source (source Europe E urope has happenedintheUnitedStates. have stabilized at around 100 a year. The same regrettable stagnation fatal accidents, in the last 10 years. It is noticeable that fatal accidents (FD safety can be achieved by using recorders aviation. The more for proactive manufacturers consider flight that improved data monitoring general at aimed recorders flight produce that France, in five ing the BEAonlightweightflightrecorders,detailsofwhichfollow. the of creation the to led approach bringthegreatest understanding theofcauses accidents.of This parameterswould bethemost relevant which for out recordings find to ufacturers thatman could and pilots by 2005 and 2004 in approached was BEA The recorders. flight lightweight low-cost, of The aeronautical industry has taken proactive steps in the production 3. Equipmentavailableonthemarket defined as“modern”thepercentageofaccidentswasnolower. nology of the airplanes. It was, however, apparent that for airplanes possible to distinguish the accidents in relation to the age or the tech- from the three tion. In order to present validated data, only the annual databasesa result of different procedures used for entering database informa- by • turers saythatittakesoneortwo man-daystoinstallthem. from • sensors, GPSpositioningoraccelerometers. inastand-alonemannerwhen therecorderitselfhasgyroscopic • technology andtheobjective: This data can be acquired in several ways according to the airplane’s etc. temperatures, pressure, altitude acceleration, speed, position, ready flying in France. They can record a wide range of data: attitude, al- are units hundred several and grams, hundred few a just weigh sufficient todeterminethecausesofaccidents. always not are data the Nevertheless, elaborated. be to trajectories very effective software. This expertise has, for example, allowed 3-D some developed BEA’shas the computers, laboratory damaged in cards electronic from data Todownload GPS. a from as such ers, comput- onboard from out read be can that those are bodies tive established withanycertainty(causesprobableorunknown). the 126 fatal accidents recorded (84 fatalities), the causes were not of half for that shows micro-lights) gliders, helicopters, (airplanes, B theby more recent aircraft. more recentaircraft. The graph of fatal accidents in The graph (Figure 1) shows the number of accidents, including There are more than 20 manufacturers around the world, includ- As regardsAs France, theanalysis theof In the majority of events, the only usable flight data for investiga- M recovering ), maintenance, or even flight management. These recorders the E A betweenaircraft2007Afor2003and under tones 5.7 installation European countries mentioned were used. It wasn’t all the of data sensors passing dedicated E urope was not easy to develop as working group by by group working EUROCAE through E CCAIRSdatabase used to recording. the bus

installed Manufac- on

150/200 feet, followed by a turn on a 300° heading with a low rate of bank. • The airplane continued more or less in level flight at the same height without giving the impression of gaining speed. • The loss of control occurred with a sharp roll to the right, associ- ated with a high nose-down attitude. The spectral analysis of the audio recording on the video tape made it possible to deduce the following: • the engine RPM. • the frequency of the wheel (38 centimeters diameter) rotation , SEPT. 15, 2009 , SEPT.

during, the run and thus a precise figure for the airplane takeoff Y run speed. In addition, the following elements were recorded without any specific signal treatment: • the warnings. • speech of those on board. TUESDA Thus, based on these elements, the history of the flight could be Figure 2 established precisely and can be listed as follows: • Start of takeoff run at T=0. These data can be completed by image and sound recordings, • The takeoff occurred at T + 28 seconds. which can represent less expensive solutions in the context of an • At T + 60 seconds, the engine RPM dropped and stabilized at aircraft retrofit. In fact, the analysis of images makes it possible to 2,220 RPM. capture all the information provided to pilots via the airplane’s • At T + 66.5 seconds, the airplane slowly began to roll and lost instrument panel. altitude. Some manufacturers even offer image analysis (Figure 2) that • At T + 67 seconds, the stall warning sounded. makes possible the automatic extraction of parameters linked to • At T + 69 seconds, the stall warning sounded again and continued the instruments with which the image is recorded. These recordings until the impact with the ground. The airplane had about a 30° can capture the airplane parameters as well as the atmosphere in bank to the right, 10° nose down, and lost altitude. The airplane the cockpit and some types of human behavior that can be crucial was diving at a very steep rate with a roll angle. to the understanding of accidents. • At T + 75 seconds, the airplane struck the ground. Wreckage examination showed a heavy airplane that was balanced 4. Example of an investigation using an to the aft, with the flaps in the landing position. Fortunately, analysis audio and video recording of the video and audio recordings also made it possible to determine On Jan. 6, 2003, at Chambéry Challes the Eaux (France), shortly with certainty that with a degraded aerodynamic wing profile, the after take off the DR400 registered F-GGJR with two persons on plane had stalled after a slight reduction in thrust. board stalled and crashed into a hangar 800 meters from the end of Runway 33. The passenger had a video camera and filmed the 5. The regulations flight from takeoff until impact (Figure 3). Since 2006, the ICAO FLIRECP (FLIght RECorder Panel) has The camera tape was not badly damaged during the accident, and worked on improving the flight recorders section of Annex 6. In the analysis of the video recording revealed the following: final meetings, it was decided to propose fitting lightweight flight • Start-up was difficult, recorders to airplanes under 5.7 tons. then the pilot started the These propositions were developed using cost-benefit analysis, takeoff run. with an evaluation of the safety benefits implying an underlying value • The run lasted about to human life. This led to comparing the implementation cost with 72 seconds over a dis- the benefits that could accrue in terms of reductions in accidents, tance of 600 meters. in damage, and deaths avoided rather than in simple economic • The pilot was holding terms. The new proposition for Annex 6 was sent for consultation a mobile phone in his to States in July 2009. This document will refer to the EUROCAE hand from time to time ED-155 document described later in this paper. during the takeoff run. At the same time, thanks to recommendations issued by the AAIB, • The takeoff run speed Figure 3 EASA carried out in 2008 a study entitled “Investigation of the Tech- of the airplane was de- nical Feasibility and Safety Benefit of aL ight Airplane Operational duced from the visual passage of the white lines (20 meters long Flight Data Monitoring (FDM) System.” Experience gained during and 20 meters between them). many years has shown that FDM can make a continuing improve- • The value of some parameters shown on the airplane instru- ment in the standard of everyday airplane operations. ments. The overall aim of this study was to demonstrate the capability of a • The right wing leading edge had an irregular distortion that could low-cost flight data monitoring (FDM) system for single engine light be attributed to an ice deposit. airplanes. The predetermined goal was that the budget of less than • After takeoff, the airplane leveled off, then climbed toward about 5,000 per installed system and 2 per flight hour direct operating costs

ISASI 2009 Proceedings • 35 ISASI 2009 PROCEEDINGS the • sors, digitalsources(regularinstrumentation),images,andaudio. different • tems (SMSs)canimprovethesafetyoflightairplaneaviation. 36 of theinvestigationanoccurrence(accidentorincident). messages in a crash-survivable recording medium forers the thatpurposes may record flight data, cockpitbe met for audio,small aircraft required images,to carry lightweight flight and record- data-link mance Specification) equipment andapplicationsformorethan45years. standards used in the certification of avionics and approval of ATM and use at and guidance documents for civil aviation equipment, for adoption principally directed to the preparation of performance specifications M non-profit international an is EUROCAE 6. EUROCAEDocumentED-155 it • sensors sothatmaneuverscouldbeindentifiedclearly. flight • shouldnotbeexceeded. for postflightdataanalysisservices ministrations, and non- ad- aviation civil national associations, trade aeronautics, for ment as flight data, audio, image, and datalink recording. as flightdata,audio,image,anddatalinkrecording. such functions specific for sections separate and survivability,etc., The worldwide. associations manufacturer,and bodies, regulatory authorities, investigation from coming members 120 than more with WG-77 for • objectives, someofwhichfalloutsidethescopeanyregulation. specifications to be referenced by a regulatory authority, it has four in • data storage. less than 5,000€ compared • TBO elongation). or training and maintenance (e.g., tasks multiple for used be can when • referenced. recognized the specifications, the of velopment priate parameters to be known for the analysis of flights, dedicated for • standard. conformitywith airplane or a helicopter with a lightweight recorder, the recorder’s ous typesofaircraft. to see the real benefit for the FDM on 1,000 hours of flight for- vari facilitate theuseofaFDMdrastically. will systems digital only with airplane modern a required), sensors broad • useracceptanceisanessentialnecessityforapurposefulFDM. • must beprecluded. embership embership is open to manufacturers and users in This document was produced by the The The conclusionofthestudyisthat E We hopetodevelop asinglestandardmeetingtheseobjectives In the continuity of this study, another study has been launched • ven if the primary objective of this document is to provideto documentisthis objectiveprimary of the if ven

is all the ISASI 2009 ISASI flight the possible EUROCAE Document

cases, data a user manufacturer, European and worldwide levels. certification pilot, types trials

monitoring

to acceptance potentially to and 2€

a PS has a common section for crash and fire fire and crash for section common a has MOPS a of Proceedings showed E

provide retrofit company, D-155 will ensure adherence to a recognizeda adherenceensureto willD-155 data D-155 ED-155 defines theminimum specification to /hour DOC without the use of a crash proof E

ED-155 must authorities, uropean organizations. Its work program is

(FDM) reasonable unauthorized would

the system be or MOPS (Minimum desired

will, taken an be as

for part for greatly aero results who

into older systems example, EUROCAE Working Group

of misuse EUROCAE has produced club participated uropean organization. organization. European Safety account: improved with

airplanes for wishes

by

allow the Operation Perfor Management E

a policing D-155 will be be will ED-155 urope urope of - equip additional target use all if

to (additional the in

of the equip low-cost price the

parties system - appro sen- Sys- de- an of -

precise • thresholds areexceeded, ih otae associ- software with flight training the of simple • briefing including de- a with flight a after returning students his help couldinstructor the clubs aero of text perspective, in the con- pedagogical a From for training The advantages premiums. drop • and ministrative structure, ad- and management simplification • flying hours, systematic • optimizemainten­ • optimize potential, optimizemaintenancecosts, • It isessentialtoshowhowarecorderwillallowcompany The advantagesforbusinesses a recorder (Figure 4). them involved so that they become of aware of each the get benefits of to carrying need we companies, small and clubs, associations, pilots, inform to seek we If aviation. general of world the in actors flight simulation, and leisure activities. There are a large number of instruction, monitoring, data flight through especially framework amandatory outside even recorders, flight lightweight of use Accident prevention in GA could be improved by more widespread 7. The advantages in terms of aviation safety a • requirement. they areinstalledwithoutaregulatory This document must be an aid to development of recorders, even if to investigations into accidents, as well as defining image resolution. key aviationstandardsbodiessuchasEUROCAEandRTCA. ICAO standards lead to a greater reliance on closer relationships with in contained detail of level the reduce to desire a and issues, funding ingly important global level, changes in the ICAO processes, including become obvious for general aviation safety investigations. At the increas- cockpit audiorecordingsystems(CARS). a on pilots the of voices the capture to quality audio the (AIRS), ontheinstrument panel ofanairborne image recording systems instruments the capture to needed resolution image the FDM, for useful those investigation, an for useful (ADRS) systems cording recorders willfall. of cost unit the and improved be will safety installation, recorders that isusefultotheunderstandingofcausesaccidents. The need to define specifications for lightweight recorders has recorders for lightweight specifications define to need The re- data aircraft an in parameters the lists also document The lightweight in increase the with achieved are goals four these If type ED-155 in

simulation billing insurance flight recorder

analysis, of of ance ofonboardequipment,

Figure 4 Figure 5 will with provide automatic investigators detection with where information safety

ated with the recorders, loadable memory could potentially provide an excellent additional • the visualization of flight trajectories overlaid on an aeronautical product to customers, as well as being very useful in case of an or satellite chart, investigation. • the visualization of flight parameters, First flights, leisure flights, and instruction flights can all benefit • the study of the students gestures, and from advances in technology that would be, in parallel, a vital tool • much more as can be imagined by instructors. for any investigation. The software associated with recorders permits downloading and easy reuse of recorded data. These new tools are The advantages for leisure flights thus usable by all pilots. From a leisure perspective, a private pilot might wish to show his fam- Some lightweight flight recorder manufacturers have been able ily and friends the places that he has flown over. The image recorder to reach agreements with insurers that reduce insurance premiums, , SEPT. 15, 2009 , SEPT.

would allow him to do which could mean the initial investment being offset in a few short Y this with a presenta- years. tion of an outside view from within the cabin 8. Conclusion interior. However, the A new approach must be adopted to highlight the advantages of presence of the instru- new data recording systems to all those who operate or use small TUESDA ment panel would be planes or helicopters. Associations and aero clubs all over the world vital for any technical are the core public to be addressed in this approach. investigation. Over and above its use as a final record to be analyzed by inves- During first flights, tigators, the recording of a flight could be viewed as a source for an image recorder optimizing the management of a fleet, for improving pilot training, Figure 6 with an easily down- or as a teaching tool for an instructor. ◆

ISASI 2009 Proceedings • 37 ISASI 2009 PROCEEDINGS Aviation Association. Aviation Association. 2008, hewasawarded theJohnK.LauberSafetyAward bytheUniversity InOctober the trainingof1,000flightstudentsand180instructors. of 65aircraft, conductsanaverageof300flightsperday, andsafelymanages Daytona Beach,whichfliesmore than75,000hoursperyear, operatesafleet Air Force Academy. Zwegers is responexaminer, andtrainingmanager. He waschiefofflightstandards attheU.S. employment atERAU,Zwegershasheldpositionsasaflightinstructor, pilot airplane,andCFI,CFII,MEI.Duringhis11yearsof instrument withSEL,MEL, NAFI masterCFI,andholdsacommercial pilotcertificate his MSinaeronautics. Hegraduatedfrom theNTSBTraining Center, isa 38 accident investigations and prevention at a very low cost and ease of via the Internet. This information can be recorded and utilized for to be displayed in real time, on personal computers on the ground centers inrealtime. control traffic air to information additional and aircraft’sposition ground or satellite communications transceivers that then relay the ADS-B to and aircraft capable ADS-B other to broadcast taneously simul- then is information number.This registration and altitude heading, speed, as such discretes, vehicle) other any (or aircraft of number any with position that combine then constellation GNSS (GPS, Galileo, etc.) receiver to derive its precise position mechanical of antennas. fromADS-B reliability thecapable or aircraft use speed an ordinary GNSS rotational the on depend not do intervals update and altitude, target or conditions, atmospheric range, with in remoteareasoftheworld. information weather and traffic provide to method cost-effective very a is It components. fundamental its as link communications satellite System (GNSS) technology and a relatively simple broadcast Surveillance Broadcast (ADS-B) uses conventional global navigation Dependent Automatic accident. an to leading events of standing technologies allow investigators an unprecedented view and under Current hand. in hand go prevention and investigation Accident Abstract ADS-B software applications allow traffic and weather information Also,unlikeradar, ADS-Baccuracy doesseriouslynot degrade • By DavidZwegers,DirectorofAviation Safety, AeronauticalUniversity, Embry-Riddle DaytonaBeach,Fla., USA ISASI 2009 ISASI Investigation and Prevention, an Investigation andPrevention, an aeronautical science and is in the process of completing aeronautical scienceandisintheprocess ofcompleting time.Hegraduatedfrominstructor ERAUwithaBSin hours offlighttimewithalmost3,000 father oftwohasflownmore than3,500accident-free Born in the Netherlands and raisedRiddle in Spain,Aeronautical this married University’s David Zwegersisthedirector ofaviationsafetyatEmbry- Daytona Beach campus. Proceedings Embry-Riddle Aeronautical Using ADS-B for Accident University Perspective ­sible for the safety program at ERAU in - visual aidsandpracticalapplications. years, and future initiatives. Specific examples will be presented with E on focus will operator,presentation each this to customized easily level ofsafetyintheairandonground. worldwide, the advances of hardware and software will bring a new risk offlighttraininginasaturatedenvironment. enhancingoverall pilot situational awareness and minimizing the ing aircraft since 2003, which has proven to be an invaluable tool in tions, providingavaluableamountofinformation. Some software applications can also record ATC radio communica- use. It could be viewed as a variation of FOQA for general aviation. system then converts the position into a digital code, which is com - terminean aircraft’s precise location in space (see Figure de- to system positioning global satellite-based the on relies ADS-B A). The How doesitwork? descending. or climbing, turning, is aircraft the whether and altitude, speed, air including data, other with along datalink digital a via space terrain andgraphicaltextweatherinformation(FIS-B). data toanyaircraftorgroundstationequippedreceiveADS-B. B like radar. S data.. D A with muchmoreprecisionthanhasbeenpossiblebefore. air traffic controllers on the ground to “see” aircraft traffic (TIS-B) and cockpit the in pilots allows that technology new Broadcast—a Surveillance- Dependent Automatic for acronym the is ADS-B What isADS-B? where radarcoverageislimited. or coverage, radar no is there which in terrain mountainous in or taxiways and runways of an airport. It’s also effective in remote areas the on traffic monitor to used be also can it that so ground the on —It provides “radar like” surveillance services, much much services, surveillance like” “radar provides —It urveillance RA utomatic—It’s alwaysONandrequiresnooperatorintervention. —It continuously broadcasts aircraft position and position aircraft broadcasts continuously roadcast—It —It depends on an accurate GNSS signal for position position for signal GNSS accurate an on depends ependent—It Becausepossibilitiesthe ADS-Boftechnology endlessare and industry and agencies aviation by implemented is ADS-B As ERAU has had ADS-B installed on its fleet of more than 100 train- U in position precise their broadcast aircraft ADS-B-equipped Another important feature of ADS-B is that it provides crews with nlike conventionalnlikealtitudeslowand radar, atworksADS-B U ’s past and current applications of ADS-B technology over the

other other - , SEPT. 15, 2009 , SEPT. Y TUESDA

Figure A Figure C

Figure B bined with other information such as the type of aircraft, its speed, Figure D its flight number, and whether it’s turning, climbing, or descend- ing. The digital code, containing all of this information, is updated pilots on board. TCAS systems are impractical for small GA due to several times a second and broadcast from the aircraft on a discrete their size and prohibitive cost. frequency called a datalink. This information is then displayed in At a cost of about $20,000 per aircraft installed, ERAU has ADS-B the cockpit on a multi-function display (MFD) (see Figures B and on its entire fleet of 100 training aircraft at both the Daytona Beach, C). It is more accurate and precise than traditional radar. Fla., and Prescott, Ariz., campuses since 2003. Other aircraft and ground stations within about 150 miles receive ADS-B has dramatically decreased the risk of mid-air collisions for the datalink broadcasts and display the information in user-friendly ERAU in very congested airspace and has, without a doubt, saved format on a computer screen. ERAU uses software developed by Johns lives by Hopkins University called CRABS (Comprehensive Real-time Analysis • providing pilots real-time traffic information and a much greater of Broadcasting Systems) (see Figure D). ERAU is currently working margin in which to implement conflict detection and resolution, on developing its own customized and enhanced version called SO- especially important below radar coverage (low altitudes and ground FIA (Surveillance and Operations of Flight and Interactive Analysis), operations) avoiding mid-air collisions and runway incursions. which will also provide live ATC audio and links to operations software • providing pilots graphical and textual weather information. (maintenance, scheduling, etc.) among other features. • providing operators real-time information of aircraft location for planning purposes (spreading-out aircraft to minimize congestion) Why ERAU? and flight following (tracking). During the past 20 years, the threat of a mid-air collision occurring • recording all data that can be used by the operator to increase on a commercial flight has been virtually non-existent, primarily safety and efficiency practices (accident/incident investigation, study due to the implementation of TCAS. General aviation accounts for pattern flows in/out of airspace, address noise complaints, etc). It almost all mid-air collisions, and many of them happen with student has taken the guesswork out of the preexisting conditions.

ISASI 2009 Proceedings • 39 ISASI 2009 PROCEEDINGS regardless ofthelocationaircraftwreckage. ally, the data are safely collected on the ground and always accessible, without the need of any additional equipment installation. Addition- 40 substantially damaged. were no injuries reported to the private-rated pilot, but N462ER was flight plan was filed for the 14 CFR Part 91 instructionalRunway 16/34and7R. flights. There of intersection the of corner northeast the at rest to came aircraft aircraft the bounced 10, multiple ascheduled times of and the propeller out struck landing first the runway. her attempting The RunwayingapproximatelyAt7R. us- 2137 KDAB, at operations pattern closed conducting was student O Case #1.N462ERMay2007.Hard landing. Examples ofpracticalapplications Figure 2 Figure 1 n the night of night the n ADS-B software also serves as a variant of a flight data recorder, data flight a of variant a as serves also software ADS-B NTSB probable cause: Pilot’s improper flare at night. Contribut- no and time the at prevailed conditions meteorological Visual • ISASI 2009 ISASI Proceedings M ay 4, 2007, at approximately2100at 2007, 4, ay E DT,whilepilotthe was E DT,the Figure 3 Figure 5 Figure 4 , SEPT. 15, 2009 , SEPT. Y TUESDA

Figure 6 Figure 8

cedures at KDAB to reduce the risks of traffic pattern saturation. Specific transponder codes for non-ADS-B-equipped aircraft will allow transponders to remain in ALT mode, therefore making them “visible” to ADS-B.

Case #3. Recreation of flight path leading to fatal GA accidents. Twin Commander May 2009. A Twin commander departs KDAB on VFR conditions and declares emergency shortly after takeoff. Aircraft crashes minutes later just short of the runway with one fatality and one injured. CRABS assisted investigators in determin- ing probable cause. SR-20 February 2009. During a training flight that originated in KSFB, a Cirrus SR-20 impacts the ground fatally injuring both occu- pants. The aircraft is located the next day in a wooded area with the parachute deployed. CRABS aided investigators in reconstructing the profile of the flight.

Figure 7 Case #4. Noise complaints and airspace violations. ing factor was a lack of recent night experience. ADS-B assists ERAU in the enforcement of noise abatement agree- RABS data were extensively used during the investigation and a ments and also protects pilots and operators against false identifica- key factor in determining errors at the organizational and supervi- tion or unjust noise complaints. sory levels. Several changes were implemented to eliminate future reoccurrence, like improved communications among instructors CASE #5. Flight following and overdue aircraft response. and staff, changes to training syllabi with emphasis on transition The value of flight training is enhanced by the ability to debrief the courses and visual illusions and airport/runway familiarity, changes conduct of a flight more accurately. Dual and solo flights can be to standard operating procedures with emphasis on stabilized ap- monitored by fight operations for additional safety and improved proaches, etc. All 13 recommendations implemented by EFB were communications. adopted by the Flight Department. This level of situational awareness on the ground allows flight operators to prevent or reduce airport surface and airspace satura- Case #2. 712ER and 496ER August 2008. High wing vs. low wing. tion, adapt dispatching limitations to current conditions, and many During busy closed traffic operations in daylight VFR, a Cessna 172 more efficiency measures. is climbing on upwind and a Piper PA28-R is at pattern altitude Overdue aircraft response is mostly limited to positively identifying turning downwind when a blocked transmission from ATC causes overdue aircraft on the computer followed establishing communica- confusion, and separation is compromised. ADS-B alerted the tions with crew. Many cases are just due to ATC delay vectors. pilots on both aircraft of the conflict. This increased situational awareness was used for the initial avoidance maneuver as both Future of ADS-B aircraft did not have visual contact due the inherent restrictions With the advent of NexGen and other technologies, ADS-B will in their design. CRABS data contribute to implementation of pro- be an essential tool in aviation for decades to come. Software and

ISASI 2009 Proceedings • 41 ISASI 2009 PROCEEDINGS 42 of level new a operators and controllers, pilots, gives ADS-B Conclusion especially ingeneralaviation. awareness at their fingertips that is affordable and comprehensive, situational of level a air.have the will in Pilots and ground the on management traffic air reliable and efficient more and safer lows al- that technology a from benefit soon will industry aviation The nationwide. volumes service ADS-B of implementation the in ITT end of radar. more accessible and its use more commonhardware engineering will worldwide,advance rapidly, making this signalingsystem even the • ISASI 2009 ISASI E mbry-Riddle is actively participating with the FAA and Proceedings large aircraftandoperatorsanymore.◆ to limited not event, an to lead that steps the understand you an unprecedented look into the history of a flight to better help guesswork out of it, and reducing hindsight bias. You now have picture of the events leading to an accident, taking much of the data can be a valuable investigative tool and give a much better In combination with ATC audio recording, recording of ADS-B tion. ADS-B is accurate, reliable, comprehensive, and interactive. rapidly and becoming more available and viable for general avia- the most remote areas. ADS-B hardware and software is evolving in even unavailable previously information weather and traffic situational awareness. Since its inception, it has given crews vital Human Error Prevention: Using the Human Error Template

To Analyze Errors in a Large 2009 16, SEPT. , Transport Aircraft for Human Y Factors Considerations By Wen-Chin Li, Topic Presenter, Head of Graduate School of Psychology, National Defense University, Taiwan; Don Harris, Director of Flight Deck Design and Aviation Safety Group in Human Factors Department, Cranfield University, United Kingdom; Neville A. Stanton, Chair in the Human Factors of Transport, School of Civil WEDNESDA Engineering and the Environment, University of Southampton, United Kingdom; Yueh-Ling Hsu, Professor in the Department of Air Transportation, Kainan University, Taiwan; Danny Chang, Head of Training Division, China Airlines, Taiwan; Thomas Wang, Director of Flight Safety Division, Aviation Safety Council, Taiwan; Hong-Tsu Young, Managing Director of the Executive Yuan, Aviation Safety Council, Taiwan

Wen Chin Li “Topic Presenter,” Head of Graduate Key Words: Aviation safety, human errors, hierarchical task analysis, School of Psychology, National Defense University, human error template Taiwan. (photos and biographical information of other authors not available.) Introduction For the past half century, there has been a steady decline in the com- Abstract mercial aircraft accident rate. Nevertheless during the last decade Flight crews make positive contributions to the or so the serious accident rate has remained relatively constant at safety of aviation operations. Pilots have to assess continuously chang- approximately one per million departures (Boeing, 2008). While ing situations, evaluate potential risks, and make quick decisions. high levels of automation in third-generation airliners have un- However, even well-trained and experienced pilots make errors. doubtedly contributed considerable advances in safety over earlier Accident investigations have identified that pilots’ performance jet transport aircraft, new types of error have emerged on these is influenced significantly by the design of the flightdeck interface. flight decks (Woods and Sarter, 1998). These types of accident are This research applies hierarchical task analysis (HTA) and utilizes the exemplified in crashes such as the Nagoya Airbus A300-600 (in Human Error Template (HET) taxonomy to collect error data from which the pilots could not disengage the go-around mode after its pilots during flight operations when performing a go-around in a inadvertent activation; this was as a result of a combination of lack of large commercial transport aircraft. HET was originally developed in understanding of the automation and poor design of the operating response to a requirement for formal methods to assess compliance logic in the autoland system); the Cali Boeing 757 accident (in which with the new human factors certification rule for large civil aircraft the poor interface on the flight management computer and a lack introduced to reduce the incidence of design-induced error on the of logic checking resulted in a CFIT accident); and the Strasbourg flight deck (EASA Certification Specification 25.1302). The HET A320 accident (in which the crew inadvertently set an excessive rate taxonomy was applied to each bottom-level task step in an HTA of of descent instead of manipulating the flight path angle as a result the flight task in question. of both functions utilizing a common control interface and an as- A total of 67 pilots participated in this research including 12 sociated poor display). Human error is now the principal threat to instructor pilots, 18 ground training instructor, and 37 pilots. flight safety. In a worldwide survey of causal factors in commercial Initial results found that participants identified 17 operational aviation accidents, in 88% of cases the crew was identified as a causal steps with between two and eight different operational errors factor; in 76% of instances, the crew was implicated as the primary being identified in each step by answering questions based causal factor (CAA, 1998). either on his/her own experience or their knowledge of the The skills now required to fly a large commercial aircraft have same mistakes made previously by others. Sixty-five different changed considerably during the past three decades, mostly as a errors were identified. direct result of advances in control and display design and the tech- The data gathered from this research will help to improve safety nology of automation. The pilot of a modern commercial aircraft is when performing a go-around by identifying potential errors on a now a manager of the flight crew and of complex, highly automated step-by-step basis and allowing early remedial actions in procedures aircraft systems. The correct application of complex procedures and crew coordination to be made. to manage activities on the flight deck is now an essential part of

ISASI 2009 Proceedings • 43 ISASI 2009 PROCEEDINGS 44 theprobability that oneofthem will beomitted orrepeated; the served that the larger the ob- number of (1988) steps in Reason a example, procedure, the For greater years. the over developed been are majorfactorscausingaccidents (FAA, 1996). display layout, and unsuitable standard operating procedures (SOPs) has suggested that inappropriate system design, incompatible cockpit portunities for error). Analysisflexible, are also potentially more error prone (there are far more op- of aircraft accidentprocedures. investigationComplex flightdeck interfaces,reports while flightdeckpotentially interfaces cannot be separated from themore aircraft’s operating addressed one component of the wider problem.error are often many and interrelated, the new regulations have only The design of the human factors viewpoint, which assumes that the root causes of human factors the inappropriate implementation of procedures, etc. From a such from resulting errors consider cannot It design. interface poor new regulation can only minimize the likelihood of error as a result of design can only address manythe aspectsfabric of pilotof the error airframeat source.“good” and However, humanits factors suchsystems rules on thesorelating for requirement regulatory specific a is there time flightfirst the thefor that is to deck. It is an attempt to eradicate ceptable MeansofCompliance)25.1302. (Ac- AMC in material advisory supporting with and 25.1302 (CS) Specification Certification as Agency) Safety Aviation (European material developed from ARAC tasking have been adopted by advisory and rules 2007, September D OT,Since (U.S. 1999). ror” er crew flight of recovery) and tolerance (detection, prevention address design-related flight crew performance vulnerabilitiesor advisory material should be andupdated or developed to consistently and make recommendations about what regulatory standards and/ FAR/JAR25 in material existing the “review to FAAadministrator Committee (ARAC) to provide Advisory Rulemaking adviceAviation the to task a assigned subsequently and recommendations to the flightdeck systems. The in FMS interfaces and conventions, and poor compatibility between unclear display symbology and nomenclature; a lack of consistency and confusing awareness; position/terrain awareness; energy tion; awareness/indica- mode autoflight pilots’ as such problems fying identi- interfaces, deck flight the of criticisms were There process. design the in shortcomings and deficiencies design major several pilot-aircraft interface on modern flight decks (FAA, 1996) identified Federal Aviation Administration (FAA) commissioned study of the A airliners. fourth-generation and third- automated highly the in particularly authorities, airworthiness the to concern particular the operatingenvironment. actions, the aircraft flight deck, the procedures to be employed, and and almost always involve a varied complex and many are interaction error of causes The oversimplification. amongan is the pilot’s alone failure system or error human of question The operations. aircraft with associated system socio-technical surrounding the in “error”notionthethattasksofrootstoolsitselfandandits has systematicallyerrorsare pilot’s connected that featuresmanya toof proposed (2001) Dekker explanation. an of beginning the merely is it explanation; an not is It little. very says itself in “error” of diagnosis a accidents, aircraft in factor contributory major the highly procedurallydriven.Whilepiloterroriswithoutdoubtnow safety.flight ensuring Withregard tochecklists andprocedures, various axioms have regulation this establishment the of significance true the Perhaps of become has error induced” “design decade last the During • ISASI 2009 ISASI Proceedings ost aspects of flight management are now now are management flight of aspects Most U.S. Department of Transportation (DOT) ASA EASA - specifically fortheaerospace environment. from a number of HEI methods but has been adapted and extended comprehensiveasit is based largely onexisting error taxonomies nient method to apply in a fieldconve- a be study.to designed also is it and Thetraining, little errorvery requiring taxonomy used is use, and learn to simple be to proven been has method HET The aircraft. commercial automated highly modern, a in task landing predicted errors to actual errors reported during an approach and 1988) and outperformed all of themWhalley, 1988; inand HEIST—Human a validation study comparingEmbry, 1986; Human Human Systematic (SHERPA—techniques existing three against benchmarked been Marshall, Demagalski, Young, Waldmann and Dekker, 2009). It has Harris, Salmon, Stanton, 2006; Waldmann, and Dekker,Young, Demagalski, Salmon, Harris, Stanton, (see methodology flight decks. HET has been demonstrated to be a reliable and valid man factors issues in the design and certification process of aircraft errors, and as a formal method to demonstrate the inclusion of hu- tool intended as an aid for the early identification of design-induced diagnostic a as developed was It quantification. their not methods, formal using errors potential of identification the for specifically developed was HET result, a As possible. not was error crew of ity probabil- the of estimation quantitative reliable the that suggested the aircraft flight deck. Advisory Circular AC25.1309-1A (FAA, 1988) tification (HEI)techniquedesignedspecificallyforapplicationon Demagalski, Waldmann, and Dekker (2003) is a human error iden- directly associated operating procedures. directly associatedoperatingprocedures. against errors that relate either to the orflightdeck their interfaces and proceduralized context. Hence they can only help in protecting well-defined fairly a within errors rule-based) some perhaps (and skill-based Reason’s address really only methodologies prediction their error potential. However, it shouldsubsequent assessment beof the user noted interfaces and task steps thatto assess formal error a similar way. They are usually based on a task analysis followed by the for many years. new. It has been used in not the is nuclear analysis identification and error petrochemicalFormal revisions. well-founded industries operations to diagnose problems with S design process, but they flightdeck can also the be used during subsequently during error flight design-induced avoid help to stages to operate them simultaneously. They can be applied at early design the design of the flightdeck interfaces and the procedures required (Li, HarrisandYu, 2008). SOPs to non-adherence) (or deviation a of aspect some including accidents of 70% almost with aviation, commercial in higher was SOPs, applying improper SOPs, and diverting from SOPs. The figure neglecting SOPs, ignoring intentionally included aviation military Harris (2006) found that 30% of accidents relevant to “violations” in a task that contains many steps are most likely to cause errors. response” format used on the flight deck); and interruptions during and “challenge the in example (for verbally given are instructions if omitted be to likely more is step a omitted; be to likely more are do not follow on from each other (i.e., re not functionally related) that steps required; standard the to completed be not will it that greater the information loading in a particular step, the more likely The International Air Transport Association (IATA) analyzed data T, developed by developed HET, both consider implicitly techniques identification error Formal Most formal error identification methods operate in rror Reduction and Prediction Approach, Approach, Prediction and Reduction Error Error HAZOP—Hazard and arshall, Stanton, Young, Salmon, Harris, Harris, Salmon, Young, Stanton, Marshall, Error In Systems Tool, Kirwan, O Ps and provide a basis for Operability study, arshall, Marshall, Li and Error Modes

Sub-task for performing Task execution incomplete Task task executed Wrong executed too early Task executed too much Task informationMisread Go-around by HTA Fail to execute wrong in executed Task direction repeated Task executed on wrong Task interface element executed too late Task executed too little Task Other

33.9 16.0 26.7 16.0 16.0 25.0 2009 16, SEPT. , 1.1.1 7.34 7.34 1.79 0.00 1.79 3.57

Press TO/GA Switches Y 3 7 9 7 7 0

26.7 48.2 10.7 1.1.2 Thrust has advanced 0.00 0.00 0.00 0.00 5.36 5.36 0.00 5.36 8.93 9 1 1

42.8 12.5 42.8 1.2.1 PF command flap 20 0.00 5.36 0.00 0.00 3.57 1.79 1.79 0.00 0.00 6 0 6

19.6 14.2 10.7 19.6 1.2.2 PM place flap lever to 20 5.36 0.00 3.57 5.36 3.57 0.00 0.00 7.14 4 9 1 4 WEDNESDA 48.2 26.7 12.5 1.3.1 Verify TO/GA mode annunciation 1.79 1.79 0.00 5.36 0.00 8.93 0.00 1.79 7.14 1 9 0

39.2 25.0 35.7 1.3.2 Rotate to proper pitch attitude 5.36 3.57 1.79 1.79 0.00 5.36 8.93 3.57 1.79 9 0 1 Verify adequate thrust 53.5 39.2 10.7 1.4.1 7.14 5.36 0.00 0.00 3.57 8.93 1.79 3.57 3.57 for go-around 7 9 1 62.5 26.7 12.5 1.4.2 Announce go-around thrust set 0.00 1.79 0.00 0.00 1.79 0.00 3.57 0.00 0.00 0 9 0

32.1 19.6 23.2 12.5 1.5.1 Verify positive rate of climb 7.14 0.00 0.00 0.00 1.79 0.00 0.00 0.00 4 4 1 0

39.2 19.6 42.8 1.5.2 Place gear lever to up 7.14 5.36 3.57 0.00 1.79 0.00 0.00 0.00 8.93 9 4 6

26.7 14.2 14.2 10.7 51.7 1.6.1 Select Roll mode 0.00 8.93 5.36 0.00 0.00 3.57 3.57 9 9 9 1 9

35.7 23.2 37.8 1.6.2 Verify Roll mode annunciation 1.79 3.57 0.00 0.00 0.00 0.00 3.57 3.57 8.93 1 1 6

28.5 10.7 51.0 1.6.3 Turn into correct track 5.36 5.36 0.00 1.79 5.36 3.57 0.00 0.00 3.57 7 1 7

23.2 26.7 23.2 50.0 1.7.1 Select Pitch mode 5.36 0.00 3.57 8.93 1.79 1.79 3.57 3.57 1 9 1 0

26.7 26.7 21.4 10.7 1.7.2 Verify Pitch mode annunciation 3.57 3.57 0.00 0.00 1.79 0.00 3.57 0.00 9 9 3 1

12.5 46.4 12.5 21.4 1.7.3 Maintain proper pitch attitude 1.79 0.00 1.79 1.79 7.14 8.93 3.57 1.79 0 3 0 3

10.7 50.0 25.0 17.8 30.3 12.5 1.8 Follow M/A Procedure 0.00 7.14 8.93 0.00 0.00 3.57 1 0 0 6 6 0 Table 1: The Results for the Human Error Modes in Aircraft X When Performing a Go-Around. Numbers in the Cells Show Percentage (%) of Respondents Reporting that Error Mode in Each Task Step from 240 member airlines and found about 50% of accidents in how to execute the go-around maneuver and being proficient in its 2007 occurred during the phrases of final approach and landing, a execution are extremely important but still more is required. Pilots period that comprises (on average) only 4% of the total flight time. must possess the skill and knowledge to decide when to execute a Most pilots are trained that executing a go-around is the prudent go-around. Many accidents have happened as a result of hesitat- course of action when a landing is not progressing normally and ing too much before deciding to abort the landing. This research a safe outcome is not ensured. This is the best practice, but it isn’t applies the Human Error Template (Marshall, Stanton, Young, always a straightforward decision (Li and Harris, 2008). Knowing Salmon, Harris, Demagalski, Waldmann and Dekker (2003) to the

ISASI 2009 Proceedings • 45 ISASI 2009 PROCEEDINGS 46 Go-around (ShowntheAverage Error More than40%for Both MEandOTHERS) Table 2:The Occurred RatesofError Break DownbyDetailOperationalBehaviorsforAircraft XPerforming ing go-around) had been specified, the next step was toand based breakon the SOPs. this required actions to be made by a pilot to achieve the associated goal the as Taskconsidered be can operations Go-around decomposition: inter-continental jettransportaircraft(aircraftX) four-engined, large, a on go-around the for was undertaken analysis operations procedures, and pilots’ actions during a go-around. The task the process of reviewing the integration of hardware design, standard in step initial an was study this in analysis task the of purpose The sis. hierarchical task analysis (HTA) to define clearly the task under analy- a conducting was research this in step first The task: the of Description type-rating forthelargejettransportaircraftunderconsideration. range of participants was between 28 and 60. All participants held a training instructors, and 37 pilots with teaching experience. The age ground 18 pilots, instructor 12 were There hours. flying 1,999 low 17 pilots had between 2,000 and 4,999 hours, and 11 pilots had be- hours; 9,999 and 5,000 between had pilots 18 hours; flight 10,000 officers.first 42 and captains 25 of excess in had pilots Twenty-one Participants: Method the SOPsinvolved. aircraft to identify potential areas for improvement in the design of retrospective analysis of go-around procedures in a large commercial Task executeincomplete Task executetoolittle Task executeincomplete Task executeincomplete Fail toexecute interface Task execute on wrong Fail toexecute Task executetoolate Fail toexecute Task executetoolate Fail toexecute Task executetoolate Fail toexecute Task executeincomplete Task executetoolate Fail toexecute Fail toexecute Task executeincomplete Fail toexecute • ISASI 2009 ISASI Modes ofError Sixty-seven pilots participated in this research, including Proceedings Once the overall task goal - (safely perform Q65. Notusingauto-flightsystem whenavailableandappropriate. Q62 Poorinstrumentscan Q48. Didnotmonitorthealtitudeat appropriatetime Q46. NocheckwhetherVNAV orFLCHwasbeingactivated Q42. DidnotengageVNAV modeontimefailedtocapture Q39. MixeduptheIAS/HDGbugsonCP Q37 FailedtocheckwhetherLNAV/ HDGwasbeingactivated Q33. DidnotengageLNAV modeontime failedtocapture Q30. Forgottoputthelandinggearupuntilbeingreminded Q27. Didnotidentifyandcorrectgo-aroundthrustdeviationsontime set’ Q26. Forgot tocall‘go-around thrust Q25. Didnotidentifyandcorrectspeeddeviationsontime Q23. Failedtocheckgo-aroundthrustsetting flightdisplay Q18. Nocheckforprimary Q17. Laterotation,over/underrotation. Q15. FailedtocheckwhetherTO/GAmodewasbeingactivated Q9. Failedtocommand‘flap20’duepilot’s negligence Q8.Thrust leverwerenotadvancedmanuallywhentheauto-throttles Q5. Failedtocheckthrustlevel became inoperative Description of Errors Occurred Occurred Description ofErrors during Go-Around & Salmon,& 2005). There arebasic12 HAT error modes: “Failure upon based their judgment step, (Harris, Stanton, task each for any) (if credible are modes error HET tion.Thetechnique requires theanalyst indicateto which theof (HTA)analysis task hierarchical a in step ques- in task flight the of task level bottom each to applied is taxonomy HET The methods. actualpilotsextantand error modescontemporary usedin H of instances reported from developed was taxonomy The modes. prediction utilizing an error taxonomy comprised of 12 basic error error: of modes Classifying Seventeen bottomleveltaskswereidentifiedinthisanalysis. Pitch Pitch Select 1.7.1 operations: following the into For example, the sub-goal 1.7 Select Pitch bottom level of any branch in a HTA should always be an operation. process continued until an appropriate this and sub-goals, further into down broken was goal task each of operation was reached. The M Thrust Increase, 1.5 Gear up, 1.6 Select Roll Flaps Set down into the sub-goals, for broken was goal overall this go-around,” a example:performing “safely task, 1.1 Press T the tasks required to achieve the overall goal (Annett, 2005). In the overall goal down into meaningful sub-goals, which together formed ode,and 1.8 Follow Mode Annunciation, and 1.7.3 ever to 20, 1.3 Rotate to Go-around Attitude, 1.4 Verify1.4 Attitude, Go-around to Rotate 1.3 20, to Lever 55.22% 43.28% 38.81% 38.81% 44.78% 34.33% 31.34% 49.25% 40.30% 35.82% 68.66% 46.27% 53.73% 26.87% 46.27% 44.78% 25.37% 29.85% 38.81% M T is a checklist-style approach to error error to approach checklist-style a is HET issedApproach Procedures. The analysis ME Occurrence rate Occurrence Maintain Proper Pitch Attitude. 65.67% 55.22% 55.22% 56.72% 62.96% 49.25% 64.18% 58.21% 59.70% 58.21% 70.15% 47.76% 52.24% 56.72% 50.75% 46.27% 67.16% 53.73% 56.72% Marshall, Young, Demagalski OTHERS

ode was broken down Mode was broken down Mode, 1.7 Select Pitch O ode, 1.7.2 Verify1.7.2 Mode, /GA Switches, 1.2 60.45% (2) 49.25% 47.02% 47.76% 53.37% 41.79% 47.76% 53.73% (3) 50% 47.02% 69.41% (1) 47.015% 52.99% 41.79% 48.51% 45.53% 46.26% 41.79% 47.76% AVERAG E I Scenario: Go-around at XXX International Airport Task step: 1.3.2 Rotate to proper pitch attitude Likelihood Criticality Error mode Tick Description Outcome PASS FAIL H M L H M L Pilot’s incapability when A/C not climbing and Fail to execute V V V V A/P engaged speed increasing Failed to trim to prevent excessive pitch up /failed Not enough climb Task execution incomplete V V V V to trim to reduce forward rate/speed too high pressure Failed to rotate to target

Affect go-around 2009 16, SEPT. ,

Task executed in wrong go-around pitch first Y V performance V V V direction or follow F/D without SPD too high/ too crosscheck SPD low

Banking instead of A/C not climbing but Wrong task executed V pitching up rolling, may cause V V V wings not level Task repeated Task executed on wrong interface element WEDNESDA Rotate to proper pitch Task executed too early V Airspeed low V V V too rapidly Affect go-around Rotate to proper pitch performance may Task executed too late V V V V too slowly cause not enough climb rate

Task executed too much V Increase pitch too high Airspeed low V V V

Increase pitch not Not enough climb Task executed too little V V V V enough rate May cause unstable Misread information V Misreading pitch attitude V V V climb rate

Other

Table 3: An Example of Human Error Template Output from Sub-Task Step 1.3.2 “Rotate to Proper Pitch Attitude” for Performing a Go-Around to execute,” “Task execution incomplete,” “Task executed in the rience (ME) or if he/she knew someone who had committed the wrong direction,” “Wrong task executed,” “Task repeated,” “Task errors (OTHERS). executed on the wrong interface element,” “Task executed too There were 19 task steps with a very high percentage of errors early,” “Task executed too late,” “Task executed too much,” “Task during go-around (defined as being when the average number executed too little,” “Misread Information,” and “Others.” A full of errors for both ME and OTHERS was more than 40%). (See description of the methodology and all materials can be found in Table 2.) The most common error mode for pilots performing the Marshall, Stanton, Young, Salmon, Harris, Demagalski, Waldmann, go-around was “Failure to execute,” the second highest was “Task and Dekker (2003). execution incomplete,” the third highest was “Task executed too The design of evaluating format: These 17 bottom-level tasks are broken late.” (See Table 2). The most commonly occurring operational down into 65 operational items to be evaluated by all participants error of pilots when performing the go-around was “Forgot to using a structured questionnaire. The questionnaire format asked call Go-around Thrust Set” (average 69.41%); the second highest participants if they had ever made the reported error (checked was “Not using autoflight system when available and appropriate” “ME”) and if they also had observed any one else who had made (average 60.45%); the third most common error reported was the error (checked “OTHER”). It was hoped that this format would “Did not engage LNAV mode on time failed to capture” (average increased the participant’s confidence in being able to report 53.73%). errors. For example, if they had made the error themselves but These 17 bottom-level sub-tasks were further evaluated by all had no desire to admit to making the error, they could check the participants. For each credible error identified, a description of “OTHERS” box. the form that the error would take was required and the outcome or consequence associated with the error was determined. The Results and discussion likelihood of the error was estimated using a very simple scale (low, Participants responded to items based upon 17 sub-tasks in which medium, or high) as was the criticality of the error (low, medium, each step could include any one (or more) of 12 different types of or high). If an error was given a high rating for both likelihood human errors (see Table 1). Each sub-task consisted of operational and criticality, the task step was then rated as a “fail,” meaning that behaviors for participants to evaluate based on his/her own expe- the procedure involved should be examined further and it should

ISASI 2009 Proceedings • 47 ISASI 2009 PROCEEDINGS 48 to follow the required procedures in this instance in Question 23 togo-around mode. However, theerror data also showfailure a pitch guidance because pitch mode annunciation did not change play system (AFDS) was not triggered; it wouldn’t provide correct (F/D) did not display go-around pitch because of autoflight dis- directorFlight (4)attitude; angle pitch high to climb or path normal below either attitude, pitch incorrect into went Aircraft became unstable during approach due to unsuccessful go-around. no go-around thrust and cause hard landing incident; (3) Aircraft press TO/GA switch, aircraft touched down on the runway due to to failedPilot operation;(2)go-around thecontinued aircraft Switches,” (1) Pilot retried to push the TO/GA switch immediately, TO/GA “Press of sub-task the to related incidents related some followinggo-around.are Thetheduringadvance to notlevers accidentally press the wrong switch, which would cause the thrust autothrust disengage switches are next to one another, pilots may the autothrust disengage switches. Since the TO/GA switches and system. However, to control thrust manually, pilots need to press GA switches that will activate the correct mode of the autothrust TO/ the press to is step first the go-around, to decides pilot a when example, For this. for reasons several be could There tive. inopera- became autothrottles the when manually advanced not Table 2) suggested that on many occasions the thrust levers were equate SOPs alone. For example, the responses to Question 8 (see inad- or design poor either or product the simply not are They interaction between procedures and the design of the flight deck. “fail”) canbefoundinTable 4. task 1.3.2 “Rotate to proper pitch attitude” (which was assessed as a sequencesoffailing toperform properly thetask step relating to con- and descriptions the to relevant data qualitative the example, an As Table3). in given example (see revision for considered be “Rotate toProper Pitch Attitude” WhenPerforming aGo-Around Table 4:TheQualitativeDataContainingtheDescriptionsandConsequencesofError forSub-Task too late Task executed incomplete Task execution Fail toexecute Error Mode Error Performing a Scenario: Performing any of the errors observed during the go-around show an an show go-around the during observed errors the of Many • ISASI 2009 ISASI thrust advanced(2) Pilot’s controlinputlaterthanpitchchangebecause Panic (3) Rotate toproperpitchtooslowly(5) Late rotatewhengoaroundthrustset(1) PF’s negligence(2) Distraction. Unanticipatedgo-around(2) pressure(2) to reduceforward Failed totrimpreventexcessivepitchup/failed Did notfollowFDpitch(1) PF’s negligence(2) for goaround(1) Under/over rotateoratanimproperpitchattitude Not enoughpitch(3) Distraction. Unanticipatedgo-around(2) Panic (5) Pitch uptoolateorfast(3) Pilot’s incapabilityorsystemfailurewhenA/Pengaged(2) A/C notrotatedwhenmanualfly(1) (2) PF’s negligencefromsurroundinginterference Proceedings Go-around at XXX International Airport Go-around atXXXInternational Description

13 11 15 Frequency ros hog sse lgc n/r eudn, out o fault- or robust, redundant, and/or logic system through errors of effects the preclude or means, similar or actions, confirmation ensure • enabletheflightcrewtodetect and/orrecoverfromerroror • criteria. Theyshould design) the flightdeck interfaces are required to meet the following procedural with associated closely actually is (which management error for requirement the with Tocomply faith.” good in acting thatcan be reasonably expected in service, assuming equipment flight the crews with interaction crew flight from resulting errors installedthe practicable, equipment manage flightenable mustextent to crew the the “to that requires 25.1302 CS result, a As designed flightdeck interface will make errors in certain situations. ago-around). when performing case, this in or mission, combat a of stresses the after example, (for situation stressful a in especially important particularly was looking at or touching the switch what function it controlled. by This either tell to pilot the enabling coding) (shape control they (spatial coding) and/or shape the switches to represent the part proposed coding solutions to the problem: separate the switches gear and the flaps were both identical and next to each other.ing He B-17. His investigations revealed that the toggle switches for the landing gear instead of the landing flaps after landing in the Boe- he investigating the problem of pilots where and1940s early co-pilotsthe in retractingwork his recalls the (1999) new.Chapanis not is components interface system of confusion Such setting. upthefailure ofthethrust levers toadvance totheappropriate go-aroundcheck(“failedthrusttosetting”), shouldwhichpick discourage • and landingispossibleor or capabilities are evident to the flightcrew and continued safe flight ven experienced, well-trained and rested pilots using a well- a using pilots rested and well-trained experienced, Even

Wrong attitude(4) (2) Affect go-aroundperformance A/Ccontinuetosink(2) Close toTERR(1) Speed uptoomuch(3) Not enoughclimbrate(1) Operational step:1.3.2Rotatetoproper pitchattitude Wrong attitude(2) No goaroundpitch(1) over speedorunder(1) A/C overpitchwhichincreasepilot’s workload(2) Climb gradientnotenoughorlosealtitude(1) Not satisfythego-aroundclimbingrate(2) Not enoughclimbrateorspeedtoohigh(2) Stall (2) Wrong attitude(3) No goaroundpitch(3) Over speedorunder(1) A/C didnotclimb(3) Close toTERR(1) Not satisfythego-aroundclimbingrate/Speeduptoomuch(2)

that effects flight crew of

flight errors

crew Outcome by errors

using on switch

the aeroplane guards, interlocks, functions

13 11 15 Frequency

tolerant system design. Acknowledgement However, many of the procedural errors observed are not direct This project is supported by the grant from the National Science products of the flightdeck interface. They are mostly errors of omis- Council of Taiwan (NSC 97-3114-P-707-001-Y). The authors would sion (a failure to do something). As examples, see Table 2, questions like to express their appreciation to the Aviation Safety Council for 5, 9, 15, 23, 30, etc. Some of these errors in the execution of the providing a financial endowment to carry out this research. SOPs could be mitigated by changes to the aircraft’s interfaces and warning systems (and indeed some are, for example, a speed warning Reerences on the landing gear position—question 30, better interface design— Annett, J. (2005). Hierarchical Task Analysis, in, N.A. Stanton, A. Hedge, E. question 39, better mode indication—question 46). These all address Salas, H. Hendrick, and K. Brookhaus (Eds.) Handbook of Human Factors and Ergonomics Methods. London, Taylor and Francis. the first bullet point in the previous list, enabling the crew to detect Boeing Commercial Airplanes Group (2008). Statistical Summary of Com- , SEPT. 16, 2009 2009 16, SEPT. ,

or recover from error. However, many of the errors listed in Table mercial Jet Airplane Accidents: Worldwide Operations 1959-2007. Seattle Y 2 would not be mitigated by better design (for example, questions WA: Boeing. Chapanis, A. (1999). The Chapanis Chronicles. Aegean Publishing Company: 48 and 62). Simplifying or redistributing the go-around procedures Santa Barbara, Calif. between the flight crew members may, however, have a beneficial Civil Aviation Authority (1998). Global Fatal Accident Review 1980-96 (CAP 681), effect as a result of either redistributing workload (allowing more Civil Aviation Authority, London. Dekker, S.W.A. (2001). The Re-Invention of Human Error. Human Factors and time for other tasks, such as monitoring the flight instruments) or Aerospace Safety, 1, 247-266. reducing the number of procedural steps each pilot is required to Embrey, D.E. (1986). SHERPA: A Systematic Human Error Reduction and Predic- execute (see Reason, 1988). tion Approach. Paper presented at the International Meeting on Advances in Nuclear Power Systems, Knoxville, Tenn., 1986. WEDNESDA Both Reason (1990) and Dekker (2001) have proposed that hu- European Aviation Safety Agency (2008). Certification Specifications forL arge man behavior is governed by the interplay between psychological and Aeroplanes (CS-25): Amendment 5. Cologne: EASA. Available from http:// situational factors. The opportunities for error are created through a www.easa.europa.eu/ws_prod/g/rg_certspecs.php#CS-25). Federal Aviation Administration (1996). Report on the Interfaces between complex interaction between the aircraft flightdeck interfaces, system Flightcrews and Modern Flight Deck Systems. Washington D.C.: Federal design, the task, the procedures to be employed, and the operating Aviation Administration. environment. It is naïve to assume that simply improving one com- Federal Aviation Administration (1998). Advisory Circular: System Design and Analysis (AC 25.1309-1A). Washington, D.C.: Federal Aviation Administra- ponent (such as the flightdeck interfaces) will have a major effect in tion. reducing error by considering it in isolation. With regard to the HET Harris, D., Stanton, N.A., Marshall, A., Young, M.S., Demagalski, J., and Salmon, methodology employed (Marshall, Stanton, Young, Salmon, Harris, P.M (2005). Using SHERPA to Predict Design-Induced Error on the Flight Deck. Aerospace Science and Technology, 9, pp. 525-532. Demagalski, Waldmann, and Dekker, 2003) prior to this study, it has Kirwan, B. (1988). A Guide to Practical Human Reliability Assessment. London: always been used in a prospective manner to predict design induced Taylor and Francis. error on the flight deck. This study also demonstrates that it can be Li, W-C., Harris, D., and Yu, C-S. (2008). Routes to Failure: Analysis of 41 Civil Aviation Accidents from the Republic of China Using the Human Factors used in the opposite manner to structure data collection and provide an Analysis and Classification System. Accident Analysis and Prevention, 40(2), analysis taxonomy for the retrospective collection of error data. Look- 426–434. ing ahead, the HET methodology can also be applied to prospectively Li, W-C., and Harris, D. (2008), “The Evaluation of the Effect of a Short Aero- nautical Decision-Making Training Program for Military Pilots,” International test any revised SOPs to assess their error potential prior to instigating Journal of Aviation Psychology, Vol. 18 (2), p.135-152. them, thereby avoiding the requirement for an error history to develop Li, W-C., and Harris, D. (2006). Pilot Error and its Relationship with Higher reevaluation of the revised procedures is possible. Organizational Levels: HFACS Analysis of 523 Accidents. Aviation, Space and Environmental Medicine, 77(10), 1056-1061. Marshall, A., Stanton, N., Young, M., Salmon, P., Harris, D., Demagalski, J., Conclusion Waldmann, T., and Dekker, S. (2003). Development of the Human Error By the use of a scientific HTA approach to evaluate current SOPs Template–A new Methodology for Assessing Design Induced Errors on Aircraft Flight Decks. Final Report of the ERRORPRED Project E!1970 (August 2003), design together with error analysis, interface layout, and operating London: Department of Trade and Industry. procedures, the flight safety will be enhanced and a user-friendly Reason, J. (1990). Human Error. Cambridge University Press: Cambridge. task environment can be achieved. This research utilized the HET Reason, J.T. (1988). Stress and Cognitive Failure. In, S. Fisher and J. Reason (Eds), Handbook of Life Stress, Cognition and Health. New York: John Wiley. error identification methodology (originally developed to assess de- Stanton, N.A., Harris, D., Salmon, P., Demagalski, J.M., Marshall, A., Young, sign induced error as part of the compliance methodologies under M.S., Dekker, S.W.A., and Waldmann, T. (2006). Predicting Design Induced AMC 25.1302) in a retrospective manner to assess error potential in Pilot Error Using HET (Human Error Template)—A New Formal Human Error IdentificationM ethod for Flight Decks. The Aeronautical Journal, 110 existing SOPs when performing a go-around in a large commercial (2), 107-115. jet transport aircraft. Pilots committed three basic types of error Stanton, N.A., Salmon, P., Harris, D., Marshall, A., Demagalski, J.M., Young, M.S., with a high likelihood of occurrence during this maneuver: “Fail to Waldmann, T., and Dekker, S.W.A. (2009). Predicting Pilot Error on the Flight Deck: A Comparison of Multiple Method and Multiple Analyst Sensitivity. Ap- execute,” “Task execution incomplete,” and “Task executed too late.” plied Ergonomics, 40 (3), 464-471. Many of these errors were dormant in the design of the procedures U.S. Department of Transportation (1999). Aviation Rulemaking Advisory Com- or resulted from an interaction between the procedures and some mittee; Transport Airplane and Engine: Notice of New Task Assignment for the Aviation Rulemaking Advisory Committee (ARAC). Federal Register, 64, aspects of the flightdeck design. It is hoped that the implementa- (140); July 22, 1999. tion of new human factors certification standards and analysis of Whalley, A. (1988). Minimizing the Cause of Human Error. In, B. Kirwan and L.K. associated procedures using a validated formal error prediction Ainsworth (Eds.) A Guide to Task Analysis. London: Taylor and Francis. Woods, D.D., and Sarter, N. (1998). Learning from Automation Surprises and methodology will help to ensure that many of these potential errors Going Sour Accidents. Institute for Ergonomics, Report ERGO-CSEL-98-02, will be eliminated in the future. ◆ NASA. Ames CA: National Aeronautics and Space Administration.

ISASI 2009 Proceedings • 49 ISASI 2009 PROCEEDINGS from the aviation community, which usually are not used to handling beyond thecrew’s competenceorproficiency. is that maneuver complex a execute to crew the request can data and lack of continuity. The one ordering the test or collectingby fatigue, the affected stress, easily be fear can orflights exuberance,those completes normally that as crew well as flight improperline the disciplineinstance, For operations. line normal in used one performance during the tasks. ated as a result of a technical defect or a less-than-optimum human Investigation Course at Cranfield University in 2003. Investigation CourseatCranfieldUniversityin2003. and oneinairsafetymanagement.HehascompletedtheAirAccident the CityUniversityofLondon,U.K.,oneinairtransportmanagement certified aviationsecurityauditor. Caceres holdstwomasterdegrees from He hasalsoworkedwiththeEuropean CivilAviation Conference asa ment process, especiallyinthefieldofhumanfactorsappliedtosecurity. with ENAC,hewasextensivelyinvolvedintheEUregulatory develop- ENAC.Duringhistime aviation securityadvisorfortheItalianCAA quality auditor, securitymanager, andinstructor. Healsoisapart-time on narrowbody andwidebodyaircraft. Hiscareer includes10years asa than 20years’aviationexperience,themajorityasanairlinecaptain ing new EU rules and a quality management system. Canceresoperator. After that,hesupportedSirioSpa,Milan,Italy, byimplement- has more flight operationsandtrainingPHforanItalianbusinessaviationAOC ing group basedonthecurrenta 2yearsas scientificevidence.Heserved system (FRMS),Caceres hasprovided valuableinformationtothework- 50 of that attempt should minimize further risks. sionals from different agencies, with different purposes, the outcome state oftheaircraftorleadstoabadoutcome. undesired an trigger can fault undiscovered single a that avoid to any fault before the aircraft is released to service. This operation tries and externalhazardssometimesresidentinthesystem. internal of number great a with environment, high-risk already an withextremecare. be performed to need and dangerous be can that maintenance, line after flights test as such operations, risky some still are there record, safety lent Although the civil aviation industry has achieved a distinctive excel- Introduction These flights also involve a wide cross-section of other agencies agencies other of cross-section wide a involve also flights These A test flight demands special care and awareness, exceeding the Since a flight test is a process that involves a wide range of profes- This justifies the necessity to perform flight tests in order to detect These operations are usually performed by a highly skilled staff in An Analysis of • ISASI 2009 ISASI In Post- Proceedings By Capt.ClaudioDanielCaceres,SeniorSafetyAdvisor, ContinuousSafety Washington, D.C.,onthefatigueriskmanagement sition. HavingcompletedU.S.NTSBtrainingin contributed tosustainabilityoftheEBAA’s FTLpo- Association’s (EBAA) FTL Working Group, he has membership attheEuropean BusinessAviation consultant since 2007. With almost 1 year of Capt. ClaudioCaceres hasbeenanaviation M Errors can be gener aintenance Flight Test H uman Factor Aspects - from thehumanfactorsside. and technically both proposed, be will control proper under are operations these of phases critical that ensure to training and ings and safety information will be underlined. Accordingly, special brief- personnel awareness and the use of agreed-upon written proceduresefficient, andsafeoperation. effective, an of completion successful the to contribution positive a represents involved parties the of procedures the Standardizing radar, agencies, ATC, handling (ground etc.). everyday tests flight has taken with post-maintenance flight tests. has takenwithpost-maintenanceflighttests. framework was analyzed, as well as the approach that the authority man factors in post-maintenance flight tests. The actual regulatory hu- to related issues with dealing in operators (AOC) Certificate ogy that was used to assess some Italian and In the present chapter, the author outlines the research methodol- The researchmethodology therefore, let respondents answer via e-mail, mail, or fax. The au- The fax. or mail, e-mail, via answer respondents let therefore, author, the issues, sensitive are which activities, follow-up and 6. monitoringtheeffectiveness ofthecorrectingactions. 5. developmentofcorrectiveactions. 4. involvementinsafetyoccurrences. 3. identificationandtracking of hazardsandassociatedrisks. 2. procedure,whichincludeshumanfactors. 1. policy. better examinethenextsixsystemicareas: to designed was questionnaire survey’s particular,the In account. into taken were tests flight post-maintenance in management risk focused on areas of concern. Policy, human factor aspects, and the that questions six of set a of consisted questionnaire survey’s The Description ofdata such activities,includinghumanfactorscharacteristics. cedures (SOPs) tried to identify hazards and associated risks during sample taken from the in industry form of standard operating pro- and classifying information regarding actual control measures. This tionnaire and documental review. This review consisted of gathering aspects andgoodsafetymanagementpracticeprinciples. factor human to related assessment the crucial considered also aspects influences the overall risk factors human from outcome the that fact the underlines That level1). of the operation. The author of harm or damage is limited to an acceptable level (see Reference flight tests. According to ICAO, safety is a condition in which the risk are actually dealing with human factors aspects in post-maintenance The objective of the survey was to analyze the way that AOC operators Objective ofthesurvey Finally, in the findings and recommendations the importance of Since the survey requested reporting non-compliance events events non-compliance reporting requested survey the Since The assessment took place through the means of the survey’s ques- ® , Switzerland , Switzerland European Air perator Operator thor guaranteed that only deidentified data would be included in The survey’s report the present work to protect the participants from the concern of The filled-in question- self-incrimination as well as undesirable negative consequences for naires that the author their organizations. The present project hopes to assess the system received were first dei- as a whole, not the individuals or their organizations. dentified, as per the cur- In order to get a wider view and a better understanding of the rent disclaimer policy, and topic, the author also performed a documental control. The control then the operators were consisted in the review of the Jar-OPS 1 format Operations Manual assigned letters from A to Part A, Chapter 8.7, “Non Revenue Flights, Flight Test” as the com- Z. There was one operator ponent of the SOPs of some European AOC holders operators. that answered in an infor- , SEPT. 16, 2009 2009 16, SEPT. ,

Specifically, the review of such documentation was to try to research mal way, without using the Y if the human factor aspects during post-maintenance flight test were questionnaire. Another considered in the official documentation. Since the result of the operator answered stating recognition that human action does not occur in a vacuum but in a Figure 1. Analysis of the survey’s data. that he was not able to context of organizational and technological factors (see Reference provide such data arguing 2), the author also considered as fundamental analyzing hazard that the dissemination of data in the way requested was not allowed identification as well as risk management and risk mitigation aspects by unions, company policy, or Italian law. included in those documents. Analysis of survey’s data WEDNESDA Target population The total number of participants invited to participate were about The author sent the survey’s questionnaire to the members of 57 Italian AOC operators. The total numbers of answers are divided the Italian Flight Safety Committee (IFSC). Some other Italian in the following way: independent AOC holder operators also received the survey’s The metrics about the answered questionnaires are as follows: questionnaire. However, the author also reviewed operations docu- mentation corresponding to some European AOC operators and Question Number Yes No N/A other Italian AOC operators. The IFSC was established in 1999. It No. 1 (Policy for flight tests) 6 (75%) 2 (25%) 0 No. 2 (If it includes Human Factors aspects) 3 (37.5%) 5 (62.5%) 0 represents the Italian Flight Safety Society in tune with the similar No. 3 (Identification of risks) 4 (50%) 4 (50%) 0 model developed in the United Kingdom with the United King- No. 4 (Involvement in Safety occurrences) 4 (50%) 4 (50%) 0 dom Flight Safety Committee and by the Flight Safety Foundation No. 5 (Implementation of corrective action) 4 (50%) 3 (37.5%) 1 No. 6 (Monitoring of effectiveness of in the United States. It objectives include the development of a the corrective actions) 5 (62.5%) 3 (37.5%) 1 safety culture to achieve the new safety standards required to face the increasing traffic growth. According to its website (see Refer- ence 3), the IFSC’s members include about 20 AOC operators, one The analysis of the documental control rotary-wing operator, the authority (ENAC), the Italian air traffic Regarding the regulatory framework, the actual regulation for AOC control service provider (ENAV), two aircraft manufacturers (one European Union member states operators in the area of “operations” fixed wing and one rotary wing), the Italian carrier association, four is JAR-OPS 1/3. Amendment 7 is the current issue required by ENAC airport operators, and one handling agent. to Italians AOC holders. JAR-OPS 1/3 remained valid until July 15, The industry practitioners that received the survey’s questionnaire 2008. After that date, Regulation EU No. 8/2008 implementing the were mainly flight safety managers, quality managers, and post hold- new EU-OPS rules to EU operators became effective. Both require- ers flight operations and post holders CAMO. ments and regulations impose in their Appendix 1 to JAR-OPS The document control reviews Chapter 8.7 of the following AOC 1.1045 (or OPS 1.1045 in the second case) ”Operations Manuals operators: Contents,” the structure and contents of the mandatory operating 1. No. 3 European carrier operators having more than 100 narrow- documentation. Appendix 1 to JAR-OPS/OPS 1.1045 in Chapter 8.7 body and widebody aircrafts. requires the “procedures and limitations” for “non-revenue flights.” 2. No. 4 European carrier operators having fewer than 20 aircraft. Such procedures and limitations specifically must address, in a form 3. No. 3 European Business jet AOC operators having fewer than 20 jet aircraft.

Pilot survey process The survey’s questionnaire was sent to the IFSC via e-mail, and it was presented by the IFSC’s coordinator to the IFSC’s members on Nov. 30, 2007. The initial closing date set by the author was Dec. 15, 2007. However, the proximity with the end of the year and the winter break made it difficult for the participants to meet that deadline. The author decided to extend the period until the Jan. 31, 2008. By Jan. 8, 2008, the author had sent 57 individual e-mails to the IFSC member, asking them to send back the questionnaire. This motivated the participants to respond and more questionnaires were returned. Figure 2. Analysis of the survey’s data by question numbers.

ISASI 2009 Proceedings • 51 ISASI 2009 PROCEEDINGS 52 8.7 Chapter of review The operations. its conducts operator the way the even and statement the represent They authority. the of approval the to subject are documents Such procedures. erating op- standard company’s the of part are manuals operations The and proceduresbeyondcompliance The importance to establish a policy of controlmeasures,issuesrelatedto 10 ItalianandEuropean AOCoperators. Figure 4. Graphic presentation of the evaluation of Figure 3.Evaluationof10ItalianandEuropean AOCoperators. 1. Definition 2. Policy Good practicesforFlightTest 3. DefinitionoftheOwnerProcess 6. FlightPlanningandATC Coordination 5. RiskAssessment 4. HazardIdentification o 10. Categorization 9. DedicatedBriefingwithPHCAmo 8. DedicatedBriefing(includingHF) 7. MELStandardRequirement 12. Procedure 11. PrecatuionsandProcedures 13. PassengersLimitations 14. CabinSafetyProcedures 15. Limitations 16. CustomerTest Flight 17. InsuranceCoverage 18. Weather Restriction(i.e.,Daytime) 19. SafetyPilot/Engineer 20. Taxi testPolicy 21. EngineRunPolicy 22. DedicatedFlightCrewRostering 23. ExperienceStaffOnlyRequirement 25. DedicatedAFMCharter 24. FlightTest Manual f. positioningflights. e. demonstrationFlights,and flightsduetomaintenanceprocedures, d. ferry flights, c. aircraftdelivery b. flighttests, a. trainingflights, • ISASI 2009 ISASI Proceedings

ITA 1 √ √ √ √ √ √ √ - - - - -

------

ITA 2 Italian Operators √ √ √ √ ------

ITA 3 √ √ √ √ √ √ √ √ √ ------

objectives. technical meet and conditions flight safe define clearly should 8.7 to belonging 8.7, Chapter A, Part manuals, operations eight of limitations the and authorThefocusedtest flights on reviewedand proceduresthe grating input from occurrences that happened to other operators. compliance, regulatory and it is worth keeping them updated inte- value of the proper procedure’s effectiveness is well beyond a mere added authority.The the by made place in procedures the review (seeReference4). industry events that have happened, either in one’s own company or in the by driven usually is safety for concern practical The information. represented for the author another key opportunity to get research ried out periodically on in-service aircraft as one of the processes processes the of one as aircraft in-service on periodically out ried certification requirements for new aircraft and changes to aircraft. definitions about flight tests. In order to better clarify the topic, the author provides some specific definitions related to flight testing of aircrafts General backgroundaboutdifferent that theauthorcollectedcanbesummarizedasfollows: human factor aspects and self-evaluation limitations. Thefication, risk findings assessment, and a dedicated safety briefing, including tions issued by ICAO regarding safety management: hazard identi - that list, the author added the topics concerning the recommenda- Tomeasures. control practices safety best industry’s the represent the author produced a grid that includes a selection of items that can European erations manuals that belong to Italian op- 10 A from tests flight to dedicated part the reviewed author The Documentation analysisresults Conversely,proactiveain point view,of theauthor decided to Check flights or inflight surveys can be car be can surveys inflight or flights Check testing: flight Typesof test: Flight ITA 4 √ √ √ √ ------

C holder operators. From the data, data, the From operators. holder AOC member Union A required means of establishing compliance with with compliance establishing of means required A ITA 5 √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ - - - - -

C operators. Chapter Chapter operators. AOC Italians and European EU 1 √ √ ------

EU 2 √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ ------

EU Operators EU 3 O

√ √ √ √ √ √ √ √ ------

C holder operators and EU 4 V √ √ √ √ √ √ ------

EU 5 √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ ------

- to ensure that an aircraft continues to comply with the applicable informal e-mail format. airworthiness requirements. The identification of who controls the process enhances the level Maintenance check flights: May be carried out following a main- of standardization. A standardized process improves the possibility tenance activity on an aircraft to provide reassurance of handling of replication, planning capability, the quality of data collection, characteristics, performance, or to establish the correct functioning and leads to a safe execution of the flight tests, as well as proper of a system that cannot be fully established during ground testing. debriefing and data confirmation. Permit to fly: Special document issued by EASA or the NAA or It is crucial that the operations manager is the owner of the pro- by the state of registry to an aircraft that temporally lost its C of A cess and develops a correct flight planning, considering all relevant and allows the owner or the operator to make a ferry flight to the aspects that can influence the output, including human factors. The next approved repair station or to perform a flight test limited to maintenance sector should simply ask for certain data that flight , SEPT. 16, 2009 2009 16, SEPT. ,

the maneuver exclusively stated in that document in the flight test operations should gather during the flight tests. Y schedule (FTS) or in the aircraft flight manual (AFM), whichever The person in control should be clearly stated in the flight is limiting. test policy and included in both the operations manual and the continuous airworthiness maintenance exposition (CAME). The Findings and recommendations coordinator should be a commander from the Flight Operations The author acknowledges that AOC holder operators in Italy and Department and had the role of coordinator In some cases, it was in Europe have systems in place characterized by different grades observed that the flight operations post holder was filling the role; of maturity. Operators’ experience, knowledge, organizational however, without clear statement concerning responsibilities. Usu- culture, and size, as well as available resources, influence the grade ally the flight operations post holder is an experienced person ap- WEDNESDA of system’s maturity. The actual regulation requires that operators proved by the authority. His position is not enough as a risk control should be able to deliver a similar safety standard through a system measure. Commercial pressures, complex environments, and/or “based on compliance with, and adequacy of, procedures required organizational cultures can decrease the objectivity of the assess- to ensure safe operational practices and airworthy aeroplanes.” (See ment related with the operational hazards and its associated risks. Reference 5.) Regulatory compliance in post-maintenance flight The support of a flight safety review board (FSRB) that encompass tests is not enough, unless the system encompasses the human limi- at least the post holder CAMO, the safety manager, and the quality tations and develops strategies on how to address elements related manager could assist the overall organization in delivering a more to aviation human factors. This will permit the system to effectively effective and efficient solution for post-maintenance flight tests. manage the related operational risks. A documented and auditable Finally, the establishment and implementation of the role and approach allows continuous improvement of procedures, which is responsibility of the “flight test coordinator” per the Flight Safety also able to integrate the feedback from operations and industry Review Board (FSRB) is important to permit the system to define wise. Operators have to demonstrate the airworthiness compliance safe flight conditions and meet technical objectives, in an efficient in their maintenance programs. That includes flight tests, inflight and effective manner. surveys or demonstration flights. It is up to the operators to set up control measures specifically related to human factors during post- The post-maintenance flight tests process maintenance operations. Ignoring these underlying safety hazards The purpose of airworthiness check flights is to ensure that the could pave the way for an increase in the number of more serious aircraft’s flight characteristics and its functioning in flight do not occurrences (see Reference 6.) The collection of data gathered differ significantly from the normal characteristics for the type and from the survey’s questionnaire and from the official documenta- to check the flight performance against the appropriate sections of tion reviewed made evident some systemic inconsistencies in the the flight manual (see Reference 7). following key areas: A clear definition of the role and responsibilities of the owner of 1. Clear identification of the owner of the process regarding flight the process should enhance the planning process, especially in the test. following critical areas: 2. The risk assessment decision-making process and communication a. Definition of the flight test schedules approved by the NAA or system to flight crew. by the manufacturer. 3. The establishment of standardized supportive briefing guidance b. Definition of the safety considerations and control measures for material that includes HF best practices. such a mission (hazard identification and risk assessment). 4. Over-reliance on experienced captains (or TRE/TRE) instead of c. Since human action does not occur in a vacuum but in a context the concept of flight crew. of organizational and technological factors, this must be taken into 5. Lack of dedicated flight tests guidelines and/or training. consideration. 6. List of authorized flight crew to perform flight tests. The design of the post-maintenance flight test process Presentation of findings: The owner of Drawing the process of a post-maintenance flight test can be very the process post-maintenance flight tests helpful in identifying and communicating the critical areas of It was observed that the post-maintenance flight tests process owner concern. Since improvisation increases the risk, the process above was not clearly identified, not included in the documentation. This describes the time necessary to make an effective planning of the can lead to people not being aware of their role in such a position. flight test. Good safety management practices from the organization In other cases, the flight operations post holder required the CAMO is required to identify areas of concern and associated risks. post holder to answer on behalf the organization. Only one safety Areas such as pre-flight inspection, aircraft acceptance, ramp manager answered the survey’s questionnaire, however using an safety, and taxiing in complex environments that are not quite famil-

ISASI 2009 Proceedings • 53 ISASI 2009 PROCEEDINGS 54 Figure 6.Explanationofcriticalphases ofthepost-maintenance flighttestprocess. M.A. 704whereapplicable(seeReference8). Part 2042, (EC) Regulation with accordance in exposition ment flights should be included in the check continuing airworthiness manage- conducting for procedures and criteria, acceptance, Pilot Pilots conductingcheckflights steps thatrequiredouble-controlcheck. “D”) could draw the attention of the staff regarding specific critical (i.e., double-check a specify to cards, task on maintenance in used risk level. The use of colors or effective symbols, like the ones already iar to the flight crew can expose the operation to an unacceptable checks are requested. process, whichshowswhere criticalareas are andwhere double- Figure 5. A generic example of a post-maintenance flight test Landing plusrampsafety ATC clearance Ramp safety Aircraft acceptance Pre-flight inspection Technical briefing Flight crew composition Hazard identification/riskassessment C • ritical ISASI 2009 ISASI

steps Proceedings / phase might arise), while taxiing in unfamiliar or complex areas. might arise),whiletaxiinginunfamiliar orcomplexareas. Following demanding tasks, in this phase, the flight crew may becomeA mistakecancreatetrafficconflict orcrewdisorientation. less focused or distracted (complacency The flightcrewmightnotbefamiliar withthespecialphraseologyor ATC clearancesusedduringflighttests. attention oncreworientationisrequired whenreachingtherunwayinuse. O ating pressureontheflightcrew. leak, partiallyfaultyinstruments,orothernon-compliantitemsthatcan furtherincreasetheriskandoper The decisiontocontinuewiththeprocesswhenfurtherMELitemsemergeduringacceptance,suchasfuel Accurate in-depthpre-flightinspectioncandetectmaintenanceomissions aswellwrongpanelsettings. to announce“stop”ofthetest. layout and technical issues. Avoid adding itemsflight not crew,briefed onengineering, the ground. and Any the member Authority of theA whenclear crew on statementis board. entitled The of flightthe objectives crew is notof thealways test familiar clears upwith any FTS confusion“homogenous” flightcrewconceptmakesredundantthe composition. about the mission’s objectives for theE or windcanexposetheoperationtounacceptablerisk. Planning apost-maintenanceflighttestwithinstrumentmeteorological conditionsorextremeweatherlikeice J ustification xperienced commanders or TR ften maintenance areas are not well equipped, marked, or familiar to the Flight Crew. During taxiing, special E /TRI are exposed to any possible human impairment factors. The use of a shall be briefed in advance, that, condition permitting, only discussed recover manoeuvres should be reviewed. contingency other Any measures. safety related its and maneuvers scheduled all cover should briefings crew flight test The requirement. flight the complete to required time the to limited strictly erations anditsdedicatedinformation(seeChartA). op- of areas three the about explanations in-depth provide should organization the awareness, crew’s flight the facilitate to order In Test maneuvers holderin coordination with the F post CAMO the by prepared schedule, test flight manufacturer’s or plans test flight approved the of use the requiresPlanning Planning apost-maintenanceflighttest challenginginflight. which sometimescanbevery FTS, the on writing of instead gathering data in useful very be can the source of crew distraction. Digital cameras set in high resolution the aircraft to record system performance. However, this shall not be during maintenance activities requires installing cameras outside of post-maintenancefor flight test. Sometimes searching failurefor activities will be discussed. test Aflight successful chasefor items key the aircraftparagraph, following the In normally is not required flight testprocedureconsiderations Dedicated post-maintenance Chart A 375/2007 (see Reference 9). fly is required prior to starting the test, as per Regulation (CE) No. to permit A PHFO. the by approved was and work the completed that 145 Part the and authority relevant the with coordination in flight or testplans schedulestests Flight times. shouldall beat prepared observed be byshould theinstructions CA Ps, SOPs, operator’s the of outside operate should crew flight The

O PH. M Members of the authority anufacturer’sor CA MO post holder

ME and agreed-upon maneuvers are to be completed in flight and only risk management and assessment, the Flight Safety Review Board conditions permitting. Any unsafe/uncontrolled exceedance will members should make a subjective decision of their assessment. This require the crew to abort the mission, to land as soon as possible, and should also remind the staff involved in the operations and Flight to participate in a debriefing, and inspect the aircraft. Any flightcrew Safety Review Board members that although a minor improvement member can announce “stop” in case he/she notices any abnormal in the safety plan may not change the assessed “severity,” “probability” situation that might jeopardize flight safety. or “risk,” it may still reduce the actual risk.

Identification of hazards The use of the flight test schedule The basic premise is to identify test-specific hazards so that controls The ICAO airworthiness manual, Volume 1, states the purpose can be placed on the flight test activity to minimize the probability of of post-maintenance flight test or check flights. It also states , SEPT. 16, 2009 2009 16, SEPT. ,

hazards occurring. Hazard identification is a key activity during post- that the objectives of such flights are to ensure that the aircraft’s Y maintenance flight test planning. Flight test schedules demonstrate flight characteristics and its functioning in flight do not differ system performance in an already certified system. The flight crew, significantly from the normal characteristics for the type and to familiar with the aircraft’s system and its intended use, identifies check the flight performance against the appropriate sections most of the hazards. Careful evaluation of the flight test schedule of the flight manual (see Reference 10). ICAO recommends the in the operational context should be considered to address its re- above operation through the application of flight test Schedules lated flight test hazards. These hazards are highlighted in the safety approved by the authority. However, since there is an ongoing plan that should be issued by the FSRB. It consists in combination transition from NAA to EASA regarding EASA-registered aircraft, with an executive summary and a staff summary sheet. Thus, risk the national aviation authorities within the 27 European member WEDNESDA management is at the core of the flight test plan approval process. states limit the requirements to non-EASA-registered aircraft. The A complete safety plan documents both the flight test hazards and EASA introduced a non-expiring certificate of airworthiness for the risk mitigation plan. EASA registered aircrafts (airworthiness review certificate [ARS]). An approach to hazard identification can be summarized as However, the aircraft operator has to review the airworthiness the follows: aircraft through a maintenance plan. In the future, the owners or 1. The hazard (anything that could lead to a mishap. It must be test aircraft operators will establish a need to carry out periodic check specific and not a generic hazard associated with generally flying flights as part of their own airworthiness assurance process to ensure airplanes). that their check flight schedules and procedures are developed in 2. The causes of the hazard (anything that could lead to the pres- accordance with current best practices. The support of the aircraft ence of the hazard). manufacturer or the NAA Flight Department will be crucial for 3. The effect of the hazard (the mishap you are trying to prevent: advice on content and safety procedures, which includes human death, loss of aircraft, major damage, etc.). factor aspects. The EASA regulations also place obligations upon 4. Minimizing procedures that address the specific causes of the NAAs as the designated competent authorities for the European hazard to prevent its occurrence (breaks the link between the causes Union member states in respect to aircraft continuing airworthiness and the hazard). monitoring. This requires the NAAs to monitor the airworthiness 5. Corrective actions that document what to do if the hazard occurs status of the fleet of aircraft on its registry and may include inflight to prevent it from becoming a mishap (breaks the link between the surveys as one element. hazard and the effect or mishap). 6. Remarks that document additional applicable information about Objectives and contents of the flight test the hazard. schedules (FTS) and hints of human factors Hazard classification and protocol should be performed. The FTS is a crucial tool, and its objectives are to assist the operator in confirming the following data: Analysis of the effectiveness of the control measures a. Handling characteristics are satisfactory and typical of the type. The safety plan, which includes the flight test plan, should be sup- b. Climb performance equals or exceeds the scheduled data (see ported by an independent safety review and based, for example Chart B). on a qualitative risk assessment performed with the BowTieXP© Note: Data are necessary in order to assess any future deterioration methodology. The safety review board (SRB) should be chaired by of performance in service. the FOPH, and it should be composed of at least the post holder c. The aircraft and its equipment function satisfactorily and the CAMO, the safety manager, and the quality manager. This team aircraft continues to comply with its type design standard. reviews the flight test plan and the safety plan, identifies additional From the human factor point of view, it is wise to consider that indi- hazards, recommends additional risk mitigation (or the elimination viduals, in confined spaces, will use the above flight test schedules. The of risk mitigation that will be counterproductive or unnecessary) and finally assesses the overall risk of the post-maintenance flight test.

Risk assessment and safety planning The final risk assessment is the responsibility of the FOPH. The Board assesses the overall risk of the flight test based upon the identi- fied risk, risk mitigation efforts, and potential for unknown risks. The assigned risk level (low, medium, or high) determines the level of supervision required to approve the flight test plan. During Chart B

ISASI 2009 Proceedings • 55 ISASI 2009 PROCEEDINGS 56 in activity non-recurrent a is test flight post-maintenance The Conclusion events andimprovesafety. gardingflight tests. This will avoid recurrencere- of process non-compliancetraining the into integrated be should feedback the in improvement and review of the process. The information contained humanFactors. This will allow of the field system the in to strive especially PHFO, for the continuous to given be should Feedback safety. on impact its to according classified be should defect Each report. flight check the comprises schedule, test flight completed the with together This, flight. the during found defects the all list should crew holder.flight post The CAMO the with coordination in certificate post-flight the complete should maintenance to due After each check flight, the flight crew that conducted the flight test Post-maintenance flighttestsresults Figure 7.Documentationcontents data, typeoffontsaswellthesizeandcolorpapersheet. readability,on depend of will collection data the of for quality spaces be used for a range of airplane types (NAA responsibility). be usedforarangeofairplanetypes(NAAresponsibility). airplanes below 5700kg thereof) above 5,700 kg aircraftavailableaircraftshouldmostbevariantsfortypes(and of normalusage. for the purpose of the schedule, to have been checked on the basis systems, and equipment that are used regularly may be considered, gear lowering, use of alternate braking systems. Note that controls, emergency e.g., systems back-up of functioning recoverable safe, c. Tests to check functioning of thespeeds. aircraft equipment in flight and 2. and predictedconfigurationsconditions, 1. Simple, free air pressure rate-of-climb measurements under known tests b. Performance characteristics duringthefollowingphasesofflight. the evaluate to note) (see direction specific with trimmers, and Handlinga. tests, including theeffectiveness primaryof controls following: Define recurrent training Review & up-to-date risk assessment Define possibleFTfleetwise Review InstructionstoFTcrew Consider HF aspects of FT Define clearFTPractices o.MPartA,8.7–Procedures Define alistofpilots(EASA/M.A.706) & o.MPartD–Qualification Define aFTpilotqualificationprocess Define clearFTProcedures Define clearpolicyonFT Finding

The Schedules for required check flights for flights check required for Schedules M • easurement of low-speed warnings and, if applicable,stall if and,warningslow-speed easurementof ISASI 2009 ISASI U .K. CAA recommends that the schedules should cover the Proceedings MAUW, there are generic schedules that can

MAUW. However, for certain categories of

training O QM, S F.S.R.B.: F CAME –FTRequirement (FTS) CAME –FlightTest Schedule during FT O briefing O.M PartA,8.7–andatory CAME –FTChapter Training O.M PartA,8.7–Policy Action . . M M . Part D – FT Recurrent . Part A, 8,7 – HF aspects O ASA non-EASA and EASA PH, CA MO PH,

tives isthebasicstimulustobecertainaboutwhattest.◆ supported by an adequate briefing with clear declared mission objec- load management during the whole process. A well-planned mission, system assafeitshouldbe. compliance. Feedbacknon- of likelihood andthe less procedurethe gap, the closer The updaterisk. with increased related is is needed procedures the to and keep policy the the between gap The tasks. the conducting is staff end sharp that way real the represent how the staff must perform the tasks. The practices and the people biguity anddesignedintheformoffollowingrepresentation: following companydocumentation: the in included least at be should documentation natural The instructions. clear with involved staff the and crew flight the give must organization The place. take not does routine which relationship withthesafetyculture (seeReference 11). Figure 8.Thepolicy, procedures, practices,andpeopleits 2. Arthur Dijkstra, Arthur 2. 1.ICA References 11. 10.Safety Regulation Group, CAAFlight CheckHandbook, page12, 9. Regulation (CE) 375/2007, Permits to fly, refer to http://eur-lex.europa.eu/ /2003, 2042 (CE) Regulation 8. Safety7.Regulation Group,FlightCAA Check Handbook, 6.ICA 859/2008, (CE) Regulation 5. N. Woods, D. 4. 3. Italian Flight Safety Committee’s website www.itafsc.org/en/association/1_00_ 4, ICAO,2006. London U.K.,2007. Kingdom CivilAviation Authority, Issue2.2,April/2009. LexUriServ/site/en/oj/2007/l_094/l_09420070404en00030017.pdf. OJ:L:2003:315:0001:0165:EN:PDF. ment Civil Aviation Authority, Issue2.2,April2009. 1.3, ICAO,2006. 20:EN:PDF. LexUriServ.do?uri=Ceuropa.eu/LexUriServ/ ONSLEG:1991R3922:200809 concepts, Chapter12,Ashgate,2006. constitution.php. neering, ConceptsandPreconcepts,Chapter12,Ashgate,2006. Another key factor resides in a task prioritization and proper work- on instructions general the are procedures the and policy The The above documentation must be easy to read, eliminating am- de oa, aey y Design by Safety Rogan, Eddie O O Exposition,http://eur-lex.europa.eu/LexUriServ.do?uri=LexUriServ/ Doc. 9859, Safety Doc. 9859, Safety vsn dtr Resilience editor, Leveson . Hollnagel, D. Woods,D. N. Hollnagel, E. M M anagementSystem anagementSystem .A. 704 Continuous Airworthiness Airworthiness Continuous 704 M.A. S .3. ult Sse. http://eur-lex. System. Quality 1.035. OPS dl cus nts City notes, course Module gneig Cnet ad Pre- and Concepts Engineering, eveson editor,Leveson Resilience M M anual,1st anual,1st U E E dition,Chapter dition,Chapter nitedKingdom niversity of of University Manage- U nited Engi- Findings of Using Human Factors Analysis and Classification System

(HFACS) as a Tool for Human 2009 16, SEPT. , Factors Investigation Y By Yung-An Cheng, Thomas Wang, Jenn-Yuan Liu, Chi-liang Yang, and Wen-Chin Li

Thomas Wang is currently the director of the Flight the majority of aviation occurrences (see Reference 1). According Safety Division, Aviation Safety Council, Taiwan, to Boeing’s annual statistical summary, about 70% of aviation oc- ROC. He is a former airline pilot who flew the Airbus currences were related to the actions of flight crews, maintenance A300. Thomas joined the ASC as an aviation safety personnel, air traffic controllers, aircraft system engineers, or others. WEDNESDA investigator in 2000, primarily working on the flight It is obvious that investigation agencies need to put more emphasis operation and human factors investigation. on human factors (HF) in aviation occurrence investigations to explain how and why the occurrences occurred. Though the majority of aviation occurrence investigators are Yung-An Cheng is currently an engineer for the specialists in technique and operation, only a minority of them Photo Flight Safety Division, Aviation Safety Council, specialize in HF. In some cases in which the tangible technical not Taiwan, ROC. Cheng joined the ASC in 2001. His evidence was limited, they would enlist investigators who have available primary role is to investigate aerodrome and organiza- knowledge and skill in dealing with HF issues. The ICAO Human tional factors. He is also handling the voluntary Factors Digest (see Reference 2) suggests that providing intensive safety reporting system of the ASC. HF training to investigators will give them the essential knowledge and skill. Developing a uniform approach ton HF investigations is a universal goal of each investigation agency. However, the progress Jenn-Yuan Liu is currently an engineer for the Flight is relatively slow. Photo Safety Division, Aviation Safety Council, Taiwan, The Aviation Safety Council (ASC) is an independent government not ROC. She used to be an analyst for the Flight agency responsible for civil aviation occurrence investigations in available Standards Division, Civil Aeronautic Administration. Taiwan. Since May 1998, the ASC has conducted 63 investigations Liu joined the ASC in 2001, primarily working on and issued 420 safety recommendations. However, compared to the survival factors issue during investigations. NTSB, the ATSB, the TSB, and other well-developed occurrence in- vestigation agencies in the world, the ASC is still a young organization building up its investigation capacities, especially in HF aspects. Chi-Liang Yang is currently an associate engineer for Photo the Flight Safety Division, Aviation Safety Council, Current practices of HF investigation not Taiwan, ROC. He joined the ASC in 2003. In ad- To understand the current practices of HF investigation, a research available dition to participating in routine investigations, he is team from the Boeing Company (see Reference 3) surveyed 12 also working on the voluntary safety reporting system. aviation occurrence investigation agencies in 2006 and documented their approaches to human performance (HP) issues in investi- gations. In the survey, one inquiry was regarding the number of investigators or staff who have been formally trained as HP experts Dr. Wen-Chin Li is the head of the Graduate School (they have M.S., M.A., or Ph.D. degrees in HF-related fields), and Photo of Psychology, National Defense University, Republic the responses were considerably varied. In contrast to five agencies not of China, and a Visiting Fellow in the Department of that had no investigator trained in the HF field, two agencies had available Systems Engineering and Human Factors, Cranfield 10 personnel, and another two agencies had 6 personnel trained in University, United Kingdom. He is an aviation hu- HF field. Those agencies that have no HF expertise in house often man factors specialist for the European Association of hire consultants who have that expertise. Aviation Psychology and a registered member of the The survey also inquired about the types of HP training provided Ergonomics Society (MErgS). He and his co-authors won the prize for to the investigators. For four agencies, the HF training is a part of the best paper of the 2007 ISASI seminar. broader investigation courses. Another four agencies sent each of their investigators to a dedicated HF course. For the remaining four Background agencies, only a few investigators may receive some HF trainings. All kinds of data indicate that various human errors are involved in Another issue concerned in the survey was the procedures that

ISASI 2009 Proceedings • 57 ISASI 2009 PROCEEDINGS 58 The highest level, the fourth level of HFACS, is “organizational influ- supervisors. front-line the of level the to up acts unsafe producing is“unsafe supervision.” This level traces the causal chain level third The events. of sequence causal ofthe within events perform they that practices substandard the and operators of conditions dard substan- the addresses It acts.” unsafe for “preconditions concerns HFACS of level second The violations. and errors categories, two closely tied to the accident. Failures at this level can be classified into events under classifies the HFACS general heading of of “unsafe acts level of operators” first most The 1. Figure in diagrammatically each of which influences the next level. The framework is described of underlyingcauseshumanerror. inter-relationships,their and failures identification the facilitates it occurrences. Given that the system focuses on both latent and active based tool for identifying and classifying the human errors in theoretically aviation a with professionals safety providing by practice and theory between gap the bridges HFACSframework the that claim Shappell and Wiegmann structures. regulatory and management to related are and organization the of levels upper the in spawned tors have a direct impact on safety. local factors to breach the system’s defenses. Active failures of opera- system for a period of time are triggered when combined with other complexasystem. in failures are associated with the of performance front-line operators active the model, this error.In human of model (1990) Reason’s and analysis of human factors aspects of accidents. It is based upon for developed originally framework error human generic a is 4-6) References (see System Classification Human Factors Analysis and System and Classification H community. arevery rare in the aviation documents investigation U became a potential solution. quiring it from out-sourcing ac- themselves, by guidance develop the HF investigation to unable seem expertise Sinceagencies with less HF develop. can agencies the investigationguidanceHF theagencies had, the more thatthe more HF expertise revealed survey The issues. HP investigating in them general guideline that aided investigationan manualor had agencies the of some document at all; meanwhile the 12 agencies had no such of some that indicated sults the HP investigation. The re- agenciesprovided guideto nfortunately,practical HF uman Factors Analysis HFACS (see References 6-8) addresses human errors at four levels, • ISASI 2009 ISASI .S. military aviation as a tool for the investigation investigation the for tool a as aviation military U.S. Proceedings L atentfailures dormantthatliewithin the Figure 1.TheHFACS framework(adoptedfrom ShappellandWiegmann, 2007). L atent failures in the system are the great gains in reducing aviation accidents could be achieved by that indicated study the of results The pattern. similar a onstrated the with comparison The errors. perceptual and violations errors, decision by followed errors, skill-based were TheAustralian results showed that the most prevalent unsafe acts well as the conditions and actions of front-line operators. well astheconditionsandactionsoffront-lineoperators. levelsofmanagement that directly affect supervisory practices, as upper in decisions fallible of contributions the describes It ences.” in the in andto compare them with the unsafe acts of aircrew in accidents Australian in aircrew of acts unsafe the analyze to tool HFACSa as accidents occurring in the of sample larger a against results compare and accidents aviation cally analyze the types of human error occurring in Australian civil the with comparison and accidents aviation Australian of analysis factors “Human on study a ducted (see References11-12). analysisonTaiwanese military andcommercial aviation accidents hasalso successfully been used andproven itsapplicability tothe dents in a different cultural context. In recent years, the framework acci- of analysis regarding applicable is inter-raterand of reliability 11)demonstrated thattheHFACS framework highhasdegreea general aviation (see References 9-10).regarding the analysis of accidents in demonstrated been also had applicability Its operations. aviation for developed and designed originally was HFACS Applications ofHFACS n 07 te utain rnpr Sft Bra (TB con- (ATSB) Bureau Safety Transport Australian the 2007, In .S. based on 10 years of Australian and Australian of years 10 on based U.S. U.S. (see Reference 13). This study used U.S. commercial aviation and ie Sae” o systemati- to States” United L i and Harris (see Reference .S. accidents dem- accidents U.S. .S. accident data. data. accident U.S. .S. military military U.S. reducing skill-based error. Moreover, improvements in aeronautical consequently not be able to classify the unsafe acts correctly. decision-making and the modification of risk-taking behavior could In addition, the report stated that the pilot maintained a heading reduce aviation fatalities. instead of following the QRH to initiate the emergency descent in Although there are many applications of the HFACS methodology a turn. Since there was no description of “why” the pilot did not now being reported, many aviation occurrence investigation agencies initiate the descent in a turn to avoid interfering with other traf- do not adopt HFACS as a tool for HF investigation. The Department fic, increase descent rate, and diminish the negative G force, such of Defense (DOD) of the United States is now one of the few organi- as “pilot focused on other matters and then forgot to initiate the zations that has formally adopted HFACS as a mishap investigation descent in a turn” or “pilot decided not to initiate the descent in and data analysis tool. Drawing from Reason’s and Wiegmann and a turn for some reason,” the research team, as well as the general Shappell’s concepts of active failures and latent failures, the DOD readers, cannot determine whether this unsafe act is a skill-based , SEPT. 16, 2009 2009 16, SEPT. ,

(ref. 14) developed a new taxonomy to identify hazards and risks error or a decision error. Y called the DOD Human Factors Analysis and Classification System The research team also discovered that in some reports, though (DOD HFACS). The DOD has issued a DOD Human Factors Guide the pilot’s unsafe acts have been clearly pointed out, the factors to explain procedures for using DOD HFACS for all DOD persons contributing to these unsafe acts, the upper levels of the HFACS who investigate, report, and analyze DOD mishaps. were not completely considered or mentioned. For example, one of the reports stated: The pilot did not make stan- The ASC’s study dard callouts to exchange critical information and execute cross check after the In 2008, a small research team was formed within the ASC to evalu- TCAS traffic advisory (TA) warning been announced (note: translated from ate the feasibility of using HFACS as a tool for HF investigations. Chinese). After reviewing the CVR transcript, the research team found WEDNESDA Three engineers with basic HF training were selected as the analysts the flight crew also received an ATC instruction right after the TCAS and then sent to a 3-day HFACS training course instructed by the TA warning, and the TCAS resolution advisory (RA) warning was developers of HFACS to familiarize themselves with knowledge of issued 5 seconds after the ATC instruction. The circumstances that the framework. After receiving the formal training, the three analysts the flight crew faced at the time all happened in rapid succession, classified both latent and active failures of 30 investigation reports, thus the research team believed there should be a factor regarding including 21 commercial aircraft occurrences, 5 general aviation “insufficient reaction time,” level 2 of the HFACS taxonomy that occurrences, and 4 government aircraft occurrences conducted by contributed to the flight crew’s unsafe acts. However, this influential the ASC between 1999 and 2007. precondition of the pilots’ reactions to the TCAS TA situation was In each report, flight operational failures related to HF were clas- not discussed in the report. sified by each analyst independently by using the HFACS checklist As recommended in Chapter 6 of ICAO Annex 13, the body of for aviation. The results of the classification were compiled and the ASC’s occurrence investigation report comprises four chapters: unified in the end by eliminating discrepancies through discussion. factual information, analysis, conclusions, and safety recommenda- The analysts were allowed to consult senior investigators about the tions. Most of the general readers only read the conclusions, Chapter details of the occurrences during the process. 3 of the investigation report, because they do not have the time or patience to read it entirely. For this reason, the conclusions of the in- Results and discussions vestigation report must be complete and consistent when compared The following are some preliminary results of the study. to the factual information and analysis, Chapters 1 and 2. After reviewing the ASC’s previous occurrence reports, the The research team used the HFACS to classify failures in Chapter research team found that some actions or behaviors of the pilot 1, 2, and 3 separately, and then compared the classification results can only be recognized as “unsafe acts,” i.e., level 1 of the HFACS of Chapter 1 and 2 with Chapter 3. By doing this, the research team taxonomy. Those actions or behaviors could be fitted into the sub- hoped to recognize whether the content in Chapter 3 is complete, categories of “unsafe acts,” because the research team was unable to systematical, and sufficient to represent the whole report. classify those actions or behaviors further, such as skill-based errors, The results of the comparison showed that investigators may decision errors, perceptual errors, and even routine or exceptional leave out some information during the process of condensing the violations. This is mainly because of the insufficiency of information conclusions from the factual and analysis information. For example, in the reports, which could result from investigators’ writing as well one conclusion in the report stated: After the aircraft developed a stall as integrating techniques, or the incompleteness of factual data and an abnormal attitude, the recovery maneuvering did not comply with collection in the initial stage of the investigation. the operating procedures and techniques for recovery of unusual attitudes. In For example, one of the ASC’s reports stated The flight crew did not Chapter 2, the analysis section of the report, there were descriptions follow the standard procedures to initiate a turn when conducting the “EMER of pilot’s unsafe act during abnormal attitude recovery maneuvering DESCENT” procedures. This finding clearly stated that the flight crew as well as the preconditions contributing to it. However, in Chapter did not follow the procedures. Was it an error? Could it be a viola- 3, the conclusions did not include all information except for the tion? According to Reason (1990), errors represent the mental or unsafe act of the pilot. If a reader reviews the conclusions only, he physical activities of individuals who fail to achieve their intended or she will not have a complete picture of what really happened and outcome. Meanwhile, violations signify the behaviors of willfully dis- why the pilot conducted the unsafe act. regarding the rules and regulations that govern the safety of flight. The difference between errors and violations is the “intention” of Benefits of applying HFACS to occurrence investigation the operator. When applying HFACS, the first step is to classify the Based on the preliminary results of the study, the research team unsafe act either an “error” or a “violation.” If the “intention” of the believes that HFACS may benefit the investigations in the follow- operator was not described in the report, the research team would ings ways.

ISASI 2009 Proceedings • 59 ISASI 2009 PROCEEDINGS 60 Currently, HFACS has some limitations when being applied to HF in- HFACS limitations volved intheinvestigation.Figure 2isanexampleofthediagram. in- parties all for platform communication a provides also diagram sis and conclusions to see if theyreport. Investigators can examine werethe logic and allconnections of analy- supported by evidence.indicate The the relationship and sequence within various factors in the Events andCausalFactorsAnalysistechnique,forexamination. the as such techniques, analytical some with model HFACS the ate causes were considered in the report, investigators can integrate from factual data and analysis. To ensure all underlying and immedi - the causal factors and derive the In the conclusionsfinal stage of the investigation, investigatorsand need to determine recommendations Examining theintegrityandlogicalityofreport sential informationcantheycompletetheclassification. violation. routine or violation, to determine if it was a skill-based error, decision error, exceptional insufficient is information the that found team research the work, However,HFACSinto act unsafe this classify to frame- trying when steering is not intended for speeds above 20 knots. the body gear steering. Meanwhile, the operations manual states the body gear using by turn left the initiated pilot-in-command the when knots 76.8 near and stopped on the grass strip. onto the taxiway. The aircraft consequently hit a protruded concrete manhole body gear steering. The pilot-in-command, however, failed to turn the aircraft the using by runway the exit to attempted pilot-in-command remaining,the areas needfurtherattention. what realize may investigators pause, a After needed. is collection data factual more acts, unsafe those sion, and organizational influences of or finding the- preconditions, supervi acts. If there are difficulties classifying ly utilize HFACS to classify the unsafe factual data, investigators can tentative- of amount certain a collecting After factual datacollection Confirming thecompletenessof lecting HF-relatedinformation. col- while investigators the to helpful anticipates this checklist would be very couldbefeasible. The research team Human Factors Digest (see Reference 2) other checklists described in the integrating and framework HFACS on based checklist investigation HF a Developingthem. amongtionships rela- causal describes and theories HF various encompasses framework HFACS 19-category four-level, The checklist Developing aHFinvestigation Drawing a diagram of HFACS classification results can clearly clearly can results classification HFACS of diagram a Drawing roll. landing Obviously,the during pilot’sact a unsafe was there According data flight the to recorder, ground the aircraft the of speed was During the landing roll of the Boeing 747, with half length of the runway Let’s lookatanexample. • ISASI 2009 ISASI Proceedings nly if the analysts learn more es- more learn analysts the if Only ICAO ICAO Figure 2.AnexampleofdrawingadiagramHFACS classification results.

to the occurrences. Those external organizational issues should to theoccurrences.Thoseexternalorganizationalissuesshould tors, manufactures, and other providers service that may contribute the civil aviation system, there are still many external, such as regula- connections among factors, yet it focuses on internal affairs only. In points out what investigators should pay attention to and clarifies the It organization. one within are systems operational all which in use vestigations. First of all, it was originally designed for military internal tion experiences. The ASC HFACS research team has learned a a learned has team research HFACS ASC The experiences. tion investiga - and development HF latest the to according contents its framework. Safety investigators should continually review and quality ofthefinalreports. updateand integrity the also but processes, analysis and collection data HF of comprehensibility the on only not it, on based checklist the reap great benefit by can applyingASC the that believes team theresearch The conceptusage. and purpose of HFACS investigation for anddetailed adoptingand complete more is HFACS models, social,and organizational perspectives, such as Reason and SH theories developed from cognitive, or behavioral, aeromedical, approaches psycho- analysis HF well-known some to Compared able. the gathering ofevidence. prioritize and organize them help and issues factors human relevant the of investigation the of thoroughness the verify them help can checklists investigators with less experience or little HF training background, human factors, of investigation the conducting and organizing arein checklists aids useful checklist-based due to the complexities of the occurrence. However, been told and learned that occurrence investigation is not generally veloped their capabilities for knowledge from years of conducting occurrence investigations de- collecting evidence. They probablychecklistsduring specific theinvestigation.have use ever, Accumulated if rarely, experience investigators experienced and the of Most Conclusions As mentionedAs thedeveloperby theHFACS,of “fix”notaisit adopt- and understandable quite is HFACS the of concept The as stated in the ICAO Digest (see Reference 2). For those EL lot through the process and will keep refreshing its knowledge to 6. Wiegmann D.A., and Shappell S.A., A Human Error Approach to Aviation improve its investigations. The team values this experience and has Accident Analysis-The Human Factors Analysis and Classification System: Aldershot, England, Ashgate, 2003. the desire to study further. ◆ 7. Shappell, S., Detwiler, C., Holcomb, K., Hackworth, C., Boquet, A., and Wieg- mann, D., Human Error and Commercial Aviation Accidents-An Analysis Acknowledgement Using the Human Factors Analysis and Classification System: Human Factors, 49, 227-242, 2007. This project is supported by a grant from the National Science 8. Li, W.-C., Harris, D., and Yu, C-S., Routes to Failure-Analysis of 41 Civil Aviation Council of Taiwan (NSC 97-3114-P-707-001-Y). Authors would like Accidents from the ROC Using the HFACS: Accident Analysis and Prevention, to express their appreciation to the NSC and the ASC for providing 40(2) 426-434, 2008. 9. Wiegmann D.A, and Shappell S.A., A Human Error Analysis of General Avia- a financial endowment to carry out this research. tion Controlled Flight into Terrain Accidents Occurring Between 1990–1998: Report No. DOT/FAA/AM-03/4. Federal Aviation Administration, 2003. 10. Wiegmann D.A., and Shappell, S.A., HFACS Analysis of Military and Civilian 2009 16, SEPT. , References Aviation Accidents- a North American Comparison: ISASI 2004. Y 1. Wiegmann, D.A., and Shappell, S.A., The Human Factors Analysis and Clas- 11. Li, W.C., and Harris, D., HFACS Analysis of ROC Air Force Aviation Accidents- sification System (HFACS): Repot No. OD T/FAA/AM-00/7. Federal Aviation Reliability Analysis and Cross-Cultural Comparison: Int. J. Appl. Aviat. Stud. Administration, 2000. 5, 65–81, 2005. 2. ICAO Human Factors Digest No. 7, Investigation of Human Factors in Accidents 12. Wen-Chin Li, Hong-Tsu Young, Thomas Wang, Don Harris, and Lon-Wen Li, and Incidents: 2. ICAO Circular 240-AN/144, 1993. Approaches of Aviation Accident Investigation in Different Cultural Contexts 3. Mumaw, R., Industry Working Group for Enhancing the Investigation of from Human Factors Perspectives: Journal of Aeronautics, Astronautics and Human Performance Issues: ISASI 2006 Annual Air Safety Seminar, Mexico, Aviation, Series A, Vol.41, No.1, pp.053–060, 2009. 2006. 13. ATSB Transport Safety Investigation Report. Human Factors Analysis of 4. Wiegmann, D.A., and Shappell, S.A., Applying Reason: The Human Factors Australian Aviation Accidents and Comparison with the United States: Report

Analysis and Classification System (HFACS): Human Factors and Aerospace No. B2004/0321. Aviation Research and Analysis Repot, 2007. WEDNESDA Safety I(I), 59-86, 2001. 14. Department of Defense Human Factors Analysis and Classification System: 5. Reason, J., Human Error: Cambridge University Press, 1990. Published by DOD of United States, January 2005.

ISASI 2009 Proceedings • 61 ISASI 2009 PROCEEDINGS I National Transportation Safety Board and the United psychologist andaccidentinvestigatorforboththe aviation Statesan as Navy.served tive psychologyin1992from Texas ChristianUniversityandformerly in Urbana-Champaign.Dr. received Wiegmann hisPh.D. incogni- been anassociateprofessor ofhumanfactorsattheUniversityIllinois atMayo. Aprivatepilot,Dr.diovascular Surgery hasalso Wiegmann Medical Branchin1990. psychology and a Ph.D. in neuroscience from the University of Texas Wright State University graduating summa cum laude with honors in and fatigue.Dr. Shappellreceived aB.S.inpsychology(1983)from investigation, system safety, spatial disorientation, sustained operations, more than200papers,books,andpresentations inthefields ofaccident some processfor monitoringchangesinthe system. and interventions, of implementation and identification hazards, of identification real-time the involving process dynamic a is this gies, intervention implementation, and system monitoring. Ideally, strategies to address specific hazards, an assessment of those strate- intervention of identification assessment, hazard identification, hazard acquisition, data components: following the include safety are several variations to the basic approach, mostfieldthe system have turned models a safetyto answers.for of While theresystem & Shappell,2003). remained between 70% and 80% (O’Hare et al., 1994; Wiegmann but the percentage of aviation accidents due to human mechanical factorsfailures has decreased has remarkably over the past 40 years, age (and absolute number) of aviation accidents attributable solely to 62 To address the human component of aviation safety, many in in many safety, aviation of component human the address To • with accidents and incidents. This may be because the percent- onthe evaluation and assessment of human factors associated n recent years, the aviation industry has focused more and more Safety Process: The ISASI 2009 ISASI By Dr. ScottShappell,Professor, ClemsonUniversity, Clemson,S.C.,andDr. DouglasWiegmann, Closing the Loop on the System experimental psychologist He has published/presented more than 16 years in the U.S. Navy as an aerospace space Medical Institute. In addition, he has served for Factors Research BranchmanagerattheCivilAero- faculty at Clemson, Dr. Shappell was the Human neering at Clemson University. Before joining the Dr. ScottShappellisaprofessor ofindustrialengi- and patientsafetyresearch withintheDivisionofCar- where he also served as the director of human factors map Scholar at the Mayo Clinic College of Medicine hewasaNationalInstitutesofHealthRoad- Wisc., of Wisconsin. Before joining the faculty in Madison, industrial andsystemsengineeringattheUniversity Dr. DouglasA.Wiegmann is an associate professor of Proceedings Intervention Associate Professor, UniversityofWisconsin,Madison,Wisc. M Wiegmann andShappell,2003. pendix A. For a complete description of the HFACS framework, see Ap- in included is category each of description brief A influences. organizational 4) and supervision, unsafe 3) acts, unsafe for tions precondi- 2) controllers), traffic air and personnel, maintenance factors at each of four levels: 1) unsafe acts of operators (e.g., aircrew, human describes that error human of model derived theoretically Reason’s (1990) “Swiss cheese” model of human error, HFACS is a associated with general aviation (GA) accidents. Based, in part, upon Classification and Analysis Factors System Human the (HFACS) using began as FAA a tool the to 1999, examineIn human factors General aviationhazardidentificationandassessment 2005. al., et Wiegmann by described 2000, and 1990 between occurring amination of more than 14,000 GA human-factors-related accidents ex- the was above referenced work of body the of Representative Identification ofGAhazards considerably higher for fatal accidents. In fact, the data suggest that equal,proportionthe accidents of associated withviolations was relatively was errors perceptual and decision, skill-based, with ated leading totheaccident. or just the first human cause factor in the temporal chain of events errorwas evident whether one looked at all human causal factors with considerably fewer accidents. associated were disorientation) spatial and illusions visual to due (often errors perceptual contrast, In rules. the of violations with at least one decision error and a little less than 20% were associated After all, nearly a third of all fatal GA accidents were associated with say that poor decisions did not figure prominently in GA accidents. in roughly four out of every five accidentsimplicated been accidents—having GA with associated sinceerror man 1990. This is not to emerged (seeFigure1,followingpage). & Shappell,2001a,2001b,2003;Wiegmannetal.,2005). Wiegmann 2006; al., et Shappell 2004; 2003c, 2003b, 2003a, 2001, Wiegmann, & Shappell 2006; al., et (Detwiler years several last the over FAA the by conducted data accident GA of investigations of medicine.andoil, Particularly mining, seriesgermanea reportthis rail, isto like environments industrial high-risk other as well TransportationSafety Board, Air Canada, and Alaska Airlines), as and Indian Air Force) and civilian aviation settings (e.g., Australian U.S. Army, Corps, HFACS has since been employed in a variety of military (e.g., Originally developed for use with the Finally, while the percentage of fatal and non-fatal accidents - associ hu- of form prevalent most the were errors skill-based Second, atrix ( U H sing the HFACSframework,thesing several interesting findings U.S. Air Force, Royal Dutch Air Force, Hellenic Air Force, uman Factors H FI Moreover, this pattern of human X United States Navy/Marine )

, SEPT. 16, 2009 2009 16, SEPT. , Y

Figure 2. The Human Factors Intervention matriX (HFIX). For simplicity, only the four unsafe acts are illustrated. Figure 1. Percentage of accidents associated with at least one instance of a given unsafe act. Note that because each accident Aircrew Unsafe Act Frequency (Percentage) WEDNESDA can be associated with multiple causal factors, the percentage of Skill-Based Errors accidents for a given year will not equal 100%. Directional control on the ground 2,345 (12.9%) Airspeed 2,008 (11.1%) Stall/spin 1,400 (7.7%) pilots who violate the rules and are involved in an accident are four Aircraft control in the air 1,359 (7.5%) times more likely to perish or fatally injure someone. This latter find- Compensation for wind conditions 1,179 (6.5%) Total Skill-based Errors Committed 18,136 (100%) ing was particularly striking since pilots are repeatedly told that the Decision Errors “rules are written in blood”—a lesson apparently true even today. Inflight planning/decision-making 1,061 (18.2%) Takeoff/landing from unsuitable terrain 431 (7.4%) Assessment of GA hazards Preflight planning/making 393 (6.7%) Refueling 367 (6.3%) The next logical step was to assess the hazards within each HFACS Go-around 354 (6.1%) error category (e.g., skill-based errors, decision errors, perceptual Total Decision Errors Committed 5,845 (100%) errors, and violations) and which errors were most common. A Violations summary of the GA hazard assessment is presented in Table 1. The VFR flight into IMC 269 (10.7%) numbers alone would seem to imply that the largest threat to GA operating with known deficiencies 269 (10.7%) Failure to adhere to procedures/directives 260 (10.4%) safety are skill-based errors like directional control on the ground Flight into known adverse weather 223 (8.9%) (e.g., ground loops) as well as concerns regarding control of air- Aircraft weight and balance 162 (6.5%) speed and flight controls leading to inadvertent stalls/spins.E qually Total Violations Committed 2,503 (100%) important, however, were inflight planning and decision errors, as Table 1. Specific Types of Errors Associated with were violations associated with visual flight rules (VFR) flight into General Aviation Accidents1 instrument meteorological conditions (IMC), particularly given 1 Perceptual errors are not shown due to the low frequency. the emphasis within the FAA on reducing fatal GA accidents (FAA, 2006). Notably, while the loss of directional control on the ground HFIX employs five broad areas around which interventions can be occurs quite frequently, it typically does not result in fatalities. By developed: 1) organizational/administrative, 2) human/crew, 3) comparison, stalls/spins, errors associated with inflight planning/ technology/engineering, 4) task/mission, and 5) operational/physi- decision-making, and VFR flight into IMC may not occur as fre- cal environment. Each is briefly summarized in Table 2. For a more quently but are often fatal when they do. complete description, please see Shappell & Wiegmann, 2006. In effect, by mapping prospective interventions onto the HFIX GA intervention identification and assessment matrix, it would be apparent to senior officials within the FAA the It would appear that with the addition of tools like HFACS within the breadth of a proposed safety program (i.e., is the program uni- or mul- human factors system safety process, we might be better able to iden- tidimensional?) and the exact aspects of human behavior that were tify and assess hazards associated with GA operations using existing targeted. Given that human error is, by its very nature, complex and NTSB accident records. The next step in the human factors system multidimensional, it seems reasonable that any strategy for addressing safety process is to identify and assess current, planned, and other it would likewise be multidimensional and represent a “strategy” or potential interventions to address the hazards identified above.O ne “program,” rather than an individual intervention, per se. system safety tool that may assist in that process is the Human Factors In addition, HFIX could be used proactively to determine which Intervention Matrix (HFIX; Shappell & Wiegmann, 2006). areas an organization has “covered” and where gaps exist given The HFIX tool contrasts the causal factors identified within current trends in the error data. For instance, if decision-makers HFACS against five approaches to accident intervention and miti- knew that the largest threat to GA safety was skill-based errors (as gation identified in the literature (see Figure 2). While a complete was shown above), followed by decision errors, violations, and per- description of HFIX is beyond the scope of this review, in general ceptual errors, HFIX could be used to determine if proposed and

ISASI 2009 Proceedings • 63 ISASI 2009 PROCEEDINGS 64 associatedwere decisionwithinterventionserrors,the 72.6%of accidents examined. Indeed, while roughly a third of the accidents GA the of 80% nearly for account errors skill-based where error of ferentfrom the percentage of accidents associated with each type (37.6%) and violations (26.9%). These numbers are noticeably dif- roughly half of the recommendations with associated were errors skill-based contrast, In examined. followedtion by perceptualrecommenda- JSIT four every errorsof out three nearly with associated entirely surprising that aimed interventions at decision errors were those obtainedfromtheJSITs didso. of third a nearly human/crew, the with changes targeted directly recommendations few relatively where However,NTSB the unlike approaches. technological/engineering involved ommendations interventions. administrative organizational/ involved recommendations JSIT the of third a NTSB recommendations (Wiegmann & Rantanen, 2003), roughly addressedmorethanoneaircrewunsafeact. many interventions would impact. This latter task intervention the felt they violations) and errors, perceptual errors, could involve multiple decision errors, skill-based categories,(i.e., categories acts HFACSunsafe any since identify to instructed were raters the addition, In approaches. tion Team (JSIT) recommendations into one of the five HFIX- interven independently classified more than 600 Joint Safety Implementation with aviation experience and graduate-level human factors training to beaddressed. knewexactly what type of skill-based error or other unsafe act was possible to refine intervention identification andwhich areas are currently assessmentbeing targeted. Furthermore, it would be if one have the potential future to interventions address those needs and Table 2.BriefDescriptionofHFIXInterventionCategories included isthetrainingofpersonnelinhandlingemergencies. Training: Reviewing, developing, and implementing trainingHuman/Crew programs. Also vibration, lighting,andeliminatingtoxinstoimproveperformance. (e.g., weather, altitude, terrain) or the Operational/Physical Environment:ambient Modificationstotheoperationalenvironment environment, such as heat, Operational/Physical Environment safety checks. ing such day-to-day operations as inspecting Inspection: Maintenanceinspections,overhauling,fuel, detectingdamageinclud- oil level, and recommended or repairofpartsandequipment. Also included is the modification, replacement,Design/Repair: Specific removal manufacturing and/or installation changes including theTechnology/Engineering design of parts. checklists, andotherinstructionsorguidance. Manuals: Reviewing, revising, issuing, and modifying andmanuals, validating bulletins, procedures. Procedures: Amending,reviewing,modifying,revising,establishing,developing, Task/Mission validate methodologies,etc. technological advancesorcallforspecialstudiestoreviewprocesses,develop/ Research/Special Study: Conducting research to determine the impact tionsof recent regarding collection of data, issuing information,ing, archiving,andpublishinginformation.Alsoincludedarerecommenda- and reporting activity. Management/Communication:Improvementsindisseminating,stor Information reviewing policies,rules,orregulations. Rules/Regulations/Policies: Issuing, modifying, establishing, amending, for additionalpersonnel,andtheevaluationofindividualskillsemployees.and/or Human Resource Management: Adequacy of staff in specific situations, theOrganizational/Administrative need As for what types of aircrew unsafe acts were targeted, it was not not was it targeted, were acts unsafe aircrew of types what for As The findings demonstrated that as with an earlier examination of Toassess these proposed safety programs, 18 graduate students • ISASI 2009 ISASI Proceedings kws, ay 2.% o te rec- the of (22.2%) many Likewise, - GA aircrew are engaged in or the environments they are exposed to operations of type the of examination Perhapscloser with. a faced specific task/mission of the aircrews or the environment they were proaches foraddressingperceptual errorswerebelow10%. violations). (i.e., regulations and rules engineeringapproaches dealing with the willful disregard for the technology/ and human/crew were for accounted not were What man/crew, and technology/engineering approaches were included. the remaining boxes among the organizational/administrative, hu- contained between 10-20% of the possible interventions, nearly all of mayhavebeenoverlooked. viable, interventions equally potentially other, that just effective, be not would egories containedwithinthesecat- committees. Notthattheinterventions than a broad approach to accident intervention/mitigation by these to affectmultipleHFACS unsafeacts. will not add up to 100% because each intervention can be judgedthe JSIT interventions. As before, the percentages within the matrix of more or 20% contained error) skill-based by human/crew and error, decision by human/crew error, decision by administrative (organizational/ framework HFIX the within elements possible unsafe20actscategoryseen,the threebeof(Figurecan As 3). tervention within both the intervention approach and the HFACS of thisapparentincongruitymaybewarranted. review additional that suggests here presented analysis global the Regardless, error). skill-based a for up pilot a set can decision bad a (e.g., another to lead may error of type one is, That orthogonal. decision-making. pilot address naturally may interventions more Besides, another. than reduction. After all, their targeting itrecommendations of percentage maythe and category take more effort to error addressgiven a with associated accidents of percentage the between one error form appeared totargetpilotdecision-making. not. Seethetextaboveforanexplanation. will add up to 100%, those across categories of unsafepercentage ofrecommendations across intervention approaches acts will intervention approach andHFACS unsafeact.Notethatwhilethe Figure 3.Thepercentage ofJSITrecommendations classifiedby E It is also interesting to note that if one examines the elements that O in- each however,of important, Perhapsmapping more the was This is not to say that there should be a one-to-one relationship qually notable was the general lack of interventions targeting the n the surface, this appears to reflect a somewhat narrow rather ikewise, human errors are not necessarily necessarily not are errors human Likewise, ikewise, administrative ap- administrative Likewise, would prove fruitful in the development of additional interventions. Regardless, these findings suggest that there may have been options that were not considered as important by these select committees.

Examination of current safety programs While the HFIX analysis of JSIT data examined future safety pro- grams, a similar analysis of the FAA’s National Aviation Research Program (NARP) would provide the best estimate of current safety programs. That is, the NARP describes current research, engineer- ing, and development (R, E, & D) programs aimed at the develop- , SEPT. 16, 2009 2009 16, SEPT. ,

ment and validation of technology, systems, design, and procedures Y that directly support six of the agency’s principal operational and regulatory responsibilities: acquisition, air traffic services, certifica- tion of aircraft and aviation personnel, operation and certification of airports, civil aviation security, and environmental standards for civil aviation. Of particular interest to this analysis were those R, E, & D programs with potential use within GA. Figure 4. Percentage of R, E, & D programs classified by inter­ In much the same manner as the study examining future safety vention approach and specific HFACS unsafe act addressed. Note programs, 42 FAA aviation safety inspectors (n=33), air traffic con- that while the percentage of recommendations across intervention WEDNESDA trollers (n=3), and managers (n=6) attending a weeklong Depart- approaches will add up to 100%, those across categories of unsafe ment of Transportation-sponsored human factors accident investi- acts will not. See the text above for an explanation. gation course were asked to independently classify 273 separate R, E, & D programs funded between 1999-2005 into one of the five HFIX intervention approaches. In addition, the participants were instructed to identify any HFACS unsafe acts categories they felt the intervention would impact. The one notable difference between the studies was that in this study the data set was randomly parsed so that at least five (but as many as nine) respondents independently reviewed each R, E, & D program. A simple majority was required for any category to be counted. Another important difference was that rather than targeting GA safety alone, many of the R, E, & D programs were aimed at both GA and air carrier aviation. Instead of trying to distinguish which particular type of operation a given program currently targeted, all human factors programs were considered. This was done because many successful air carrier safety programs, like LOSA and FOQA, have potential uses within GA. As with the JSIT (future program) analysis, nearly a third of the R, E, & D programs involved organizational/administrative approaches Figure 5 that focused on such things as developing non-precision global positioning sensor (GPS) routes for emergency medical facilities would be affected by a given R, E, & D program. and establishing certification standards for GA auto navigation and When mapping the NARP R, E, & D programs onto both the control systems using pilot performance data and flight simulation. intervention approach and HFACS unsafe acts category some Considerably fewer R, E, & D efforts were human-centered (15%) similarities with the JSIT data emerged (see Figure 4). For instance, while decidedly more utilized technology (more than 40%) to organizational/administrative approaches that target pilot decision- improve safety. Obviously, technology that provides pilots better making accounted for a large percentage (21.6%) of the R, E, & weather information in flight can increase aviation safety. How- D efforts examined. However, nearly a third of the R, E, & D ef- ever, developing programs that train pilots to recognize hazardous forts focused on some sort of technology aimed at improving pilot weather and make judicious inflight decisions might also be of use. decision-making—some 17% higher than that seen with the JSIT Like the JSIT interventions, few R, E, & D efforts targeted changes recommendations. Surprisingly few interventions targeted violations within the task/mission or operational/ physical environment. of the rules—less than 10% across the board and less than 5% if The R, E, & D efforts associated with the HFACS unsafe acts organizational/administrative approaches were not considered. As were surprisingly similar to those proposed by the JSITs. The over- with the JSIT interventions, very few R, E, & D programs examined whelming majority (71.8%) of the R, E, & D efforts targeted pilot targeted improvements associated with the task/mission or the decision-making with decidedly fewer targeting skill-based errors operational/physical environment. (40.3%) and perceptual errors (34.4%). Perhaps most surprising In an effort to evaluate the entire spectrum of safety programs in the analysis of R, E, & D programs was the finding that very few (those currently in place, under development, or proposed for the (less than 15%) were aimed at violations of the rules. Remember, future) the two matrices were combined. Judging from Figure 5, the the SMEs were permitted to identify all the unsafe acts that they felt largest share of safety initiatives is targeting decision and skill-based

ISASI 2009 Proceedings • 65 ISASI 2009 PROCEEDINGS 66 the likelihood that a pilot would initiate flight into adverse weather participants were instructed to generate programs that would reduce approach human/crew the to assigned if instance, For possible. as approach particular that within interventions many as generate to sizes. (FAA), andAlaskaAirlines. portation Safety Institute (TSI), the Federal Aviation Administration (ERAU), the Canadian Helicopter Corporation (CHC), the Trans- AeronauticalUniversity enlisted fromfivelocations:Embry-Riddle administrators,government regulators, and aviation faculty) were lots, aerospace engineers, air traffic controllers, mechanics, aviation variety of aviation specialties (i.e., pilots, flight a instructors, studentin pi- expertise with participants 218 development), (intervention enlistedthesupport ofseveral aviation experts. Inthefirst phase evaluationmodewe tion moderatherthansimplyanintervention & Shappell,2005;NTSB,2005). Faaborg Detwiler,Holcomb, Boquet, Wiegmann, 2006; Shappell, & Wiegmann, Hackworth, Holcomb, Boquet, (Detwiler, weather accidentsfatalinvolvedthoseencountersadverse withof many 20% involved fatalities (Shappell & Wiegmann, in press). Tragically, roughly which accidents—of in involved been have aircraft (GA) aviation general 40,000 nearly years, 20 last the During weather. O generationandevaluationusingHFIX Intervention development. intervention beone area that would benefit from may a morethis creativereasons, the of approachRegardless explored. to be to remains issue addressing violations or a need for a more creative approach to with the associated difficulties inherent reflect simply may findings ment approaches may not be the only answer. In other words, these enforce- that concern the and/or levels of variety a at compliance ensuring in invested FAAheavily the is that fact the to due be may few programs addressing the issue using different approaches. This relatively were there view, of point organizational/administrative 10% of the JSIT and NARP programs addressed violations from an rules such as continued VFR flight into IMC. While just more than with technologythattargetedpilotdecision-making(18.6%). type of error. with only slightly fewer crew-centeredtional/administrative approaches that target pilot decision-making approaches targeting theIndeed, nearly one samequarter of the safety programs involve organiza- latter. the than attention more occupying former the with errors Table 3.Top 10InterventionsbyAverage onaScaleof1“Worst” to5“Best” Standardize initialflighttrainingthatcoversVFRintoIMC. Intervention Require spatialdisorientationtrainingforallpilots. Make VFRintoICtrainingaspecialemphasisonthebiennialflightreview. Conduct awarenesstrainingwithingroundschoolthatdemonstratesflightinweather Include trainingontheimportanceofcommunicationandradiocallsforitemsthatmay Require thatinstructorsareabletocompleteallthemaneuverstheyteach. Add aweatherupdatetotheenroutechecklist. Create anincentiveprogramthatteamswithinsuranceprograms. Mandate minimumstandardsandtrainingforallequipmentusedinanaircraft. Include trainingondecision-makingversusskillindealingwiththe (e.g., videosofA/Cexceedingstructuralcapabilities). seem trivialorembarrassing(e.g.,informingATC thatunfamiliarwiththearea). hazards offlyinginIMC. ne area of particular flight adverseofinto areaFAAis interestnethe to At each location, participants were split into five groups of similar genera- intervention an in used be can HFIX how Toillustrate the violationsof atinitiatives aimed few Notably, were there • E ISASI 2009 ISASI ach ach group was assigned a particular approach and instructed E ven the third most populated element was associated Proceedings

4.8 4.6 4.4 4.4 4.0 4.4 3.8 4.2 4.2 4.0 come tothetop. may interventions different characteristic, given a weighs one how effective, the top-rated interventions may change. Depending upon be would intervention given a whether in interested most was tion effectiveness) than another (e.g., cost). For instance, if the organiza- many organizations are more interested in one characteristic (e.g., safety afreshapproachtohistoricalproblem. GA with charged those provide may it novel, are here identified for continuing existing efforts. In contrast, where the interventions support additional some provide may analysis this cases, those In community.GA the within level some at considered being already higher rated interventions seem almost intuitive.trol and flightIndeed, service stations when inmany adverse weather), manyare of the training and the importance of communicating with air traffic con- disorientation spatial (e.g., there gets one once survive to how or hazards associated with VFR flight into IMC beyond current levels) flying into instrument conditions (i.e., information regarding the of training. Whether that training deals with preventing pilots from wasidentifiedandispresentedin of interventions Table 3. equally,dimension each treating By ratings. four the list 10” “top a of average overall the upon based interventions potential the sort merely and equally dimension each treat could one instance, For the four dimensions (feasibility, acceptability, cost, and effectiveness). during timesoffiscalausterity. is of tremendous concern among many organizations—particularly to the successful employment of safety interventions. important all are intervention?) proposed the accept community pilot the Will (i.e., acceptability and exist?), actually it does or tion tion?), feasibility (i.e., How easy will it be to implement the - interven GA accidents?), cost (i.e., Can the organization afford the - interven reduce will it that likelihood the is What (i.e., effectiveness as such JSIT.the by past Clearly,the in factors successfully used been have acceptability, and cost. These dimensions were chosen because they feasibility, effectiveness, dimensions: four of each on intervention “excellent”or eachpilot-S In doing so, safetydoingprofessionalsso,In decision-makersand withinthe factors. human GA within concepts safety system integrate to sible factors hasyettobefullyleveraged withintheaviationindustry. eficial within the aviation domain. However, its utility within human There is no denying that system safety concepts have proven very ben- Discussion While considering all four dimensions equally has some appeal, While considering all four dimensions equally has some appeal, degree some involve many that is list the from apparent is What using rankings intervention the analyze to ways many are There At a minimum, the studies presented here suggest that it is pos- is it that suggest here presented studies the minimum, a At 4.2 4.4 4.0 4.4 3.6 3.8 3.6 4.0 4.0 3.6 4.6 4.4 4.6 4.2 4.6 4.2 4.0 3.6 4.2 3.8 4.0 4.0 4.2 3.8 4.4 4.2 5.0 4.0 3.4 4.2 4.4 4.4 4.3 4.2 4.2 4.2 4.1 4.0 4.0 3.9 “low”or“poor” andrepresenting5 “high” representing 1 with 5 to 1 of scale a Using earlier. reported studies the in framework humanofcausal factors usingtheHFACS previouslyas pilot-S pilot-S typical ofthesegroups. mentoring program for all new pilots” were effects of weather on flying” and “creatinga review/enhanceknowledge oftheadverse Ideas such as “conducting annual only by trainingchanging the behavior of the toaircrew. The interventions were then given to five ME ME wasaskedrateto each prospective s for prioritization. All had served ME sduring the coding Likewise, cost FAA have been provided a unique glimpse at the roots of many GA Technical Report No.DOT/FAA/AM-06/18. Office of Aerospace Medicine, accidents—human error. Beyond that, existing and proposed inter- Washington, D.C., 20591. Shappell, S. and Wiegmann, D. (2001). Unraveling the mystery of general ventions have been organized within a single matrix that integrates aviation controlled flight into terrain accidents using HFACS. Proceedings human error theory and human factors approaches to accident/ of the Eleventh International Symposium on Aviation Psychology, Ohio State incident prevention. University. Shappell, S. and Wiegmann, D. (2003a). Reshaping the way we look at general By combining both, it may now be possible for the FAA to put aviation accidents using the human factors analysis and classification system. the intervention pieces together in such a way that they can obtain Proceedings of the Twelfth International Symposium on Aviation Psychology, a “quick look” at the strengths and weaknesses of their safety initia- Dayton, Ohio. Shappell, S. and Wiegmann, D. (2003b). A human error analysis of general tives. aviation controlled flight into terrain (CFIT) accidents occurring between Additionally, it provides decision-makers within the FAA the 1990-1998. Office of Aerospace Medicine Technical Report No. DOT/FAA/ AM-03/4. Office of Aerospace Medicine, Washington, D.C., 20591. 2009 16, SEPT. , ability to ensure that a broad spectrum of interventions has been Y Shappell, S. and Wiegmann, D. (2003c). Reshaping the way we look at general considered. aviation accidents using the human factors analysis and classification system. Where gaps exist, HFIX provides a means to “fill the gaps” and Proceedings of the Twelfth International Symposium on Aviation Psychology, assess those interventions that are most likely to address a perceived pp. 1047-1052, Dayton, Ohio. Shappell, S. and Wiegmann, D. (2004). HFACS Analysis of Military and Civil- human factors need. ian Aviation Accidents: A North American Comparison. Proceedings of the In the end, it is hoped that tools like HFACS and HFIX will Annual Meeting of the International Society of Air Safety Investigators, Gold ensure that human factors system safety will become a reality and Coast, Australia. Shappell, S. and Wiegmann, D. (2006). Developing a methodology for assess- that ultimately GA accidents attributable to human error will be ing safety programs targeting human error in aviation. Office of Aerospace reduced. ◆ Medicine Technical Report No. DOT/FAA/AM-06-24. Office of Aerospace WEDNESDA Medicine, Washington, D.C., 20591. Wiegmann, D., Boquet, A., Detwiler, C., Holcomb, K., Faaborg, T., and Shappell, References S. (2005). Human error and general aviation accidents: A comprehensive, Detwiler, C., Boquet, A., Holcomb, K., Hackworth, C., Wiegmann, D., and Shap- fine-grained analysis using HFACS. Office of Aerospace Medicine Technical pell, S. (2006). Beyond the tip of the iceberg: A human factors analysis of Report No. DOT/FAA/AM-05-24. Office of AerospaceM edicine, Washington, general aviation accidents in Alaska and the rest of the United States. Office D.C., 20591. of Aerospace Medicine Technical Report No. DOT/FAA/AM-06/07. Office Wiegmann, D., and Rantanen, E. (2003). Defining the Relationship Between of Aerospace Medicine, Washington, D.C., 20591. Human Error Classes and Technology Intervention Strategies. Final Technical FAA (2006). Federal Aviation Administration Flight Plan 2007-2011. Obtained Report AHFD-03-15/NASA-03-5. from the worldwide web at http://www.faa.gov/about/plans_reports/media/ Wiegmann, D. and Shappell, S. (2001a). Human error analysis of commercial flight_plan_2007.pdf. aviation accidents: Application of the Human Factors Analysis and Classifica- National Transportation Safety Board (2006). Table 10. Accidents, Fatalities, and tion System (HFACS). Aviation, Space and Environmental Medicine, 72, Rates, 1986 through 2005, U.S. General Aviation. Obtained from the worldwide 1006-1016. web at http://www.ntsb.gov/aviation/Table10.htm. Wiegmann, D. and Shappell, S. (2001b). Human error analysis of commercial Reason, J. (1990). Human Error. New York: Cambridge University Press. aviation accidents: Application of the Human Factors Analysis and Classifica- O’Hare, D., Wiggins, M., Batt, R. and Morrison, D. (1994). Cognitive failure tion System (HFACS). Proceedings of the Eleventh International Symposium analysis for aircraft accident investigation. Ergonomics, 37(11), 1855-1869. on Aviation Psychology, Ohio State University. Shappell, S., Detwiler, C., Holcomb, K., Hackworth, C., Boquet, A., and Wieg- Wiegmann, D. and Shappell, S. (2003). A human error approach to aviation mann, D. (2006). Human error and commercial aviation accidents: A com- accident analysis: The human factors analysis and classification system. Bur- prehensive, fine-grained analysis using HFACS.O ffice of AerospaceM edicine lington, VT: Ashgate.

ISASI 2009 Proceedings • 67 ISASI 2009 PROCEEDINGS rely to explain the special challenges in air medicine. tem (ASRS) from 1985 to 2008. This is the information on which they and a review of reports from NASA’s Aviation Safety Reporting Sys- Services Database (CMAS) comprised of accidents, incidents, events, safety issues. that have resulted from the growth of the and industry subsequent graduate oftheU.S.AirForce AcademyandtheauthorofLossControl. tives: TheForensicsofFatalTransportation Accidents. TheCrashDetec- Again (HarperCollins2000)andtheforthcoming Prevent theTWA Flight800DisasterandHowitCouldHappen 68 of here arewidelyapplicable. transport patients is growing through the world. The issues raised on attention tiononthe safety issues inthis atten- industry. renewed it While and this papermedicine, focusesair for record on year deadliest 8 of them fatal, killing 28 people—5 of them patients. This was the equipment, anduseofsafetyapparatus. each air service sets its own standards for pilot qualifications, aircraft A Analysis of E The authors have created the Comprehensive the created have authors The It is important to discuss the history and evolving business model In 2008, between helicopters and airplanes there were 16 crashes, EM • available Photo Photo ISASI 2009 ISASI not not S aviationS inthe under different rules depending on the phase of flight, flight, of phase the on depending rules different under medicalairbut transport exception.oddanis viation in the

A Comprehensive and Statistical S aviation in the in aviation EMS book, She istheauthorofTheNewYork Times notable Systems Rulemaking Advisory Committee (ATSRAC). 2005. Negroni served on the FAA’s Aging TransportNew York Times andotherpublications.From 2000- specialist inNewYork. onaviationforThe Shereports Christine Negroni isanaviationwriterandsafety Proceedings mulated more than15,000hours.Dr. Veillette isa1983 in 2007.In25yearsofpilotingexperience,hehasaccu- bytheRoyal Aeronautical Society year (safetycategory) Safety Digest. He was named aerospace journalist appeared inAviation SafetyJournal andtheFlight of the safety specialist, and aviation Dr.writer. PatrickVeillette is a professionalHis articles havecorporate pilot, air United States is a highly regulated environment, Deadly Departure: Why the U In the United States from nitedStates tounderstand the pressures nited States, use of aircraft to to aircraft of use States, United By ChristineNegroni(FO5208)andDr. PatrickVeillette At WhatCost? At 1985 to2007 M xperts Failed to Experts Failed to edical Aviation Aviation Medical Of the 1,132 air S O perating H elicopter Accidents make severalsafetyrecommendations. to authors the leads also reports ASRS and Database CMAS the of rather than mandate many of these to recommendations.1988. The Federal Aviation Administration has chosen to suggest The analysis Board has issued multiple sets of safety recommendations going back threats is an important first step. The National Transportation Safety narratives areincludedinthispaper. illuminatethoroughlymore happened,whatthoseofsome and to help participants of narratives The states. aircraft undesired to and ifthethreatprogressedtoan“undesiredaircraftstate.” assessment model was used to see how and adverse theseweather conditions, the threat-and-error management episodes were handled investigated bytheNTSB. by pilots who experienced a safety issue in flight as well as accidents industry reported events, and 369 ASRS narratives filed anonymously Towardrisk. FAA reducing analyzes paper incidents, this end, that of method proactive more a as self-reporting including events and (HEMS) operationsarethefocusofthisreport. than fixed-wing medical flights. For these reasons, helicopter vastlyaisIt different world markedlyanda morehazardous one zone all contribute to the unique nature of helicopter ambulances. landing and route inflight the of nature often-unplanned the and inherent instability of helicopters, the high workload environment, ambulances in the offer helicopter ambulance services intheU.S. offer helicopter ambulanceservices to first the became Denver,Colo., in Hospital Anthony’s St. 1972 In world. civilian the in injured and sick the move to helicopters conflicts in Korea and then Vietnam that inspired the idea of using shortly aftertheendofsecond World War. in California started moving patients in specially equipped airplanes flying patients to hospitals. In the the service flew doctors to patients rather than the present model of in the world, starting in 1928. A mission of the Presbyterian church, The Royal Flying Doctor Service is probably the oldest air ambulance History Threats to safety will emerge in every flight. Removing the known percentagethreatslargedegradeofa thatreviewshows The Inreviewing incidents and events, such as aircraft malfunctions Contemporary air safety philosophy values the analysis of incidents It was the wartime practice of moving American casualties during United States, nearly two thirds are rotorcraft. The United States, Schaefer Air Service

S EMS From one in 1972, hospital helicopter ambulance programs grew tion flight risk assessment decisions (A-06-14), and requiring the quickly. There were 32 by 1980 and 174 by 1990, a fivefold increase. installation of terrain awareness and warning systems on aircraft Entering the 21st century, the number of operators slowed but the and training flight crews on the use of this equipment (A-06-15). number of aircraft flying continued to grow, from 231 helicopters While the authors agree with these recommendations, the follow- in 2000 to 840 in 2008. ing threat and error management review of the EMS accident and The increase was attributed to a 2002 change in federal Medicare incident data leads us to suggest several others. policy that revised the fees operators would be paid, doubling and in some cases tripling reimbursement for flying patients. TheM edicare Threat and error management fee schedule guaranteed a flat payment from the government. It also A “threat” is an external event or an error outside of the flight affected what private insurance companies would pay because often crew’s influence but requiring the active management of the crew , SEPT. 16, 2009 2009 16, SEPT. ,

the insurance rate is pegged to Medicare’s rate. Seemingly overnight to prevent it from impacting safety. An “error” is a deviation from Y private companies found it profitable to get into the business of organizational or crew expectations, and an “undesired aircraft state” medical transport. is a compromised situation placing the flight at increased risk. Pressure is the most common threat, present in 93% of all the What is medical transport? pilot reports. This can be from insufficient time to prepare for a The typical HEMS flight is defined by its atypicality. It can be any flight, patient conditions, management pressures, deteriorating time of the day or night, departing and landing at helipads or on weather, etc. An excellent example is contained in the following highway shoulders, carrying accident victims, premature babies, or pilot narrative. organs for transplant. The constants are that the EMS helicopter “The flight was flying from a hospital with a patient on board. WEDNESDA pilot will operate under time pressure in a high-workload environ- The rain had picked up, and the visibility was less than reported…. ment, often with a lack of enroute and/or destination information I was able to maintain a couple of lights to the side but forward and weather reporting and will be expected to operate through lights all disappeared…. The problem is having a patient on board obstacles and obstructions and into or out of non-standard landing and feeling the pressure to try to continue the flight in less than zones including rooftops, highways, and parking lots. reported conditions. They had disconnected the autopilot so it was The industry works under several important parameters. Fed- inoperative. I am ATP rated but not current IFR. We do have an IFR eral and insurance payments have encouraged the growth of air ship that should have been sent on the flight but we are closer by 18 medicine, and air medicine is considered vital and important in mi (sic) and our ship is much cheaper to fly…. It is too bad that we American society. Helicopter ambulance companies operate in sometimes have to have less than favorable flight to get non-aviation an environment in which moving patients is the only method of people to realize closer and cheaper are not always the right thing generating a return on a capital-intensive investment. Payment for to do. (ASRS No. 635667) flights is based on geography—where the helicopter is flying—and Time pressure is commonly cited in ASRS and greatly increases distance—how far the patient is flown. the probability of human error. Dr. James Reason, professor emeri- The reimbursement criteria means there is no business incen- tus at the University of Manchester and an expert on human error, tive for flying larger aircraft, twin-engine helicopters, or installing found that the perception of a shortage of time increases the prob- anything beyond the minimum required safety equipment. The ability of human error by 11 times. The following ASRS narrative decision of what safety equipment or whether to install safety equip- illustrates this point. ment is left up to the operator. “I arrived at work for a shift change. After parking the car, I heard As a result, less than half—40%—of HEMS operators have ter- one of our hospital helicopters turning on the hospital helipad. I ran rain awareness and warning systems (TAWS); slightly more than to the pad so I could relieve the night pilot and take the flight…. half—57%—use twin-engine aircraft and are therefore capable of We were responding to a multiple car accident with serious inju- autopilot or IFR; 30 % use night vision goggles; and less than 1% ries…. I remember glancing at my instrument gauges before lift off. of HEMS operators fly two-pilot crews. Everything looked good. I made the appropriate calls and began Rather than elevating industry standards, the geography/distance the takeoff process…. As we moved forward, my warning lights and payment method depresses safety by pressuring conscientious horns for low rotor rpm came on. My rotor rpm’s began to drop, and companies to reduce their costs to match the lowest competitor the aircraft slowly began to settle…. I turned and was able to settle as explained by Gary Sizemore, an EMS helicopter pilot and past back on the pad and appeared to land without incident. I looked at president of the National EMS Pilots Association. “One company is the gauges and around the cockpit. Everything was normal again, flying substandard; it’s using the cheapest aircraft available, saturat- except I noticed that my engine throttles were not full forward. I ing the area, flying with no safety equipment,” he said. “It is going assumed that was the problem. I pushed the throttles forward com- to cause the large vendor to reduce overhead to compete.” pletely, lifted off again, and flew the flight to the accident scene as Since its first hearing onEM S safety in 1988, the NTSB has held if everything was normal. Upon landing and shutting down at the two more hearings urging the Federal Aviation Administration to scene, I discovered that approximately 2-3 inches of each tail rotor mandate certain equipment and operational practices. In 2009 the blade (2) was chopped off. I gave the remaining rotors a detailed NTSB recommended requiring all EMS operators to operate under inspection and checked the drive train from the engines to the ro- Federal Aviation Regulations Part 135 on all flights with medical tors and found everything in place. The patient was brought to the personnel on board (A-06-12), requiring all EMS operators to use aircraft, dying, and placed inside. I made the decision that I could risk evaluation programs and train in the evaluation of flight risks make the 5 minute flight back to the hospital safely. The flight went (A-06-13), requiring EMS operators to use formalized dispatch and back without incident. Problem areas: The quick EMS helicopter responses, flight-following procedures including up-to-date weather informa- the numerous interruptions of the EMS pilot during start-up and the pilot

ISASI 2009 Proceedings • 69 ISASI 2009 PROCEEDINGS 70 emphasis) (NASAASRSAccessionNumber118240) the pilot to make emotional decisions instead of safe ones.”(Italic added for allowing this to happen. Plus, the added pressure of a dying person causing S accidents. EMS accidents. ports.) Inadvertent IMC continues to be a large contributor to fatal re- sampled the of (8% terrain with separation of loss serious a or serious degradation of aircraft control (14% of the sampled reports) vertent IMC” should receive focused attention as it often results in a unplanned entry into instrument meteorological conditions. “Inad- fatal in factor common most single 78% occurred at night. The NTSB’s 1988 study determined that the of instrument conditions, cited in 18% of the sampled ASRS reports; wasnotadequatelymanaged. threat category rating weather, and unexpected weather. About 34% indicated this deterio- destination, or route the along reports weather definitive weather forecasts with “chance of marginal conditions,” or a lack of ceilingsthat create higher risks for helicopter operations, reports. This but category included also not only limited visibility and cloud were notadequatelymanaged. reportsindicated this threat. Approximately 42%of these threats equate information about weather and obstacles;However, 53% “on scene” operations often present problems with inad- of the ASRS areas. inaccessible other and accidents, highway scenes, disaster at monitoring. pilot and cross-check by management error of benefit the lose pilots Single crews.single-pilot with conducted are operations (NASA ASRSAccessionNumber181754) zone.” landing the at landing and approach subsequent and for search the with the traffic avoidance while coordinating with the ground vehicles during I was aware of my close proximity to the airport traffic area. I was preoccupied conflicting coordinates from the ground while searching for the landing zone. coordinate with his controller…. approach supervisor advised me that I entered his airspace and did not Unicom….The properly on intentions and reports position broadcasting and scene on vehicle emergency and (flight-following/status reports,) command medic recognized theI before error airport B andCity the reversedof south miles nautical course.5 me took I and was incorrect coordinating were provided coordinates withThe dispatcher,B. City mall, the at patient a recover to A, pilot inthefollowingASRSreport. an by stated aptly is This cross-checking. for monitoring pilot a of lack the and helicopters in operations single-pilot by induced clearly present in 84% of theThe excessive workload ASRSfaced by helicopter reports.ambulance pilots is most These included workload indicated thisthreathadnotbeen adequatelymanaged. ground to avoid obstacles. Approximately 14% of the ASRS reports departurefrom aconfined area, and a lack of guidance from the equate lighting to detect obstacles, adverse wind conditions during inad- obstacles, about information of lack obstacles, of proximity room, maneuvering limited with deal frequently pilots HEMS Confined-area operations were present in 29% of the ASRS reports. years, 69—or one in three—involved the aircraft hitting something. The O This, of course can lead to the threat of inadvertent penetration Adverseweather conditions werepresentASRStheof 45% in HEMS great asset is the helicopter’s ability to operate off-airport, Withthe exception of half-a-dozen hospital operators, H City in hospital, XYZ from dispatched helicopter EMS an flying was “I io fcos nldd aiu ad ak f F currency/profi- IFR of lack and fatigue included factors Pilot • f the 210 accidents in the C accidentsthe210thein f ISASI 2009 ISASI EMS pilot works in a “very high threat” mission environment. Proceedings I was working four frequencies and receiving M AS database over the past 20databasepast theASover S helicopter accidents was was accidents helicopter EMS EM S EMS S

change to weather minimums may not have a wide-reaching effect. change toweatherminimumsmaynothaveawide-reachingeffect. significant loopholes in the Part 135 weather minimums, this recent of existence the without even that shows This minimums. weather HEMS amended recently the than better was weather actual the amended weather minimums. In more than half of the 55 accidents curring between April 1, 1988, and Sept. 27, 2009, against the recently flights. local flightsand1,000-5forcross-country system or terrain awareness warning system will require 1,000-3 for day conditions. At night, an operator“local” flightwithout in day conditions, anda 800-3 fornight a cross-country flight in vision imaging requires a minimum of 800-2 (800 foot ceiling, 2 nm visibility) for a “Helicopter A021, tions operators. HEMS for authorized minimums program minimumsshouldbeprohibited. be communicated to the pilots in writing, and deviationbased on belowlocal terrain theand weather. These weather minimums should visual flight weather minimums for individual helicopter programs rized for HEMS flights and has recommended the development of NTSB has repeatedly warned about the weather minimums autho- first reportonHEMSsafety21yearsago. by the author (Veillette, 2001), or for that matter, since the NTSB’s the Flight Safety Foundation’s study of and itwasnotproperlyhandled15%ofthetime. ure. About 16% of the reports indicated the presence of this threat; operating with inoperative components, and/or a mechanical fail- that caninfluencethepilot’s abilitytooperatetheaircraftsafely.” and operate on a schedule conducive to acute and chronic fatigue Board believes “that Safety The time. the of 9% in managed inadequately and reports NTSBhearings onH The topic of fatigue in be a primary contributor to the industry’s poor safety performance. ciency. In its 1988 study, the NTSB suggested that pilot fatigue could appropriate observations.” supply to competent persons other of those on or observations command may…use weather information based on the pilot’s own pilot-in- the VFR, under operations “For observation. weather own One was47milesaway. and in eight accidents the weather reporting was even more remote. weather reporting stations in 10 accidents were 15 to 25 miles away, decision. educated from the destination, making it difficult for go/no-go decision. Weather reports are often a significant distance Such aforecastwouldstillallowpilottolaunch. occasional visibilities below 1 mile and ceilings below 800 overcast.” ibilities better than 5 miles…with a weather forecast may state, “Ceilings better than 3,000 feet and vis- 40% chance of rain showers and weatherconditions.Forexample,a ‘x’ conditions”or“temporary” of “probability contain that forecasts weather is “loopholes” these allow a pilot to launch into weather hazardous to the flight. L This study compared the weather in 55 IMC-caused accidents oc- weather to amendment an implemented recently has FAA The Given the frequency and severity of the IMC-related accidents, the These are the leading threats, and they have changed little since capable, IFR being not aircraft the included factors Helicopter In actual operation, actual In U their make to allowed still are pilots rules, flight 135 Part nder preflight the impacts also reports weather on-site of lack The oopholesweatherwithin135Partminimumsthe would still xamining NTSB accident reports, the nearest nearest the reports, accident NTSB Examining EMS helicopter pilots work in an environment EM EMS operations was revisited during the 2009 S pilots often fail to keep their weather weather their keep to fail often pilots EMS Emergency S.This threat waspresent in17%ofthe edical Services Services Medical EM S safety in 2001 conducted S pilots to make an EMS pilots to make an perating Specifica- Operating perations,” Operations,” ne of One of assessment objective. A review of ASRS reports for the Flight Safety single-pilot flights are riskier than those with two pilots. The statistics Foundation’s 2001 study found that an astounding 67% of the EMS show the risk of a fatal accident is 3.7 times greater with a single pilot. pilot reports documented that knowledge of the patient’s condition In publishing these findings, AOPA Pilot magazine wrote, “Single- influenced their decision-making. A survey of flight paramedics pilot operations create higher workloads and greater demands on conducted by the International Association of Flight Paramedics and pilot skill when the chips are down and stress levels run high.” presented at the NTSB’s special hearing on EMS safety revealed 30% Behind the phenomenal growth of HEMS from one hospital in of the respondents reported that the pilot is aware of the urgency 1972 to the multimillion-dollar business it is today is a disturbing of the flight request, despite attempts to shield that information to business model; fly the helicopters as inexpensively as possible—with avoid pressuring the pilot to conduct the flight. one pilot and a minimum of safety equipment. This has created an In light of this reality, giving the pilot the authority to take off even inherently unsafe system. As one EMS pilot said, “If they knew what , SEPT. 16, 2009 2009 16, SEPT. ,

in weather others would judge questionable should be addressed. I knew, even the nurse and paramedic wouldn’t get on board.” Y Since weather and reduced visibility (including night flight) cre- This report lists some of the recommendations made by the ates layers of risk, management is required on several fronts. Since NTSB. Based on the threat and error management analysis of the 1987, there have been 305 EMS helicopter accidents or significant ASRS data, further recommendations would improve safety for the safety incidents in the United States, according to the CMAS data- industry as a whole and serve as guidance to other countries where base, and nearly half of them occurred either at night or in weather the HEMS industry is not as well developed or as influenced by that obstructed the pilot’s vision. private for-profit operations. These include In addition to changing weather minima, providing EMS pilots • two pilot (IFR proficient and current), two-engine, IFR-qualified and dispatchers with more accurate weather information, and re- helicopter. WEDNESDA moving subjective decision-making in questionable weather with a • advanced avionics (autopilot, satellite weather capability). formalized flight risk assessment program, EMS aircraft should be • night vision technologies. equipped to fly in these conditions. This is problematic since engine • automatic dependent surveillance-B. helicopters are unable to accommodate autopilots and IFR equip- • scenario-based simulator training. ment and the recent trend is toward replacing twin-engine aircraft • a Safety Management System. with single-engine for the fuel savings. • further refinement and eventual approval of the HEMS weather A number of aviation organizations, from the International Civil tool. Aviation Organization to the Professional Helicopter Pilots Associa- • fatigue management. ◆ tion, claim two-engine helicopters are important. The PHPA position is that the standard “should be a multiengine, fully IFR certified he- References 1. Comprehensive Medical Aviation Safety Database (CMAS) Veillette, Patrick licopter.” Medical helicopters in Canada and air rescues conducted R., and Negroni, Christine. by the U.S. Coast Guard require two-pilots. 2. U.S. National Transportation Safety Board. Commercial Emergency Medical The ASRS reports feature stress as a recurrent theme. EMS pilot- Service Helicopter Operations. NTSB/SS-88/01. Washington, D.C. 3. U.S. Government Accountability Office. Aviation Safety: Improved Data Collec- ing with high workloads and unpredictable operating environment tion Needed for Effective Oversight of Air Ambulance Industry. GAO-07-353. has become its own “error trap.” This makes the need for two pilots February 2007. Washington, D.C. obvious. 4. Veillette, Patrick, “Human Error Cited As Major Cause of U.S. Commercial EMS Helicopters.” Flight Safety Digest, April-May 2001. In a study of turbine-engine airplane accidents, aviation research 5. U.S. National Transportation Safety Board. Public Hearing: Helicopter Emer- company Robert E. Breiling Associates of Florida, concluded that gency Medical Services, Feb. 3-6, 2009. Washington, D.C.

ISASI 2009 Proceedings • 71 ISASI 2009 PROCEEDINGS System SafetySociety. College ofForensic ExaminersandaseniormemberoftheInternational Society, andaretired professional safetyengineer. ISASI’s Board ofFellows, aFellow oftheInternationalSystemSafety Data Association’sAccident InvestigationProject Group, chairmanof 72 redesigning • immediate needsforimproving thelessonslearningprocesses: Wethese alternatives. address design system strategic eight least at signers, which enabled us to define 26 desired system attributes and the standpoints of lessons-learned users, system developers, and de- organizations’ safety performance. disseminating and Weapplying lessons learned analyzedto improve the learning those elements aprocess from from generations of lessons-to-be-learned source functionaldata to elements into a “lessons successful learningresulting the incorporated We gained. system”insights the and that identifies aries, functions, and attributes. This paper documentsprocesses and ouroutputs and analysisisolate and document the systems’ bound- approach to define historical accident analysis systems Wea accidents. undertook investigated by offered investigation lessons-learned belearned are inadequate to take advantage of the opportunities for identifying,defining,communicating,andactingonlessonsto knowledge successfully to avoid the latest crashes. Current processes that used have might who those by analyses or accidents previous similar from lessons the learn to opportunities missed reflect later FedEx a and N.Y., Buffalo, at 8-Q400 Dash Havilland de Continental-Colgan a of crash the of continueunderperformto expectations. accidentThescenarios ing costly lessons that should have been identified by investigations Recent high-visibility accidents demonstrate that processes for learn- Abstract redefining • source datatoimprovetheirusefulness and Avoiding Lost Learning Opportunities Avoiding LostLearning • ISASI 2009 ISASI Sifting Lessons from the Ashes: investigation

the dent memberoftheEuropean SafetyandReliability investigation supportsoftware. Bennerisacorrespon- taught accident investigation and led development ofbook on accident investigation process research.1982. Hehaspublishedmore than50articlesanda He has headed itsHazardous MaterialsDivisionfrom 1976- Ludwig BennerjoinedtheNTSBin1970and can Academy ofForensic Sciences,andtheAmerican since 1977.RimsonisaFellow ofISASI,theAmeri- consulted andperformedprivatesafetyinvestigations Group in 1981, heading its safety services. He has joined senior FAA retirees founding Aviationrector ofsafetytheNavalAirSystemsCommand.He Resources Ira RimsoncompletedaNavyaviationcareer asdi- Proceedings

form By

and L product udwig Benner, Jr., Principal, Starline Software

substance D-11 at Narita, Japan, a month month a Japan, Narita, at MD-11 Ira J.Rimson,ForensicEngineer, Albuquerque,N.M.,USA specifications

of

lessons-to-be-learned to require that

Overstress • icing inseverethunderstorm(seeReferences3-5)or O situation. ambiguous an in crew the by control manual immediate mal) computer control to one of three degraded levels demanding rant input signals, with resulting reversion of control laws from (nor References 12-14). Kai Tak in August 1999 exhibited similar operational behavior (see Airlines China A 1997. in N.J., Newark, at accident Japan, on accidents havebeenabanefor decades(seeReferences8-11). principal airmanship rule: “First fly the airplane.” Crew distraction sors.In both cases minor anomalies distracted the crews from the sterdam’s Schiphol Airport 13 days later, Am- were to high-profile retrocur approach on crashed which 1951, Flight Airlines Turkish which crashed on approach to Buffalo, N.Y., on Feb. 12, 2009, and Acombinationofboth. • sequent lossofcontrol(seeReferences6-7)or Air • hypotheses, atleasttwoofwhichhavehappenedbefore— many the of any support to adequate yet not are Facts Paris. to Rio from enroute Atlantic equatorial the over 447 Flight France Air of paper’s writing in late June 2009, the this most of recent time of the these At was past. the the loss in accidents to led have that patterns behavior reenact “retrocursors” future, the in come to events age “retrocursors.” recurrences these call We before. happened have that those to similarities striking fulfilled theexpectationsofISASI’s founders.Whathappened? have been reduced substantially,than if25 years.not Recurrenceeliminated, of accidentshad investigationsfrom adopted similarat that time. Its sources Code of Conduct shouldhas been in effect for more Reference 2.) or organizations that may use such information effectively….” (See similar accidents. prevent to reasonably done be can something which about ships TION.” (SeeReference1.) Background processes. lessons learned be an explicit documented product of investigation ut-of-envelope airspeed signals could have resulted from pitot tube A third retrocursor was the Ex Fed 8-Q400, Dash Bombardier a 3407, Flight Continental-Colgan What happened has been the recurrence of accidents that bear bear that accidents of recurrence the been has happened What ISASIwasincorporated 45years ago, andits official motto was “5.3Communicate facts, analyses andfindings to those people relation- cause-effect those investigation the from Identify “5.1 “ “The official motto of ISASI is “SAFETY THROUGH INV ESTIGA- 5. ACCIDENTPREVENTION…Eachmembershall data M inertial L arch 22, 2009, which duplicated a similar Fed separation td., O reference akton, Va., of the unit airplane’s U (ADIRU) nlike “precursors,” which pres- which “precursors,” Unlike SA, and D-11 MD-11 landing crash at Narita, vertical faults

stabilizer resulting D-11 crash at at crash MD-11 E x and from M D-11 sub- er - - - Why haven’t the lessons that should have been learned from —there is too much material to search, earlier accidents been communicated well enough to the crews and —they are formatted differently in different reports, or internalized sufficiently to prevent the retrocursors? —they’re not readily available. • Applications are unplanned and haphazard. Contemporary lessons-learned practices • “Taxonomy” categories obscure data searches. Are there formal contemporary lessons learned “systems” and, if We observed two categories of inhibitions to developing lessons so, why don’t they maximize learning from lessons generated by learned within the investigation process itself. The more fundamen- accidents? tal is a mindset of unquestioned acceptance of “how things have Historically, investigators acquire, document, and report factual always been done” and can include data in many forms and formats, by many diverse and often isolated • archaic accident “causation” models, , SEPT. 16, 2009 2009 16, SEPT. ,

systems. These data are used by investigators and analysts to piece • unwillingness to share investigation data, Y together a description and explanation of what happened, usually • language barriers that obscure identification of relevant behaviors, in narratives or on pre-existing forms, using natural language. These • data loss from software obsolescence and lack of standardization, accident data comprise the bases for cause-oriented conclusions and from which findings and recommendations are derived. Causes, • concerns for legal liability. findings, and recommendations rarely specify the “lessons learned” A secondary category frequently derives from the obstacles above from an investigation (see Reference 15). Analysts abstract, code, and occurs at the levels of individual investigators and analysts. It characterize, aggregate, or otherwise refine or condense the data. includes missing data, biased scope and data selection, logic errors,

They are then “published”: disseminated internally or made public misinterpretation or misrepresentation of observations, flawed as- WEDNESDA in various news media, as databases, reports, articles, papers, books, sumptions, and premature conclusions during investigations. Each stories, graphics, training materials, checklists, etc. Published data inhibits development of useful lessons. are stored in organizational files or databases for retrieval and use. They may also find their way eventually into revised procedures, Clarification of terms standards, and regulations. Lessons learned are often considered to be new knowledge obtained Dissemination practices vary but include electronic dissemination from experience, applied to benefit future performance. The ques- in computerized databases, e-mails, and Internet sites. Non-electron- tions arise: knowledge about what? And how can we put it to beneficial ic dissemination may include hard-copy investigation reports, tables, use? We find it helpful to think of the new knowledge generated by checklists, on-the-job training, safety meetings, standardization, investigations as clarification of what happened, and why it happened. training sessions, codes or regulations, and books. Deriving lessons That new knowledge can be applied to change behaviors of people, from the data depends on someone recognizing the value of the systems, or energies. This concept distinguishes between the lessons content and generating and communicating the lessons. and the learning, identifying the tasks required of those documenting Reported investigation data may also be used for research, to the lessons to describe and communicate them so that end-users can develop lessons learned in the form of historical trends or statistical apply them to initiate desired behavioral changes. correlations, using statistical analyses or data mining techniques. Data are frequently abstracted or characterized to generate “taxono- What data are needed to develop lessons to be learned? mies” of causes and causal factors referenced in investigation report Mixed perceptions of the investigation data that need to be acquired databases, safety digests, and investigation software. and disseminated as lessons may be the greatest obstacle to learning. We analyzed contemporary lessons learning practices, focusing on Accident causation and investigation models influence those per- how data are analyzed to isolate and describe the lessons that should ceptions. Current investigation goals do not prioritize information be learned. Major inadequacies we observed include needed by end-users who initiate behavioral changes. Investigations • Authors variously define lessons as causes, cause factors, findings, focus on determining “causes”: cause factors, multiple causes, “root” conclusions, eecommendations, issues, statements, or scenarios in causes, and other easily labeled actions from which investigators and texts of narrative reports. analysts infer lessons and propose corrections. Investigation report • Authors often obscure lesson data within excessive wordiness authors typically do not provide data in forms from which end-users and jargon. can derive the behavioral changes they need to prevent recurrence. • Authors do not explicitly list lessons learned as such. Instead, the “expert” investigating agencies select changes they deem • Analysts rarely categorize investigation data to facilitate end-users’ desirable and direct them to target audiences of their choice in the retrieval and use. form of recommendations. • Analysts assume that proposed changes alter system behavior favorably, without testing. Challenges to developing lessons learning systems • Lessons are “pushed” to preestablished recipients, but must be The challenges to lessons learning systems are to collect accurate “pulled” by other users. mishap-based data and communicate them quickly and efficiently What inadequacies of current lessons-learned practices have to end-users that can develop and implement changes. already been reported? Werner and Perry (see Reference 16) cited The first challenge is to define the end-users of lessons from the following barriers to effectively capturing and applying lessons investigations and how they would use them. End-users are all enti- learned by investigators: ties that can change behaviors that led to an undesired outcome, • Data are not routinely identified, collected, and shared across or initiate new avoidance behaviors, in their operations, in objects organizations and industries. or systems they design or operate, or in energies they manage. • Unsystematic lessons are too difficult to use because Current investigation data are designed to fulfill the needs of the

ISASI 2009 Proceedings • 73 ISASI 2009 PROCEEDINGS 74 applications. be decomposed further for specific the accident process. during interacted that behaviors about investigators by developed lessons learned are new knowledge that assumes model The 1. Figure in shown are model system ing produce effectiveresults. that have been tested and shown an to archive of lessons the accident process and ends with during data lessons-to-be-learned systembeginscapturingwiththe Thebehaviors. changedachieve to required tasks and functions from investigations by tracking the lessons comprehensive a of Wemodel a developed A lessonslearningsystem tothepeoplewhoneedlearnthem. their delivery and learned, be to need that lessons the effect to needed changes goal should be timely and efficient identification of the behavioral remoteaccess,interoperability processing, amongaccess.users,easyandIts documentation, machine support time, same the at of the lessons learning system. It must satisfy end-users’ needs and, the unwanted outcomes. with unambiguous reasons for changing the behaviors that produced formats they can internalize readily in end-users to delivered and and developed be will directly, data needed fied, and provide them coupling, and logic during investigations. That will ensure the identi- and objectively. Investigators must test behavioral describe behaviors that constituted the grammar, structure, and format for investigation input outputs by standardizing and applying scientific language. Common apply thatnewknowledgetochangingbehaviors. can that end-users of needs data learning lessons the fulfilling to would better serve its prevention goal by devoting priority attention agency conducting the investigation. The investigation community Figure 1.Users’componentsoflessonslearningmodel. Users’ components of the learn- content and structure the define to is challenge major third A A second challenge is to systematize investigation data inputs and • ISASI 2009 ISASI Proceedings and responses Each task can

Figure 2.Developers’components of lessonslearningmodel. mishap process thoroughly data sequencing, data sequencing, systemlearning data should end-users. for data generates minimize • backwardcompatibilitywithlegacydatarepositories. • accessibleexpeditiouslytoallpotentialusers. • inclusiveofcontextidentification. • opentomultiplechangeoptions. • abstracted “factors.”IdealLLSattributesinclude Establish • learned sourcedatawithsuchattributesas of components investigation 2, Figure in shown perspective, developer’s a From system developers’perspectives learningsystemattributesfrom Lessons timely • metricsforbehavioralchanges. performance • improvedacceptance,andmoreactionsinitiated,byend-users. • costsensitivity:thevalueofsystemintermsresultsitproduces. • quality. scalability: • enhancedassimilability. • enhanceddeterminationofrelevance. • maximize“signaltonoise”ratio,i.e.,maximizingrelevantcontent. •

repository 1

an elapsed the input-output S should support development of lessons-to-be- of development support should LLS ability S, and when the lesson becomes available to to available becomes lesson the when and LLS,

updating. and energies,and ratherthan linear “causes” or behavioral interactions among people,ergy, objects or process.en- object, Therefore,person, targeted the in behavior into instructions to incorporate the changed and analysismanagement change of form translating enable should system The introduce. might changes that effects predicting and ships, relation- behavioral to changes alternative toenable comparing behavior sets, defining haviorallyconsistent with dynamic processes processes. ing system (LLS)? What should users expect from a lessons learn- from users’perspectives learningsystemattributes Lessons time to increase

(latency) framework dcmnain ut e be- be must documentation LLS LL data S responseS optionsintosome

between for LLS users deal with dynamic quantity

defining

the

without LL occurrence what S must describe happened sacrificing

that

by LLS data sets that describe behaviors in non-judgmental and and report all the lessons that can be learned from each mishap, logically verifiable terms. record them explicitly for ready access and retrieval, oversee their • Establish investigation goals to provide lessons that can change application in which they can contribute to avoiding retrocursors, future behaviors. and measure the results. The first steps needed to improve lessons • Focus on behavior data acquisition and processing. learning practices are • Specify a structure for input data documentation that ensures data • redesigning the form and substance of lessons-to-be-learned consistency and economy and facilitates data coupling and support source data to improve their usefulness for users, and for documenting output LLS. • redefining investigation data product specifications to require that • Machine supportable input data management, display, and expan- lessons learned be an explicit documented output of the investiga- sion to reduce latency. tion processes. ◆ , SEPT. 16, 2009 2009 16, SEPT. ,

• Objective quality assurance and validation processes. Y References Lessons learning system documentation component 1. ISASI Bylaws, §1.5 (Rev. 08/93). 2. ISASI Code of Ethics, §5 (Rev. 10/83). attributes 3. http://www.eurocockpit.com:80/archives/indiv/E009424.php. LLS documentation derived from investigation descriptions must 4. Air Carraibes “Note Compagnie” re AB 330-200 F-OFDF dtd 01/12/2008 en- fulfill end-users’ needs. System attributes should include route Fort-de-France, Martinique (FDF) to Paris-Orly (ORY), Aug. 31, 2008 (in French). • Requirements that behavioral data outputs provide context, mini- 5. Australian Transportation Safety Bureau Aviation Safety Investigation Report- mize interpretive and analytical workload, maximize signal-to-noise Interim Factual AO-2008-070: “In-flight upset, VH-QPA, Airbus A330-303, 154

ratio, and reduce latency. km west of Learmonth, Western Australia, Oct. 7, 2008”; dtd March 6, 2009. WEDNESDA 6. NTSB Aircraft Accident Report NTSB/AAR-04-04 dtd October 26, 2004: “In- • Provisions for machine processing support, interoperability, and flight Separation of Vertical Stabilizer: American Airlines Flight 587; Airbus repository uploading capabilities to accelerate documenting and Industrie A300-605R, N14053, Belle Harbor, New York, Nov. 12, 2001.” distributing lessons to all collections. 7. Transportation Safety Board of Canada Report A05F0047 mod 7-31-2008: “Loss of Rudder in Flight; Air Transat; Airbus A310-308 C-GPAT; 90 nm S of • Establish accessible Internet LLS output data libraries and end- Miami, Florida, 06 March 2005.” user notification to support both “push” and “pull” data distribution 8. Video of NTSB May 12-14, 2009, Public Hearing, Colgan Flight 3407 at . 9. See . • Easy repository access, with search and filter capability to minimize 10. Dutch Safety Board Preliminary Report at . • Objective verification and validation to ensure quality before 11. U.S. Civil Aeronautics Board Aircraft Accident Report SA-387 File No. 1-0031: “American Airlines Boeing 727, N1996, Constance, KY, Nov. 8, dissemination. 1965,” available at . 12. See . 13. NTSB Aircraft Accident Report DCA97MA055: “Federal Express, Inc., (Fe- Other observations dEx) Flight 14, McDonnell Douglas MD-11, N611FE, Newark International During the study of lessons learned processes we noted two other Airport, Newark, N.J., July 31, 1997.” significant observations: 14. Report of the Board of Review on the Accident to Boeing MD-11 B-150 at Hong Kong International Airport on Aug. 22, 1999; at . accidents often address lessons learned explicitly in their reports 15. Werner, Dr. Paul & Richard Perry, “The Role of Lessons Learned in the Investi- (see References 18-20). Yet the reports we surveyed by traditional gate, Communicate, Educate Cycle for Commercial Aviation.” Presented at the ISASI 2004 Seminar; excerpted in ISASI Forum, V. 38, #4, October-December government investigation bodies lack a discrete section address- 2005, pp. 20-25. ing, documenting, or summarizing the lessons found during the 16. Rimson, I.J., “Investigating ‘Causes’ and Assigning ‘Blame.’” Invited presenta- investigation. No standardized guidance exists for doing so. For tion at the Mary Kay O’Connor Process Safety Center 2003 Symposium, Texas A&M University, October 29, 2003. (available at ). lessons learned. Lack of standardized methodology for reporting 17. http://en.wikipedia.org/wiki/OODA_Loop. “lessons” burdens prospective end-users by requiring them to search 18. Report of Columbia Accident Investigation Board, Volume I, Chapter 8: “History as Cause: Challenger and Columbia.” at http://anon.nasa-global.speedera. and interpret voluminous data with little assurance of finding what net/anon.nasa-global/CAIB/CAIB_lowres_chapter8.pdf. they need to initiate changed behaviors. 19. “The Buncefield Incident, Dec. 11, 2005”: The Final Report of the Major Incident • LLS requires designers to make strategic choices about investiga- Investigation Board, Vol 1. P. 21 Item 63; (LL Workshop, Dec. 20, 2007) ISBN 978 0 7176 6270 8. tion process frameworks, purposes, scope, and data structures; LLS 20. Davis-Besse Reactor Vessel Head Degradation Lessons-Learned Task Force content, form and language; and appropriate choices of repositories, (2002), Davis-Besse Reactor Vessel Head Degradation Lessons-Learned Task Force distribution, updating and metrics. Traditional (or inadvertent) Report, publicly accessible only at http://www.nrc.gov/reactors/operating/ ops-experience/vessel-head-degradation/lessons-learned/lessons-learned- strategic system design choices have adversely affected the utility of files/lltf-rpt-ml022760172.pdf. current LLS processes, operation, and performance. 21. Benner, L., Jr., “Accident Data for the Semantic Web.” Draft Proceedings of the 33rd ESReDA Seminar, Ispra, Italy, Nov. 13-14, 2007. 22. Benner, L. Jr., and W.D. Carey, “Lessons Learning System Attributes: An Conclusions Analysis,” Draft Proceedings of the 36th ESReDA Seminar, Coimbra, Portugal, Contemporary investigation-based LLS has not prevented re- June 2-3, 2009. currence of accidents from known behaviors that produced undesired outcomes. Their primary weakness lies in neglecting Endnote the knowledge requirements of users capable of changing those 1. Boyd’s “OODA Loop” concept (Reference 17) encourages the strategy of responding to situational feedback to effect immediate changes by bypassing behaviors. Current reports are too often inconsistent, ambiguous, administrative process, i.e., prioritizing the application of new LLS knowledge and vague. Investigating agencies should design LLS to identify to change behavior, improve operational efficiency, and avoid retrocursors.

ISASI 2009 Proceedings • 75 ISASI 2009 PROCEEDINGS Investigation Branch. issues ofsafetyriskmanagement,fault,regulation, andcost-benefit. aviation director, which includes oversightcontrols, of safetydataandanalysis.Hiscurrent rolebusiness withRTI Ltdisas concerned with safety management,accidentcostanalysis,regulatory andmarketsafety integrating safetymanagementwithinbusinessmanagement,valueof course. Helectures ontheframeworkofSafetyManagementSystems, is coursedirector foritssafetymanagementprofessional andacademic the CranfieldUniversitySafetyand Accident InvestigationCentre and and asacorporatepilotsafetymanager. Heisavisitingfellowwith 76 Introduction argued, andfullyjustifiedsafety recommendations. well- compelling, frame to investigator’sability an enhance greatly can it how and skills, financial sophisticated for need any without odology can be adopted effectively by aviation accident investigators, remedy. This paper illustrates with general principles how this meth- remedy,costsregulatoryand remedy, costsandinvestigativeand technological and costs between relationship understood easily an text his in Circuit) Second the described by the Hon. Guido Calabresi (U. S. Court of Appeals for tion “indirect” cost classification (as advocated by International Civil Avia- propriate stakeholders better than the more simplistic “direct” and ap- to recommendations safety target and priorities highlight will It analysis. the structure to way effective more a is it consequently methodology associates costs with cost drivers in clearer detail, and namely:primary, secondary, andtertiary profession, legal costcategorization. the by utilized methodology common Thisa of value and associated cost reduction measures. The evidence supports the analysis cost accident examine to research summarizes paper This Abstract By Dr. SimonMitchell,Aviation Director, RTI Ltd,ondon, U.K., andVisitingFellow, CranfieldUniversity, U.K.,and • Organization [ICAO]). The legal profession’s methodology, as Professor GrahamBraithwaite,Director, CranfieldUniversitySafetyandAccidentInvestigationCentre,.K. ISASI 2009 ISASI Effective SafetyRecommendations Using the Best Cost Analysis for Using theBestCostAnalysisfor military flying,inoffshore military oil support,asapolicepilot, experience in all the key helicopter industry sectors:the economics of safety. As a professional pilot,with doctoralresearch he intoaccidentcostanalysisand has 5,400 professional helicopterflyinghours,combined industry for more 20 years, a career that includesDr. SimonMitchellhasworkedintheaviation Cranfield in collaboration with the U.K. Air Accidents the aircraft accidentinvestigationcoursesthatrunat University insafetymanagementandisresponsible for University. He holds a Ph.D. from Loughborough Safety andAccident InvestigationCentre atCranfield the Department of Air Transport and director of the Professor GrahamBraithwaite is the head of Proceedings , 1970, results in in results 1970, Accidents, of Cost The whether • accounting systemwillbeassessedon financial well-being of an organization. The value of a management information to those charged with making decisions that affect the relevant and accurate, timely, providing with concerned is which accounting), managerial as known (also accounting management is this to analogy appropriate most The improvements. safety proposed of value the assess properly to side, one to discussions avoidtomitigateor future costsotherin words, putting emotive seek who decision-makers aid to accidents about information cost find inpreparingthem. investigators most difficulty the reveals reports investigation State O ICA many by published recommendations of analysis Careful inaction by an air transport system that is unconvinced by its merit. for excuse an provide may recommendations ambiguous or cal, learned. not are occurrence an of lessons well, poorly prepared recommendations may mean that the painful within the independence advocated by ICAO Annex 13 know all too analysis of it, and preparation of final reports. Yet as those who work investigators in their thorough and impartial collection of evidence, accidents. and incidents serious of the safety of the air transport industry through painstaking analysis improving in role key a recommendations investigators Accident nantly about businesses rather than the social provision of transport, safety. (ICAO,2006) total costs of an accident is fundamental to understanding the economics of the of understanding An public. travelling the of confidence of loss the as such costs important) less no (but tangible less are there addition, In costs. uninsured many are there risks, specified cover may insurance While sense. business bad make accidents time, over accident an of costs the spread can than relyingonthesafetyblanketofinsurance: rather accidents of cost true the understanding of value the scores under 1.3.2 Paragraph (2006). Manual” Management “Safety 9859, accident cost information, most notably in the first edition of Doc. reliable. whether • attention. requiring most factors toward effectively decision-makers guides unaffected.whetherinformationtheisthisRelated to provided not become confused by mixing other cost drivers that will remain (cost drivers) that will be affected by the decision in hand and does whether • a deadlinetomakethedecisionisjustanothercost. make a balanced judgment, as clearly any information received after The researchThe presented thispaperconcernedinis withusing Acknowledging that air transport has developed to be predomi- be to developed has transport air that Acknowledging Accidents (and incidents) cost money. Although purchasing “insurance” ICAO has published useful guidance on collecting and analyzing

the the the

information

information means

of

measurement provided

provided yriad skills are exercised by by exercised are skills Myriad clearly

is

received

is

identifies isdirected, impracti- Misdirected, valid,

in consistent,

good those

time factors

and

to -

ICAO also recognizes that viability is not ensured. With competition Cost Item ICAO Calabresi from high-speed rail, increased car ownership, and alternatives Hull Damage Direct Primary such as video conferencing, aviation should be clear of one of the Medical Treatment Direct Primary advantages that it has long enjoyed its safety performance. However, Property Damage Direct Primary as ICAO notes, the industry needs to take care of the customer’s Loss of Business Indirect economic Loss* Damage to Reputation Indirect economic Loss* perceptions of safety. Loss of Use of Equipment Indirect Primary Para 1.3.3 The air transportation industry’s future viability may well be Loss of Staff Productivity Indirect Primary predicated on its ability to sustain the public’s perceived safety while travel- Investigation and Clean-up Indirect Tertiary Insurance Deductibles Indirect Secondary ling. The management of safety is therefore a prerequisite for a sustainable Legal Action Indirect Tertiary aviation business. Compensation & Damage Claims Indirect Secondary & Tertiary Fines & Citations Indirect Primary & Tertiary 2009 16, SEPT. ,

In Mitchell’s doctoral thesis (see Reference 2), the economics of Y safety were examined using the case study of North Sea passenger *Note: The addition of a classification for E“ conomic Losses” is a contribution helicopter operations. Cost analysis of a fatal helicopter accident to the system made by Steven Shavell (1987). revealed not only how little cost data are collated following an occur- rence, but also once a thorough analysis had been completed, how Table 1: Accident cost classification. expensive and accident really is once all of the costs are considered. It was in developing the cost model that the following methodology of ensuring long-term social efficiency and justice. was reviewed and adopted. Having recognized these differing and sometimes competing

interests, Calabresi found that greatly improved analysis of acci- WEDNESDA Alternative cost analysis system dent cost reduction strategies would result once a clear set of goals When it comes to assessing cost information, the ICAO guidance (justice and cost reduction) and associated subgoals (e.g., reducing (along with that from other regulatory bodies) is useful but not administrative costs) are first identified. Underpinning the whole optimal. An alternative system is one that has been widely adopted of this framework of analysis is the concept of classifying costs into by the legal profession for analyzing the costs of accidents, described three groups: 1) primary, 2) secondary, and 3) tertiary. It is worth in the Hon. Guido Calabresi’s seminal work The Costs of Accidents noting that it is this third classification of “tertiary” costs that is the (1970). The author proposes a framework of analysis that clearly source of most advantages of the Calabresi system over the direct/ apportions costs according to the interests of the stakeholder most indirect system. concerned. A summary of ICAO’s system and the comparison with Calabresi’s Primary costs of Accidents works is shown in Table 1. These are the most obvious and directly related group of costs. By While the list of cost items shown is obviously not exhaustive, it is definition, an accident is an unplanned, unintended event that sufficiently indicative and also it mirrors the list in the ICAO Safety results in harm or damage, and therefore losses (which results in Management Manual (2006), Section 4.8, Cost Considerations. costs). These costs range from damage to equipment, damage to A working definition of direct costs are those items for which it property, and/or infrastructure, and may culminate in injuries to may be possible to get insurance coverage, and indirect costs being people. Equipment needs to be repaired or replaced; damaged those costs outside any insurance coverage. A more detailed set of property needs to be secured, repaired or rebuilt; infrastructure definitions is given inSafety Management Manual (2nd Edition, 2008), needs to be stabilized and reinstated; injuries to victims require Chapter 5, Paragraphs 5.3.8-5.3.9. However, for the purposes of this medical attention. paper, it will be assumed that readers are familiar with applying this direct/indirect cost classification system that has been endorsed by Secondary costs of accidents ICAO and other regulatory bodies for some time. From here on, Secondary costs are the “societal costs” (see Reference 4) arising from the objective will be to summarize the principles of the alternative accidents. These costs include the various compensations to victims system and highlight the key advantages to be gained. and/or the families of victims. It also includes activities that are aimed It is important to recognize that the definition and priority given at managing long-term psychological and related social impacts, to any cost will change according to your viewpoint; and in the case through counseling, government, and community support. of aircraft accidents, these viewpoints (and related stakeholders) are often in conflict. The air transport industry has many stakeholders, Tertiary costs of accidents but for the purposes of accident cost (and associated safety cost) Coping with accidents involves organizing the resources of multiple analysis, they can be reduced to three broad groups, identifiable by parties and organizations and arbitrating competing interests. This the primary interest of members. gives rise to a set of costs concerned with administrating the system, and, in the case of aviation accidents, includes such items as accident Stakeholders investigation, safety regulation, and legal proceedings. According to Calabresi and Shavell, there are three identifiable categories of stakeholder. The “industry” clearly forms one major Economic loss group, whose members will include operators, maintenance orga- The issue of “economic loss” (see Reference 5), as distinct from nizations and manufacturers. “Society” forms the second, made up other accident costs, is a way to highlight particular circumstances of both individual protagonists, community groups, and the wider of a situation that will not be generally true for others, or for population. The third group is “Administration,” comprised of ex- consideration by the air transport system as a whole. Inclusion of ecutive, legislative, and judicial authorities charged with the duties these items as costs might distort or otherwise impose a bias on the

ISASI 2009 Proceedings • 77 ISASI 2009 PROCEEDINGS 78 Figure 1.Accident cost/safetyrecommendation framework. reduc- cost tertiary and secondary, primary, of combination best the find to the reduction that are greater achieving in costs than incurring without thepoint reduction certain a beyond costs isaccident worth. Our aim must be all reduce cannot we as other,just the in reduction some forgoing without category one in reduction of amount certain a than more have cannot We reduction] cost ary/tertiary costs). reduced incentivestoavoidaccidents(primary compensated perfectly (secondary cost reduction), there would be restricting“feeder”-type airlines).Similarly,accidents allwere if severely (e.g., society to costs in result also might this accidents, of frequency the reduced powered multi-jet not were that aircraft all excluding example, for If, costs. secondary in increase an in result In some circumstances, targeting the primary costs, for example, will will not always result in an overall reduction in the costs of accidents. fashion, it is important to note that reducing any one group of costs similar a In drag. total on impact detrimental overall an create to optimal point and, thereafter, be negated by increases in the other an until up drag total in advantage overall an produce may speed in increase an through one in reductions where aerodynamics in teraction between zero lift drag and lift induced drag on total drag in- the of understanding an is analogy closest other.The any over analysis cost of framework this adopting for argument strongest the probably is directionality of concept the of appreciation An Directionality may betoactuallyincreaseoverallaccidentcosts. effect overall the so another,and with sympathetic be necessarily not will cost of category one at targeted solely initiative An result. might that consequences unintended any and actions, different system is that it becomes easier to identify the interaction between stakeholders. than amatterforindustry rather circumstances of set specific and particular very a clearly is but measures, extraordinary justify well may This dollars. of lions high-net-worth passenger, potentially owning assets worth many bil- example might be when there is an accident causing injury to a very industry.Another the to cost a is that altogether,then lost is ness operator.individual that just cost, a experienced not has se, industry,per the case, this In business. that up picks operator another where business of loss operator’s decision-making process. An example of this would be an individual LOSS ECONOMIC TERTIARY SECONDARY PRIMARY CATEGORY “It should be noted in advance that these subgoals these that advance in noted be should “It categorization cost accident Calabresi’s of advantage Another • ISASI 2009 ISASI issue risks Specific business administration regulation; court Investigation costs; compensation Market instability; Human capitalloss/damage Fixed assetloss/damage; ACCIDENT COST Proceedings are not fully consistent with each other…. other…. each with consistent fully not are n the other hand, if that busi- that if hand, other the On Corporate governance social efficiency e xecutive branches ambiguity; enhance resolve uncertaintyand Tools tominimizeor trust andconfidence legislativebranches targeted toenhance Reputational measures probability offailure measured against Improved reliability RECOMMENDATION SAFETY - [primary/second Shareholders and judiciary of government of government and OEMs) providers service (operators, Industry STAKEHOLDER KEY (Calabresi, 1970,page29) reduction.”that achieve to up given be must what account into taking tion cost might well be justified on the basis of the expected loss in pas- secondary a addressing with concerned recommendation safety A are ofpreeminent concern. 2. Past accidentsinwhichsecondaryfactors reliability ofthemaingearbox. AS332 knowledge about the formation of ice reliability in the fuel system. 2008, 17, Jan. G-YMMM, 777, Boeing recent casesare somepreviously unknown failure mode or issue of reliability. There Two are many examples of accident investigation that highlighted life. of loss or damages of cost expected and failure of probability fully justifiable on the existing basis of cost-benefit analysis namely, be will costrecommendationprimary safetyconcernedwith A are ofpreeminent concern. 1. Past accidents in which primary factorsSome illustrativeexamples without resourcetoemotivereasoning. strengthened, greatly be will analysis cost-benefit associated any of recommendation to the appropriate costs. Consequently, the validity separate the various goals and sub-goals in order to match the safety (even if that is the ultimate objective). Therefore, it is important to atedjustification predicated expectedthe on savingvalue of life is concerned with the industry probability of failure, and an associ- transport air sustainable and stable a maintaining with concerned in Figure1. process, theoverallobjectivewillbelargelyachieved. whether or not absolute consistency is achieved in the classification issues of concern in their areas of control most effectively. In this way, direct the attention of the relevant stakeholders toward the relevant betweencategorizations,these classificationprocessofthe does Whilenotisitalways obvious where distinctions should madebe Application The important thing to recognize is that not every objectiveevery not thatrecognize is toimportant thing The Diagrammaticallysystemthesummarizedbecan illustratedas , Apr. 1, 2009, with a focus on the Apr.G-REDL, Puma, the Super on L2, focus a with 2009, 1, ter situations aswell,forexample, “secondary” factors evident in less cataclysmic attacks inNewYork. 1988, 21, Dec. 103, Am Pan 747,Boeing ofterroristbombing some major political event, most notably the have significant market potentialcrisis. often involve withreal potential to place the industry into thesesecondary (social) factors are the ones that recognized be should It yields. maintain pricechanges (temporary or permanent) to ticket necessary the or values) of range a on based analysis scenario a (or demand senger AAIB, Special Bulletin, S3/2009, these see to possiblealso is However,it , Feb. 18, 2009: 18, Feb. G-RED U, EC225, Examples of accident investigation that ondon Heathrow,London new with ockerbie, and the 9/11 9/11 the and Lockerbie,

Eurocop- “Because “Because of the importance of helicopter operations in support of the offshore oil and Summary gas industry, it is considered appropriate to disseminate the results of the In the face of any accident aftermath, there is a clear and recognized initial investigation as soon as possible. No analysis of the facts has been need to fulfill obligations and responsibilities towards multiple attempted.” parties, each with its own set of priorities and goals. The recom- mendation remains the most powerful weapon in the arsenal of the 3. Past accidents in which tertiary factors investigator but should be used wisely. Although this should not be are of preeminent concern. a primary driver in deciding whether to make a recommendation, A safety recommendation concerned with addressing a tertiary cost understanding the cost implication may assist investigators in direct- might well be justified on the investigation costs saved should bet- ing them. This is particularly important where costs are less visible, ter quality information be available, or avoiding damaging public as is often the case with secondary and tertiary costs. , SEPT. 16, 2009 2009 16, SEPT. , disagreement and resolving contentious differences of opinion effi- A cost categorization and classification system that best matches Y ciently. Additionally, it will be a justification made against system-based these goals and priorities will likely aid more socially efficient deci- costs (recognizing the agents of State as legitimate stakeholders, with sion-making than alternative systems. The authors of this paper have specific roles and with financial interests) rather than attempting to compared these two systems in great detail and are of the opinion justify cost-benefit on the level of each and every individual operator. that the accident cost classification system based on Calabresi’s work Probably the most pressing tertiary factor for accident investigation (see Reference 4), modified by Shavell (see Reference 5), is supe- is concerned with flight data recorders (FDR). There have been rior in this regard. Due to the principles on which the framework numerous accidents that cannot be resolved satisfactorily because of is founded, it encourages the accident investigator or safety analyst the lack of adequate data, to the extent that the International Heli- to represent the problem from different viewpoints. In this way, it is WEDNESDA copter Safety Team (IHST) has made wider use of FDR a keystone of also a very useful aid for structuring the whole safety analysis along its strategy to reduce helicopter accidents by 80% by 2016. However, logical pathways, without adding any significant complexity for the it is evident that to demonstrate the full financial value of this initia- analyst. It is for these reasons of effectiveness, clarity, and ease of tive, the issue needs to be considered at a system level rather that at use that accident investigators should give serious consideration an individual operator level. Possibly the highest profile examples to adopting this technique when identifying and framing safety that illustrate the potential value of proper allocation of resources to recommendations. ◆ tertiary factors (in practical terms, aids to investigation) are References Boeing 737, US Air 427, Sept. 8, 1994, Pennsylvania, where the 1. International Civil Aviation Organization. Safety Management Manual (SMM). investigation was frustrated by the lack of data concerning the loss Doc. 9859 AN/460, 2006. 2. Mitchell, S., The Economics of Safety: A Case Study of the UK Offshore Heli- of control. copter Industry. Cranfield University, Ph.D. thesis, 2006. 3. International Civil Aviation Organization. Safety Management Manual (SMM). Boeing 747, TWA 800, July 17, 1996, Atlantic Ocean near New York, Doc. 9859, 2nd Edition, 2008. 4. Calabresi, G., The Costs of Accidents. Yale University Press, New Haven, 1970. resulting in a highly complex and costly investigation process because 5. Shavell, S., Economic Analysis of Accidents Law. Harvard University Press, Cam- of a lack of objective data. bridge, Massachusetts, 1987.

ISASI 2009 Proceedings • 79 ISASI 2009 PROCEEDINGS (ASSE), andtheSystemSafetySociety. Safety Investigators(ISASI),theAmericanSocietyofEngineers professional organizations, includingtheInternationalSocietyofAir human factors,andsystemsafetycourses.Bramanisactiveinvarious including graduate-andundergraduate-level accidentinvestigation, for ERAU inHuntsville,Ala.,certifiedtoteachallsafety-related courses tal, safety, andhealthmanagement.Heisanassistantadjunctprofessor agement; environmental auditinginhealthandsafety;environmen - safety professional (CSP)andholdscertificationsinhazard control man- safety managementfrom Texas A&MUniversity. Bramanisacertified a masterofscience(MS)degree inindustrialengineeringtechnologyand Aeronauticalmanagement from University(ERAU) Embry-Riddle and has a master of aeronautical science (MAS) degree instructorfortheU.S.ArmyAviation primary SafetyOfficerCourse.He in aviation/aerospace asaU.S.Armyaccidentinvestigatorand at theUSASC,heserved ing 6 years at the United States Army Safety Center (USASC). While 80 func- a be, will always and is, safety that conclusion the support to and fatal accidents. These examplesexample how a lack provideof leadership results in unnecessary catastrophic overwhelming evidenceand nuclear power industries. The paper will also illustrate through company leaders in the luxury transportation, utilities, construction, of mixture a include recipients 2009 The Council. Safety National ingsafety andhealth practices consistent withthemission theof advanc- in record superior a demonstrate must leadership its and in safety and health. To be considered for the award, an organization organizations and their leaders for their outstanding achievements Councilhas presented its annual Green Cross for Safety Safety National the 1999, Additionally,since training. combat safe and realistic conducting in commanders unit assist to initiated was Safety Philosophy was part of his “Safe Army Now Program,” which Point Five The needlessly. dying were soldiers numerous and ing train- combat during occurring were accidents unnecessary many that saw Wickham General time, this During (1983-1987). Army A. Wickham, instituted during his tenure as the Chief of Staff of the paper examines the “Five Point Safety Philosophy” of General John both aviation and ground operations. To illustrate these points, the is effective in both military and civilian organizationsa andlack of includesleadership. The safety is a function of leadership philosophy leadership.” It will also illustrate how accidents have occurred due to accident rates by embracing the philosophy that This paper explores how top management and leaders have reduced Abstract • ISASI 2009 ISASI By Gary D.Braman;SystemSafetyEngineer;SikorskyAircraftCorporation,Huntsville,Ala.,USA By Gary level through theDepartmentofArmylevel,includ- an aviationsafetyofficer, from theflightdetachment duty, he served in varying positions of responsibilityin the asaviation and safety professions. While on activeretired master Army aviator with more than 25 sky Aircraft years CorporationinHuntsville,Ala.Heisa Gary BramanisasystemsafetyengineerwithSikor Proceedings A Function ofLeadership “safety is a function of Safety: M edalto - the factthatsafetyisafunctionofleadership. highlighting occurred, have not would it likely highly is it mission, alive today. If the organization’sandthe six leaderspersonnel fatally had injured adequatelyon the lead occurred aircraft have not plannedwould accident this likely very is would it determined, be this been had routing alternative if that known is it collided, aircraft area.Though the investigation did not determine exactly why the 180-degree continuous right turn to final in a compressed maneuver four the required planners mission Standards/procedures • ing isinsufficientincontentandamount. unnecessary accidentsbeprevented. unnecessary responsibility, ultimate their as will safety leaders, and managers as embrace leadership and management organizational when only that conclusion the supports also It accidents. of prevention the in effective extremely is leadership safety and leadership, of tion Support • clear ornotpracticalstandardsandproceduresdoexist. turn to their landing zone while sling loading requirementto have the flight of four aircraft make a 180-degree leaders made numerous errors, with the most significant being the the part of unit leaders. During the planning of the mission, the unit injured (seeReference1). were aircraft lead the board on personnel 11 the of 5 and injured, fatally were (trail) 4 chalk board on occupants six All were destroyed. and crashed aircraft Both aircraft. lead the with midair in zone (LZ) when chalk 4, sling loading an landing tactical a to approach final to turn right 180-degree a ing vision goggle, multi-ship air assault. The flightnight ofa aircraftin was execut- participating were aircraft The aircraft. other two with formation in flying while turn degree 180 a executing while flight two 2001, 12, Feb. On Introduction Training • root causesasdefinedbytheU.S.Army(seeReference2): gated to determine the root cause. Human errors have five specific determined that a human error occurred, it can be further investi- human error, materiel factors, and environmental factors.investigated If it wasto determine the cause of the mishap. These include accidentDuringaninvestigation, threespecific always areas are Safety andleadershipdefined Individual • and typeofpersonnel. number and facilities, services, supplies, equipment, of condition Leadership • to ownpersonalfactors). butelects not to follow the standard (self-discipline—mistake due The accident occurred due to inadequate mission planning on on planning mission inadequate to due occurred accident The failure—formal failure—shortcomings

failure—individual failure—direct, Blackhawk helicopters collided in in collided helicopters Blackhawk UH-60L failure—standards training, unit knows

command, in experience, aircraft to execute a a execute to aircraft UH-60L

type, and M998 HMMWV, collided is

and capability,

trained or M procedures or 998 H higher on-the-job to

the MM amount, command standard Vs. The are train- not

or

supervision not ready, willing, or able to enforce known standards. puted aircraft performance data, and assessed the risks associated Leadership can be defined as the ability or capacity of one indi- with the mission. Additionally, it conducted all mission and crew vidual to influence the actions of others to accomplish a specific briefings. The crew then filed the flight plan and completed the task, objective, or goal. Leaders can be those people in positions preflight inspection of the Apache. The time was about 1400 when of specific authority such as a supervisor or manager, or it could they took off. The pilot-in-command (PC), who was also a unit IP, be someone who is a leader by virtue of position with no specific was in the backseat on the controls, and the copilot was in the front authority. These people include flight instructors, aircraft captains, seat. They conducted ATM training consisting of low-level and NOE or safety professionals. Army leadership refers to officers, non-com- operations in several different training areas. They also practiced missioned officers (NCO), senior executive service (SES) officials, multiple target engagements and high- and low-recon of landing and government service (GS) employees designated, authorized, zones. This training was completely documented on the aircraft’s , SEPT. 16, 2009 2009 16, SEPT. ,

held responsible, and accountable by the Army to make decisions videotape. The video also showed the PC operating the aircraft as Y at various levels of the Army involving execution of the Army’s mis- low as 3 feet above ground level (AGL) at 26 knots between trees sion. An inherent responsibility of every leader is to accomplish the and wires beside common-use roads. At one point, the copilot was task, goal, or objective in a safe manner. heard to say, “Yeeeeeee-haaaaaaaa,” as the PC completed a return- Safety is defined as freedom from those conditions that can cause to-target maneuver. injury, death, occupational illness, or damage to, or loss of, equip- The crew continued the flight along a common-use roadway until ment or property (see Reference 3). It is now obvious how the leaders arriving at one of the large drop zones scattered around the reser- failed in the accident sequence described in the introduction. Had vation. The PC turned the aircraft left to a heading of 320 degrees the leaders been involved, taken appropriate action, and adequately toward a stand of trees. As the aircraft approached the trees, the PC WEDNESDA planned the mission of the Blackhawk helicopters ensuring the noted a gap in the trees and asked the copilot, “Do you think we safety of the crews and their aircraft, this accident would have never can make it between there?” The copilot answered, “Nope.” The happened. (This was only a training mission, and taking this type of PC then remarked, “Sure we can. Look how big it is. Oh, ye of little risk was not necessary nor was it required to train the aircraft crews faith. Look how big that is.” in performing this task. At 1532, immediately after the PC’s remarks, the No. 4 main ro- tor blade struck a 2½-inch diameter limb, breaking off an 8½-inch Leadership failures piece of the blade. The Nos. 2 and 3 main rotor blades also struck As a former Army accident investigator, I could provide literally the tree. The aircraft shook violently, but the aircrew was able to land hundreds of examples highlighting the fact that safety is a function in an open field unassisted. The aircraft was at 16 feet AGL and 76 of leadership. However, the following two examples truly exemplify knots when it struck the tree, resulting in more than $1 million in the phrase safety is a function of leadership. damage to the aircraft. Approximately one year later while serving in Korea, an individual Oh Ye of Little Faith: During my time in the Army as an aviation safety approached me during a social event and began talking to me. officer, I was trained to be on the lookout for high-risk aviators or Though I knew his face, I couldn’t remember his name. After telling what we used to call “cowboys.” Cowboys are not identifiable by me his name, he told me I knew him from the “Oh Ye of Little Faith” age, gender, race, rank, or position and can be anyone. They are accident. He was the battalion standardization officer. He told me sometimes praised as heroes because they accomplished a mission he owed me an apology. During his interview that was part of the ac- under extremely difficult circumstances and at very high risk. Their cident investigation, he stated he lied to us as had several others. He behavior is known to everyone in the organization. including the said this was not the first time this pilot had acted in this manner, and chain of command, though no action is undertaken to stop it. They it had occurred again after the investigation was complete. I asked can be the best or the worst officer in your organization. Their be- him why he or anyone else would protect this individual knowing havior can be very obvious or very discreet. They don’t like doing he could kill not only himself but others. I got no response. things by the book and don’t understand why they should. They become defensive when confronted and will always have an excuse The Grenade: In August 1996, an infantry battalion’s scout platoon for their actions. had occupied a range in the local training area in preparation for I served on an accident investigation board investigating the crash numerous training events that were to take place over a period of of an AH-64 Apache in January 1997. Shortly after arriving at the several days. Training on the first day consisted of day and night, scene of the accident, we were handed the tape from the aircraft’s dry and blank firing, as well as live-fire operations in preparation video recorder. After viewing the tape, I knew we were dealing with for the next day’s training. The training was conducted without cowboys. An accident had been inevitable during this flight; it wasn’t incident. The second day’s training consisted of a hand grenade a question of “IF” an accident was going to happen, it was only a range and a fast rope live-fire exercise (see Reference 5). matter of “WHEN” (see Reference 4). Early in the morning of the second day, the lieutenant platoon The mission was a single-ship, day aircrew training manual (ATM) leader, who was also the range officer-in-charge (OIC), was informed training flight for an officer who had not flown much but was sched- that another unit was also scheduled to use the same range that uled to deploy on a Joint Readiness Training Center rotation. The day. In an attempt to expedite the training, the lieutenant picked training was to include high- and low-level reconnaissance, low-level up four M67 fragmentation grenades from the ammo supply point flight, and nap-of-the-earth flight with target-engagement opera- on his way to conduct his leader’s recon for the fast rope live-fire tions. The crew was briefed to conduct the flight in the local training exercise. From there, he would go directly to the grenade range. area utilizing several different sectors and transition corridors. As he headed toward the recon area, he attempted to secure the As part of preflight planning, the crew checked the weather, com- grenades in the four grenade pouches located on his two ammo

ISASI 2009 Proceedings • 81 ISASI 2009 PROCEEDINGS pierced his heart killing him instantly. The battalion commander’s fragment grenade small a and closed properly vest fragmentation thehilltoward themwith axe. down an Thespecialist walking didnot was have his specialist young A situation. the discussing together huddled were sergeant platoon and leader, platoon the brigadecommanderleft range,thegrenadeexploded. thesoldiers again began cutting the vegetation. and range Ten the departed he soldiers, the briefed minutes he After grenade. after the locate to order in vegetation the cut properly to how included briefing his of Part soldiers. the briefed and range the at arrived rest oftheday. cutthe vegetation. The operation continued uneventfully for the axes,machetes, sickles, andscythes, issued andwent were backhelmets, inthe Kevlar area toand vests fragmentation their on put ers, the infantry soldiers were told to cut down the vegetation. They 82 used. In an attempt to assist in the em­ through it. Due to the vegetation, the mine sweepers couldlost is more than not10 feet behigh and so thick a human can was hardly walk grenade the where vegetation The terrain. barren or low-cut over forth and back it swinging by employed is detector) metal a find the grenade using minesweepers. The mine sweeper (basically engineers andEODtolocatethegrenade. the use to but grenade the find to soldiers use to not command of been informed the grenade had no pin and had told had the unit general chain the that headquarters division from came word day, looking for the grenade. This proved to be unsuccessful. slowly walkdownthelane,carefullymovingeachbranchandtwig, enough for eight soldiers. Standing side by side, the soldiers would the lieutenant had lost it. The area was then divided into lanes wide that suspected was it where area the off cordoning by grenade the not beeninformedthatthegrenadewasmissingsafetypin. that the unit was to find the grenade. The division commander had of range control when the word in came the fall. These from actions had been completed the under the supervision division commander burned be would area the and area, impact an as it mark area, the for thegrenadeorassistunitinsearchinggrenade. EOD detachment commander would not allow his people to search sessed the risk of searching for the grenade as “extremely high.” The and knowing that the grenade had no safety pin, viewing the terrain and vegetation where the grenade had been lost, After scene. the on arrived personnel (EOD) Disposal Ordnance control and the chain of command. grenade and called a cease fire haltingall training. He notified range missing the of informed was range, the on training inspecting was continuetraining.battalion The command sergeant major, who him of the missing grenade. He instructed the platoon sergeant to told and (RSO), officer safety range the also sergeant, platoon his searched for the grenade for two hours without success. He notified still hangingonthegrenadepouchstrap. was pin grenade The missing. was grenades the of one noticed he pin. grenade the through placed only secured to the pouch by the grenade pouch strap that he had pouches.properlyHe secured four.threetheof fourthThe was At the moment of detonation,momentofthebattalion theAt commander, the Early on the morning of the fourth day, the brigade commander The following morning (Day 3), an engineer unit attempted to Thefollowing day(Day2),theunit initially attempted findto The local range regulation stated that the unit was to cordon off He grenade. the find to went immediately lieutenant The • ISASI 2009 ISASI Proceedings pon completion of the recon, recon, the of completion Upon Early that afternoon, ploy­ ment of the mine sweep- EOD personnel as- Later that xplosive Explosive

Safety • must betaken.Thatpersonpenalized. action concrete some then negligence, someone’sclear by caused developsensea ofresponsibility toaccept it.When accidents are Fix • employees. their in safety of sense sixth this instill also can managers and sors that they see the potential for tragedy and avoid it. - Civilian supervi so happen, to about are that acts unsafe of conscious are leaders kind of sixth sense about safety within the Army so that soldiers and Instill • involved tofulfilltheirroleandresponsibilitiesasleaders. happen. Supervisors to going isn’tand safety involved, managersis commander the areunless but safetyroles, officers. They must their in helpful be and responsible not are others that mean doesn’t commanders: “You must put yourself out as the safety officer.” That previous accidentscenarios. forthis first, and foremost, point is illustrated only too well in the warrants unnecessary risk of life or equipment.” The total disregard point in his philosophy is the firstquite effective. They fit both and military civilian activities. The key one: “Nothing we do in peacetime off-duty activities,ofyourunitinroleassafetyofficer. personally involved in the activities, the training activities, the on- and Commanders • riskoflifeandequipment. the unnecessary to fit both and the civilian military worlds. Nothing we do warrants effectiveness, and safety of all our operations. unnecessary risk. We Thismust be alert canfor ways be to modifiedimprove the efficiency, name of realism,” if doing it exposes your people or and equipmentequipment—You cannot say to that “we are going to do this in the risked to find a grenade that did not have a pin inas it?”“How could anyone let this happen?” or “Why were soldiers’ lives such mind to coming questions many with failures leadership the were within12feetoftheblastalsoreceivedshrapnelinjuries. who soldiers other seven and wounds, shrapnel multiple received sergeant staff and lieutenant The knee. the below amputated be left foot and lower left leg were so badly injured that his leg had to Nothing • are listedbelow(seeReference6). mitment to points safety in These his Five Point Safety Philosophy. realistic and safe. The document reflects General Wickham’s com- manders to use when conducting training, ensuring it can be both com- unit for roadmap a was document The Now.” Army “Safety entitled document a published Center) Center–USACRC/Safety the (now (USASC) needlessly intrainingaccidents. and accident prevention. He had seen too many soldiers were dying which ended in 1987 when he retired, he was dedicated A. asJr.chiefto Wickham, John ofstaff tenure,safety his ofthe During Army. General appointed Reagan Ronald President 1983, In The Five Point SafetyPhilosophy cilannually awards theGreen Cross Medal: Safety for Cross Green successes Leadership These five points are very basic, simple, easy-to-remember, and easy-to-remember, and simple, basic, very are points five These As you read the accident scenario, you should be able to identify In December 1986, the the 1986, December In accountability—Accountability

in officials soldiers we do

are must in a nited States Army Combat Readiness/Safety Readiness/Safety Combat Army States United peacetime safety sixth

be

sense proactive officers—This Since 1991, the National Safety Coun- Safety National the 1991, Since U warrants nited States Army Safety Center Center Safety Army States nited of safety—We

must and M edalforSafety. Theaward the

aggressive—You be is unnecessary the fixed have message and to develop people risk I

must give of must that

life my be

recognizes organizations and their leaders for outstanding achieve- the qualifications of the aviation unit commander, performance ments in safety and health, and for responsible citizenship. To be criteria established by the commander, pilot-in-command appoint- considered for the Green Cross for Safety Medal, an organization ment process, priority given to training; and support received from and its leadership must demonstrate a superior record in advanc- higher headquarters. ing safety and health practices consistent with the mission of the • Operations—The survey focused on flight operations being National Safety Council. The winner of the 2009 Green Cross for conducted by the book. Safety Medal was Moir Lockhead, Chief Executive FirstGroup PLC, • Maintenance—Maintenance activities were analyzed to determine Aberdeen, Scotland/Cincinnati, Ohio. Lockhead’s corporation if they were performed by the book; determine the strength of NCO employs 137,000 people worldwide. The following leaders were leadership involved in maintenance operations; and maintenance recognized by the National Safety Council as their 2009 CEO’s who quality control. , SEPT. 16, 2009 2009 16, SEPT. ,

get it (see Reference 7). • Training—The review of training was very in-depth. It included Y • Robert Bellagramba, president, CEO and CFO, Concorde Limou- reviewing and analyzing the emphasis placed on training, aviator sine Inc. (a luxury transportation service company), Freehold N.J. self-discipline, action taken against violators of proper flight disci- • Larry C. Bryant, commissioner, South Caroline Vocational Rehabilita- pline, mission planning, crew selection, enforcement of the safety tion Department (a state government agency), West Columbia, S.C. program by the flight instructors, aviator proficiency training, and • Dan Fulton, president and CEO, Weyerhauser Co. (a manufac- NCO training. turing, distribution, and sales of forest products company), Federal • Accident prevention program—The unit accident prevention Way, Wash. programs were reviewed and analyzed to determine if aviation

• James H. Miller, chairman, president, and CEO, PPL Corp. (an safety officers were involved and supported by the unit chain of WEDNESDA energy company), Allentown, Pa. command, if safety surveys were conducted and results acted on, • Davis Mullholland, president and CEO, CCI Mechanical Inc. (a and the management of the safety program. design, installation, and maintenance of mechanical systems com- • Aviation medicine—This topic dealt primarily with flight surgeons, pany), Salt Lake City, UT. their support of the units, their credibility, their involvement in the • George H. Rogers, III, president and CEO, RQ Construction, Inc. unit safety program, and the use of the flight surgeons. (full-service construction company), San Diego, Calif. The analysis of these areas of aviation units highlights the fact that • Vic Staffieri, chairman, CEO, and president, E. On U.S. (a diversi- involvement by unit leaders is absolutely necessary to prevent acci- fied energy services company), Louisville, Ky. dents. These unit leaders not only include the unit commander and • Capt. Neil C. Stubits, Indian Head Division, Naval Surface Warfare his/her non-commissioned officers (NCO), but the unit’s aviation Center, (U.S. Navy research, development, and test facility), Indian safety officer (ASO), the maintenance officer, and the flight instruc- Head, Md. tors. Leaders not only are those individuals in positions of authority, • Andy Studdert, chairman and CEO, NES Rentals (an aerial equip- such as CEOs, supervisors, managers, or unit commanders and NCOs, ment rental company), Chicago, Ill. but also those individuals who are leaders by virtue of their position in • Timothy J. Whitener, CEO, LUWA Inc. (an HVAC specialty con- an organization. They are also the individuals who set the examples tractor), Winston-Salem, N.C. of conduct for subordinates in any unit or organization. These CEOs run a variety of different companies, with a varying number of employees, and are located in all corners of the company. Conclusions Though they are of varying sizes and in various locations they have Though only a small number of leadership failures and successes a lot in common. Each of these individuals was asked a series of were discussed, it is readily apparent that safety is, and will always, questions with the first one being “Why is safety a core value at your be a function of leadership. It can be applied to civilian industry, company?” The recurring theme was people, be they employees or military units, and government agencies regardless of the number customers. Additionally, safety was not seen as an impediment to of employees or location. Safety works when the CEO’s get it! ◆ doing business, but an integral part of their business. Without safety, they could not succeed and their companies or organizations would References not be successful. 1. Earl Myers (accident investigation board president) in discussion with the author, June 2009. 2. Department of the Army Pamphlet (DA PAM) 385-40, Army Accident Investiga- U.S. Army: In December 1986, the then United States Army Safety tion and Reporting, Nov. 1, 2004. Center (USASC) published the results of a study that was conducted 3. Army Regulation (AR) 385-10, The Army Safety Program, Aug. 23, 2007. to determine what makes the difference between a unit with no 4. Braman, Gary D., “Cowboys are Alive and Well,” FlightFax, June 1998. 5. Braman, Gary D., “Take No Unnecessary Risk of Life,” Countermeasure, Janu- accidents and a unit with accidents. The USASC surveyed three ary 1999. battalion sized units that had historically excellent safety records. 6. U.S. Army Safety Center, Safe Army Now, December 1986. They analyzed the following aspects of these organizations (see 7. “2009 CEO’s Who Get It,” National Safety Council Magazine of Safety and Health, February 2009. Reference 8): 8. U.S. Army Safety Center, Aviation Unit Safety Records: What Makes the Difference? • Management—The management aspects analyzed included June 1986.

ISASI 2009 Proceedings • 83 ISASI 2009 PROCEEDINGS Delft UniversityofTechnology. 84 require- these where areas in controls, flight for requirements using special conditions to augment the airplanes traditionalFBW certifying airworthinessbeen have authorities certifying The tion requirements dealing with fly-by-wire were flownbyhelicoptertohospital (seeReference1). The flightdiverted to an AustralianAir Force base and these injured over abruptly seriously injuring fourteen passengers and cabin crew. function flying between Singapore and Perth. The airplane pitched In Introduction TCAS—Traffic and Collision Avoidance System Advisory PNF—Pilot notflying PIO—Pilot inducedoscillation PF—Pilot flying MMO—Maximum operatingach MEL—Minimum equipmentlist FL—Flight level FCS—Flight controlsystem FBW—Fly-by-wire ASRS—Aviation Safety ReportingSystem(NASA) ADIRU—Air DataInertialReferencenit Abbreviations databases for FBW accidents and serious incidents. will examine the service history of civil FBW airplanes, using several emphasistheoncertification requirements found Partin 25. We fly-by-wire of history The Summary causes willbediscussed. their and found be will incidents of types Three involvement. trol and incidentswillbescreenedtoexcludethosewithnoflightcon- This accident gave impetus to efforts to review the certifica- the review to efforts to impetus gave accident This October 2008, Qantas Flight 072 experienced a flight control mal- • available Photo Photo ISASI 2009 ISASI not not A Review ofFly-by-Wire Accidents

an airlinepilot. to thathewasaconsultingengineer, atestpilot,and Riddle Aeronautical University in Prescott, Ariz.was anassociateprofessor ofsafetyscienceatEmbry- Prior Directorate. Prior tojoiningthe FAA, Dr. Newman was an aerospace engineer in the Transport AirplaneDick Newmanrecently retired from theFAA where he Proceedings Aircraft on fly-by-wire design and taught at the joining the FAA, he worked for a year with Fokker variety ofproduction andresearch projects. Prior to the Boeing Company, where he worked on a wide He has more than 40 years of experience, 29 with technical advisorforadvancedcontrol systems. Tony Lambregts istheFAA’s chiefscientificand (FBW) airplanes will be reviewed with a a with reviewed be will airplanes (FBW) By Dr. R.L.(Dick)Newman,Seattle,Wash., andA.A.(Tony) Lambregts, Chief Scientist-AdvancedControls,FAA, Renton,Wash., USA (FBW) flight controls. 1 These accidents authority tection designs range from full authority stability augmentation, such as the without designs simpler and designs Boeing or Airbus the as such controls. control system. sault, or Das- Boeing, models—Airbus, All requirements. 25 Part the of all systems. None of the current transport FBW airplane designs meet mechanical direct of terms in forces and motion stick-and-rudder updated to cover FBW designs. The certification rules still speak of been not have They systems. mechanical traditional for developed airplane anddon’t aboutlosingcontrol. worry other words, with full authority envelope protection, you just fly the As one NASA test pilot said, “This results in carefree handling.” airplane. the overbanking or overstressing, overspeeding, stalling, preventthepilot fromreaching unsafe flight conditions, such as help can protection envelope present, If features. protection lope reducing pilottrainingcosts. can be designed to fly with virtually identical handling qualities, thus the range of speed, altitude, andthe airplane’s aircrafthandling qualities appear the same to the loading.pilot across Different airplanes morepayload. burning lessfuelorbeingabletocarry mean can this 777, Boeing or A320 Airbus the as such airplanes, be reduced and the maneuverability can be increased. In transport the operational center of gravity is moved aft, the airplane drag can stability when computers to compensate for the less basic airframe was on the military F-16 fighter. By programmingtual control surfaces. The thefirst operational flight use of FBW control flight controls modify the pilot’s control inputs before sending the signal to the ac- fuselage grewbysome10-12inchesduringsupersoniccruise. tered service in 1976. Control rigging was the driving issue since the you thatcontrolriggingcanbetimeconsuming. tell will mechanic airplane Any requirements. man-power tenance or fuel savings. It also greatly reduces the manufacturing and main- payload increased to translates which savings, weight significant a For the manufacturers, elimination of the cable and pulleys means systems. control flight FBW have airplanes transport new all, not if and the flight control surfaces, such as the ailerons or elevators. direct mechanical connection between the pilot’s stick and rudder FBW is the description of airplane flight controls in which there is no Background ments areinappropriateorinadequate. There are currently 10 civil airplane designs with FBW flight flight FBW with designs airplane civil 10 currently are There were controls flight airplane for requirements Certification Most FBW flight control system designs also include flight enve- Inaddition, the flight control system can be designed to make M en- which Concorde, the was FBW with transport civil first The odernFBWflight controls use onboard digital computers to Embraer—have employed special conditions for the flight 3 These include designs with full stability augmentation, augmentation, stability full with designs include These mbraer). (Embraer). protection envelope minimal to (Boeing) Embraer designs.

(Airbus) through limited Envelope pro- ost, Most, 2 2 In In Table I: Civil Transport FBW Models Table III: FBW Incidents in Civil Aircraft Manufacturer Certified Models Proposed Models Model Accidents Incidents Total Rate* Airbus A320, A330, A340, A380 A-350 A320 7 13 20 0.30 Boeing 777 787 A330/340 2 2 4 0.26 Bombardier C-series B-777 0 2 2 0.12 Dassault 7X SMS E170/190 0 1 1 0.16 Embraer e-170, E-190 All Others 0 0 0 --0 Gulfstream G-VI, G-250 Total 9 18 27 Ilyushin Il-96 * Rate is events per million flight hours. Misubishi RJ Sukhoi SSJ-100 Tupolev Tu-204 Models 10 Current 8 Proposed 2009 17, SEPT. , Table IV: Types of FBW Incidents Y Type of Incident Number Comments Table II: Accidents Caused by FBW Systems Uncommanded Pitch/Bank 11 8 Pitch, 3 Bank Date Model Location Phase Description Injuries Damage Abrupt Maneuver 6 Dual Control Input 02/07/01 A320 leBB landing Abrupt 1 serious Pilot Induced Oscillation 4

maneuver 25 minor Write off Collision with Terrain/Obstacle 3 1-Dual Control Input URSDA 2-Envelope Protection Misused

03/17/01 A320 KDTW Rotation Pilot Induced 3 minor Substantial H oscillation FCS Mode Reversion 2 T 10/07/08 A330 YPLM Cruise uncommanded 14 Serious minor Tailstrike 1 pitch Total 27

Table I lists the current and proposed civil airplane FBW aircraft. necessarily that FBW was the cause. In fact, in one case, FBW pre- The next section outlines the methodology used to examine the vented an incident from being catastrophic. Table A (in Appendix) service history. lists the incidents obtained from this review. Table III summarizes the data. Method The principal types of FBW incidents are uncommanded pitch or One of the problems with examining safety problems with extremely bank, abrupt maneuver, or pilot induced oscillations (PIO) account- safe systems is the lack of many examples. We only found three ac- ing for 22 of the 27 incidents. There were three collision with terrain cidents caused by FBW systems (shown in Table II). accidents. These were not caused by FBW, merely influenced by the With such systems, one cannot examine accidents, but must system design choices. Two incidents (cases a and b)4 were caused search for precursors. Therefore, we reviewed the service history of by the pilot apparently relying on envelope protection to provide civil FBW airplanes, using several databases for FBW accidents and terrain clearance. The third incident (case x) was apparently caused serious incidents. The databases used were the U.S., British, Aus- by spatial disorientation, but was compounded by conflicting control tralian, and Canadian databases (see References 2, 3, 4, 5). We also inputs from the two sidesticks. used two private databases: the Aviation Safety Network and Flight There were three reported instances of the flight controls drop- Simulation Systems databases (see References 6 and 7). Once the ping back into alternate or direct law (cases n and v)—relatively event was identified, we examined publicly available information, minor events. However, they are included because of the potential such as the accident report from the investigating agency. We did consequences. not include anonymous reports, such as the NASA ASRS because Uncommanded pitch/bank: The predominant causes were of the inability to verify information. specific component failures (flight control electronics or incorrect Flight test reports were not included for several reasons. It is dif- wiring) often coupled with design errors in flight control software ficult to obtain reliable data, and the data may not be releasable. implementation. Fault detection and isolation design errors seem Further, the aircraft may not be typical of the inservice configuration. to be a major contributor as well. Many of these involved dispatch Military safety data were not used for the same reasons. In addition, with known bad components and subsequent mishandling of an many military aircraft designs and missions are not representative additional failure. Table V summarizes the factors. of civil aircraft. Cockpit ergonomics (sidestick) factors are interesting. In one We grouped airplanes using virtually identical FBW control incident (case y), the first officer (PNF) unintentionally depressed systems, such as A330/340 and E-170/190. Only airplanes in line operations were considered (test flights were excluded). These incidents were manu- Table V. Factors in 11 Uncommanded Pitch or Bank Incidents Cause of Incident Number Case In Table A Comments ally reviewed to exclude those with no flight control Flight Control Electronics 4 (e) (f) (g) (n) involvement. Secondary flight controls (i.e., flaps) Flight Control Software Implementation 3 (k) (q) (w) were not considered. Individual examination of Sensor Error Detection and Isolation 3 (q) (w) (aa) 2 Sensor, 1 Electrical each record was used to cull those with no FBW System Annunciations 3 (f) (w) (aa) multiple Warnings Cockpit Ergonomics 2 (n) (y) Sidestick Issues involvement. Envelope Protection Implementation 2 (k) (aa) Maintenance Error 2 (c) (n) Dual Control Input 1 (y) Results Flight Control Mode Reversion 1 (c) We found 29 accidents and serious incidents in- Inadvertent Control Input 1 (y) volving FBW systems. It must be emphasized that Reversed Controls 1 (n) maintenance Error these accidents and incidents involved FBW, not Undetermined 1 (z)

ISASI 2009 Proceedings • 85 ISASI 2009 PROCEEDINGS 86 following sevenincidentsarerepresentative ofthelist. Space does not permit a complete review of all FBW incidents. The Representative incidents r ands).Table VIIsummarizesthefactorsinPIOincidents. unprotected flaps affecting the aircraft response was a factor (cases on accretion ice instances, two In airplanes. FBW digital with lem prob- particular a awareness, pilot without authority displacement of the digital signals can saturate the control surface actuator rate or added lag of the digital computers and the high dynamic amplitude pilot’s control input. While this happens in non-FBW airplanes, the responses that the pilot is trying to control get out of phase with the maneuver incidents. input to the first officers. Table VI summarizes the factors in abrupt during a landingthrough follows pilot flare.one when occur also They help. to control the on gets (PNF) pilot other the and (RA), advisory resolution TCASrespondingpilotwhenone(PF)isevent,a ansuchas to outputcontrolaction.incidentsThesetheformtypically occur to averaged, not summed, are inputs two the inputs, make pilots both When design. FBW Airbus-type an on sidestick the to inputs took overpreventingacatastrophicaccident. (PNF) officer first the and liftoff, after just wingtip a drag to about captain’ssidestick was wired backwards laterally. The airplane incident another In landing. hard a causing landing, was the takeover button on his sidestick while the captain was flaring for crew’s jobintroubleshootingdifficult (casesf,p,v, w, andaa). gering failure/fault, there are cascading annunciations, making the there was “no recognizable failure” presented with multiple failure/fault indications. a andb). training crew on as much as systems FBW the on reflect not actually use the system to command a go-around. These incidents do protection and may have led pilots to either become complacent or many airline instructors were pointing out the features of envelope time, the At inappropriately. protection envelope the used crew transports,therewereaccidentstwo whichappearsinit that the of (PNF) also responded. This resulted in accelerations in the aft galley advisory was received. The firstofficer (PF) responded. The captain Dallas-Fort Worth. During the climb at 13,800 ft, a TCAS resolution injuries (see Reference 8) (caseh). Rate Limiting Contaminated Airfoil Flight ControlGains Cause ofIncident Table VII.Factors inFour Pilot-Induced OscillationIncidents Envelope ProtectionImplementation Crew Training Dual ControlInput Cause ofIncident Table VI.Factors inSixAbruptManeuverIncidents

A340 protection: envelope of misuse Pilot Pilot induced oscillation: These incidents occur when the aircraft applyingpilotsboth bycaused aremaneuver: TheseAbrupt M +2.3g, • ultiple warnings: In many of these incidents, the crew was crewincidents, thethese of many warnings:ultipleIn ISASI 2009 ISASI

abrupt

changing

maneuver: maneuver: Proceedings

to

-0.8g. U sually, it is the captain who adds his control O

Four n n June 21, 1996, an A340 was departing

flight Number Number (case p). In addition to the trig- 1 2 3 1 1 6

attendants arly in the service of FBW FBW of service the in Early (h) (i)(l)(o)(t)(u) Case InTable A Case InTable A One report states

(d) (r)(s) received (r) (s) (m) (h) (l) (case n), the the n), (case

serious (cases (cases Comments Comments During Takeoff Ice onFlaps TCAS Maneuver ence 11) (caseh). sidesticks allowed the first officer to fly the airplane safely effect, the captain’s sidestick was wired backwards. The independent In reversed. were wires of Twopairs replaced. connector the and bent was pin connector a replacement, this During replaced. was maintenanceinwhich one ofthe two elevator aileron computers airplane returned safely to Frankfurt. It was the first flight following The control. took instinctively officer first The increased. roll left lift-off.The captain (PF) compensated with right stick input. The logic wasmodified (seeReference10)(casel). airplane beyond repair. Subsequently the alpha protection engage the damaged which landing hard a was result The pilots. both by input control dual the and rate angle-of-attack high a by triggered was logic protection alpha the but around, go to attempted crew Bilbaolandatencounteredtowhenit strongvertical gusts.The FL370 (see Reference9)(casek). at A330 an with miss near a was result The level. flight assigned stick, which the crew eventually did, nose-down to a return command the airplane must crew to theflight the mode, Alpha-prot the disengage To FL384. to zoomed and up pitched airplane floor, the power is automatically advanced to takeoff power. The Alpha- reaches alpha When triggered. was Alpha-floor because possibly or crew flight the power,by off either take to advanced ADIR mumequipment list ( mini- The exchanged. were ADIRUs 3 and 1 Nos. the parts, spare an apparent ADIRU-1 failure. After landing at an outstation with no again. As a result of this incident, the failure detection and isolation at which point the system began to use the faulty accelerometer No. 5 continued to ignore this latentignoring failureitsoutput. theIn intervening untilyears,4 theaflight controlssecond failure2001, accelerometeroccurred No. 5 had failed with the flightpilot disengaged.control system This was followed by auto- the aand occurred, warnings stall pitchand overspeed simultaneous up to F erroneous airspeed and sideslip information during climb. At FL380, Reference 12) (casep). duringhavedetecteddidprevioustheiterror theas flight (see would voting operative, been ADIRUs three all Had ADIRUs. the extended. The fault was found to be in the pitot tube, not in any of was gear the when law direct to then and law alternate to switched symptomsas having no “recognizable failure.” The flight controls there were multiple failures and warnings. The report describes the was rendered inoperative per the Dispatch “Backwards” A320 Pitch U -3,butnot with either ofthe others inoperative. ADIR up landing over with Mach Alongitudinal gust caused an airspeed increase to ing at FL360 over the North Atlantic in turbulence. to Alpha-prot. At some point during power was was power during point some At Alpha-prot. to held is attack of angle input, stick pilot no With directly.alpha commands sidestick the protection, alpha In protection. alpha engaged which prot, Alpha- reached attack of angle the and sharply off anotheroverspeed. Subsequently airspeedthe fell prevent to apparently idle to power reduced pilot autopilot. The autothrottle also disengaged and the Indian Ocean: sidestick: accident: A340 inoperative

0.882 pitch MEL On

On Feb. 7, 2001, an A320 was attempting (MMO+0.02), ) permits) dispatch with aninoperative up: ADIRU: March 20, 2001, an A320 rolled left at On Aug. 1, 2005, a B-777 crew received On MEL. During the subsequent leg, Oct. 2, 2000, an A340 was cruis- On Aug. 9, 2001, an A319 had

which

disconnected L 410. In June (see Refer

U the -3 - software was modified to prevent the use of known bad sensors (see deflections appropriate to the flight condition and harmonization Reference 13) (case w). between the displacement maneuver commands and the required Pitch down over Indian Ocean: On Oct. 7, 2008, an A330 autopilot deflection forces. Similar issues with respect to FBW rudder control disconnected during cruise with multiple failure indications. While system designs also need to be addressed. the crew was troubleshooting, the aircraft abruptly pitched down at Pilot induced oscillations: Finally, PIOs will continue to be an issue -0.8g. There was a second pitch down at +0.2g. ADIRU-1 had many (see Reference 14). Current flight test evaluation is addressing this spikes in the output data stream and had flagged its output as in- by requiring evaluation in those areas where PIO is likely. Various valid. Both pitch downs were associated with angle-of-attack spikes prevention approaches have been proposed to develop system de- to more than 50 degrees alpha. The flight diverted to an air force sign attributes to reduce susceptibility to PIO or to detect PIO and base. Twelve serious injuries occurred (case aa). change gains accordingly. , SEPT. 17, 2009 2009 17, SEPT. , Y Conclusions Accident databases The three main types of FBW incidents, uncommanded pitch/ During the course of reviewing these accidents and incidents, we bank, abrupt maneuvers, and pilot induced oscillations have dif- noted that there is no consistent nomenclature of citing accidents ferent causes. and incidents. Accidents are variously cited by airline and flight Uncommanded pitch/bank: To address these events, improve- number, by aircraft registration, or by the city in which they occur. URSDA ments in system fault detection and isolation are required, par- In the U.S., generally, we use airline and flight number or the city. H ticularly for second failures of the same kind and combinations Even use of the city is clouded by using a suburb (such as Roselawn T of different types of failures. It is unlikely that we can achieve the or Alliquippe) in place of the airport involved. Most foreign agen- requisite reliability without better fault management. At the same cies use aircraft registration, although some hide the registration time, more attention should be paid to the effect of dispatch with or airline. Manufacturers use the serial number, which can make faulty or inoperative system components (allowed by MEL) on the tracing the incident difficult. It would be much easier if all used the probability of successfully coping with subsequent additional failures aircraft registration. (e.g., correct handling of a second failure). Also there have been a number of incidents and accidents relat- Closing ed to envelope protection functions design in which the envelope It is clear that FBW systems are becoming increasingly complicated. protection activated due to deficient engage logic design or faulty These systems are difficult to design and test. The federal airwor- information fed into the envelope protection function, causing an thiness requirements must be updated to include FBW system undesired sharp “pushover,” as appears to have recently happened requirements. The currently special conditions used for FBW in the Qantas accident mentioned at the beginning of this paper. system certification are incomplete. The flight crews have difficulty Also envelope protection designs in which the envelope protec- coping with a sudden change in the control system behavior due tion function mode change latches and remains in effect after to unexplained/unannounced mode changes: “What’s it doing the threat of airplane departure from the safe flight envelope has now?” Training may need to be improved for situations in which passed and which require flight crew action to restore the normal immediate pilot intervention is required. Certification office per- flight modes are not satisfactory and possibly unsafe (cases h and Appendix l). This area will require research Table A: Accident Listing Civil FBW in Service Incidents to establish satisfactory envelope Case Date Model Registration Where Flight Phase Description protection system functional and (a) 26Jun88 A-320 F-GFKC lFGB manuevering Collision with Terrain design safety requirements for (b) 14Feb90 A-320 VT-EPN VOBG landing Collision with Terrain certification. (c) 26Aug93 A-320 G-KMAm eGKK Initial climb uncommanded Bank (d) 27Apr95 A-320 N-331NW KDCA Approach Pilot Induced Oscillation (PIO) Abrupt maneuvers: The issue of (e) 28Apr95 A-320 N-331NW KMSP Climb uncommanded Bank dual control inputs should be stud- (f) 18Mar96 A-320 N-340NW KDTW Cruise uncommanded Pitch ied to determine if simple summing (g) 14Jun96 A-320 N-347NW KBOS Climb uncommanded Pitch (h) 21Jun96 A-340 D-AIBE KDFW Climb Abrupt Maneuver of the pilot inputs is the best solu- (i) 14Aug98 A-320 G-MIDA eIDW landing flare Abrupt Maneuver tion for designs using sidesticks with (j) 5Nov99 B-777 N-784UA eGLL Rotation Abrupt Maneuver passive feel forces. This will require (k) 2Oct00 A-340 TC-JDN N Atlantic Cruise uncommanded Pitch (l) 7Feb01 A-320 eC-HKJ leBB landing Abrupt Maneuver some research study and careful (m) 17Mar01 A-320 N-357NW KDTW Rotation Pilot Induced Oscillation (PIO) assessment of the consequences of (n) 20Mar01 A-320 D-AIPW eDFF Initial climb uncommanded Bank dual inputs. At this time, however, (o) 15Jun01 A-320 N-561AW KSAN maneuvering Abrupt Maneuver (p) 9Aug01 A-320 G-EUPV eGLL Approach FCS Mode Reversion we are reluctant to recommend any (q) 14Jun02 A-330 C-GHlm eDDF Approach uncommanded Pitch alternative to simple summing of the (r) 7Dec02 A-320 C-GIUF CYYZ Approach Pilot Induced Oscillation (PIO) pilot inputs in view of the incident (s) 7Dec02 A-320 C-GJVX CYYZ Approach Pilot Induced Oscillation (PIO) (t) 16Jun03 A-320 C-GTDK eGGD landing flare Abrupt Maneuver at Frankfurt (case n). More research (u) 15Apr04 A-320 G-TTOA lemG Descent Abrupt Maneuver is also needed to establish sidestick (v) 25Jun05 A-320 I-BIKe eGLL Approach FCS Mode Reversion safety requirements related to stick (w) 1Aug05 B-777 9M-MRG YPPH Climb uncommanded Pitch (x) 3May06 A-320 eK-32009 uRSS missed appr Collision with Terrain maneuver command sensitivity, (y) 23Oct06 A-320 N-924FR KDEN landing flare uncommanded Pitch the scheduling of the maneuver (z) 27Mar07 e-170 HZ-AEN oeRK Descent uncommanded Pitch command authority for large stick (aa) 7Oct08 A-330 VH-QPA YPLM Cruise uncommanded Pitch

ISASI 2009 Proceedings • 87 ISASI 2009 PROCEEDINGS 88 4. considered not is it and cancelled, been has Concorde’scertificate The type 3. FlightResearchCenter),May2004. 2. RogersSmith(NASADryden 1. We will use the term incident to describe the events. It seems too cumbersome Endnotes 15)—not onewasaFBWairplane.◆ in commercial transport operations with 848 fatalities and saved lives. In the past that15 overallyears, FBWthere and haveenvelope been protection 27 stallhave accidentsprevented accidents design practices. best and requirements certification future establishing in helpful A special FBW incident and accident investigation board resolution couldof potential be design safety issues and to verify compliance. design issues and to work with the applicants to ensure satisfactory identifytrainedtobepotential tosonnelsystemneedwill FBW Appendix. in thispaper. to use“accidentsandseriousincident”repeatedlythroughoutthetext. ower case italic letters, such as (a), refer to specific accidents listed in the the in listed accidents specific to refer (a), as such letters, italic case Lower In spite of today’s summary of FBW incidents, we must not forget • ISASI 2009 ISASI Proceedings

(see (see Reference 15 14 13 12 11 10 9. AirbusA330C-GGWD,A340TC-JDN,AAIBBulletinNo.6/2001. 8. AirbusA340-200,RegistrationD-AIBE,NTSBFileFTW96LA269. www. 2006, Systems, Simulation Flight DVD, on Reports Accident Aircraft 7. 6. http://aviation-safety.net. 5. http://www.tsb.gc.ca. 4. http://www.atsb.gov.au. 3. http://www.aaib.dft.gov.uk. 2. http://www.ntsb.gov. InFlight1. References

Upsets: OldProblem,NewIssues,AIAAPaper2008-6867,August2008. . A.A.. Academy Press,1997. . D.T. McRuer, et al., Aviation Safety and Pilot Control, Washington: National File DCA05RA086. 777-200,9 InFlight. . AirbusA319-131,G-EUPV, AAIBBulletinEW/G2001/08/10. Airbus IndustrieA320-200,BFUInvestigationReport5X002-0/01,April2003. . findarticles.com/p/articles/mi_m0UBT/is_5_21/ai_n27136979/. http:// from 2009, 30, June Week,dowloaded Safety Aviation2007, . 5, Feb. fss.aero. A330-303, ATSB 2008. ReportAO-2008070(Preliminary), U ncommanded roll, Serious Incident on L ambregts,G. U M U pset 154 km Westkmof154pset pset - M RG,August1 2005, ATSB A E vent 240 km Northwestkmvent240Perth, of WA, Boeing Company

Nesemeier,J. L earmonth E .

Wilborn,andR. M arch 20, 2001, at Frankfurt/ O R-200503722,2007; also NTSB O ct. 7, 2008,VH-QPA,7,ct. Airbus L .

Newman,Airplane M ain to Simulation of Emergency Evacuation Factors in Transport-Category Aircraft By Dr. Eric Robert Savage, Assistant Professor, ERAU, Prescott, Ariz., and Erich Skoor, Graduate Student, ERAU, Prescott, Ariz., USA , SEPT. 17, 2009 2009 17, SEPT. ,

Dr. Eric Robert Savage is an assistant professor of evacuation situations. Constraints were placed on the activities to Y safety science at Embry-Riddle Aeronautical Univer- simulate blockages at various stages of the evacuation. These con- sity in Prescott, Ariz. He’s held an assistant professor straints were intended to represent handicapped passengers or “kin” position at the University of Dubuque in the Aviation behaviors in which groups of passengers attempt to stick together. Department, and a visiting assistant professor posi- The results of the preliminary simulations indicated the viability and tion at Southern Illinois University Carbondale in the validity of the approach and showed the expected effects of passenger URSDA Aviation Management and Flight Department. He movements and delays. More extensive investigations, planned over H received his B.S., M.S., and Ph.D. from Purdue University and his MBA the coming months, will explore blockage types and effects, and T from Southern Illinois University Carbondale. Dr. Savage worked for discounting models of passenger and flight attendant behaviors. the Boeing Company both as an estimating and pricing analyst within business management and a human factors design engineer within flight Introduction operations and systems engineering. Dr. Savage has significant experience Aircraft accidents are relatively rare events. However, the context of co-engineering platform cockpits and co-managing international programs high (but survivable) impact forces, volatile fuels, ignition sources, for the Boeing Company’s F/A-18, F-15, T-45, T-38, and AV-8B aircraft and flammable materials is such that successful evacuation is a very programs. He is a private pilot, instrument ground instructor, a trained time critical issue9. There are examples of successful evacuation of air safety investigator, and a trained air traffic controller. He is a member large aircraft in a very short time—both from demonstrations and of the Human Factors and Ergonomics Society, International Society of Air from actual accidents (e.g., the Toronto runway excursion accident Safety Investigators, University Aviation Association, American Manage- involving an Air France A340 in August 2005; and the recent British ment Association, and Society of Automotive Engineers. He has served as Airways B-777 in London), with minimal casualties. There are also a contributing editor for the Journal of Professional Aviation Training records of unsuccessful evacuations (e.g., the Air Canada DC-9 at and Testing Research, a new textbook in engineering psychology, and is Cincinnati in 1983 in which 23 of 46 people died due to the fire, currently writing a new textbook in human factors engineering. Dr. Sav- and the British Airtours B-737 at Manchester, England, in 1985 in age’s current research topics are emergency evacuation, passenger and flight which 55 people perished in an aircraft that never left the ground). attendant behaviors, and modeling the cost of aberrant behaviors. New airplanes are being designed with greatly increased capacity, but the time available for evacuation is unlikely to increase. Potential Erich Skoor photo and bio are not available solutions to this problem are an increase in the capacity of the escape routes together with improved procedures and training. Discrete Abstract event simulation approaches will provide important contributions The certification of transport-category aircraft requires an emergen- to these designs. cy evacuation demonstration mandated in both FAR Part(s) 251 and 1212. There are many constraints on the demonstration, including Background gender, age, exit availability, and time. There are no provisions in The requirements for emergency evacuation demonstrations by the regulations concerning use of simulation for emergency egress; operators were first established in Part 121.29 of the Federal Aviation yet, simulation is widely used in design considerations for buildings, Regulations by Amendment 121-2, effective March 3, 196510, 11, 12. roads, manufacturing processes, and even aircraft evacuations. Muir Operators were required to conduct full-scale evacuations within a et. al.3 has studied passenger behaviors within emergency evacuation limit of 120 seconds using 50 percent of the available exits. In 1967, of transport category aircraft and suggested the use of simulation as this established time limit was reduced to 90 seconds as amended an alternative to demonstrations, to better understand the impacts by Section 25-4613. This exercise demonstrates the operator’s ability of variability in emergency egress situations. Moreover, Galea4, to execute the established emergency evacuation procedures, and Ceruti and Manzini5, Xue and Bloebaum6, Parks and Ostrand7, ensures realistic assignment of functions to the crew. and Schroeder8 have studied simulation of emergency evacuation The requirements for the emergency evacuation demonstrations to create valid models with finite parameters to better understand by manufacturers were established in Part 25.803 by Amendment the impacts of variability in egress environments. 25-15, effective Oct. 24, 196714. With seating capacity of aircraft The simulation approach adopted here involved the development exceeding 44 passengers, manufacturers were required to conduct of models with varying levels of detail, such as movement durations full-scale evacuations within a 90 second time limit. It was considered through the sequential evacuation stages―exit seat, exit aisle, exit that the manufacturer’s demonstration illustrated the basic capabil- door, and exit slide. These times were modeled by the gamma and ity of a new airplane before the Part 121 requirement intended to lognormal statistical distributions with parameters estimated from account for crew training and adequate crew procedures developed observations and data related to human movement in constrained by the individual operator. Hence, the test conditions were somewhat

ISASI 2009 Proceedings • 89 ISASI 2009 PROCEEDINGS 90 location, restraint system, distance to aisle, width of aisle, number of nature of the evacuation situation, including seat configuration and temporal and geometrical, physical, the assess to was task first The Evaluation ofphysicalfactors Methods during thedemonstrations. rates, (b) escape system performance, and (c) behavior of evacuees different. These demonstration tests provided data on (a) evacuation stage presentsanidealopportunityforsimulation. design This model. approved previously a than capacity passenger airplane or model that had major changes or a considerably larger data since data may not be available test in the case sufficient of a on completely new based be would approvals ensure to meant was this 25-46, Amendment through tests and analysis of combination dropping the provision that allowed analysis alone and requiring a capability.evacuation show to used By be tests, and analysis of tion aisle widthandexitaccessibilityaremet.” ratesifthe airplane type certification requirements for minimum seat pitch, and aisle width have no significant bearing on the egress type of exit and that changes in the passenger cabin configuration, rates of passenger egress are not significantly different for the same evacuationdemonstrations statesexceptions,rare“thatwith the partial testingratherthanafull-scale evacuationtest.” eration could be given to the use ofof passengers, aand as combinationa consequence the potential for injury,of consid- modeling and senger survival factors they concluded that, “In view of the numbers and very large transportation aircraft. In their landmark study safety of pas- passenger investigated they when perspective this supports ups required in full-scale demonstrations. understanding of aircraft designs without the costs, injuries, or mock- tion, inAC25.803-1. simula- or modeling as such demonstrations, evacuation of means U circular. advisory the in explained are evacuations the conducting evacuation needs to be conducted as well as the procedures used in Evacuation Demonstrations.” So, the analysis used to ascertain if an scale demonstration’s and the FAA issued AC 25.803-1 “Emergency full- of lieu in analysis the concerning reached be could consensus when to conduct on evacuationformulation policy discuss to was discussions such of demonstrationsrationale or analysis. However,tions and the use of noanalysis in lieu of full-scale demonstrations. The Wash., discussed the conduct of emergency evacuation demonstra- in understandinghumanbehaviorandsafetydesign. useful prove could variations aisle with evacuation emergency the width are met. Therefore, the possibility for modeling or simulating evenwhen the type certification requirements for minimum aisle rates egress on bearing significant possible a have widths aisle that the formerconditionwaslessthanthatoflatter.” Thissuggests than in the 20-inch tests, even though the mean evacuation time for that “more bottlenecks occurred in the 24-inch configurationfits. tests flow rates, but further width increase provided no additional bene- in aperture width up to 30 inches produced significantly beneficial ltimately,though, therementionnois alternative theuseof to t a pooe i Ntc 75-26 Notice in proposed was It The preamble to Amendment 121-176 Amendment to preamble The However, M Seattle, in held Conference Technical Public FAA 1985 The • Moreover, when comparing different aisle widths they concluded odeling or simulation of emergency evacuations could provide ISASI 2009 ISASI Muir, Bottomley, and Proceedings Marrison 15 ht nlss o a combina- a or analysis, that 16 Muir and Thomas’ study 17 from the FAA study of of study FAA the from found that all increases ingtheenvironmental factors post-impactin situations. ation slides. An additional set of variables will be developed regard- configuration and operation of the exit, as well as associated evacu- exit, of front in headspace exit, nearest to distance exits, available will be obtained from industry andFAAwill beobtainedfromindustry documents. passengers. Finally, detailed evacuation performance requirements the of behaviors and characteristics numbers, the regarding made modes, and escape probabilities. Next, informed assumptions will be failure times, conditions, evacuation identify to accidents previous and heat have not been investigated gasses, toxic smoke, as such yet. survival to compromises and mented) Data will be obtained from related to conditions of the fuselage (intact, partially intact, or frag- tion, exit availability, and post-impact condition.and include such Additionalthings as fire ignition, development and factors propaga- regarding environment factors will be obtained from the literature unavailable. a. This may involve back tracking along the aisle if an exit becomes blockage (queue)develops. a when introduced is pathways other to branching Probabilistic 4. an “occupied”stateforavariable timeorpermanently. a. This feature may be modeled byseat, oraisleslotresourceand anactivityendingeffect. having a resource branching intothe current activity or by simply removing the availability of an exit, 3. Blockages are simulated either by a probabilistic branch back into ing the egress activity. preced- door,develop aisle, to queues forces which “slots,” slide or seat, as such resources limited creating involves level next The 2. nential, lognormal,orgammadistribution. rectangular,a expo- assume can variability time movement The a. movement times. normal,orderlyevacuation behavior, assuming variable fixed or to the next in a seat row or aisle. At this level, it is possible to simulate broken downintosubactivities,suchasmovingfromonelocation exit. slide and exit, door exit, 1. The basic models developed in this study included seat exit, aisle of sophistication: slide failures,etc. situational variables, such and as attendant, fire, flight smoke, passenger, configuration, aisle of blockages,combinations door and andare not subject tostatistical controls that address the various These demonstrations are usually single and events performance. behavior, training, crew cabin and etc.) dimensions, door width, performanceinclude aircraftthe configuration (seat pitch, aisle and a time limit (90 seconds). availability, exit mix, demographic passenger include constraints tion from transport aircraft is by constrained demonstration. The pants are exposed. The current method of certification of evacua- validity owing to the cost and potential danger to which the partici- The latter approach has good evidence. missing repeatability, by flawed be may conclusions) therefore but(and often questionable although the exact conditions are not easily approach has replicatedconsiderable validity (the events actually happened) and former analysis The demonstration. or experimentation controlled and fatality,accident, (e.g., statistics outcome include statistics), injury aircraft, transport from evacuation in that and as such behavior performance, human observing of methods traditional The Simulation The simulation study development includes the following levels Other factors affecting behavior and ach of these activities was further further was activities these of Each E vidence , SEPT. 17, 2009 2009 17, SEPT. , Y Figure 3. A model that overtly separates the different evacuation Figure 1. A basic model of evacuation processes. pathways. URSDA H T

Figure 4. Typical evacuation output graphs.

seconds per movement between “spaces”) for each row, aisle, and Figure 2. A model of evacuation that allows probabilistic branch- door exit activities and updated the location of a passenger as he/ ing to blockage conditions. she moved incrementally along a row or aisle or exited the airplane. Queues were allowed to form if a service “resource” (space) was 5. The final level of sophistication involves the introduction of aber- not available. rant behaviors by passengers The model in Figure 2 includes a probabilistic branch to a series a. There may be very large, old or handicapped passengers whose (seat, aisle, and door) of blockage conditions. Furthermore, the door movement times are significantly slower and who may be the cause blockage may develop into a “door unavailable” condition, again on of temporary (or permanent) blockages. a probabilistic basis. Manipulation of the activity throughput times, b. There may be passengers who choose to take luggage with them, using a Gamma distribution with means and standard deviations which can be simulated by slowing them down or by having them calculated based on the distance of the seat from the aisle and the occupy multiple resources (e.g. aisle slots). distance of the seat row from the door. The probabilities of seat, aisle, c. A third behavioral feature is “kin behavior” in which groups of and door blockages were systematically increased from 0.0 to 1.0. people, such as families stick together. Again, this is simulated by This model explored specific exit path assignments based on seat linking individual entities (passengers) and having a group take up location. Exit times were related to position in row and location of multiple spatial resources and/or move more slowly. This behavior row. An extension of this model addressed looping back to alterna- will also increase the probability of blockages tive routes if a resource became unavailable or the waiting time for d. The fourth group of behaviors can generally be called “panic the resource exceeded an assigned amount. behavior.” These are characterized by irrational acts, such as freezing Figure 4 shows the time line of movement from rows, aisles, door or pushing or going in the wrong direction and hysterical outbursts. and slide. In this run, it can be seen that there were 180 passengers As far as evacuation is concerned, these behaviors can be very disrup- who all exited the seats after 5 seconds and the aisles after about 25 tive and cause time consuming blockages. seconds. However, apparent congestion at the doors indicated that Each of these variants is set up in Micro Saint Sharp by creating only about 50 passengers exited the doors and slides. “scenarios.” Furthermore, each scenario or combination of scenarios needs to be arranged according to an appropriate experimental Discussion design, and each experimental combination needs to be replicated The project to date has reviewed a considerable amount of the multiple times to understand the effects of residual random vari- extensive literature available on this topic, and this activity is ongo- ability in the implementation of the model, whose building blocks ing. The modeling effort to date has focused on the development are based on classical statistical distributions. of representative models, although the scarcity of actual passenger movement times in these situations is a barrier. Despite this short- Results to date coming, and using estimated movement times and movement time Three different models were developed during the first phase of this variability from evacuation and industrial engineering literature, the investigation as shown below in Figures 1, 2, and 3. Each of these models behave as expected. A second aspect of the modeling effort models added a degree of sophistication to the simulation. is to develop an adequate representation of blockages at various This basic model used exponential “service times” (Mean = 1–5 locations in the exit pathway and a discounting model of passenger

ISASI 2009 Proceedings • 91 ISASI 2009 PROCEEDINGS that thissimulationapproachisbothflexibleanduseful.◆ 92 3. 2. FAA. (1990). CFR Title 14 Aeronautics and Space: 121.803 1. FAA. (1990).CFRTitle 14AeronauticsandSpace:25.803Emergencyvacu- References using been developed to demonstrate the utility of the simulation approach have Additionally,models aircraft. large exploratory of evacuations factors—configurations, regulations, training, conditions, and actual To date, the current project has focused on the evaluation of the many are, therefore, valuable evaluation. aids to design and performance replications many of that different in flexible and conditionsinexpensive, safe, are data, canappropriate be investigated. Simulations and models valid given simulations, computer hand, other the On and furthermore do not give a reliable representation of real events. Actual demonstrations are costly, inflexible, and possibly dangerous, passengers. and attendants flight the of behaviors and capabilities the and conditions the configurations, the by affected is aircraft transport-category large from evacuation emergency Successful Conclusions and presentonlyasnapshotofonesinglesetconditions. dangerous, costly, are which demonstrations, live traditional over “resource capacities.” This demonstrated a considerableto explore advantagea wide range of conditions, One suchparticular value asof this movementapproach that has emerged timesis the ability and of the simulation will be forthcoming during the next few months. behavior. This project is at the midway stage, and further refinements Cabin ConfigurationAdjacenttotheExit. ation.. Federal Aviation Administration. ation.. Federal Aviation Administration. M • uir, ISASI 2009 ISASI M M icrosoft arrison,and E xcel and Proceedings E vans.(1989). The M icro Saint Sharp software. It is concluded E ffectof Passenger Emergency M otivationand Evacu- 17. 16. FAA. (1990). CFR Title 14 Aeronautics and Space: 121.803 FAA.15. Task(1986). on Force 14. FAA. (1987). Advisory Circular No. 20-118A: No. Circular Advisory (1987). FAA. 14. 25.803-1: No. Circular Advisory (1989). FAA. 13. 12.NTSB. (1974). Cabin Safety in 11. NTSB. (1973). Special Study- Safety Aspects of 9. FAA. (1990). 6. Xue, Z., and Bloebaum,Xue,andZ.,6. C. 5. Ceruti, A., and 10. FAA.10.(1966). Grant, J.E., Schroeder, 8. 7. Parks, D.L, and 4.Galea, ation. Federal Aviation Administration. ation. FederalAviation Administration. ment of Various Aisle Configurations and FAA. tion. onstration. E tration. onstrations. Service: National Transportation SafetyTechnicalNSTB-AAS-81-2).NationalInformation(No. Board. 1981 September Air Carrier Aircraft. National Transportation Safety Board. Aviation Agency. (pp. 1312-1319). Wilson,J.R.( and R.C., Crain, D., Goldsman, J.J., Swain, In evacuations. aircraft in havior ences aircraft evacuation simulation model-VacateAir. In 46th AIAA Aerospace Sci- Engineering (AerospaceDivision). onsimulation tool. Italy: Conference: Vol. 106(2).(239-247).TheUniversityofGreenwich,K. Crash. Federal Aviation Agency. Society-26th AnnualMeeting-1982(pp.974-978). nel performance in airplane evacuation. Proceedings of the Human Factors and Astronautics,Inc. Developments into the 21st Century.of 21st Institute the into Developments massoftransport vehicles using computer models. FireInSafety Ships,on Muir, H., and Cobbett, A. (1996) Aircraft vacuation Scenarios. Meeting and E .R.,and U.S. Department of Transportation: Federal Aviation Administra- .S. Department of Transportation: Federal Aviation Adminis- Aviation Transportation:Federal of Department U.S. Evacuation Patter Analysis E d.),Proceedings theof1992 Winter Simulation Conference Manzini, R. (2003). Aircraft evacuation dynamic model based E Ostrand, R.A. (1982). mergency O Exhibit (pp. 1-20). Reno: American Institute of Aeronautics wen, , n Tuttle, and M., M U . (1994).. Predicting theevacuation performance niversityofBologna, Department of E L vacuationCrashedTestsAircraft.a of Federal Emergency . (2008).particle. A swarm optimization-based L argeTransport Aircraft, Washington D.C., EVAC computer simulation of person- Of A Survivable Commercial Aircraft L (1992). M.L vacuation of Transportof Evacuation Airplanes. ighting Conditions under Different Evacuation Tests-An Initial Assess- Emergency Emergency Emergency Marine dln hmn be- human Modeling ) (IMarE) Engineers Emergency Evacuations From vacuation Dem- Evacuation vacuation Dem- Evacuation M echanical Evacu- The Accident “CAUSE” Statement— Is It Beyond Its Time? By Robert MacIntosh (MO0996), Chief Advisor, International Safety Affairs, National Transportation Safety Board, Washington, D.C., USA , SEPT. 17, 2009 2009 17, SEPT. ,

Robert MacIntosh has a long career in the aviation consideration. The final product titled Aircraft Accident Inquiry Y industry, including NTSB investigator-in-charge, was adopted as Annex 13 to the Convention and became effective airline director of safety, airplane manufacturer staff Sept. 1, 1951. engineer/accident investigator, and 22 years as a U.S. The new Annex 13, first edition, consisted of only four pages of Air Force officer pilot and safety director. He has more text. There were three definitions, aircraft, aircraft accident, and than 8,000 hours of flying experience and holds resi- state of registry. There was a note indicating the report on the inquiry URSDA dent bachelor of arts and master of business degrees. would normally include, in addition to the findings, a summary of H evidence and other essential information on which the findings T The opinion, facts, and conclusions expressed in this paper are those of the were based. There was no mention of “cause” in that first edition of author; the content is not a product of the U.S. National Transportation Annex 13, and that version prevailed for the next 15 years. Safety Board. So how was the idea of cause introduced? It was the second edition of Annex 13, effective in August 1966, that defined the inquiry as, he recent ICAO Accident Investigation and Prevention Meet- “The process leading to determination of the cause of an aircraft ing, AIG 2008, conducted in Montreal in October 2008, pre- accident including the completion of the relevant report.” This Tsented an opportunity for 190 Member States and observer second edition further expanded the inquiry definition to include organizations to review any needed changes in the protocols of in the SARPS a Paragraph 5.4 as follows, “The inquiry instituted Annex 13, Aircraft Accident and Incident Investigation. The agenda by a State shall include the investigation and the obtaining and included a topic of frequent and long-standing discussion among air recording of all available relevant information; the analysis of the safety investigators, the issue surrounding determination of “causes” evidence; the determination, if possible, of the cause; completion or “probable cause” related to Annex 13 air safety investigations. The of the report and the making of recommendations when appropri- subject was discussed in considerable detail in two sessions of the ate.” Further, this second edition of Annex 13 provided the format AIG 2008 meeting. Some attendees commented that it was essential of a Report calling for separate paragraphs, one containing (a) the to emphasize “risk mitigation and accident prevention” in concert most significant determinations of the fact finding and analysis and with Safety Management System (SMS) principles rather than to (b) the cause or probable cause(s) and a final paragraph containing focus directly on causation. In addition, a variety of opinions were recommendations. From this history, one can see that the issues of expressed by several State delegations and international organiza- cause and safety recommendations have been interrelated within tions regarding both the use and misuse of a causal statement. Of ICAO Annex 13 protocols for more than 40 years.2 particular concern within the air safety community is the entry of Before we move on from the historical perspective we should note final accident reports into the judicial process in various states. How- one more interesting development. The fourth edition of Annex ever, outside our investigator community, we must recognize that 13, which became effective April 1976, changed the title to Aircraft there continue to be major expectations regarding the results of the Accident Investigation, replacing the word Inquiry, and added more Annex 13 investigative efforts by various groups and the public. For inclusive definitions of Investigation, Safety Recommendation, example, news media, legislators, consumer groups, and families of and Cause. At that time, the plurality of cause was recognized and victims all expect their government to conduct an investigation and reflected in a further definition as, “action(s) omission(s), event(s), provide answers to the “how and why” of any major accident. Therein conditions(s), or a combination thereof, which led to the accident lies a question, How best can the final report meet the expectations or incident.”3 of the public and other groups while meeting the very focused and So with this brief view of the background of the developing issues sole objective of Annex 13, “an investigation for the prevention of surrounding “cause”, what are the benefits and drawbacks surround- accidents, not to apportion blame or liability”? ing the pronouncement of cause? Does a causal statement serve In aviation circles, it has been a long tradition that we continue the intended purpose of Annex 13—to promote the prevention of to learn from the past. Therefore, let’s indulge for a moment in accidents and incidents; or is a causal statement simply an adjunct the history surrounding the Convention on International Civil item working to the detriment of the stated purpose, instead provid- Aviation (Chicago 1944) and the guidance developed for accident ing support for blame and liability. investigation1. Following the initial meetings of those pioneers, by There are many answers to that question depending upon your 1946, a newly formed Accident Investigation Division proposed some perspective of the process of accident and serious incident investiga- applicable standards and recommended practices (SARPS) to the tion. And it is useful at this point to update ourselves and examine Air Navigation Commission. In the administrative practice still used the evolution of thinking that has taken place since the 1970s. The today, the proposals went to the Member States for comment and current edition of the ICAO Safety Management Manual (SMM)4 then back to the Air Navigation Commission and the Council for provides an interesting overview comprised of three periods of air

ISASI 2009 Proceedings • 93 ISASI 2009 PROCEEDINGS have openeduptheairtransportationscenearoundworld. are laudable, and remarkable as commercial jet transport airplanes argue that it is unreasonable to single out one front line action and personnel thatmaybeassociated withtheaccident. on the working environment of all those front line air and ground requiredfortheiroperating certificate. And, course,of focuswe practicesmanagement company operating the and personnel into service. We look at thego to airplane trainingthe permits that process regulatory the programsexamine to for crew and ground concepts of task sharing, checklist construction, and follow through with the operator. We associated look at closely the manufacturer’s most design organization philosophy, specific the to investigation our limit than scope broader much a involve to endeavor we and involved, organizations the of culture safety overarching the and We environment. operational concepts SM the by influenced are managementthe decisions providethatbackgroundthe the for issuesassociatedaccident. anwith Thesesystemic issues include systemic deeper the understand to attempt to motivated now are livering thepassengerstoairlineterminalattheirdestination. decisions from airplane design all the way to the final element of de- management the and oversight, of levels processes, organizational patchers, and other support staff but also on the working conditions, actions of flight crews, air traffic controllers, ground engineers, dis- M no small part based on the foundations in Professor James Reason’s inclined to focus our investigative attention much more broadly, in with ouraccidentinvestigationprocess. to appear in the aviation safety lexicon and in the thinking associated procedures, etc. However, the omnipresent “cause” word continued turnover shift tasks, critical of oversight and control quality cards, work instructions, task the state clearly to need the recognized we area the maintenance In operations. and certification in efforts inspire advocacy for all crewmembers, and upgraded the regulatory to efforts training introduced monitoring,” “pilot the as flying not aspects of the cockpit social gradient, recognized the copilot or pilot and CRM of era” “human the accident scenario. an of “how” and “why” the on placed been has emphasis little very that allege Critics guises. different under and degrees different in blame indicate to came investigation of era traditional the in error. pilot i.e., personnel, statement causal the consequence, a As operational by committed errors or technology in shortcomings and flaws for search a simply as some by described been has tion investigation process has its critics. The formal process of investiga- accident 13 Annex the and consequences some with come have 94 0.1 per million departures in today’s air transport fleet. the full entry into the jet age to below 5 in the mid 1970s to less than hull loss rates have gone from the historic 10 per million departures at safety improvements enjoyed in commercial air transportation. The the to made have experts training flight and regulators engineers, professionals, safety the that contribution historic the recognize investigationasanactivity for“funereal purposes,” theS ganizational era. Despite the description of a “traditional era” safety or the and era, human the era, traditional the investigation, safety odelof Accident Causation. We focus not only on the front line L Aftersuch an encompassing look at all these aspects, many will We are able to gather much more data than in the past, and we Now we have transitioned toward the “organizational era.” We are era, another into passed we thinking, safety of evolution the In • ike mostmodernikeadvances, thesecivilaviation achievements ISASI 2009 ISASI Proceedings . We’ve studied the the We’vestudied TEM. and LOFT 5 These efforts MM does - blame whetherwelikeitornot.” assess to used are investigation accident aircraft an of results the ISASI Seminar (Vancouver) in 1988, stated that “The fact is, though, the fundamental accident prevention objective of Annex 13, at the Should Be Done.” and Can “What on suggestions with concludes and cons, and pros thoroughandencompassing studythe ofevolution cause,of the a offers 1991 in (Canberra) seminar ISASI the at presented Cause investigation process. Dr. C. found it appropriate to include the expectations of the public in the statements, causal of ills the condemning while activities, ISASI to should notappearinthefinalreport. blameand liability and therefore they opine that such toward statementscontribute statements causal that argue uniformly process about causes. leagues within the air transport industry—those motivated to write Group Divisional meeting of 2008 of meeting Divisional Group Investigation Accident ICAO the to submission Association Pilots’ Airline of Federation International the in stated well is point This events. of chain complete the of part small very a only be may that omission or act last focused narrowly that statement, causal a form known safety advocates. known safetyadvocates. there are 20 “Cause(s)” titles in authored our by ISASI well- library present, the to 1970s late the From subject. the on articles of trove bibliographyofthe ISASI Forum publications provides treasurea out a search of the opinions of our close ISASI colleagues, and the mitigate theassociatedrisks. to and issues causal of range broad a address to recommendations order to achieve the Annex 13 goals of corrective actions and safety scenario—in accident the in issues multiple the highlight to need prevention.” accident for ideas any provide not do they since work prevention accident in useless often are determinations cause These reports. my in cause accident single one writing of mistake the repeated continuously have I Investigation, Accident of Board the at years 9 from thelessonslearnedtoimproveSafetyofFlight?” tentiousness now surrounding ‘Probable Cause’ without detracting ings,’ ‘Significant Factors,’ and ‘Recommendations’ remove the con- of Aviation Safety” in 1992 wrote, “Would not the adoption of ‘Find- Foundation and recognized throughout the industry as the “Father from specialemphasiscauses, they mightchangetheirattitude? resulting difficulties the of knew public the if terpoint—Perhaps follows: community.tionpoint-counterpointoffers a He summarizedas in the causal discussion among those within the air safety investiga- consumers (the public), whose interests are frequently overlooked of probablecauses…”. clusion that “...there is no ‘the the probableinvestigator’s role of finding all the causes. He offered the con- cause,’ but only a multitudearticle describing probable cause as a misnomer that detracts from Fellow ISASI Fellow O One conclusion can be drawn from the input of some of our col- In 1979,ISASIIn Any discussion of the “cause” subject would be incomplete with- Swedish AIB Investigator Aage Roed in 1989 wrote, “During my my “During wrote, 1989 in Roed Aage Investigator AIB Swedish Jerome F. “Jerry” on—as() rvd a ipe nwr o te public. the for answer simple a provide Point—Cause(s) Point—The public is used to it (cause) and seems to like it. Coun- fferingan added perspective, two well-respected contributors 9

Many persons closely associated with the investigative ember Professor Richard H. Wood, referring to to Wood,referring H. Richard Professor Member 11 M Dr. Lederer, president emeritus of the Flight Safety emberTomDavisISASIwroteForumH.an 7 Miller highlights a most important group of O . M 8 iller’s article Down with Probable

6 . The Association reiterated the 10 Counterpoint—The public seems to thrive on one cause, not a material in this Manual was compiled by some very learned safety multiplicity of them. Can a well-considered press release overcome practitioners brought together by the ICAO AIG Office. The causal this tendency? statement is the subject of several pages of guidance, including a Another valuable contribution addressing public interest comes table of exemplar wording tailored to indicate how to avoid language from our former ISASI Forum Editor Ira Rimson in an article titled of a blame-setting nature that is focused on an individual person. Investigating Causes presented at the ISASI seminar (Barcelona) in Rather, this guidance focuses on the task not accomplished or the 1998.12 His paragraph titled “Customers and accountability” high- inadequacy of a facility or a program. This guidance is intended to lights the United States Aviation Disaster Family Assistance Act and deflect and disassociate causal statements from the connotation of the obligation of investigators within the government investigation blame. It is quickly evident to a reader that use of this guidance will agency to keep the victims’ families and the public informed.13 provide an informative causal statement, yet one that is less attrac- , SEPT. 17, 2009 2009 17, SEPT. ,

People in modern democratic societies are affected by the “com- tive to misuse in judicial or administrative actions. An example from Y munications moment” of a major air accident. They participate in the Manual follows: open government whereby citizens are able to maintain trust in their government through this interaction, and they expect to be One accident—same cause(s) informed on such events. The open government features of society - failure of the airport management to identify and correct airport embodied by “Freedom of Information initiatives” continue to pro- drainage URSDA liferate in a number of States. A keystone of the trust and confidence versus H in government is the free flow of information. And a national catas- + the known and uncorrected lack of runway drainage T trophe such as a major air accident puts this issue in sharp focus with high public expectations directed to the investigation. - the flight crew’s mismanagement of final approach airspeed The traveling public in most of the developed world (certainly versus those States represented in the ISASI community) is an informed +aircraft crossed the threshold 16 knots above Vref and interactive group; they read various news media outlets, they blog, they twitter! Many of them are national legislators, political - the flight crew’s mismanagement of the thrust reversers figures, media representatives or successful business executives; and versus as a result, they have high interest in aviation and some of them are + the late application of reverse thrust the customers of our final reports. They can be an ally or a foe to the air transport industry. They can be an advocate for our investiga- Another somewhat different initiative has been undertaken by tive process and safety recommendations or, on the contrary, they several ICAO Member States. They have promoted national legisla- can lose confidence in the accident investigation authority’s ability tive initiatives intended to moderate or eliminate the appearance of to provide meaningful information and become adversarial to the “causes” in their final report of accidents. In Australia, the Transport industry and to the existing government oversight. We have seen the Safety Investigation Act of 2003 (TSI Act) as recently amended demise of airline companies and key government officials replaced directs the Australian Transport Safety Bureau (ATSB) to identify as a result of circumstances associated with a major accident. If the factors that contribute to transport safety matters and communicate/ public and the other stakeholders outside the close-knit aviation publish a report to the relevant sectors of the transportation industry. community are kept informed and if they regard our investigative ATSB eliminated the cause word from its investigation reports since work as credible, they can support our safety objectives. If they think 2006. Australian reports contain only “contributing safety factors” we are withholding information, keeping secrets, and taking sides, to avoid any language grounded in legal liability or legal contribu- unable to call out the truth, they will be our detractors. The same tions.15 New Zealand follows a similar practice. Korea provided a observation can be applied to the press, legislators, and victims’ further initiative at the AIG 2008 Divisional Meeting making the families. If they believe accident investigation authorities are cred- point that a final report containing only direct cause factors may ible, they will advocate for us. Otherwise? omit other deficient safety factors needing correction.16 Brazil’s A final report lacking understandable causal factors may lose the CENIPA final report on the Sept. 29, 2006, GOL Airlines Boeing confidence of these public customers. Regrettably these stakeholders 737/EMB-135 BJ Legacy airplane mid-air collision is published with a simply may not be prepared to comprehend and accept the issues of Paragraph 5 Conclusion section listing facts and contributing factors multiple causation as we in the industry would desire. In the event of in lieu of any mention of a cause.17 And the TSB of Canada has for a national catastrophe (perhaps an air accident of 50-250 fatalities) several years used a somewhat different approach to its conclusions public expectations from the official accident investigation and final using the term “Findings as to Causes and Contributing Factors” in report will run high, and include all manner of questions about “how lieu of a specific causal statement.18 and why” this tragedy happened. Accident investigation authorities As a result of the discussions at the AIG 2008 Divisional Meeting, that provide to the public a final report devoid of causes, or offer the ICAO Secretary General circulated a letter to Member States convoluted findings and factors, set the stage for a variety of parties, all in May 2009 containing a proposed amendment to Annex 13 to be with vested interests, to step in to pronounce cause(s) as they see fit... applicable on Nov. 18, 2010.19 The proposed amendment includes to their benefit. Confusion regarding causal factors in a major event language to provide for the determination of cause(s) “and/or” provides a perfect setting for tabloid journalism to run amuck. contributing factors in a final report. The proposal will affect both This somewhat untenable background provides us with an op- the definition of an investigation and the format of the final report. portunity to compare two recent and well-based initiatives. One is Left unanswered is the important task to provide a definition of the ICAO Manual of Aircraft Accident and Incident Investigation, “contributing factors” in the context of Annex 13. States will be Part IV, Reporting, Doc. 9756, published in 2003.14 The guidance able to use either “causes” or “contributing factors,” or both, in the

ISASI 2009 Proceedings • 95 ISASI 2009 PROCEEDINGS 96 aboutthe overall objectives of the ICA better educate the judicial officials (and the news media and public) (not to apportion blame or objectives safety liability)? same those reflect better to altered be society that The most suitable answer is to of law national the should and 13 Annex of objectives safety the on Annex 13 Report be altered? be true in some societies, make butit less valuable to onethose desiring to misuse shouldthe report. This may ask, is it suggested appropriatethat to eliminate the word cause within the thatfinal report will the avoiding misuse if they will follow this guidance. It has been further toward strides make can Report Final the of approve who officials on functions not performed. Investigators who draft the reports and focus rather but nature blame-setting a of be not should Language ICAO the in guidance provided and report final the of use inappropriate ICA former members seem to enjoy participating in tabloidism. However, our of some task; ending never a is press sensationalist a Educating detailed contributingfactors. of continuum a offers report written the if reduced be can deficit this studies, case select in substantiated well Although accident. never see corrective action until they resurface as causal in another may which importance less to relegated or dismissed be to factors self limiting and sharply focused, allowing some/many contributing is statement causal a that fact the on based is premise This ment. state- causal the without risk eliminating or reducing toward tives and mayoutweightheundesirableeffectsofcausalstatements. momentum necessary to overcome financial and political obstacles safety proposals. That value-added emphasis may provide the extra to necessary overcome resistance and gain positive action on many a causal statement provides value-added emphasis to the justification preceded by an accident causal statement, tradition may indicate that programs. However, if desired safety actions or recommendations are continuous monitoring, and proactive and predictive risk reduction envision to some degree in the future with the introduction of SMS, accomplish a formal safety recommendation. In fact, this is what we or action safety a initiate to opportunity an provide to accident an risk without providing a causal statement. Simply put, it doescause(s) notbe missed? take If so, by whom, and with what result?without naming the cause(s) of the accident? Will the statement of ingsafety actions to reduce or eliminate risk still be accomplished investigation process? To review, can the overall objectives of instigat- use, and abuse, is it time to Is omitthe accident cause thisstatement beyond its time? traditionalAfter many years of step in the Summary Annex 13 investigation authorityofeachstate. the introduction or omission of cause(s) will rest with the accident legislation, national by guided future, the For states. responding of majority a by accepted be to expected are general secretary the by proposed changes the factors, causal about discussions of years many,many these Following issue. causal the regarding protocols national their with consistent response their in option and/or the comments to the draft final report (consultation) will be free to use in the investigation and entitledconclusions to provideto the finalaccredited report. Also,representative additional States participating How can we reduce the misuse of a final report to assess blame? blame? assess to report final a of misuse the reduce we can How Some will argue that we can better meet a wider range of objec- O • O f course we can meet the objectives of reducing or eliminating ISASI 2009 ISASI has recognizedhas importancethe editorialof stylereduceto Manual of Aircraft Accident Investigation, Part IV, Doc. 9756. Proceedings Or should the society be better educated O protocols and encourage documentation willberegardedinthefuture. credibilityofour government air safety investigation process and the how approaches—and different these regard will community aviation professional the and legislators, public, the how us tell format. ICAO “and/or” the in acceptable be will their society to provide a final report listing factors.investigation Bothauthorities will methodsfind it appropriate within the needs of other while reports final in cause(s) provide and interests various of expectations fulfill to need the recognize to continue will ties legislation of individual States, some accident investigation authori- However, with recognition of the cultural differences and national risk reduction initiatives to make a safe air travel system even safer! The road. ultimate the objective in ofAnnex fork 13will a remain asalways, choice, to a promote to come have we report, final to underminethereputationofinvestigationauthority. sequences and may erode the credibility of the investigation and serve self-serving and erroneous statements of cause and unintended con- pected to turn elsewhere for causal answers! This search may produce ex- be can they met, not are causes regarding expectations their If will not be satisfied with a convoluted or oblique statement of causes. statement. causal a provide will investigation independent funded publicly a that expectations munity that is receiving a final report of a major tragedy holds strong prove deficient to an affected community of users. The broad com- national legislationtoprotectthefinalreportfrommisuse. 2. 1. Endnotes 12. 11 10. 9. 8. 7. 6. 5. 4. 3. 17. 16 15 14 13 19. 18.

near was published Sept. 18, 1934, CABof ReportAir 0002,Commerce Rapid indicateAir than the75 years. Records firstof the public air accident In the probable cause statementof AnnexestotheConvention,ICAOAnnex13,1sted.,page13-14. For further background information see, Historical Note on the Development O 1991. ISASIForum,Volume 1992,pages120-135. 24,Number4,January Seminar,International 22nd Australia, the Canberra, of Proceedings ISASI . ISASIForum,Volume 22,Number1,May1989,page26. California. ProfessorandDirector ofAviation Safety Programs, ISASI Forum, Volume 21, Number 4, page 10. Richard Wood was the Associate ISASIForumVolume 12,Number3,December1979,page37. http://www.icao.int/AIGdiv08/docs/AIGdiv08_IP03_en.pdf. tions, 1959-2008, the Boeing Company. Statistical Summary of Commercial Jet Airplane Accidents, Worldwide ICAODoc.9859,SafetyManagementanual(SS)2nded.-2009,pages2-31. accidents-and to make a report available to theNTSB to public.establish the facts, circumstances, and cause or probable cause of air the requires amended, as 1974, of Act Board Safety Independent the Board, The enabling legislation for the C . http://www.icao.int/AIGdiv08/docs/AIGdiv08_WP61_en.pdf. tion_reports/2005/AAIR/aair200501977.aspx. No. 200501977, pages 235-240. http://www.atsb.gov.au/publications/investiga- seen in the be can factors) safety (contributing approach “factors” the of example An . . ICAODoc.9756,firstedition2003. rev-12-2008.pdf. . http://www.ntsb.gov/Publictn/2008/Federal-Family-Plan-Aviation-Disasters- a05h0002_sec3.asp#a3. Aviation/Brazil-CENIPA/US_Summary_Comments.pdf. ments with Findings and Probable cause are available at http://www.ntsb.gov/ 256-265. pages on conclusions ISASI Proceedings of the 29th InternationalProceedingsISASI29ththe ofSeminar, Barcelona,Spain, ISASIForum,Volume 25,No1,March1992,page9. IA eot vial a http://www.ntsb.gov/Aviation/Brazil- at available Report CENIPA Brazil ICAOStateletterAN6/1.2-09/36 datedMay28,2009. http://www.tsb.gc.ca/eng/rapports-reports/aviation/2005/a05h0002/ So after more than 40 years of providing cause(s) in the ICAO the in cause(s) providing of years 40 than more after So may causes defined any of devoid report accident final Lastly,a E ctober, 1998, ISASI Forum, NIPA/ O United States, probable cause has been available to the public for more regon, M Metro 23 accident report, idair_Collision_Final_Report_1907_ M issouri, U SA. The Formal Report listed 3 causes. United States Department of Commerce, Bureau O any of these report users (customers) (customers) users report these of Many nited States accredited representative com- representative accredited States United ctober 1998, page 26. United States National Transportation Safety Lockhart River Airdrome ATSB Report E nglish_version.pdf. See nglish_version.pdf. U ◆ niversityofSouthern L ines Corporation, nly time will will time Only Opera-

Accident Prevention: Pushing the Limits By Bernard Bourdon, Accident Investigation Manager, European Aviation Safety Agency, EU , SEPT. 17, 2009 2009 17, SEPT. ,

Bernard Bourdon is an engineer from France and in Europe. It has to act upon the results of air accident investigations Y holds a masters degree in aeronautics from the French as a matter of urgency in order to ensure consumer confidence in air National Civil Aviation School (ENAC1). He started transport without prejudice to Community law. his career in 1995 as a project manager in the French Aviation behaves as a single network involving products (aero- Civil Aviation Authority and joined the French Inves- planes, parts, and appliances), users (crews, operators), and supports tigation Office (BEA) in 1999 as safety investigator. (aerodromes, air navigation service providers). The regulatory frame- URSDA After 7 years managing safety investigations, he joined work must eradicate safety gaps conflicting requirements or confused H T the European Aviation Safety Agency (EASA) in August 2006. He is responsibilities and enhance the integration of airborne and ground currently the accident investigation manager with EASA in charge of the systems. This enhanced integration of all aviation domains in a interface with safety investigation and the follow-up of safety recommenda- single European regulatory framework initiated the “total system tions. Contact Information: Bernard Bourdon, e-mail address: bernard. approach.” Uniformity is achieved through implementing common [email protected], telephone number: +49 221 8999 0000. rules adopted by the Commission. Regulations are interpreted and applied in a single way, and best practices are encouraged. Uniformity Historical background equally means protecting citizens and providing a level playing field Europe is an old continent with centuries of anchored traditions for the internal market and in the perspective of interoperability. The and culture. On May 9, 1950, the French Foreign Minister Robert “total system approach” also streamlines the certification processes Schuman proposed the creation of a single authority to control and reduces the burden on regulated persons. the production of steel and coal in France and West Germany, The EASA system is in line with “better regulation.” Its possibil- to be opened for membership to other European countries. The ity to combine “hard” and “soft” law provides a good answer to the proposal was realized in the European coal and steel community, needs for subsidiarity and proportionality. The Agency’s approach and the plan laid the foundations for the 1957 treaties establishing of performance-based rulemaking implements these principles by the European Economic Community (EEC). Europe was born, and placing essential safety elements in the rule, leaving non-essential in 1965 the merger treaty established the European Community implementation aspects to certification specifications or applicable (EC), which set up a single council and a single commission of the means of compliance, which, albeit of a non-binding nature, has an European Communities, gradually eliminating the control at the important role to play in providing for a uniform implementation internal borders of the Schengen stakeholders and establishing a of common requirements with sufficient flexibility. common market and then a common currency. Europe has been The gathering of executive functions is made in 3 steps: building up synergies since then. EASA safety In the domain of air transport, the European Civil Aviation Con- regulator for: ference2 (ECAC) has enabled civil aviation authorities of a number of European States to cooperate in developing and implementing Initial Basic Reg. 1592/2002 of Airworthiness The product common safety regulatory standards and procedures. The Joint Avia- Regulation July 15, 2002

3 tion Authorities (JAA) launched in 1970 is an associated body of this 1st extension Reg. 216/2008 of OPS+FCL+TCO5 Those who use cooperation whose intent is to provide high and consistent standards February 20, 2008 the product

Approach of safety. Originally its objectives were only to produce common System Total 2nd extension Reg. xxx/xxxx ATM 6+ Aerodrome Those who help certification codes for large aeroplanes and for engines in order to using the product meet the needs of European Industry and particularly for products manufactured by international consortia (e.g., Airbus). Since 1987 Therefore, the EU aviation system is now based on shared respon- its work has been extended to operations, maintenance, licensing, sibilities among members States, the European Commission, EASA, and certification/design standards for all classes of aircraft. and the industry. Member States are essential pillars for implement- ing rules in their territory while EASA promotes community views The new regulatory framework: the total system approach regarding civil aviation safety standards and rules and, therefore, Within the framework of existing EU treaties and institutions, the adop- has taken executive powers in tion of Regulation (EC) No. 1592/2002 of the European Parliament • production of all EU legislation and implementation materials and of the Council of July 15, 2002, established a European Aviation related to the regulation of civil aviation safety and environmental com- Safety Agency (EASA)4 and the full performance of its functions, cre- patibility, including products certification, licensing, and operations; ated a Community competence for aviation safety. The EASA has then • cooperation in setting international standards; been appointed as the executive body tasked for this objective with a • type certification and continued airworthiness of products, parts, view to establish and maintain a high uniform level of civil aviation safety and appliances;

ISASI 2009 Proceedings • 97 ISASI 2009 PROCEEDINGS oversightofnon-EUoperatorsflyingtoEurope. • common rules;and (See chartnextcolumn.) process. oversight the during tasks duplicating avoid also will It only on the specific technical requirements for the new business. ready approved general organization requirements and focusing al- its using maintenance to activity its extend would operation transport air for approved already operator air an consequence, a As field. each of specificity the account into taking while ing, requirements in terms of reporting, personnel, and record keep- of harmonization the improving at aims scheme regulatory The requirements. organization the and States to applicable ments high andincreasingsafetylevelthoughcommonactions. a creating and processes, approval the streamlining organizations, and authorities of management stakeholders’ standardization, ing promot- at aims oversight, collective the supports It objective. this latest Notice of Proposed Amendments 2008-22 aimed at fulfilling 98 in aproactive approachtosafetyrisks The activeroleofsafetyinvestigators System Safety ICAO on based is and rules the to compliance way.systematic up a backs in It information disseminating and risk, Theproactive approach approach. proactive a aims by at risk identifying safety the managing in hazards, forward step managing the not achievable. Therefore, accident prevention requires a significant It is obvious that eliminating the risk,However, non-compliance evenstill exists and foris causing aviation an accidents. ultra safe system,nel qualificationis that provide compliance with rules and procedures. are already requirements for quality systems, monitoring, and person- Reactive approach to safety risk is in place forfactors in organizations.the 1970s and, today, is expanding Thereto organizational factors. human to extended was 1950s the in factors technical on set focus approach focusing on the compliance with rules prevailed. The initial The historical perspective of the safety regulation shows that a reactive to safetyrisks The new regulatory framework: a proactive approach structure EASA regulations standardization • approvalsoforganizations; • environmentalapprovalofproducts; • The new regulatory scheme defines the authority require authority the defines scheme regulatory new The As a matter of fact, • ISASI 2009 ISASI 7 fororganizationsandstatesafetyprograms. Proceedings

of States EASA is implementing rules proposed in the and the oversight

of compliance anagement Management

with -

FCL: FlightCrew Licensing 147: Training Organization ATO: AirTransport Operator MED: Medical AeMC: Aeromedical Center new developments. workalready done inthe past canbe reviewed inthe light ofthe ing from a quantitative to a qualitative evaluation, the investigation recorded, the risk assessment can be re-evaluated. Therefore, mov- areport. The aim is to make sure that whenever asimilar event is all investigated events in a central database is as important as writing benefit for authorities in their decision-making process. Reporting cies. The reporting and the dissemination of reports both are of great explicit andtransparentapproach. is good and a significant amount of data is available. It provides an and notifications. Quantitative • and subjectiveapproach. detailed description of the risks encountered. It provides an implicit of information. nicationenhances theknowledge risksof through better sharing likelihood. their reducing or consequences theirconsequences. Therisk management aims atmitigating the and occurrences of likelihood the determine severity.helps a It to The risk assessment is commonly based on a probability combined Qualitative • assessment: the to ing safety recommendations that close the safety loop is paramount Investigators provide an essential input for fixing safety deficien- Therefore, accident investigation authorities reporting and issu- safety system. It helps the following aspects of the risk risk the of aspects following the helps It system. safety EU risk risk Meaningful statistics can be drawn if the reporting assessment assessment based based 145: MaintenanceOrganization Operators TCO: Third Country OPS: Operations CC: CabinCrew staff 66: MaintenanceCertifying on on investigation the reporting ast, the risk commu- risk the Last, reports of accidents with a

Endnotes 1. www.enac.fr. 2. www.ecac-ceac.org founded in 1955 as an intergovernmental organization, the European Civil Aviation Conference seeks to harmonize civil aviation poli- cies and practices among its Member States and, at the same time, promote understanding on policy matters between its Member States and other parts of the world. 3. www.jaa.nl. The Joint Aviation Authorities (JAA) was an associated body of the European Civil Aviation Conference (ECAC) representing the civil avia- tion regulatory authorities of a number of European States who had agreed to cooperate in developing and implementing common safety regulatory standards and procedures. This cooperation was intended to provide high and consistent standards of safety and a “level playing field” for competition , SEPT. 17, 2009 2009 17, SEPT. ,

in Europe. Much emphasis was placed on harmonizing the JAA regulations Y with those of the USA. The JAA Membership was based on signing the “JAA Arrangements” document originally signed by the then current Member States in Cyprus in 1990. Based on these Arrangements and related commitments, the JAA’s objectives and functions may be summarized as follows: 4. www.easa.europa.eu.

5. OPS: Operations; FCL: Flight Crew Licensing; TCO: Third Country URSDA Operators. 6. ATM: Air Traffic Management H T 8 7. ICAO Doc. 9859, Safety Management Manual (SMM). ADREP is based on a core common taxonomy for recording, 8. www.intlaviationstandards.org—“Standardizing International Taxonomies” exchanging, and classifying occurrences. Therefore, cross-checking ISASI 2007, Corey Stephens; Kyle Olsen; Olivier Ferrante; Vivek Sood. similar factors using a central database is made possible with tools 9. http://Eccairsportal.jrc.ec.europa.eu European Coordination Center for Ac- 9 cident and Incident Reporting Systems assisting national and European transport like Eccairs, which promotes the proactive approach to safety entities in collecting, sharing, and analyzing their safety information in order to improve deficiencies. ◆ public transport safety.

ISASI 2009 Proceedings • 99 ISASI 2009 PROCEEDINGS T Additional preventative presentations followed. Additional preventativepresentationsfollowed. balance between the safety “haves” and “have not’s” in the industry. im- the redress to example, by present, person each implored and tion.Iupdated the delegates on recent ISASI Reachout initiatives example oftherecentAirFranceFlight447accident. tragic the to related issues background through threaded were 100 with this, that could be achieved by using GPS data over radar data. Coupled update of the ICA approaches. bilized sta- from gained be could that investment on return the espoused by highlighted were excursions runway the potentialaboutthesetypesofaccidents. magenta line present in the audience were left with no doubt as to inwhat should have been recoverable events. The children aerodynamics basic of role the in lessons somber of his thewith Cox John with a greatstart. were accounts of her other vital role, motherhood! We future weredealings offwas towelcomed by all delegates. for cooperation and accountability, transparency, of declaration graphically established context of the difficulties under which which under difficulties the of context established graphically water” of miles “Switzerland2 beneathlikebeing siteaccident into the Air France Flight 447 investigation. His metaphor of the The enhancedsafetyresultsare simple,safe,andcosteffective. ADS-B fitment into the safety. ample of modern technology delivering tangible benefits to aviation weight flightdatarecorderdevices. with current and future technology capable of functioning as light- Ryan Graue Ryan The seminar took a change of heading into a preventative direc- The increasing likelihood and catastrophic consequence of of consequence catastrophic and likelihood increasing The From this point, the technical program developed, commencing Day 2 began with The final session of Day 1 concluded with yet another practical ex- • Mike Poole’s focus on the value of data in training, reinforced by David Zwegers took the seminar step by step down the path of ISASI 2009 ISASI Seminar Summary of ISASI 2009: the NTSB’s colors to the organizational mast. Her timely timely Her mast. organizational the to colors NTSB’s the man Chair NTSB by delivered address, keynote he Philippe Plantin de Hugues set the tone for a productive seminar when she nailed nailed she when seminar productive a for tone the set and Foundation. of theAustralian Board Advisory oftheFlightSafety chairs the ISASI Reachout Committee and is co-chair delivery of specialist safety investigation training.ment He of transport system safety management and the an Australian companyspecializinginthedevelop- John Guselliisadirector ofJCGAviation Services, O Proceedings Geoff Geoff Edwards Accident Prevention Beyond By John Guselli, JCG Aviation Services andChairmanofISASI’sBy JohnGuselli,JCGAviation Services ReachoutCommittee Annex 13 enhancements recently made. These Paul Arsianian’s refreshing and realistic insight capped this session with a timely timely a with session this capped Costa Marcus mbry-Riddle Embry-Riddle national training aircraft fleet. detailed investigative improvements brought the seminar up-to-date , who once again again once who Burin, Jim Equally well regarded Investigation Deborah Hers- Deborah lessons of the past. lessons ofthepast. tive words linked firmlyprovoca- His withdate? prioruse-by its seminarpassed statement statements“cause” traditional allied to the in comparisontothepast. especiallyinlight ofpassengers’ ever-increasing body dimensions theprinciples thatunderpin emergency evacuation philosophies vein, similar a In programs. to beproactiveandaggressive. practitioners safety for called he when Wickham General of words correct method of stowing fragmentation grenades, cited Gary the a function of safety. In addition to his briefing the audience on the Gary with concluded day The recommendations. safety for methods sis enhanced by library,open-source the ofmeanstechnology byof usepromotedcontrast thethey not to forget the lessons learned from past investigations.in stagers” In sharp ment withthefamous“moneytrail.” place. safer a to industry the take to suggestions proffered time same the at and environment HEMS the to related statistics chilling with seminar stark reality of the world of tinkicking. Matrix(HFIX). tors Intervention seminar toward “Tomorrowland” with his work on the Human Fac- Finally, checklists. of value the of attendees reminding as well as System cussed the benefits of the Human Factors Analysis and Classification as continued theme The operations. test flight Caceres demonstrated the weaknesses in existing post-maintenancethe means compliance for large aircraft certification, while stimulating and relevant human factor issues. and notagenda.” all present to ensure that their investigative work is “based on fact major investigations.major ICA Drawingon in confidentiality on policy realistic for call loud a with cluded con- paper His organizations. many afflicting amnesia collective the knowledge,scatteredandchange,societal of elements key from this investigation into his presentation as he touched upon this investigation labored. Paul incorporated significant examples fly-by-wire technology, particularly in the construction of the construction in particularly technology, fly-by-wire through unwary the to introduced pitfalls the of illustration lent oet MacIntosh Robert with opened seminar the of day final The The seminar was further treated to the vast experience of two “old The comfort of the psychology domain was soon replaced by the Seminar proceedings adjusted heading slightly to take in a raft of Braman as he advised delegates of the notion of leadership as Doug Wiegmann got with the Disney theme as he moved the as they urged all present present all urged they as Rimson Ira and Benner Ludwig Simon Mitchell through his insight into best cost analy - ne productive way out could well be in sharp align- sharp in be well could out way productive One posed a most significant question—has thesignificant most a posed IB. The value of this session was further further was session this of value The MESLIB. Eric Savage Eric Christine Negroni provided the O challengedreassesstoall guidance, he imploredguidance,he Wen-Chin Li provided excel- Newman’s Dick dis- Wang Thomas Claudio Claudio MEL

Bernard Bourdon provided the seminar with a timely update of He concluded with support for Paul Arsianian and highlighted the recent initiatives from EASA and impressed the delegation with hindrances generated by the leakage of confidential information his perspective of EASA’s “total system approach in aviation safety at critical stages of an investigation. regulation.” The future of ISASI was then on display as the Rudolph Kapustin The concluding industry update presentations were then deliv- Memorial Scholarship winners, Dujuan Sevillian, Murtaza Telya, and ered. Robert Sumwalt implored us to remember why we exist as an Brian Dyer, were introduced to the assembly. From their topical pre- investigative body. ISASI was challenged to produce safety recom- sentations it was obvious that they will perform valuable service to mendations that will prevent recurrence of accident and incident the industry into the future. Although the students were a hard act sequences. He amply illustrated his message through a series of to follow, Martine Del Bono of the BEA, Mark Clitsome of the TSB, and structured case studies to emphasize the lessons. Ikuo Takagi of the JTSB completed the update process for investiga- , SEPT. 17, 2009 2009 17, SEPT. ,

David Miller then brought the assembly up-to-date with the breadth tion throughout the world. Y of successful work achieved by the UK AAIB. In a span from Russia In closing, let me urge all delegates to measure the value of the to the Caribbean, and the North Sea to literally its own backyard at ISASI 2009 seminar from a personal perspective and to remember Heathrow, the AAIB has been stretched enormously. This led David that, like any structure, the strength of ISASI is dependent on the to espouse the virtues of cooperative resources for obvious reason. integrity of its components. ◆ URSDA H T

ISASI 2009 Proceedings • 101 ISASI 2009 PROCEEDINGS G ment, aswellpromoting theinterests ofaviationsafety. propriate accesstoinformationmakingpeopleaware ofcrisismanage- all aspectsofthecommunicationsstrategy, rangingfrom ensuringap- Science) inParis, shejoinedtheBEAin2002.DelBonoisinvolved is conducting the safety investigation. is conductingthe safetyinvestigation. Annex 13 of the Chicago Convention, France, as the state of registry, victims havebeenrecovered,43 ofwhichhavebeenidentified. 50 of remains the all, In found. were remains human where show resenting only 2 or 3% of the entire aircraft. The solid white circles rep- found were pieces 1,000 than more total, In wreckage. the of as of June 18, 2009. The white circles show where we found pieces in thecomingmonths. begin should and prepared being is phase third know,a probably you As operations. search the of phases two first the coordinated ofthevictimsWorldceremony inmemory War II. said to the press on June 7, 2009, during his visit in France nary tragedy” foras the thepresident of the all oftheproblemsinvolvingvictims’families. ambassador, by this tragedy. The French government appointed a former French even within of the victims was the sheer number of countries that were involved into theclouds. disappeared have to or Atlantic the by up swallowed been have to seemed aircraft the that suggested newspapers the of pages front this accidentoccurred. There were216passengersand12crewmembersonboard. disappeared in bad weather conditions in the middle of the Atlantic. the news media. Around 102 Regarding the organization of the investigation and according to The slide on the right shows the status of the search operations Assisted by the Brazilian, American, and French navies, the BEA This accident was described at the highest levels as an “extraordi- The first challenge in terms of communication with the families the followingaccident,graphicsondaysused thethethe In how or when, where, say could one no following, hours the In Communication Challenges After the • ISASI 2009 ISASI face between the technical work that you do and the world of me this opportunity to speak to you a little bit about the inter giving for you Thank gentlemen. and ladies afternoon, ood By MartineDelBono,HeadofPublicAffairsDivision,Bureaud’Enquêtesetd’Analyses(BA),France

Europe, where 21 different nationalities were touched Pierre Jean Vandoorne, as special ambassador to handle Air France Flight447 Accident communications atSciencesPo (InstituteofPolitical ment andcommunicationasheadoftheinternational diverse experienceinthefieldofintercultural manage- head of the public affairs division at the BEA. AfterCommunication Sciences, Sorbonne University), is the (School ofHigherStudiesintheInformationand Martine DelBono, who graduated from the CELSA Proceedings 2 a.m. on June 1, 2009, Air France Flight 447 United States, Barack GUEST SPEAKER bama, Obama, - A’s safety message could get lost. This was our our was This lost. get could message BEA’ssafety the that danger ties, often with conflicting interest and their own agendas with the to listentheirrequests,questions,andproposals. was the opportunity to give an update on the investigation, but also It representatives. 40 around together bringing 5, August on BEA anexpert. result,Asa aninternational meeting took place atthe 12 countries requested to be named observers and to have appointed investigation, the AAIB is a guarantee of the credibility and integrity of the French investigativebodies such as the C A is also facing a multitude of other interested par interested other of multitude a facing also is BEA the But Furthermore, as some of their citizens were among the fatalities, of participation the media, news the of view of point the From E NIPA,the NTSB, the BF U ,and - second challenge in terms of the underlying goals of any safety Around 100 national and international reporters attended the investigation—particularly in the context of this accident where we presentation of the interim report on July 2 by Alan Bouillard, the had not yet found the main wreckage, where we had not yet found BEA investigator-in-charge. The same day, within 8 hours, 30, 000 the flight recorders, where we did not have radar track, and where copies of the interim report were downloaded from the Internet. there were no eyewitnesses. Experience proves that there are peaks of news media interest The information we had at the beginning of the investigation was following accidents, particularly after 3 months, which—in this case— 24 ACARS messages sent by the aircraft during the last 5 minutes of corresponded to the end of the second phase of the search operations. the flight. As you know, these messages are normally used for aircraft So the news media interest was quite intense. Consequently, the public maintenance purposes, not for investigative purposes. concern has remained high because of the aforementioned factors. Up to 5 minutes prior to the estimated time of impact, the flight After more than 3 months, I would say that the biggest issue path was reconstituted and presented to the press at the BEA 2 days in terms of communication after a major accident is to adapt our after the accident. Unfortunately, the ACARS messages were quickly safety message to the questions asked by reporters. By persistently GUEST SPEA K ER leaked to websites and created speculation that a malfunction of explaining the safety investigator’s mission and the BEA’s mission the air speed sensors, also known as pitot probes, was the cause of we have arrived at a point where the news media message relates to the accident However, the BEA continued to maintain that the air the basic issues and not just to the need for a scoop. speed sensors were being looked at but had not been identified as Finally, I think it is worth underscoring the contrast between the a cause of the accident. way the news media have handled this accident and another recent This has been our third challenge in terms of communication: major accident. I am talking about the accident involving Yemenia dealing with reporters who mostly did not have any knowledge of Flight 626, which crashed off the coast of the Comoros Islands, aviation or safety investigations; could not distinguish between in- near Madagascar, which resulted in 152 fatalities just 1 month later. complete information, findings, spin, or the causes of an accident; There was practically no interest from the international news media, and could not accept the answer “we do not know,” immediately including from the French press. The news media coverage was interpreted as “you do not want to tell us.” remarkably different even though 61 French citizens were killed During the first month, anything the BEA did or said or any on the Yemenia flight and the Comorian Investigation Commission comment from interested parties resulted in a news media frenzy provided regular press releases. reinforced and amplified on the Internet without regard to the The only thing that interested the international news media until affect that would have on the families. The time pressure and the the recovery of the flight recorders 2 months later was the tragic news media pressure were enormous, and our top priority was to story of the sole survivor, a young girl of 14. immediately update and translate into English—on our website— It is as if the other 152 victims had never existed. the information given during the press conferences. Thank you for listening. ◆

ISASI 2009 Proceedings • 103 ISASI 2009 PROCEEDINGS G Bell 47and206JetRanger helicopters. B-757, B-767,B-737,andCessnaCitationaswell the A300-600R, chief inspectorofairaccidents.Heholdsacurrent ATPL andisratedon Miller joinedtheAIBin1991and2002waspromoted todeputy 104 cost isapproximatelyUS$12M. manufacturer’s and academic courses worldwide. The total running currency with the industry and their systems knowledge by attending the with leading ascaptains line” the “fly to continue employees, AAIB inspectorsareall current airline captains who, although full-time remaining 20 provide administrativetors,divided support. inspec- into are engineering these of TheThirty-five and 55. operations AAIB’sof count specializations. head a operationswith operates The discuss andsharebestpractices. remainseparate, butthethree chief inspectors meetregularly to a multimodal of organization part threeorganizations NTSB.Allthelike not is however, AAIB, The (Rail). RAIB and (Marine) the organizations sister independent its from it distinguish it was renamed the “Air” Accidents InvestigationAir the of part (AIB), Branch tion Branch (AAIB) to Investiga- Accidents the as known became and civilianized was it I, nization in 1915 as part of the Royal Flying Corps. After World War business inthefuturefromU.K.perspective. do all we way the affect to potential the have or affect that issues up-to-date with our recent and ongoingseminar the bring then will activity. I of responsibility, level accidentof and investigations and the with familiar less Kingdom AirAccidentsInvestigationBranch. as farafield the FalklandIslands. U the AAIB is responsible for investigating accidents occurring in the is the state of occurrence; but what may not be widely known is that sibility andaccidentactivity? .K.’s crown dependencies and its overseas territories, which stretch How does this establishment relate to the the of part AAIB, The The In order to do this, I feel it necessary to briefly inform those of you The AAIB is also responsible for appointing accredited represen - The AAIB is, obviously, the investigating authority when the • ISASI 2009 ISASI U.K. first established an aircraft accident investigation orga- you all up-to-date on the activities concerning the concerning activities the on up-to-date all you bring to opportunity this for Committee Seminar ISASI ood morning ladies and gentlemen. First let me thank the U.K. operators. The engineering inspectors maintain their The UnitedKingdomExperience By DavidMiller, U.K.DeputyChiefInspectorofAirAccidents,AccidentsInvestigationsBranch Boeing 757s, 737-300s, and 737-400s. captain on Boeing757s,737-300s,and737-400s. pilot. Inthecivilenvironment, hebecameatraining air-to-air refueling instructor, andVC10display standards ontheVC10,instrumentratingexaminer, manding the VC 10 training spent 17yearsintheRAF becomingtheofficercom- David Miller qualified as a private pilot in 1967. He Proceedings .K. situation on the AAIB’s resources, areas areas AAIB’sresources, the on situation U.K. .K Department for Transport,for Department U.K presently inistry. In more recent times, times, recent more Ministry.In

unit, chief examiner for U.K.’s areas of respon- GUEST SPEAKER nited United AIB MAIB .K. U.K. as such fall within the AAIB’s spherethe of subsets as classed are registrations of responsibility. oftenaircraft,forgottenis it“ butthethat It is well known that the “G-” registration denotes a a to overseas occur accidents when tatives mercial turbine-powered aircraft. ultimately the fitment of “robust” light-weight recorders on all com- and specifications the regarding initiatives these of endorsement issuedseeking comment in this area. The been AAIBhas States would to letter encourageICAO an that and Panel Recorder Flight powered executiveaircraft. turbine- light to recorders voice and data flight of fitment the for need the highlighted evidence, the of most destroying accessories engine and fuselage, cockpit, the of portion significant a sumed con- fire post-crash a and died people five which in Hill, Biggin at highlighted a particular area of note. The Cessna Citation accident cantaccidents involving AAIB inspector teams. manpower andfinancialterms. in both resources, our of bulk the consume to however,continue oftheirtrainingregimes. a reviewbythemilitary air experience flights with the RAF. undergoing cadets air teenage three of deaths the to led tragically involving civil-registered but military-operated aircraft. These events ground. In 2009 specifically, we have dealt with two mid-air collisions which in recovery analtitude could at not be completed occurred has before flight the controlled aircraft from thata hitdeparture the such theaircraft flown have or qualifications or training necessary the without conditions weather deteriorating into flight their continuing by disorientated become either have pilots which under investigation. in one of the North Sea Super Puma helicopter accidents presently lives 16 of loss the to due high is figure This 2007. for 44 of figure high the approaching fast is fatalities of number the already and 35 investigators—that’s 6weeks. approximatelyoneevery themselves. We have no regional The offices,figures teams. for fatal field accidents and of and the number deployment of this fatalities the speak for require work year is a done 78 approximately by the but correspondence, through remotely investigated are these of definition of an accident or serious incident. A significant number average,on events790ofeach year, whichoffall470within the within Russia. registered in Bermuda operate permanently under example, 83a majority of the medium-haul twin-jet transport aircraft agreements aircraft operate permanently remote from their host register—for We have already heard this week on the work carried out by the On the screen you can see here a list of some of the more signifi- aircraft, transport public to incidents serious and Accidents in accidents fatal aviation general see to continues AAIB The July, to January period 7-month the for are 2009 for figures The the to regards With .K. accident rates, the AAIB is notified, notified, is AAIB the rates, accident U.K. U nderstandably this has led to .K. “main register” and and register” “main U.K. .K-registered aircraft. aircraft. U.K-registered M -,” “VP-,”“VQ-”-,”and E achofthese has .K.-registered U.K.-registered M any of these The investigation into the previously mentioned Cessna Citation The other helicopter (G-REDL), wherein the rotor head detached accident also highlighted a disturbing trend in which investigators in flight killing all on board, hit the sea and sunk in four discrete sec- can be denied the use of valuable investigative tools such as flight tions. The weather was benign, and the subsurface visibility and sea simulators. The investigation team needed to examine the cockpit bed were such that recovery was relatively straightforward. However, environment to study the man/machine interface and human fac- the AAIB had to set aside total costs of just under US$1.5M. tors affecting crew resource management. The inspectors, however, I would like to now come onto the investigation into the Boeing were denied the use of local resources and had to travel significant 777 accident at Heathrow, which is continuing, It is hoped that a distances to find facilities to meet their needs. final report will be published around the end of the year. Here we Advances in the fidelity of flight simulators have led to them see a positive message. being certified for use as “zero flight time’ training facilities. We The AAIB has already published several reports detailing the all know the advantages of flight simulation, whether it is for initial circumstances in which ice accumulating in the aircraft’s fuel system training, recurrent training, testing and checking, cockpit resource was released such that it temporarily blocked the engine fuel/oil GUEST SPEA K ER management training, jet upset training, and much more. We also heat exchanger, preventing the engines from responding to the know their use can contribute immeasurably to an investigator’s thrust lever demands. understanding of aircraft systems, aircraft performance, and crew The issue I would like to highlight here, however, is how coopera- behavior and performance. tion among the investigators, the FAA and EASA, the operators, and It is sad to say, however, and this has been the AAIB experience of the manufacturers was essential in achieving an understanding of the late, that more and more frequently investigators are being denied accident. The investigators formed only 10% of the total manpower working on this accident. This B-777 accident raised the need for significant research using fuels system test rigs and engine power tests, as well as the analysis of monumental amounts of statistical data provided by several airlines from their FDM/ QAR programs—all I might add at significant cost to the companies involved, but carried out voluntarily to achieve a common aim in support of the investigation. I think we can sometimes become compla- cent in this respect and forget to acknowledge how far our industry has come in the provision of voluntary cooperation in all respects. This cooperation, however, is continually under threat and may reduce in the future. Recent challenges in the U.K., requesting the release of confidential information, not protected under national legislation or deemed as “relevant records” under the ICAO Annex 13 definition, held by the investigation team and provided in good faith by the industry, threaten to close the door on the future free flow of in- the use of this investigative tool because of cooperate policy decisions formation. I’m sure you will all agree that the main players must feel brought about by the threat of potential litigation. that their participation in any investigation is carried out in an atmo- I admit I do not understand why or how this situation has devel- sphere of mutual trust and confidentiality and safe in the knowledge oped, but the AAIB will continue to seek the cooperation of those that information provided, whether sought or volunteered, must be that provide this type of facility. This situation causes concerns and protected from uncontrolled release in the public domain threatens to erode a hitherto cooperative environment. In conclusion then I would like to pose this well known question. The Boeing 737 accident in Perm, Russia, served to remind the How many accidents have been prevented as a result of safety recom- AAIB, and its overseas territories, of the need for closer monitoring mendations, arising from accident investigations, made by accident of operational standards for aircraft permanently operating clear investigation authorities? from direct oversight of the regulator. I hope you will agree that we don’t know, but over the decades The two North Sea Super Puma helicopter accidents that threat- the accident rate has reduced and the AAIB remain convinced that ened to close down oil production in the North Sea, and of course through cooperation and the free exchange of information, treated the loss of the Air France A330 in the mid-Atlantic, remind all of us in confidence, that we, collectively, can continue to give the com- of the difficulties and substantial cost involved in recovering aircraft mercial aircraft traveler the confidence that his or her journey will from the sea bed. In one of the North Sea accidents, the helicopter reach a safe conclusion. Seminars like this, offering opportunities for (G-REDU) had flown onto the surface and floated, allowing the oc- like minded safety professionals, to meet and exchange views in the cupants to escape virtually uninjured and also affording a relatively interest of global cooperation, in an informal atmosphere, continues easy but still costly recovery operation. to form part of the global safety management system. ◆

ISASI 2009 Proceedings • 105 ISASI 2009 PROCEEDINGS T Nagoya University. In 1982heearnedamaster’sdegree inaeronautical engineeringfrom director foraviationsecurity, andsafetysecurityinspectorgeneral. engineer,carrier airworthiness director fornoiseabatementtechnology, in thefollowingpositionswithCivilAviation Bureau: chiefair 106 in China for Narita International Airport rolledFedEx a over upon landing on a.m. 6:49 accident—Around 80 Flight FedEx Initial investigationofaserious accident such asthecauseofaccident. still in the midst of investigation, I will not touch on sensitive matters like to present to you how we reacted to thisTodayinjured. fatally were occupants occurrence.two I’d and Airport national As we are Inter Narita at land to failed airline foreign a by operated aircraft big A accident. serious a with year,faced this were of we 23 March on But accidents. catastrophic such investigating experienced has than 20 years.). Although I have 21 investigators,discuss only onewhy ofJapanese them airlines have not not hadwill (I aircraft single a with fatalinjuries fatal of number largest the accidents for more suffered JAL when 1985 since occurred not has injuries fatal with national Airportinwhichaforeignairlinewasinvolved. in hugefatalinjuriessinceoneoccurred1996atFukuokaInter suffered not a has largeJapan year. each aircraftof cases 40 accidentand 20 between of somewhere a scheduled airline that resulted this typeofaccident. state of aircraft design and manufacture, little chance to investigate rare,giving ordinary accident investigators, except those largetransportafrom aircraftthe involved is catastrophicwith damageis where on the earth day.every However, a serious accident in which Agency.Accident Inquiry Railroad Accident Investigation Commission and the Japan on established An accident of a large aircraft, operated by a domestic airline, airline, domestic a by operated aircraft, large a of accident An with combined, are incidents serious and accidents Japan, In some- occur may accidents aircraft that reality regrettable a is It • ISASI 2009 ISASI today.TheJapanTransportation Safety Board(JTSB) was great pleasure a is to have It a chance everyone. to to talk afternoon at the good 40th and ISASI you, seminarhank Accidents: TheJTSB’s Experience D-11 departing from Guangzhou International Airport Airport International Guangzhou from departing MD-11 By IkuoTakagi, InvestigatorGeneralforAircraftAccidents,theJapanTransportation SafetyBoard ct. 1, 2008, with the mergers of the Aircraft and and Aircraft the of mergers the with 2008, 1, Oct. Initial Investigation of Serious Initial InvestigationofSerious former Ministry ofTransportformer Ministry in1982andhasserved of the present JTSB on Oct. 1, 2008. He joined thegation Commission(ARAIC) priortotheestablishment with thethenAircraft andRailway Accidents Investi- a positionhehasheldsinceJuly2008whenserved accidents attheJapanTransport SafetyBoard (JTSB), Ikuo Takagi istheinvestigatorgeneralforaircraft Proceedings GUEST SPEAKER arch 23, 2009, 2009, 23, March arine Marine - - injuries. Theaircraftburnedtotheground. aircraft manned by only two occupants. Both of them suffered fatal cargo a was aircraft The flames. in exploded and 34L Runway on accident. Iwaspreparingtoimmediatedepartfortheoffice. train foundoutabouttheaccidentaftergettingtooffice. emergency call-out network. Some who were already on a commuter the occurrence by watching TV before being informed through the this image had been seen by many of my investigators who knew of time, same the At occurred. accident the how of image clear a got and wrong was that realized soon I but reason, some for aired was I couldn’t grasp what was going on. I thought a past accident image as usual. I turned on the TV and watched an aircraft roll over. At first over, andexplodedontherunway. rolled bounced, repeatedly which aircraft, doomed the of image and it was featured repeatedly in news broadcasts using the recorded of morning early the in occurred accident The activities. TV cameras are installed on the airport buildings to monitor runway Notification oftheaccident aircraft were not able to takeoff or land, and flights were delayed, delayed, were flights and land, or takeoff to able not were aircraft becameRunwaysolelyB operational. However, long-range large parallel remaining The closed. was A runway,Runway the on was damage and debris scattered and A Runway beside just rested and burned aircraft the Because m. 2,180 only is B Runway however, m.; 4,000 is A Runway B. Runway and A Runway runways, two with before March23thisyear. anniversary. The airport had not experienced a fatal aircraft accident Narita airport was opened in Narita InternationalAirport midnight, forcingustoworkinfreezingtemperatures. about sleet to began it and plummeting, temperatures with noon after the in drastically changed weather The gear. winter proper car. It was windy but warm for the season so we left the office without among ourrecentinvestigations. most the assigned, investigators six were There position. IIC the to cope with all the aspects of the accident investigation. I assumed airport officeandpolicestationsatNaritaairport. were already there and were busy collecting informationarrived fromIofficethe at thearound 8:30 a.m. Appointment ofinvestigators Itwas around 7:20 a.m. when I received a phone call about the On the day of occurrence, I got up sometime before seven o’clock The airport serves as Japan’s most important international airport by airport the for headed and office the left I a.m. 9:30 Around I decided to assign investigators from all expertise areas to be able May 1978, and this year marks its 31st M ost of the investigatorstheofost Monday, - cancelled, or diverted to other airports, causing delays for a huge level of our individual understanding differed due to our English number of travelers. The demand increased to reopen Runway A as capability. It would have taken twice the amount of time if we had soon as possible after finishing the onsite investigation, relocating used an interpreter for the meeting. In every sense, language the wreckage so that it would not interfere with the operation of the proficiency is a high hurdle under the condition of bilateral or runway and repairing the damage to the runway. multilateral investigation.

Documentation of the accident site Party system investigation We arrived at the airport around 10:30 a.m. and hurried to the ac- The NTSB uses the party system accident investigation. I had some cident site after getting a rough idea of the accident. The fuselage knowledge about it. But it was my first experience to work closely was still smoldering, and intermittent watering by fire trucks contin- with the NTSB so at first I was perplexed about its way of doing ued. I made the first priorities to documenting and photographing things. In Japan, it is not our usual practice to have someone who scars left on the runway, debris dispersion, and wing and landing is considered or might be relevant to the cause of the accident GUEST SPEA K ER gear destruction. directly joining the investigation. So I was surprised to find that the My work schedule was to finish the site recording, including the accredited rep was accompanied by about 20 advisors consisting of fuselage, and some work that needed to be done before relocating operators, manufactures of the aircraft and engine, pilot associa- the wreckage. The anticipated work ended in the evening, and it tions, and the like. was already dark then. I decided to do detailed documentation after Although their way is different from ours, I accepted them all, the relocation, without worrying about a time limit. considering the nature of the accident and efficiency of the investiga- Representatives from the U.S. were supposed to join us. Be- tion. I observe that our investigation has worked effectively so far. cause the relocation was supposed to be done before their arrival, coordination on this issue was carried out by the investigators who Readout of DFDR/CVR data remained in Tokyo. Although the aircraft was equipped with an FDR and a CVR, they were not the types used by Japanese airlines. My first impression was Responding to the news media that we could be able to retrieve data from them with our equip- Many requests for a press conference on the accident by the IIC ment. But their seeming damage caused by shock and fire made me flooded the Public Affairs Division of the JTSB. We held two press decide to ask the NTSB to do the work. On the 26th, a non-assigned conferences in the evening of Day 1 and Day 2. On and after Day 3, investigator flew to theU .S. with these devices. Data retrieval at the the news media interest seemed to somewhat fade. Reporters were NTSB was successful. satisfied with the end-of-the-day quick interviews, and even this type of interview was not requested on Day 6. Future investigation During the first phase of investigation, we documented aircraft Relocation of the wreckage at midnight exterior damage and scars left on the runway, retrieved FDR/CVR The airport authority planned to relocate wreckage during the data, and collected aircraft operations data, weather data, and the night in order to open Runway A the next morning. It was after like. Our future tasks include in-depth examination of crucial aircraft 9 p.m. when all the heavy equipment necessary for relocation was components, analysis of aircraft maneuver, and the sequence of assembled and the work started. In order to relocate the fuselage, destruction at the time of the accident using data collected during it had to be severed and this necessitated our attendance to avoid the first phase. These tasks require detailed aircraft information, valuable information from being spoiled forever by improperly operator’s operations manuals and the like. The cooperation of the severing the fuselage. state of design/manufacture, the U.S., is indispensable. The weather deteriorated: the temperature plummeted, and it began to rain. Rain turned into sleet in the wee hours of the morn- Lessons learned (what my investigators have learned ing. Trembling in the cold, investigators took turns attending to through the initial investigation) the relocation. Not all investigative organizations around the world face serious The next morning the wreckage was relocated to an open lot, accidents very often. I assume every country is prepared for a big some distance away from Runway A. The damaged runway was accident, and Japan was. We have practiced liaison and coordination repaired, and it was opened to operations sometime after 9 p.m. activities under simulated serious accidents with all investigators. Investigators were tired from attending to the relocation all night; This accident occurred at Narita International Airport, which however, they couldn’t argue with the necessity considering the lies in the vicinity of Tokyo, giving us easy access to assistance importance of Narita International Airport. The wreckage was again from the Civil Aviation Bureau Narita office. The number of relocated to a new place at the end of June after securing a warehouse casualties was only two. If the case had been similar to the JAL for the storage until the investigation was completed. 123 accident in 1985, in which an aircraft crashed into a remote steep mountain slope resulting in 520 fatal injuries, the level of The NTSB joins the investigation difficulties would have been multiplied, and we would have had The NTSB accredited representative and his advisors arrived at a very difficult time. Narita in the evening of the 24th, one day after the occurrence and What makes accident investigation more difficult is not the size joined our daily meetings. They started the investigation on 25th. of the accident itself but peripheral factors. For instance, once the In the morning of the 25th, I briefed them on our investigation, accident occurred, people from the news media and concerned confirmed their expertise, and we coordinated future activities. individuals asked me questions, demanding opinions, decisions, The bilateral meeting was carried out in English; however, the etc., and all of this affects my investigation.

ISASI 2009 Proceedings • 107 ISASI 2009 PROCEEDINGS 108 the changedenvironmentbroughtbyadvancedtechnologies. of example good a is This accident? the of time the at wind-shears What is the cause of porpoise maneuver of the aircraft? Weren’t there investigation: my of commencement the after minutes some tions ques- with me bombarded them of Some conclusion. tendentious the occurrence. As a result, the news media jumped to a premature, after just aired were camera airport fixed the by recorded aircraft cameras and abundant man power. airport fixed many utilized they accident this In investigation. our press release,andwebothbecameirritated. investigation accident first the on media news the with agreement an reach to awhile took it preparation, media news poor to Due The newsmedia considering thenatureofaccident. investigatorsthenumberstheof approachtermsof involved in gotsomeinappropriate pictures. guessshouldII flexiblehave a however, I had no investigator to assign to that task and consequently made our walk difficult. I arranged aerial photos using a helicopter; even that condition wind strong under m. 1,000 as long as runway ried out in an environment in which debris was scattered along the seemed to be insufficient. This is because the investigation was car their homesooner;somewerealreadyincommutertrain. morning. Some investigators checked the occurrence at home and left early the in occurring accident the to due site accident the reaching Although it didn’t work as planned,Emergency callnetwork this didn’t delay the investigators News media information collection activities sometimes surpass Asfor the number ofinvestigators onsite, atthe beginning six • ISASI 2009 ISASI Proceedings Moving images of the accident - different. completely was situation the sense this In report. investigation the other factors, and then it is released, if necessary, concurrently with of prudent analysis of DFDR recording, eyewitness statements, and investigation report in ing the lessons learned in this accident and to compile the accident have enjoyedagoodrelationshipwithNTSBsofar. investigationdepends on how we cope with that. of To success the my and relief, high is hurdle we this that seems however,it ers”; barri- language and 2010’sdifferences cultural “over is sub-theme take necessary measures to speak copenot do with investigators themy of languagesome problem. ISASI representative and advisors from the concerned states. I knew that accreditedthe coordinationwith good have toimportant is It Coordination withotherinvestigatingbodies and accurateinvestigationundertimeconstraints. to be done to cope with this kind of situation in the future for quick investigators did their best under the circumstance. Something has my believe I relocated. be to forced were debris the all and spot, beginning.the Detaileddocumentation possiblenotthewas on Airport, the onsite investigation had a limited length ofBecause timethe accident fromoccurred on Runway A at Narita International On-site investigationunderlimitedduration pendent, A Usually an account of the accident aircraft is generated as a result My future task is to mend the emergency go-system, implement- Thank you.IhopetoseeyouallagaininSapporonextyear. uthentic manner(likeISASI2010’s theme). ASIA fashion—in an nglish well, but I didn’t I but well, English A ccurate, S peedy, I nde- ◆ GUEST SPEAKER The Continuous Challenge for U.S. Air Safety Investigators Assisting

In International Investigations GUEST SPEA K ER By Dujuan B. Sevillian

Abstract would seem practical to assist the international aviation community This paper addresses the significant challenges ofU .S. government of Africa within these confines. From an FAA air safety investigator air safety investigators assisting with investigations within the African perspective, and beyond just investigating accidents, areas of con- continent. The reader will be introduced to possible “areas of con- centration in Africa should be the development or the continuous sideration” that could be used as continuous positive interfaces that support with facilitating effective air carrier internal evaluation the National Transportation Safety Board (NTSB) and the Federal programs, aviation safety action programs, and continuous analysis Aviation Administration (FAA) could utilize with and surveillance systems within Africa’s air transportation system, international investigations. Since the major role just to name a few. These programs could assist their government of an air safety investigator is to investigate the and airlines to continuously improve aviation safety. These types of causes of aviation safety-related issues and provide oversight systems and the active management of these programs recommendations based on findings, the reader have helped improve the United States air transportation system will also be introduced to other significant roles considerably over the past 10 years thus reducing the number of that an air safety investigator could benefit from aircraft accidents and incidents. during and after a completed investigation. Moreover, to fulfill the Recently, the Air Transportation Oversight System (ATOS) initia- international obligations of the International Civil Aviation Authority tive was developed by the U.S. FAA to enhance the overall system (ICAO), Annex 13 and Annex 8, the NTSB must assist as needed safety aspect of air carrier programs and the associated departments with international investigations. that require oversight by the FAA for the airline industry. As air travel increases and new aircraft are developed, there is a demand Introduction for continuous surveillance of an airline’s maintenance and flight NTSB investigators support the standards within ICAO Annex 13 operations programs. However, this program could also help air and have assisted international investigators with aircraft accidents safety investigators determine a cause(s) of an accident or incident. for several years. Sending U.S.-accredited representatives to aircraft Since ATOS is a multifaceted system, Africa’s airlines could adapt accidents builds rapport with international investigators. The vari- to a similar system structure. Safety culture is a key aspect with the ous methods of exchanging technical expertise, the willingness of ability for this system to produce positive and meaningful results. The investigators to serve, and the continuous exchange of information airline must understand that effective organizational safety culture to improve aviation safety around the world are just a couple ways and the acceptance of this culture from upper-level management that can improve communication within aviation safety. In 2003, the could make the process of investigating an incident/accident easier NTSB conducted a study regarding aircraft accidents around the from the air safety investigator standpoint by helping the investiga- world. According to the study, Africa and the Middle East maintained tor understand the airline’s dynamic culture. Seemingly enough, an accident rate of 1.54 fatal accidents per million flight hours and the utilization of the ATOS system safety attributes within Africa’s 3.62 per million flight departures. Several other agencies have con- airlines could be a good evaluation tool to improve air safety within ducted studies to determine why there are so many aircraft accidents Africa and possibly reduce the rate of accidents from the commercial in other areas of the world (NTSB, 2003). U.S. investigators have scheduled domestic air carrier perspective. assisted the African continent with improving aviation safety. The The six ATOS system safety attributes are responsibility, author- United States Congress mandates that the NTSB promote aviation ity, procedures, controls, process measurements, and interfaces. safety across the world, and it would seem pertinent that the NTSB These attributes would capture areas of satisfaction and related would be an integral part in continuous aviation-safety-related im- areas of needed improvement within particular areas such as provement strategies. manual currency, flight operations, personnel and training, and On April 1, 1998, a “Safe Skies of Africa” program was initiated by compensatory rest requirements. Moreover, airlines would have the the U.S. Department of Transportation (DOT) and focused on avia- opportunity to utilize safety attribute inspections (SAIs) to deter- tion safety and airline security between the U.S. and nine African na- mine if their entire processes incorporate the six safety attributes, tions, including Angola, Mali, Namibia, and Tanzania. According to thus meeting the requirements of Africa’s Civil Aviation Agency statistics, most of the accidents in Africa are related to maintenance (ACAA), and then provide an assessment to the airline utilizing human factors (FAA, 2004). Since the FAA regulates the continuous elemental performance inspections (EPIs). These types of analysis analysis and surveillance of maintenance programs within the U.S., it and the associated results that are documented by the airlines and

ISASI 2009 Proceedings • 109 ISASI 2009 PROCEEDINGS 110 caus- threads” “common underlying the of awareness an of more inAfrica. After implementing this team inAfrica, there could be ment officials to reduce the rate of aircraft the incidents and accidents accident.TheCAST team could similar abe infrastructure from more information regarding the aviation-safety-related incident or providing by investigations incident and accident with aid could would seem most practical from the organizational standpoint and Africa in team similar a of development The ago. years 10 almost the reduction of aircraft accidents and incidents since its inception accidents within the and incidents aircraft of reduction the on focuses which (CAST), the organizationalsafetyculturemake-upofairline. any primary or final cause of an incident or accident depending on earlier, the safety culture could be a pivotal factor in determiningutilizing by followed the source is data process from this the inspections. if accident However, or incident the as stated of cause a shareinformation and assist “as needed” with helping determine investigation(s). incident or accident the with agency(s) applicable the assisting aid could ACAA the The U.S., teaming with industry partners and other related govern- • ISASI 2009 ISASI U.S. has implemented the Commercial Aviation Safety Team .S. investigators would have the opportunity to to opportunity the have would investigators U.S. Proceedings U.S. The CAST team has been very successful in .S. investigators when they proceed with with proceed they when investigators U.S.

investigator is“kickingtin.”◆ investigator in Africa but could reduce the amount of times the types of programs will present more challenges to the air safety tors with African-related air safety investigations; however, these rica’s air safety enhancement and could aid air safety investiga- Af- to essential be could programs of types similar or program, programs within the airline human-factors-related industry. enhance The CAST program, to AT OS need a is there programs, maintenance and programs operations industry’sflight airline world the within prominent remain to continue accidents and incidents human-factors-related Since considered. are safety organizational and culture safety as such factors other if rate crease the global percentage and could decrease Africa’s current and accidents. air-safety-relateddiscussand investigators meetincidentscould incidentsaccidentsingandAfrican withincontinent.the Team Federal Aviation Administration(FAA): SouthAfricaAviation Accidents,2004. National Transportation SafetyU.S. DepartmentofTransportation: “AfricaSafeSkiesInitiative,”1998. Board (NTSB): “Worldwide References Commercial Aviation Accidents Statistics,”2003. The reduction of incidents and accidents could possibly de- possibly could accidents and incidents of reduction The GUEST SPEAKER Caring for the Mental Health of Air Safety Investigators By Brian Dyer oday’s aviation industry possesses many challenges for air mutilated bodies, mass destruction, the stench of burnt flesh, and GUEST SPEA K ER safety investigators. Some of these challenges include, but aviation fluids at the scenes of these accidents. Tare not limited to, composite materials, jagged edged metals, In the search for the probable causes of these accidents, the environmental hazards, wildlife, blood-borne pathogens, parachute investigators are also required to conduct interviews with surviving systems, hazmat, and aviation fluids. Among all these challenges, participants, along with coworkers and the family members of the there is one that receives very little attention: the mental health deceased crew. It is also a common practice to listen to the cockpit aspects or mental preparation of air safety investigators voice recorders (CVRs) capture the last transmissions of the pilots’ The International Civil Aviation Organization conversation with air traffic control (ATC). In these final moments (ICAO) training guidelines for aircraft accident prior to impact, it is not uncommon to hear the vivid screams, investigators (Circular 298-AN/172, page 5) outcries, and panic among the crewmembers as they face certain recommends that investigators be trained in death on these doomed flights. All of these factors may contribute investigator safety, including psychological stress. to the accident investigator experiencing the effects of traumatic The accident site safety (Section 4.1.2.5, page 8) distress and other psychological symptoms if the coping skills of of that same document mandates that the subject that individual are overwhelmed. of dealing with the psychological stress of investigators and other It has been recognized that immediate intervention following personnel exposure to an accident site must be covered. This a traumatic experience will reduce the long-term impact of acute training does not imply that the investigators are trained to be stress and other psychological-related problems. In an attempt emotionally tough. It merely prepares them for what is anticipated to mitigate the psychological effects of the traumatic exposure, at an accident site. formal clinical interventions have been adapted. These interven- Aircraft accident investigators (AAI) generlly arrive at the tions include critical incident stress debriefing (CISD), critical scene of an accident after the emergency services person- incident stress management (CISM), crisis counseling (CC), and nel. However, there are instances where the investigators are resiliency management (RM). However, despite the popularity of exposed to the chaotic, traumatic, and emotional situations the many clinical applications to mitigate psychological distresses, at the scenes of accidents. While exposure to extreme psycho- there has been some controversy about how best to address the logical stressors does not always bring about negative reactions onset of exposure to the critical events. in aircraft accident investigators, there is empirical evidence Research from the International Critical Incident Stress Foun- that the exposure to these critical events does pose a challenge. dation (ICISF) demonstrated that more than 90% of individuals Understanding the cases in which the investigators allow an event involved in a traumatic event would develop some type of adverse to become a traumatic stressor is both important and essential for psychological effect. These psychological effects are enhanced by a diagnosis and to provide timely mitigation measures. number of risk factors that include, but are not limited to, previous Recently, the awareness of the psychological impacts of traumatic exposure, limited intelligence or awareness, limited social traumatic and critical events has increased, and post-traumatic support, genetics, prior mental illness, and problems associated with treatments have received considerable attention. This attention personal family life (Flannery, 1999). has brought greater interests in the events that are likely to In 1994, the American Psychiatric Association (APA) published lead to post-traumatic stress symptoms. Empirical evidence has a table of common symptoms of psychological trauma and post- found that post-traumatic stress symptoms may develop after a traumatic stress disorder. According to the table, those who are single exposure to a critical event. However, although clinical traumatized will develop symptoms that may include intrusive recol- procedures have been developed primarily for assisting first lections of the critical event, avoidance of the traumatic situation with responders, military personnel, and public safety employees a numbing of general responsiveness, and increased physiological (police, EMTs, firefighters) with symptoms of acute distress, there arousal. An individual experiencing substantial and long-lasting cog- is currently no specific program developed for intervention and nitive, emotional, behavioral, and physical change must be treated prevention of distress experienced by aircraft accident investigators immediately to prevent additional problems. It has been proven that (Coarsey-Rader, 1993). early intervention can greatly reduce the time and expense of the The traumatic effects of aircraft accidents on aircraft accident treatment process, as each individual may have a different reaction investigators have received very little attention since the primitive to the traumatic distresses (Flannery, 1999). However, individuals aviation days of early aviation enthusiasts and the Wright Broth- have a tendency to feel that asking for support is a sign of weakness ers. Aviation accidents are sometimes fatal, and aircraft accident and results in that person ignoring the side effects, which may have investigators often experience graphic exposure to severe injuries, irreversible effects.

ISASI 2009 Proceedings • 111 ISASI 2009 PROCEEDINGS regarding exposure to critical events must continue in earnest earnest in continue must events critical to exposure regarding respective programs. their of component critical a as services and/or training, vention, inter psychological early provide should investigating accident in involved personnel for training conducting institutions addition, In information. sensitive of flow the for channels communication organizationand training investigating teams todevelop effective course may include procedures to evaluate the resources within an traumatic events that are themost address likelyto requiredconditioning mentalto occurthe with tigatorsat accident sites. This O 112 - inves provide may that course pathogens blood-borne SHA’s In the interim, communication and educational awareness educational and communication interim, the In of that to similar package training a develop to prudent is It • ISASI 2009 ISASI Proceedings - becoming thesilentvictimsofdisasters.◆ awareness and training may result in the investigators themselves situations during the discourse of our duties, the failure to provide we cannot prevent exposure to these emotional and psychological throughout the aircraft accident investigating community. While Raymond B. Flannery, Jr. (1999). Psychological Trauma and Posttraumatic Stress International Civil Aviation Civil International Coarsey-Rader, C.V.,References and Rockwood, T. (1993) “Secondary Trauma and the Air Safety Disorder: A Review of Psychological Trauma and PTSD. June 2003. craft AccidentInvestigators.Cir. 298AN/172page5,8,Section4.1.2.5. Society ofAirSafetyInvestigators.Ottawa,Manitoba,Canada;ctober. Investigator.” Paper presented at the 14th Annual Seminar of the International ). Training(ICAO). Organization Air for Guidelines - GUEST SPEAKER Challenges to ASI Investigations By Murtaza Telya

viation safety investigators (ASIs) are undervalued and the crash was caused because the plane was on autopilot in icing berated quite often, but the fact of the matter is, ASIs are conditions, even though there were other factors involved, thus A crucial and intrinsic to commercial aviation. Being an undermining the official investigation and misinforming the GUEST SPEA K ER ASI can also be perilous at times; stepping into a hazardous area public (Learmount, 2009). Similarly, news media outlets such surrounded by debris and toxic fumes to investigate an accident as The Times of London and The Sun published many inaccurate can pose a serious threat, but it must be done to find the root articles related to the Air France Flight 4590 crash before the cause of an accident and to improve aviation safety. ASIs deserve investigation had concluded; they incorrectly speculated that the credit for improving air safety within the past decade. The average supposed cracking of the Concorde’s wings and metal fatigue in accident rate has dropped to only 1.6 per million the fan blade caused the accident (Johnson, 2003). Such misinfor- departures between 1998 and 2007 (Boeing, 2008); mation can be very harmful. The news media frenzy after airline however, there are still many issues that need to be accident in certain countries is so great that investigators in Russia addressed to improve global air safety, especially are compelled by the news media to finish their investigations for ASIs. Some of these issues are cultural factors, within a year, or else they are bound to face excessive scrutiny and detrimental news media coverage, and judicial and badgering (Bills, 2007). Finishing an investigation within a year legal duress. may sound efficient; but in many cases, gathering and analyzing The first issue that needs to be addressed is the role of evidence takes a long time, and sometimes excessive pressure can cross-cultural factors in accident investigations, particularly compromise the quality of an investigation. national cultural factors. Cultural factors are pivotal and have The last issue that needs to be mentioned is that of judicial and a significant impact on the methods of accident investigation legal duress. Legal and judicial authorities tend to complicate and the interpretation of events leading to an accident. All investigations because of their unnecessary interference and accident investigators don’t necessarily concur on the causes of unwarranted criminalization of aviation personnel involved in an an accident. For example, after the crash of Flash Airlines Flight accident. This needless meddling from legal authorities has become 604 in Egypt, the NTSB and the BEA concluded that both pilots increasingly prevalent, especially since the September 11 attacks. on the aircraft were insufficiently trained and attributed the ac- Judges and prosecutors constantly tend to seek criminal sanctions cident to human error; however, Egyptian authorities persistently against aviation personnel in the wake of accidents involving hu- disagreed with the assessment and stated that the plane crashed man error, even though the facts do not support the findings of because of a mechanical failure (Sparaco, 2006). Such biases can sabotage, criminal negligence, or willful misdemeanors (Quinn, impede the investigation if they are not tackled properly. These 2007). This has been illustrated in many accidents, such as Gol differences can be attributed to the fact that Egyptians tend to Airlines Flight 1907 crash, where the surviving pilots of the Embraer be more collectivist than Westerners, which means their society jet that crashed into the Gol aircraft were charged with involuntary is more integrated and cohesive and they don’t encourage indi- manslaughter, even though there is no evidence (Quinn, 2007). vidual reprobation (Staunch, 2002). Methodologies can differ The maintenance crew of the Concorde aircraft that crashed on from culture to culture as well. A recent study conducted on 16 July 25, 2000, experienced similar treatment from the French gov- Taiwanese and 16 British ASIs found that while Taiwanese investiga- ernment, which prosecuted four Continental Airlines maintenance tors focus on accidents in a holistic manner and try to understand crewmembers for manslaughter (Quinn, 2007). Such legal pres- how all the casual factors leading to an accident interact with each sures can have drastic ramifications for the ASI, since it discourages other, British investigators basically focus on preferred patterns of ex- personnel from providing accident information that would make planations and an object-oriented method of accident investigation; them susceptible to unnecessary prosecution. At times, prosecutors in other words, Eastern cultures use a holistic approach to investigate and judiciaries even tend to withhold valuable information from accidents while Western cultures use a more individualistic approach investigators; case in point, after the crash of a Cessna citation in (Li, Young, Wang, & Harris, 2008). These cultural conflicts become Rome on Feb. 7, 2009, Italian authorities confiscated the cockpit quite prevalent when international accidents occur, and one must and flight data records and refused to disseminate them to the learn to utilize the differences in culture to one’s advantage instead ASIs, in order to conduct their criminal investigation before the ac- of trying to eradicate them. cident investigation could be concluded (Flight Safety Foundation, Another prominent challenge that aviation investigators face is 2009). Authorities must realize that unless there is solid evidence detrimental news media coverage. News media attention can be of sabotage or criminal negligence, crucial evidence cannot be very cumbersome for investigators, since many news media outlets withheld from authorities and personnel cannot be incriminated tend to propagate conjuncture and incomplete reports; the news either, or else the investigation process will be hampered and safety media coverage of the Colgan Flight 3407 crash corroborates the will be compromised. aforementioned statement. News media reports propagated that Improper accident investigation is one of the primary causes of

ISASI 2009 Proceedings • 113 ISASI 2009 PROCEEDINGS 114 Bills,K. (2007, September). Accident investigations References still important. Aero safety to implementthem.◆ tions, but the only way to improve safety and enhance aviation is solu- quick-fix not are These investigation. accident an impede manner, and by urging authorities to change regulations that can disseminateaccident information responsibleina andaccurate cultural training, improving relations with news media outlets to with promptly and efficiently. They dealt must bebe solvedto byneed improvingissues These ASI. the for cumbersome be can news media coverage, and unnecessary regulatory andin the area legalof accident investigation, cultural duressfactors, detrimental poor safety, and even though there have been many advancements world. • ISASI 2009 ISASI Proceedings Staunch, B.(2002).InvestigatingHumanError:IncidentsAccidentsandCom- Sparaco, P. (2006,April4).SafetyFirst,Always.Aviation Week &SpaceTechnology. Quinn,K.P.(2007,January). Battling accident criminalization. FlightSafety Sci- the and Art The (2008). D. Harris, T.,and H.T.,Wang,Young, C., W. Li, L the of Role the in Study C.W.Case Johnson, A (2003). Flight Safety Foundation. (2009, February 26). Flight safety foundation criticizes Accidents. Airplane Jet Commercial of Summary Statistical (2008). Boeing. earmount, D. (2009, February 16). Colgan 3407, Icing, and Turboprops.andIcing, 3407, Colgan 16). February (2009, earmount,D. plex Systems.Burlington,VT, USA:Ashgate. Foundation AeroSafetyWorld. Halifax, NS,Canada. ence:Approaches ofAccident Investigation inDifferent Cultural Contexts. mount/2009/02/colgan-3407-icing-and-turbopro.html. Retrieved gla.ac.uk/~johnson/papers/ISSC2003/Media%20Final.htm. of Causes tion pressrelease. Founda- Safety Flight investigation. accident with interference prosecutorial Seattle, WA: Boeing. ajor Accidents. Retrieved Accidents. Major rh 7 20, rm http://www.flightglobal.com/blogs/lear from 2009, 17, March arch 19, 2009, from http://www.dcs.from 2009, 19, March edia in Reporting the the Reporting in Media - ISASI 2009 Pictorial Review Photos by Esperison Martinez ISASI 2009 PICTORIAL REVIEW

ISASI 2009 Proceedings • 115 ISASI 2009 PROCEEDINGS 116 • ISASI 2009 ISASI Proceedings ISASI 2009 PICTORIAL REVIEW

ISASI 2009 Proceedings • 117 ISASI 2009 PROCEEDINGS 118 • ISASI 2009 ISASI Proceedings