AeroSafety world
PILOTS TALK AUTOMATION Coping strategies AUTOMATION DISTURBED Causes AMS crash CONTROLLING FATIGUE Which approach is best PROFESSIONAL BEHAVIOR An NTSB examination LATIN SAFETY RENEWAL São Paulo gathering LIGHTNING STRIKES PROTECTION BY DESIGN
The Journal of Flight Safety Foundation JUNE 2010 BASS-Asia Business Aviation Safety Seminar-Asia
November 10–11, 2010 Changi Village, Singapore
Today’s best safety practices for the Asia Pacific region.
The rapid growth of business aviation in the Asia Pacific region represents opportunity for organizations and national economies.
As other regions have discovered, however, expansion is also a safety challenge. Fortunately, business aviation has already developed best practices that BASS-Asia can be applied in Asia Pacific.
is a new safety seminar, sponsored by four leading organizations to transmit practicable knowledge and techniques supporting safe flight.
To register or to see a preliminary agenda, go to
SINGAPORE
AVIATION AsBAA ACADEMY Asian Business Aviation Association President’sMessage Gentlemen’s Agreement
think it is time for us to be honest with ourselves. This isn’t a new idea. Many industries, includ- With all that is going on in the world today, is ing medicine, civil engineering, shipping and aviation safety really that much of a priority? mining, set their own standards and measure I find the answer to that depends on who you themselves by those criteria. It isn’t even a new ask.I If you put a television camera in the face of a idea in aviation. The bolts that hold the wing on politician or an airline CEO, then, of course, safety are built to an SAE standard. Airlines qualify for is the number one priority. But once we get past International Air Transport Association (IATA) that public reflex, to be honest with ourselves, we membership with an IATA Operational Safety Au- must admit that safety improvements are publicly dit, and corporate flight departments prove their mandated, but privately discouraged. The system is safety management system competencies with entering a new age, and it is time to adapt. an International Standard for Business Aircraft Take a look at how fatigue regulation is pro- Operations (IS-BAO) registration. gressing in the United States and Europe. Improved All of these are standards established by in- fatigue regulations have been a public priority dustry for industry. This type of standard setting since the Colgan Air accident near Buffalo, New will be central to our future. Why do such a thing? York, U.S., in early 2009 (ASW, 3/10, p. 20). But Because the industry has no real choice. the poorly concealed truth is that vital regulatory Today, many leading airlines go far beyond initiatives are hitting an economic wall. Regula- the minimum regulatory requirement. That is tions have costs that, in many countries, must be great, until another company does the regulatory offset by verifiable benefits. Aviation is now so minimum and threatens to run the others out of safe that there is little chance a new rule might business by undercutting them on costs. immediately prevent an accident and save a life. If an industry wants to raise safety standards, it This cost-benefit hurdle is not a U.S. anomaly. It is must do so jointly, and publicly, and it has to call out common in many countries around the world. those who refuse to go along. There has always been Of course, the same type of analysis doesn’t ap- a gentlemen’s agreement among airlines that they will ply to security regulations, and that leads to an odd not speak ill of another’s safety efforts, but those days situation. It is OK from a regulatory perspective to may soon be over. Clearly, some airlines maintain a spend a nearly infinite amount of money to keep a higher level of safety and it may be time to admit it. human life from being lost due to hostile action; it We are left with two choices: Set our own standards is not OK to spend money as freely to protect that and celebrate them, or risk having market pressures same life from the consequences of human error. erode standards to the regulatory minimum. This is a distinction not appreciated by those who have lost loved ones in accidents. We have to find new tools. The idea of using regulations to ensure safety is wearing thin. It is time for the industry to think hard about how safe William R. Voss it wants to be, and to establish the standards by President and CEO which it can be measured. Flight Safety Foundation www.flightsafety.org | AeroSafetyWorld | June 2010 | 1 AeroSafetyWorld
contents June2010 Vol 5 Issue 5 features
13 HumanFactors | Automation Complacency
18 CoverStory | When Lightning Strikes
13 24 SafetyCulture | Professional Behavior
28 FlightOps | Obscured by Fog
32 CausalFactors | Automation at Odds
37 SeminarsCASS | Back to Basics
40 HumanFactors | The Best Rest 18 46 StrategicIssues | Pan American Summit 24 departments 1 President’sMessage | Gentlemen’s Agreement
5 EditorialPage | Worst-Case Scenarios
7 SafetyCalendar | Industry Events
9 InBrief | Safety News
12 FoundationFocus | Mission Underwriters
2 | flight safety foundation | AeroSafetyWorld | June 2010 32 40
28
AeroSafetyWORLD telephone: +1 703.739.6700 51 DataLink | Australian Commercial Aviation Trends William R. Voss, publisher, FSF president and CEO [email protected] 54 InfoScan | Aircraft Hygiene J.A. Donoghue, editor-in-chief, FSF director of publications 57 OnRecord | Tail Strike Follows Bounced Landing [email protected], ext. 116 Mark Lacagnina, senior editor [email protected], ext. 114 Wayne Rosenkrans, senior editor [email protected], ext. 115 Linda Werfelman, senior editor [email protected], ext. 122 Rick Darby, associate editor [email protected], ext. 113 Karen K. Ehrlich, webmaster and production coordinator [email protected], ext. 117 Ann L. Mullikin, art director and designer [email protected], ext. 120 About the Cover Lightning poses challenges Susan D. Reed, production specialist to composite aircraft design. [email protected], ext. 123 © Adrian Jan Haeringer/iStockphoto Patricia Setze, librarian [email protected], ext. 103
We Encourage Reprints (For permissions, go to
www.flightsafety.org | AeroSafetyWorld | June 2010 | 3 SmartLanding_Ad:Layout 1 4/14/10 12:23 PM Page 1 SmartLandingTM
Safe’til you stop. Here are more statistics that are hard to ignore: runway excursions cost the aviation industry $900 million per year and account for 83% of runway fatalities. Honeywell’s new SmartLanding helps reduce the risk of runway excursions by alerting pilots during unstable approaches and long landings. Safe from start to stop. Together, SmartRunway™ and SmartLanding provide a powerful continuum of awareness from takeoff to landing.
SmartLanding is an easy software upgrade to Honeywell’s. Enhanced Ground Proximity Warning System (EGPWS). For details, visit Honeywell.com/runwaysafety. ©2010 Honeywell International Inc. Editorialpage
Worst-case Scenarios
ast year I bought a parachute, not and guiding the ’chute to a good land- uncontrolled manner, and that never because I wanted to jump out of a ing — but I also should physically work turns out well. In an emergency ver- perfectly good airplane, but just in my way through that process as much as sion of get-home-itis, pilots want to case my airplane suddenly was no possible while sitting in the cockpit. land normally, even when that seems Llonger perfectly good. For someone who has never wanted nearly impossible. I fly gliders most weekends, and my to jump out of any aircraft into thin In probably the most popular ac- Pilatus is a nice aircraft with decent air, it was a sobering process, but the cident of all time — if there can be such performance. I enjoy the sport and I benefit in coming to grips with the a thing — Chesley “Sully” Sullenberger have few safety concerns if I pay atten- reality of the event before it happens made an early decision that he would tion to what I’m doing. The one major is quite clear. destroy an aircraft in order to give his concern I do have is about the risk of I started to relate this thinking to passengers the best possible chance of a mid-air collision. Our club’s base is some of the accidents I read about and survival. Although he briefly sought just west of the Chesapeake Bay, north came to the perhaps unsurprising con- alternatives, he immediately turned of Baltimore, and a lot of north/south clusion that in many accidents pilots toward a survivable solution and didn’t traffic cruises through the area. Plus, had become so dedicated to landing on waver. there is always the threat of collision a runway they did not seriously consider So, this isn’t a complicated training with another glider while working the the idea that at some point, when things point or procedure, but rather a mental same thermal, even though our wari- started to go bad for whatever reason, exercise. Walk through a number of ness about that situation verges on they had to accept the fact that the emergency scenarios in your mind, paranoia. airplane was going to get bent, perhaps with a variety of situations and alter- When I bought the ’chute from Alan badly, and that the survival of those on natives, and get your head to accept Silver, a wise and experienced para- board had to be the sole focus of what the fact that, sometimes, bending the chutist and rigger, he talked with me in was done next. airplane is the better choice if everyone some detail about my approach to the When we learn to fly, we all practice walks away. ’chute. It is important, he counseled, forced landings; for the most part, that that I rehearse the act of bailing out of involves a total loss of power, and in my aircraft should it become crippled. that event, there is little question about The rehearsal should not only be in my priorities. But we see over and over mind — walking myself through the again tales of pilots losing engines and procedure of jettisoning the canopy, un- systems or experiencing onboard fires J.A. Donoghue buckling my five-point harness, getting that make flying difficult, at best, who Editor-in-Chief clear of the fuselage, pulling the ripcord end up impacting the ground in an AeroSafety World www.flightsafety.org | AeroSafetyWorld | June 2010 | 5 Serving Aviation Safety Interests for More Than 60 Years
Officers and Staff light Safety Foundation is an international membership organization dedicated to Chairman, Board of Governors Lynn Brubaker the continuous improvement of aviation safety. Nonprofit and independent, the President and CEO William R. Voss FFoundation was launched officially in 1947 in response to the aviation industry’s need General Counsel for a neutral clearinghouse to disseminate objective safety information, and for a credible and Secretary Kenneth P. Quinn, Esq. and knowledgeable body that would identify threats to safety, analyze the problems and Treasurer David J. Barger recommend practical solutions to them. Since its beginning, the Foundation has acted in the
Administrative public interest to produce positive influence on aviation safety. Today, the Foundation provides leadership to more than 1,040 individuals and member organizations in 128 countries. Manager, Support Services Linda Crowley Horger
Financial MemberGuide Chief Financial Officer Penny Young Flight Safety Foundation Headquarters: 601 Madison St., Suite 300, Alexandria, VA, 22314-1756 USA Accountant Misty Holloway tel: +1 703.739.6700 fax: +1 703.739.6708 Membership flightsafety.org Director of Membership and Seminars Kelcey Ostrega Seminar and Exhibit Coordinator Namratha Apparao Membership Services Coordinator Ahlam Wahdan
Business Development Director of Development Susan M. Lausch
Communications Member enrollment ext. 102 Director of Ahlam Wahdan, membership services coordinator [email protected] Communications Emily McGee Seminar registration ext. 101 Namratha Apparao, seminar and exhibit coordinator [email protected] Technical Seminar sponsorships/Exhibitor opportunities ext. 105 Director of Kelcey Ostrega, director of membership and seminars [email protected] Technical Programs James M. Burin Donations/Endowments ext. 112 Technical Susan M. Lausch, director of development [email protected] Programs Specialist Norma Fields Manager of FSF awards programs ext. 105 Aviation Safety Audits Darol V. Holsman Kelcey Ostrega, director of membership and seminars [email protected] Technical Specialist/ Technical product orders ext. 101 Safety Auditor Robert Feeler Namratha Apparao, seminar and exhibit coordinator [email protected] Library services/seminar proceedings ext. 103 International Patricia Setze, librarian [email protected] Regional Director Paul Fox Web site ext. 117 Karen Ehrlich, webmaster and production coordinator [email protected] Past President Stuart Matthews Regional Office: GPO Box 3026 • Melbourne, Victoria 3001 Australia Telephone: +61 1300.557.162 • Fax +61 1300.557.182 Founder Jerome Lederer 1902–2004 Paul Fox, regional director [email protected]
flight safety foundation | AeroSafetyWorld | June 2010 ➤ safetycalendar
JUNE 14–18 ➤ Human Error in Accident JULY 13–15 ➤ CAE Flightscape 2010 Users SEPT. 1–3 ➤ Dangerous Goods Inspector Prevention. Southern California Safety Institute. Conference. CAE Flightscape. Gatineau-Ottawa, Initial Training. U.K. Civil Aviation Authority San Pedro, California, U.S. Sharon Morphew, Quebec, Canada.
JUNE 15–17 ➤ Cabin Safety Workshop. U.S. JULY 19–23 ➤ IOSA Auditor Training. SEPT. 13 ➤ Airworthiness Surveyor Theory Federal Aviation Administration Civil Aerospace Argus Pros. Denver. John H. Darbo,
www.flightsafety.org | AeroSafetyWorld | June 2010 | 7 APPROACH-AND-LANDING ACCIDENT REDUCTION TOOL KIT UPDATE
More than 40,000 copies of the FSF Approach and Landing Accident Reduction (ALAR) Tool Kit have been distributed around the world since this comprehensive CD was first produced in 2001, the product of the Flight Safety Foundation ALAR Task Force.
The task force’s work, and the subsequent safety products and international workshops on the subject, have helped reduce the risk of approach and landing accidents — but the accidents still occur. In 2008, of 19 major accidents, eight were ALAs, compared with 12 of 17 major accidents the previous year.
This revision contains updated information and graphics. New material has been added, including fresh data on approach and landing accidents, as well as the results of the FSF Runway Safety Initiative’s recent efforts to prevent runway excursion accidents.
The revisions incorporated in this version were designed to ensure that the ALAR Tool Kit will remain a comprehensive resource in the fight against what continues to be a leading cause of aviation fatalities.
available NOW.
fsf member/academia us$95| non-member us$200 Special pricing available for bulk sales.
Order online at flightsafety.org or contact Namratha Apparao, tel.: +1 703.739.6700, ext.101; e-mail: apparao @flightsafety.org. Safety News inBrief Data Fusion Directions
imely warnings to global avia- operational quality assurance (FOQA) tion leaders about low-frequency, programs at 12 of 30 ASIAS-participating Thard-to-identify safety threats airlines now can be matched to 17,000 soon will be routine, say leaders of the de-identified reports from 30 aviation U.S. Commercial Aviation Safety Team safety action programs and some of 44 (CAST) and the U.S. Federal Aviation other databases (ASW, 5/08, p. 25, and Administration (FAA) Aviation Safety 8/09, p. 32), they said. In one example, Information Analysis and Sharing Pro- flight crew noncompliance with resolu- gram (ASIAS). tion advisories from traffic-alert and ASIAS plans to share high-level collision avoidance systems (TCAS) hazards and trends — and to exchange improved from 2.0 percent to 0.5 parameters, aggregate data and analyti- percent in 10 months at one airline. cal protocols such as database-fusion ASIAS priorities include tools “to techniques —while CAST develops help target resources in the future if and refines safety enhancements, said current solutions are not effective” and a © Ralf Hettler/iStockphoto.com Margaret Gilligan, briefing journalists robust “vulnerability-discovery capabil- in mid-June as government co-chair of ity” to detect unsafe changes during of separation during standard instru- CAST and the ASIAS executive board, transition to the Next Generation Air ment departures with area navigation along with Don Gunther, industry co- Transportation System, Pardee said. (RNAV) off-the-runway procedures on chair of CAST and the ASIAS executive CAST uses ASIAS capabilities closely spaced parallel runways; run- board; and Jay Pardee, director of the to revisit safety enhancements, such way excursions; high-energy rejected FAA Office of Aviation Safety Analyti- as those for pilot interaction with takeoffs; unstabilized approaches; and cal Services. aircraft automation, mode confusion further study of non-safety-critical De-identified data archived from and energy-state awareness, Gunther TCAS alerts, Pardee said. 7.2 million flights captured by flight added. ASIAS lately has tackled loss — Wayne Rosenkrans
Charity Flights
ilots who conduct charitable medical flights should be The NTSB cited four fatal accidents in 2007 and 2008 that required to present proof of their currency before every involved charitable medical flights. In each case, the NTSB said Pflight, the U.S. National Transportation Safety Board that the probable cause of the accident involved either improper (NTSB) says. pilot decision making, a pilot’s spatial disorientation or a lack of The NTSB told The Air Care Alliance — a league of instrument currency. humanitarian flying organizations whose volunteer pilots “The NTSB is concerned that these pilots did not provide conduct public benefit flights for disaster relief, patient the passengers with the basic level of safety that passengers in transport and other public service missions — that it should these circumstances have a right to expect,” the NTSB said. require voluntary pilot organizations to verify pilot currency. U.S. Air Force These organizations operated under U.S. Federal Aviation Regulations Part 91, “General Operating and Flight Rules,” and were not subject to oversight by the U.S. Federal Aviation Administration. Other recommendations called on the alliance to require voluntary pilot organizations to tell their passengers that their charitable medical flights are “not conducted under the same standards that apply to a commercial flight” and to require them to implement written safety guidance to address “at a minimum, aeronautical decision making; proper preflight planning; pilot qualification, training and currency; and self- induced pressure.”
www.flightsafety.org | AeroSafetyWorld | June 2010 | 9 inBrief
En Español ‘Loose Equipment’ Crash Kills Mining Officials
Spanish he U.S. Federal Avia- transla- tion Administration Ation of T(FAA), citing a recent AeroSafety fire in a Mitsubishi MU- World is 2B, has warned aircraft now avail- owners and operators of able on the “potential hazards and Flight Safety airworthiness concerns” Foundation associated with loose Web site, at equipment in the cockpit
Engine Inspections
iting four recent uncontained engine failures, the U.S. Nation- Brazil, on March 26, 2009; a Jett8 Cargo Boeing 747-200F climb- al Transportation Safety Board (NTSB) is calling for immedi- ing through 7,000 ft above ground level after takeoff from Changi, Cate blade borescope inspections of low-pressure turbine stage Singapore, on Dec. 17, 2009; and an ACT Cargo Airbus A300B4 3 disks on General Electric (GE) CF6-45/50 turbofan engines. accelerating for takeoff at Manama, Bahrain, on April 10, 2010. The inspections should be repeated at specific intervals No injuries were reported in any of the events. Investiga- until the disk is redesigned and the new version is installed, the tions of all four events are continuing.
NTSB said in a letter to Randy Babbitt, administrator of the Wikimedia U.S. Federal Aviation Administration. Investigations of the engine failures have found that the disk “can fail unexpectedly when excited by high-pressure rotor unbalance vibration resulting from localized high-pressure tur- bine blade material loss,” the NTSB said. “A turbine disk failure can release high-energy engine debris capable of damaging an airplane and endangering its passengers.” The NTSB said that, although the failure mode was identi- fied in the 1970s, the first uncontained failure occurred in 2008 in a Saudi Arabian Airlines (Saudia) Boeing 747-300 after takeoff from Jeddah. The other failures involved an Arrow Cargo McDonnell Douglas DC-10F about 30 minutes after takeoff from Manaus,
10 | flight safety foundation | AeroSafetyWorld | June 2010 inBrief
Crash Kills Mining Officials
he entire board of Sundance Resources, an Australian min- ing company, has been killed in the crash of a chartered TCASA 212 in the Republic of Congo. The company said that all 11 people in the airplane, includ- ing six Sundance officials, were killed in the June 19 crash in a mountainous area near the border with Gabon; the airplane had been flying from Yaoundé, Republic of Cameroon, to Yangadou, Republic of Congo. The wreckage was found June 21. News reports said that an investigation into the cause of the crash was continuing. Sundance said that its officials had been visiting the com- pany’s Mbalam iron ore project in Cameroon and Congo and meeting with government representatives from both countries. The airplane was operated by Aero Service, which — along with all other air carriers certified in the Republic of
Congo — is named on the European Union (EU) “blacklist” © Fotero/Flickr of air carriers prohibited from operating in the EU because of safety concerns. operators work in areas with inadequate infrastructure and Flight Safety Foundation earlier this year launched its inconsistent safety standards, and before the BARS program Basic Aviation Risk Standard (BARS) program, aimed at was introduced, resource companies had no clear industry establishing common safety standards for aviation operators benchmarks for evaluating the safety of operators hired to that serve the mining and resources industry. Many of these transport their employees.
NextGen Milestones In Other News …
he U.S. Federal Aviation Administration has reached fficials from the European what FAA Administrator Randy Babbitt calls a major Union and the Latin American Tmilestone in developing the Next Generation Air OCivil Aviation Commission have Transportation System known as NextGen. signed two joint declarations calling for Babbitt referred to the FAA’s announcement of increased cooperation between the performance requirements for the aircraft tracking two regions. They agreed to identify equipment that will be required under NextGen. The more specific actions before the end of avionics will enable increased accuracy in controlling and 2010. … Earl Weener, a Flight Safety monitoring aircraft with automatic dependent surveil- Foundation fellow and former chief © James Thew/iStockphoto.com lance–broadcast (ADS-B). Aircraft in some airspace will engineer at The Boeing Co., and Mark be required to broadcast their positions via ADS-B Out capability by 2020. Rosekind, chief scientist and president Babbitt noted that the technology “represents another step forward in our abil- of Alertness Solutions, a fatigue manage- ity to make America’s skies the safest in the world.” ment consulting firm, have been sworn The U.S. Transportation Department Office of Inspector General, however, said in as members of the U.S. National that “a number of critical actions” are required to successfully implement NextGen. Transportation Safety Board. … Aus- “Among them, and perhaps most important now, is setting realistic expectations tralia has allocated AU$14.5 million for and firm requirements for what can be achieved in the mid-term and assessing associ- transport safety authorities to continue ated risks,” the Inspector General’s Office said in a report issued in mid-June. “Thus their efforts to help strengthen aviation far, FAA has not fully leveraged partner agencies’ existing research and development safety in Indonesia. Their work is that could significantly enhance NextGen development and reduce costs. While FAA aimed at improving the enforcement of has made some progress in engaging the private sector to develop NextGen and shape higher safety standards in Indonesia’s related policies, it must … ensure demonstration projects are more outcome-focused.” aviation and maritime sectors.
Compiled and edited by Linda Werfelman.
www.flightsafety.org | AeroSafetyWorld | June 2010 | 11 FoundationFocus
The Foundation would like to give special recognition to our Benefactor, Patron and Contributor members. We value your membership and your high levels of commitment to the world of safety. Without your support, the Foundation’s mission of the continuous improvement of global aviation safety would not be possible.
benefactors
Snecma
patrons
contributors
12 | flight safety foundation | AeroSafetyWorld | June 2010 HUMANFactors
Experienced airline pilots have evolved strategies against automation complacency.
BY HEMANT BHANA Trust but Verify utomation refers to control of and monitoring, while others are almost delivers the car to the desired location a process or system by a ma- completely independent. For example, and opens the doors when appropriate — chine or electronic device. Each entering an elevator car and selecting the all with minimal operator involvement. automated system requires a desired floor requires minimal monitor- Human-machine researchers have de- differentA level of monitoring by the user. ing. Once the operator selects a floor, fined eight levels of automation, ranging
© Chris Photography Sorensen Some require extensive operator input the elevator starts a complex process that from systems where the operator must
www.flightsafety.org | AeroSafetyWorld | June 2010 | 13 humanfactors
do everything with little help from the automation boredom study contained several open-ended to those where the automation does everything, questions to pilots about how they perceived the ignoring the operator.1 In aviation, automation automation and what individual coping strategies designed for pilots falls in the middle of this they used in connection with it. One of the spectrum. This automation level “executes the sug- The sample group of 273 airline pilots was gestion automatically, then necessarily informs the roughly 4.5 percent of the total pilot population dominant themes human.”1 Aviation’s position along the spectrum in the major airline from which the sample was has fluctuated over time as avionics and airplane drawn. Each pilot was experienced in a highly that emerged systems have advanced. Compare an early model automated aircraft. The bulk of the sample group was a wide- Boeing 727 with the new Boeing 787. The 727, — 54.4 percent — were between the ages of 41 introduced into airline service in 1964, required and 50, with the next highest group — 28.1 per- ranging lament extensive pilot involvement and contained modest cent — between the ages of 51 and 60. Thirty-six automation. This level of automation tasked the percent flew wide-body aircraft internationally. about the effect pilots with computing almost every performance Finally, 76.8 percent had flown their airplane type and navigation solution. In comparison, the 787’s for more than two years — which, significantly, of automation advanced flight management system (FMS) can allowed time for the pilots to become comfortable on maintaining compute solutions far more accurately than a in it and establish individual automation attitudes human can, and is more in line with the machine and coping strategies. hand-flying skills. performing the actions while advising the operator. As automation has gained in sophistication Attitudes About Automation and systems integration, the role of the pilot has One of the dominant themes that emerged from shifted toward becoming a monitor or supervisor the question about automation in general was a of the automation. Instead of actively controlling wide-ranging lament about the effect of automa- many of the processes, pilots are increasingly tion on maintaining hand-flying skills. tasked with evaluating the computed solution and Of the 105 responses to this question, 33 either stopping automated control or allowing it percent indicated that a degradation of tradi- to continue. The paradigm shift is significant, as tional flight skills is a significant issue in their it requires a different pilot skill set to be added to daily flying, including how they deal with in- the traditional “stick and rudder” skills. creasingly complex aircraft and operations. One Pilots now need to learn new coping and pilot wrote, “As I hand-fly less, I become more automation management techniques to quickly dependent on the automation.” Another pilot and accurately interpret the high volumes of described a side effect of automation dependen- automation-generated data in real time and turn cy: “When the automation screws up, trying to them into useful information. The trend on the play catch-up is hard to do because most pilots level of automation will continue in only one have relaxed too much and are not 100 percent direction. With the proliferation of automation- in the loop as to where they are.” Yet another centric technologies such as RNP/AR (required wrote, “Too many of my co-pilots fly with auto- navigation performance/authorization required),2 mation way too much. Their skills suffer from any idea of “un-automating” aircraft will not be not hand-flying as much as they should.” practical if the aviation industry is to meet its A pilot said, “As experience levels decrease goals of increased airspace system capacity, noise overall in many companies, the automation mitigation and carbon-emission reduction. and the decrease in ‘hand-flying’ training will Measuring pilot attitudes about automation continue to kill crews and passengers.” One pilot and collecting information about automation described the role change: “It has forced us to coping strategies were part of a study by the author become system monitors more than pilots. I on how boredom affects automation complacency must force myself to be actively engaged. Huge in modern airline pilots.3,4 The survey used in the decrease in job satisfaction.”
14 | flight safety foundation | AeroSafetyWorld | June 2010 HUMANFactors
A pilot summed up the unwanted ef- automation mode transitions were so he looks also.” This strategy effectively fect of automation: “I am a line check air- reported to be a frequent error source moves automation operation out of the man with 36 years in high-performance resulting in specific coping strategies. automatic-task domain, where opera- jets. The majority of pilots that I fly with One pilot spoke of “treating the au- tion occurs subconsciously, into the high do not back up the automation with raw tomation like a bad copilot and watching cognitive processing area of conscious data. Basic airmanship has dropped out everything the airplane is doing while thought. of the training program. This is reflected in ‘transitional’ mode.” Another said, Of all the comments by pilots, by complacency on the flight deck and an “Trust but verify, pay attention to detail, enhanced vigilance brought about by unwarranted trust in the automation.” expect the unexpected, be suspicious suspicions about reliability was the most The level of trust that a pilot can when things are going too smoothly.” common. A pilot commented, “I never place in automated systems emerged Several pilots reported consciously trust automation for altitude capture. I as an issue in roughly 16 percent of verbalizing automated modes as a means assume it is going to fail.” Another pilot the 105 responses on the subject. One of heightening their vigilance and auto- said, “I think it is very important to have principal factor that influences the level mation situational awareness. They ex- personal cross-check and habit patterns of trust is the perceived reliability of the pressed this in such comments as: “With where you program the FMS or MCP system in question.5–7 every button push, whether FMC [flight [mode control panel] and then verify management computer] or autoflight, a on the FMA [flight mode annunciator]. Mistrusting Automation confirmation is made verbally”; “Audible I don’t think SOPs [standard operating Reflecting on this issue, one pilot said, “I callouts, point and say”; “Verification for procedures] do enough. Some pilots are use automation but I don’t trust it.” Other the other pilot, verbalizing what I ob- very good at cross-checking, and some pilots echoed this sentiment in comments serve”; and “Verbalize to the other pilot don’t perform it at all.” such as, “I try never to totally trust the automation, and I make every attempt to verify that the automation is doing what I expect.” One pilot reported treating automation as if it were “a student pilot.” Another pilot’s attitude toward automa- tion was to “very seldom let the aircraft automation fly the approach.” The level of trust guides the level of automation usage when the complexity of a system or time available prevents complete understanding of the nuances of an automated system. By deliberately mistrusting the automation, pilots bias their attention toward actively monitor- ing the automated system rather than assuming correct operation and focusing attention elsewhere. Many pilot com- ments reflected that the perceived reliability of the automated system directly affected the trust they had in that system and their level of vigilance. In situations prone to automation errors — in other words, poor reliability — the trust decreased, leading to increased
© Chris Photography Sorensen vigilance and monitoring. For example,
www.flightsafety.org | AeroSafetyWorld | June 2010 | 15 humanfactors
Skepticism about automation led to display symbol that shows where the high cognitive processing, which forces various pilot coping strategies. aircraft will reach the selected altitude].” a pilot to think through each individual The benefits of such pilot strategies interaction with the automation. Inter- Automation Degradation include less boredom and more vigi- estingly, the task that requires the great- and Hand Flying lance, that is, maintaining attention for est amount of high cognitive function is Instead of trusting the automation long, uninterrupted periods.8 Conven- monitoring items such as aircraft status.9 always to work as advertised, many of tional theories on why vigilance suffers To lower the level of mental pro- the pilots in this study deliberately used over time — the decrease begins after cessing required, many pilots choose to less-complex alternative automation approximately five minutes — used to hand-fly at times when they could rely modes or different techniques to achieve revolve around the monotony of the ac- on the automation. One pilot summed the same result and remain actively en- tivity. Recently, cognitive scientists have up this concept: “The more compli- gaged in the flight. One pilot said, “I like determined that vigilance varies directly cated the ‘button pushing’ becomes, the to use different modes of automation to with the complexity of the task.7 The sooner I disconnect the auto systems, monitor the progress of the flight. For more cognitively demanding a task is, including the autothrottles.” Another example, on the B-737, one can engage the more likely the user is to “load shed” wrote, “When I become task saturated the autopilot without the flight director and assume correct automation opera- with programming automation, I click on, using ‘control wheel–steering’ and tion instead of allocating the necessary off the autopilot and fly the airplane!” pitch. I’ll use these modes to ‘capture’ the mental resources to monitor it. The data in this survey support programmed VNAV [vertical naviga- Compared to hand-flying an aircraft, the anecdotal comments. Of the entire tion] and LNAV [lateral navigation] reading, interpreting and acting on sample group, 85.3 percent hand-fly modes while monitoring the FMAs on automation-related information is a as much as possible, consistent with the electronic attitude direction indica- far more cognitively intensive process. weather and fatigue factors. Only 17 re- tor. This requires more of my attention, Cognitive scientists consider reading spondents in the survey sample, or 6.2 is more ‘hands on’ and thus keeps my and interpreting information a high percent, turned the automation on as situational awareness at a high level.” cognitive task and hand-flying an auto- soon as possible after takeoff, while 33 Other remarks added to the theme matic task. In the automatic-task realm, pilots, or 12.1 percent, kept the automa- of downgraded automation usage. For manual control occurs at a subconscious tion on as long as possible. Pilots who example, “Very rarely do I let VNAV level, can occur in parallel with other chose to hand-fly preferred varying descend the plane. I will use vertical activities and can occur very rapidly. For autopilot engagement and disengage- speed or level change”; “I fly with the example, if airline pilots need to adjust ment altitudes (Table 1). flight directors off to stay mentally pitch attitude during a hand-flown ap- sharp and in the game. Also, autoflight proach, they do not need to go through Embracing Traditional Skills and autothrust are off a lot, too”; and “I the entire decision-making process — Despite their highly automated fleet, prefer VSPD [vertical speed] to VNAV the correction occurs subconsciously pilots surveyed often suggested a deliber- for descents, utilizing the green arc [a and automatically. Contrast this with ate embrace of traditional aviation skills.
Altitudes Chosen for Engaging and Disengaging Autopilot
Autopilot selected 5,000 ft AGL 10,000 ft AGL FL 180 FL 250 FL 290 Cruise Altitude ON after departure 2.4 percent (6) 6.9 percent (17) 49.0 percent (120) 18.8 percent (46) 5.7 percent (14) 17.2 percent (42) N = 245 Autopilot selected FL 290 FL 180 15,000 ft 10,000 ft AGL 5,000 ft AGL 3,000 ft AGL OFF during arrival 2.6 percent (6) 9.1 percent (21) 9.5 percent (22) 30.7 percent (71) 25.1 percent (58) 23.0 percent (53) N = 231
AGL = above ground level; FL = flight level Note: Percentages are based on a survey of pilots at one U.S. air carrier.
Source: Hemant Bhana
Table 1
16 | flight safety foundation | AeroSafetyWorld | June 2010 HUMANFactors
Many said they are refocusing on their The pilot also uses them as a reminder airline- and airplane-specific training, manual skills and leveraging their experi- to check other automation-generated reflecting the experience gained and les- ence in less-automated airplanes to help solutions: “Cross-check and confirm sons learned after years of daily usage. them cope with the advanced automa- glass [navigation display] and switch tion. According to the pilot observations, selection with clearance. Tie existing Notes an effective strategy has been to apply habits in with new automation require- 1. Sheridan, T.B.; Parasuraman, R. (2006). traditional skills as a backup to the au- ments such as checking ACARS [air- “Human-Automation Interaction.” Human tomation. One pilot said, “I call it flying craft communications and addressing Factors and Ergonomics, pp. 89–129. the autopilot. I don’t work as much when system] ‘howgozit’ [an automated print- 2. RNP/AR is the International Civil watching the flight director bars as I do out tracking waypoint arrival times and Aviation Organization (ICAO) termi- watching the words and mode changes fuel burn] reasonableness along with nology for an RNP approach designed and approved according to U.S. Federal along with the mode control panel and fuel balance, RVSM [reduced vertical Aviation Administration Order 8260.52 or mode settings/requested changes.” separation minimums] altimeter check the ICAO RNP/AR manual. One pilot recalled a lesson from (all three), and FMC waypoint clear- 3. Bhana, H.S. (2009). “Correlating Boredom instrument training: “At every point the ances — all done at the same time.” Proneness With Automation Complacency aircraft changes course, speed or alti- in Modern Airline Pilots.” Unpublished tude, such as waypoints or TOD [top Crew Resource Management master’s thesis. Grand Forks, North of descent] points, I do a ‘six T’ check. One of the more common threads in the Dakota, U.S.: University of North Dakota. Time — is it accurate to the plan? Turn comments by the 273 pilots surveyed 4. Bhana, H.S. (2010). “Correlating Boredom — what direction and NAV [navigation] involved effective crew resource manage- Proneness and Automation Complacency mode? Throttles — are the autothrottles ment in coping with the challenges of in Modern Airline Pilots.” Collegiate behaving as planned? Twist — is there automation. In addition to verbalizing Aviation Review 28 (1), pp. 9–24. something that needs to be programmed, automation mode changes, many pilots 5. Prinzel, L.; DeVries, H.; Freeman, F.; such as the missed approach altitude at in the sample deliberately sought confir- Milulka, P. (2001). Examination of glide path intercept on the ILS [instru- mation and clarification from the other Automation Induced Complacency and ment landing system]? Track — what pilot about automation-related actions. Individual Difference Variates. Hampton, Virginia, U.S.: National Aeronautics and course am I tracking to, is NAV engaged This technique is useful in keeping both Space Administration Langley Research correctly? Talk — is there a checklist the pilots aware of the current and impend- Center. crew needs to run, is there a call to ATC ing actions of the machine, and provides 6. Lee, J.; See, K. (2004). “Trust in [air traffic control], is there a frequency an effective safety net against possible in- Automation: Designing for Appropriate that needs to be preloaded in the radio?” put errors. Moreover, this technique fos- Reliance.” Human Factors 46 (1), pp. 50–80. Many pilots referred to the funda- ters open communication on the flight 7. Bailey, N.; Scerbo, M. (2008). “Automation mentals of flying in their comments deck and enhances situational aware- Induced Complacency for Monitoring regarding individual coping strategies. ness. Pilots said, “If I’m unsure why the Highly Reliable Systems; the Role of One wrote: “Cross-check left, right and airplane is doing something, I make sure Task Complexity, System Experience, center instruments. Read aloud FMAs, to verbalize it to the other pilot”; “Verify and Operator Trust.” Theoretical Issues in assigned climb and descent altitudes. FMS with the other pilot every time a Ergonomics Science 8 (4), pp. 321–348. Engage autopilot to improve monitor- change is made”; and “Confirm proper 8. Sawin, D.A.; Scerbo, M.W. (1995). ing ability. Disengage and hand-fly programming with the other pilot.” “Effects of Instruction Type and Boredom whenever I can’t immediately resolve Proneness in Vigilance: Implications for Boredom and Workload.” Human Factors why it’s not doing what I want it to do.” Addressing the Downside 37 (4), pp. 752–765. Many pilots seem adept at blending The comments from this sample group non-automated habits with automated indicated strong coping mechanisms 9. Dismukes, R.K.; Loukopoulos, L.D.; Jobe, K.K. (2001). “The Challenges of Managing flight control. One pilot described and good automation habits to address Concurrent and Deferred Tasks.” Proceedings using traditional methods of verifying the downside of advanced automation. of the 11th International Symposium on waypoint arrival times and fuel burn to Many of the pilots said they devel- Aviation Psychology. Columbus, Ohio, U.S.: compare with the automated solutions. oped these strategies independently of Ohio State University. www.flightsafety.org | AeroSafetyWorld | June 2010 | 17 Coverstory
When Lightning
Aircraft designs incorporate systems to Strikes protect against direct and indirect damage. BY CLARENCE E. RASH
18 | flight safety foundation | AeroSafetyWorld | June 2010 coverStory
nderstanding the mechanisms and usually the only part of the lightning process consequences of lightning strikes on that is actually seen. aircraft has been a decades-long learning Another type of lightning — known as experience. “positive lightning” because there is a net UWhen the first known lightning-caused transfer of positive charge from the cloud to airplane accident occurred in 1929, scientists the ground — originates in the upper parts of and aeronautical engineers initially insisted that a thunderstorm, where a high positive charge When Lightning lightning played no part in the crash — and that resides. This type of lightning develops almost there was “no proved instance of an airplane ever the same way as negative lightning, except that having been struck by lightning.”1 Over time, the the descending stepped leader carries a positive experts of the 1920s were proved incorrect — air- charge and the subsequent ground streamer has Strikes craft lightning strikes occur frequently, although a negative charge. Positive lightning accounts for they rarely are associated with accidents. less than 5 percent of all lightning but is much Lightning is a discharge of electricity that more powerful, lasts longer and can discharge at occurs in the atmosphere and can be thought of greater distances than the more common nega- as a high-current — about 20,000 amperes — tive lighting. electric spark associated with thunderstorms. Lightning is produced when supercooled Global Pattern liquid and ice particles above the freezing level Lightning is a global phenomenon. Flashes collide and build up large and separate regions have been seen in volcanic eruptions, intense of positive and negative electric charges in the forest fires, heavy snowstorms and large hur- clouds. After these charges become large enough, ricanes; however, it is most often associated with a giant “spark,” or discharge, occurs between thunderstorms.2 them, lasting less than a tenth of a second. The While global in occurrence, lightning is not spark — lightning — can occur between clouds, uniformly distributed geographically. About 70 between sections of a single cloud, between percent of all lightning flashes occur between the cloud and air, or between the cloud and the 30 degrees N and 30 degrees S latitudes — not ground — or some object on the ground. surprisingly, in the tropics, where most thunder- The most common type of lightning storms occur. In addition, lightning over land, discharge is cloud-to-ground, or “negative” or over water that is close to land, is 10 times lightning, which accounts for 90 percent of all more frequent than lightning over oceans.3 lightning strikes. The discharge usually begins when a significant difference develops between Every 1,000 Flight Hours the negative charge in the cloud and the positive Until the past decade, when information-gathering charge on the ground — or in another cloud. At became more effective, detailed data on lightning this point, the negative charge begins moving to- strikes to aircraft were difficult to obtain.4 ward the ground, forming an invisible conduc- However, when the extraordinary frequency tive path, known as a leader stroke. This leader of lightning is considered in concert with the fre- stroke descends through the air in discrete quency of flight — estimated at 77 million aircraft zigzag steps, or jumps, each approximately 150 ft movements worldwide in 20085 — it can be no (46 m) long. Concurrently, a positively charged surprise that aircraft lightning strikes occur rela- streamer is sent out from the positively charged tively often. The French Office National d’Etudes ground or other cloud. When the leader and the et Recherches Aérospatiales (the national aero- streamer meet, an electrical discharge — light- space research center) estimates that an aircraft is ning — takes place along the streamer, up and struck by lightning on average every 1,000 flight into the cloud. It is this return stroke that is the hours — for commercial airlines, the equivalent of
© Mathieu Pouliot/Jetphotos.net most luminous part of the lightning discharge, one strike per aircraft per year (Table 1, p. 21).
www.flightsafety.org | AeroSafetyWorld | June 2010 | 19 Coverstory
Based on these searches, the first aviation accident attributed directly to a lightning strike occurred Sept. 3, 1915, when a German Zeppelin LZ40 (L10) was destroyed by a lightning strike while venting hydrogen gas off Neuwerk Island, Germany.8 From 1915 through the early 1920s, a number of airship accidents were attributed to lightning strikes.
© Joe Cavallo/Airliners.net The Sept. 3, 1929, crash of a Transconti- Scientists estimate While more study is needed, current evidence nental Air Transport Ford Tri-Motor named the that aircraft are points to altitude as a factor in lightning strikes. “City of San Francisco” usually is cited as the first struck by lightning on Current data show there are more lightning heavier-than-air aircraft destroyed by a lightning average once every strikes at intermediate altitudes (8,000–14,000 ft) strike. All eight occupants died when the airplane 1,000 flight hours. than at cruise altitudes.6 Other leading factors in struck the ground near Mt. Taylor, New Mexico, the probability of a lightning strike include being U.S., on the Albuquerque-to-Los Angeles leg of a inside a cloud (90 percent) and/or the presence of cross-country journey divided into airplane and rain (more than 70 percent). train segments.9 An aircraft lightning strike is often attributed Over the next few decades, only a dozen or so to “being in the wrong place at the wrong time” additional accidents were attributed to lightning — in other words, getting in the way of a lightning strikes; in many of those cases, however, lightning discharge. But estimates are that such a scenario was not firmly established as the cause. accounts for only 10 percent of aircraft lightning The earliest lightning-related accident for strikes. Actually, almost 90 percent of aircraft light- which a detailed description is available involved ning strikes are self-triggered, as when an aircraft a U.S. Air Force Curtiss C-46D transport plane flies through a heavily charged area of clouds — a en route from Dallas to Jackson, Mississippi, U.S., fact not known until the 1980s.7 on June 14, 1945. While at 3,000 ft, one wing was Fortunately, although aircraft lightning struck by lightning. Unable to maintain altitude, strikes are not uncommon, accidents in which the aircraft crashed into a wooded area.10 lightning has been identified as a primary or Nearly two decades later, in what often is cit- contributing cause are. ed as the first positive lightning strike-induced Searches of accident databases and histori- accident involving a commercial aircraft, a cal records maintained by various aviation Pan American World Airways Boeing 707-121 agencies, historical societies and lightning crashed on Dec. 8, 1963, while in a holding pat- safety organizations produce a diverse listing tern awaiting clearance to land in Philadelphia and history of incidents and accidents that after a flight from Baltimore. Accident investi- have been attributed to lightning strikes. gators determined that the lightning strike had
20 | flight safety foundation | AeroSafetyWorld | June 2010 coverStory
ignited fuel vapors. As a consequence of the • The July 23, 1973, crash of an Ozark Air- ensuing investigation by the U.S. Federal Avia- lines Fairchild FH227B in St. Louis, which tion Agency — a precursor of the Federal Avia- killed 38 and injured six passengers and tion Administration (FAA) — devices known crew. A lightning strike on final approach as lightning discharge wicks were ordered to be was cited as a probable cause.13 Of the 41 reports installed on all commercial jet airliners. The U.S. National Transportation Safety Also among the 202 fatalities was an aircraft mar- involving a confirmed Board (NTSB) Accident/Incident Database shaller who was wearing a headset connected to a from Jan. 1, 1962–April 30, 2010, included 58 McDonnell Douglas DC-9-31 when it was struck lightning strike that events in which lightning — but not necessar- by lightning on Oct. 7, 1989, while being pushed ily a lightning strike — was cited as a major or back from a gate in preparation for takeoff from resulted in an accident contributing causal factor. All of the reports Orlando International Airport.14 or an incident, 28 involved commercial or private aircraft, with the Of the 41 reports involving a confirmed 11 exception of one accident involving a balloon. lightning strike that resulted in an accident or aircraft — 68 percent In those 58 reports, the role of lightning is an incident, 28 aircraft — 68 percent — landed categorized as follows: safely. All sustained at least minor damage. — landed safely. • Forty-one events involved actual lightning Lightning Effects strikes to an aircraft during flight. Both the occupants of an aircraft and the • Two events involved an aircraft while on aircraft itself are subject to the powerful effects the ground. One airplane was struck by of a lightning strike. The inherent structural lightning, and the other was involved in a design of an aircraft provides the occupants taxiway accident attributed to a commu- almost complete protection despite the massive nication breakdown after ground person- amount of current involved. This protection is nel removed their headsets because of based on the principle known as the Faraday lightning in the area. • Five events involved nearby lightning strikes that impaired either the pilot’s vi- Lightning … By the Numbers sion or ability to control the aircraft. 1,800 Number of thunderstorms in progress worldwide • Three events involved lightning-related at any given moment ground equipment failures that led to acci- 40–100 Average number of lightning flashes each second worldwide dents during landing. Two of these involved 20,000 Number of amperes (amps) of current in a typical lightning discharge the loss of runway lights, and one involved 60 ft (18 m) The distance lightning energy can spread from the strike point the loss of air traffic control capability. 1:750,000 Odds of being struck by lightning in a given year • Seven accident/incident reports cited 1:6,250 Odds of being struck by lightning in a lifetime (80 years) lightning as a weather factor contribut- 1:28,500 Odds of being killed by lightning ing to an accident but did not describe its 24,000 Average number of deaths per year due to lightning worldwide actual influence. 240,000 Average number of injuries per year due to lightning worldwide 58 Average number of deaths per year due to lightning The 58 incidents and accidents resulted in 202 in the United States fatalities and 46 injuries, most of which were 500 Average number of injuries per year due to lightning associated with two accidents: in the United States • The Aug. 2, 1985, crash of a Delta Air 90 Percentage of lightning-strike victims who survive Lines Lockheed L-1011-385 in Dallas/Fort Sources: U.S. National Weather Service “Medical Aspects of Lightning,” National Oceanic and Atmospheric Administration.
cage, first devised by the physicist surrounding air the static charge build- These systems are intended to provide Michael Faraday in 1836. up that occurs during normal flight. preferred paths for the electric current A Faraday cage is a hollow enclo- Because many aircraft fly a distance associated with a lightning discharge sure made of conducting material, equivalent to several times their own to enter and exit the aircraft without such as the hull of an aircraft. In the lengths during a lightning discharge, the causing damage to the aircraft or injury presence of a strong electric field, any location of the entry point can change to its occupants.18 These systems can electric charge will be forced to redis- as the discharge attaches to additional be divided into three general categories tribute itself on the outside enclosure, points aft of the initial entry point. The of protection: airframe and structure but the space inside the cage remains location of the exit points may also protection; fuel system protection; and uncharged. Thus, the metal hull of the change. Therefore, for any one strike, electrical and electronic systems (avion- aircraft acts as a Faraday cage, protect- there may be several entry or exit points. ics) protection. ing the occupants from lightning. Occasionally, in more severe strikes, The primary goal of airframe and Some aircraft are made of advanced electrical equipment or avionics may structure protection is to minimize and composite materials, which — by them- be affected or damaged. This potential control lightning entry and exit points. selves — are significantly less conductive problem is addressed in modern aircraft The first step is to identify locations than metal. To overcome this resulting design by redundancy. The functions of (or zones) of greatest vulnerability to safety problem, a layer of conductive most critical systems are duplicated, so lightning strikes. For most aircraft, these fibers or screens is imbedded between a lightning strike is unlikely to com- zones, in decreasing vulnerability, are the layers of the composite material to con- promise safety of flight. In most strike radome and wing tips, the bottom of the duct the lightning current. events, pilots report nothing more than fuselage and the area under the wings. Regardless of hull material, the direct a temporary flickering of lights or short- The second step is to ensure that ac- effects of lightning on the exterior can lived interference with instruments. ceptable discharge pathways are avail- also include:15 The exception is the incidence of able at these potential entry points and positive lightning. Positive lightning that these pathways adjoin preferred • Burning or melting at lightning strikes — because of their greater pow- exit points on the aircraft. To a great strike points; er — are considerably more dangerous extent, this is achieved via the electri- • Increase in temperature; than negative lightning strikes. Few cally conductive hull of the aircraft. In • Residual magnetism; aircraft are designed to withstand such the outer hull design, it is important strikes without significant damage.17 that conductive bonding strips electri- • Acoustic shock effects; cally bridge any gaps between sections, • Arcing at hinges, joints and bond- Protection Methods thereby reducing potential arcing. ing points; and, Careful flight planning and the use of Preferred exit points at the tips of • Ignition of fuel vapors. weather radar help limit an aircraft’s the wings, stabilizers and fins should be exposure to lightning. It is a good safety equipped with static dischargers — wicks Accident data indicate that most of practice to avoid by at least 20 nm (37 or rods. These static dischargers are not these effects are not serious. However, km) any thunderstorm activity that lighting arrestors, however, and they do an estimated one-third to one-half of provides a strong radar echo. not reduce the probability of an aircraft aircraft lightning strikes result in at Aviation regulatory agencies being struck by lightning. Nevertheless, if least some minor damage.16 Lightning worldwide have established certifica- lightning does strike, chances are that the generally enters an aircraft at one loca- tion standards that call for an aircraft to electricity will go through the discharger tion, usually an extremity, and leaves at be able to withstand a lightning strike rather than through the aircraft. another. Burn marks are found at the and continue flying to land safely at a entry and exit point(s) of the strike, suitable airport. In addition, modern Fuel System although exit points are not present aircraft designers employ a number of The primary goal of fuel system if the energy was dissipated via wicks effective lightning protection systems protection is to prevent the ignition of or rods — static dischargers whose that address possible direct and indi- fuel vapors.19 Fuel tanks and associ- primary purpose is to bleed off into the rect damage from lightning strikes. ated systems must be free of potential
22 | flight safety foundation | AeroSafetyWorld | June 2010 coverStory
ignition sources, such as electrical arcs Surge protection works by diverting the of Transportation, FAA. DOT/FAA/AR- and sparks. All the structural joints, increased power to a grounding line. 04/13. 2004. hinges and fasteners must be designed to Every circuit and piece of equip- 5. Airports Council International. prevent sparks as current from the light- ment that is essential to safe flight “Airports Report Flat Traffic Growth ning discharge flows from one section to must be protected against lightning in in 2008.”
As current from a lightning strike Clarence E. Rash is a research physicist with 30 12. NTSB. Accident report no. DCA85AA031. travels along the exterior of an aircraft, years experience in military aviation research 13. NTSB. Accident report no. DCA74AZ003. it can induce transients — temporary and development. He has authored more than 14. NTSB. Accident report no. MIA90FA008. current oscillations — into adjacent 200 papers on aviation display, human factors wires and electronic equipment. Shield- and aircraft protection topics. 15. Rupke. ing, grounding and surge suppression 16. Harrison, H.T. “United Air Lines Turbojet Notes are the most common techniques used Experience With Electrical Discharges.” United Air Lines Meteorological Circular, to avoid this problem.20 Shielded cables 1. Parton, Lemuel F. “Records Reveal That No. 57. (1965). are wires enclosed by a common con- No Airplane Hit by Lightning,” The Deseret News, Salt Lake City, Utah, U.S. Sept. 7, ductive layer (the shield) that acts as a 17. U.K. Department of Transport. Air 1929. Accidents Investigation Branch Bulletin. Faraday cage. Shielded cables in aircraft December 1999: “Schleicher ASK 21 Two 2. U.S. National Weather Service. “Lightning may have two shields — an outer shield Seat Glider.”
Out of Bounds By Wayne Rosenkrans
espite having the benefit of in- elements of safety recommendations “We recognize that there are many in- sights from 45 people of diverse have emerged, however. dustry professionals whose work, day-in expertise, the U.S. National In remarks at the NTSB’s Profes- and day-out, reflects the highest level of Transportation Safety Board sionalism in Aviation Safety Forum on professionalism,” Hersman said. “While (NTSB)D has not settled on systemic May 18–20 in Washington, Chairman the Colgan Air [Flight 3407] accident explanations for instances in which Deborah A.P. Hersman cited seven investigation [ASW, 3/10, p. 20] was airline pilots and air traffic control- U.S. accidents and serious incidents in the impetus for this forum, many of the lers flouted regulations and standard 2004–2009 involving breakdowns in issues raised in that accident investiga-
operating procedures (SOPs). Potential professionalism. tion were not new to the NTSB. … The Board Safety Transportation National U.S.
24 | flight safety foundation | AeroSafetyWorld | June 2010 safetyCulture
evidence is clear that when pilots and controllers highly repetitive, highly automated systems drift away from their training, procedures and where everything goes right nearly all the time, NTSB delves best practices, safety margins erode and inadver- right up to the moment when it doesn’t?” tent errors go uncorrected. Things are happening Aviation professionals have to be inspired into theories of in industry that have led us to this point — errors and motivated to practice introspection, self- why airline pilots and practices that warrant closer scrutiny. … management and ethical behavior along with and air traffic Defining professionalism and creating a culture training to master technical systems, procedures, controllers strayed of professionalism … is what the NTSB will be tactical skills and information, he said. focusing on over the weeks and months to come.” Some panelists echoed the importance of from professional Most forum panelists offered personal views, intangible personal qualities. “Professionalism behavior. not positions of organizations, as the NTSB asked really starts with the pilot’s value system … early them about opportunities to strengthen defenses in life,” said John Rosenberg, a captain and against deficiencies such as lapses of discipline, check airman for Delta Air Lines and chair of distractions and deviations, including flight the National Professional Standards Commit- crews engaged in conversations and activities tee of the Air Line Pilots Association, Interna- not pertinent to aircraft operation during critical tional (ALPA). “It is a dedication to striving for phases of flight; lax, casual or unfocused atmo- mastery.” sphere on the flight deck; inexplicable deviations Others framed each individual’s responsibil- from SOPs; self-centered behavior; substandard ity for professionalism based on their personal airmanship; loss of situational or positional experience in applying the prevailing theories awareness; reluctance of pilots to challenge each of aviation human factors. “There is no perfect other’s deviations; and equivalent behaviors in flight; I have never done one,” said Ben Ber- the air traffic control (ATC) profession. man, a captain-rated first officer at Continental Soft skills of discipline, responsibility, judg- Airlines and senior research associate in flight ment, emotional stability, effectiveness under crew human factors and cognition at the Ames pressure and leadership are “what assures us Research Center of the U.S. National Aeronau- that once that cabin door is closed, that cockpit tics and Space Administration (NASA), who crew is acting professionally and doing what we explained that most errors can be traced to want them to do in a safe manner,” said Randall human cognitive limitations. “I always try, but I Hamilton, a captain and director of training at have never seen one. … Every flight has literally © ohdub/iStockphoto.com Compass Airlines. thousands of opportunities for flight crews to make errors in one way or another, and there is Pilot Accountability always an error that creeps in. … And so these In the forum’s keynote presentation, Tony Kern, errors are, in a sense, related to the way we are Out of Bounds CEO and senior partner of Convergent Perfor- wired and not so much to the way we handle mance, suggested that the pendulum in safety ourselves in terms of professionalism. … Even theory has swung too far in accepting human though we have the standards, we still make error as uncontrollable, and has diminished errors … we self-correct, accept corrections by personal accountability. He said he typically others and always strive to improve; that is pro- advises airline clients to increase their emphasis fessionalism for captains and first officers.” on personal flight discipline and airmanship. “If you believe the researchers, hundreds — The First Step maybe thousands — of mistakes and casual A number of panelists and NTSB members con- noncompliance [instances occur] without curred that careful screening and selection of ab a single negative outcome,” Kern said. “Is it initio students and experienced airline pilots is any wonder that we have a slight erosion [of the foundation of safe performance and profes- personal responsibility] in an industry that has sionalism. One challenge has been the difficulty
www.flightsafety.org | AeroSafetyWorld | June 2010 | 25 safetyCulture
of finding legal and scientifically valid selec- not impede either pilot’s willingness to offer the tion instruments — that is, tests and interview other constructive input about best practices, questions that can be used to deny employment compliance with SOPs or behavior. to an applicant — to deselect people. Some “per- A highly experienced pilot might fail to sonality tests” have been discarded as no longer perform or behave as required because of valid in a society as diverse as that in the United diminished self-discipline, poor study habits States, said Diane Damos, president of Damos or decline in personal motivation, said Paul Aviation Services. Preidecker, chief instructor at Air Wisconsin. “If Attributes of professionalism must be flight discipline and self-discipline are lacking, instilled long before pilots are hired for the it will eventually show up in training,” he said. flight deck of an airliner, Continental’s Berman “The measuring tools that we have for [soft skills said. “There are certain aspects of people that of] professionalism are … not always clear.” cannot be trained, and those need to be selected The NTSB’s Sumwalt asked for panelists’ out,” he said. “They cannot be allowed to join or opinions of the feasibility of identifying specific at- to continue with an airline. When they [most] tributes of professionalism and behavioral markers, Forum panelists need to act professionally — make professional and reaching a government-industry consensus from airline pilot and decisions to do the right thing — will be in the about how to measure and apply them. “We need ATC communities heat of things [an emergency].” the industry to agree upon those attributes and sometimes then come up with the behavioral markers for the characterized Metrics of Professionalism continuum — this is excellent, this is substandard,” professionalism In major U.S. airlines, the likelihood of the Sumwalt said. Such an agreement would enable as complying with same captain and first officer flying together pilots to be objective in assessing one another and SOPs when no one more than once or twice has become remote. in measuring themselves, he added. is there to observe. This makes excellent communication, trust and adherence to SOPs es- ‘Pro Stan’ Successes sential but may make Professional standards programs of pilot unions mentoring socially — open to all members but providing services awkward, several relevant to the situations of very few — help presenters and NTSB pilots face professionalism issues through peer members agreed. One intervention by trained volunteer counselors. byproduct of merg- “Pro stan” services facilitate confidential discus- ers has been more sion of a professional or ethical problem of any first officers who nature, including issues of attitude, motivation are captain-rated or compliance with procedures. Pilots typi- and who have more cally, but not always, overcome such problems experience than the without entering a formal company process that pilot-in-command. may lead to disciplinary action, documentation NTSB Member in personnel records or termination of employ- Robert Sumwalt ment, said ALPA’s Rosenberg. suggested that a new Robert McDonnell, an American Airlines defense against lapses captain representing the Allied Pilots Association, of professionalism estimated that professional standards committees might be increasing of U.S. major airlines interact with fewer than 1 the social acceptance percent of their unions’ members. of mentoring among One serious safety issue addressed by coun- pilots. Ideally, any so- selors involved SOPs and compliance with the
cial discomfort would operating manual, and a pilot who repeatedly © Chris Photography Sorensen
26 | flight safety foundation | AeroSafetyWorld | June 2010 safetyCulture
refused to respond to communication from them, management — espe- McDonnell recalled. “This pilot was a little defi- cially ongoing work to cient, but because this was definitely a safety issue, fully implement the we went to the chief pilot, who told him he was Air Traffic Aviation either going to be fired or retire early,” McDon- Safety Action Program nell said. “The pilot decided to retire early. Once (ATSAP; ASW, 7/09, a chief pilot … and issues that involve safety are p. 9); a professional involved, there is no recourse but to bring in the standards committee; Federal Aviation Administration [FAA] for cer- a fatigue risk manage- tificate action … termination or early retirement.” ment system; and the Next Generation Air Model Captains Transportation System Several pilot panelists told the NTSB that noth- (NextGen; ASW, ing has been more influential in maintaining 4/10, p. 30) — has a professionalism in their own careers than flying significant bearing on with captains who modeled the “right” attitudes enhancing controller and behaviors to operate safely. Captains must professionalism. continue setting the standard of professionalism In April, teams to influence others, they said. from the FAA and Chris Keinath, a Horizon Air captain and NATCA began meet- director of safety, was among panelists who ing to design the © Chris Photography Sorensen expressed concern that some soft skills for professional standards coping safely with the demands of airline flying program. Plans call for its implementation in Professional behavior may not be transmitted to a new generation of the third quarter of 2010 with termination in is instilled in German first officers and captains, given their varied October 2012, subject afterward to collective student air traffic backgrounds. “This generation of new [civilian] bargaining, said Garth Koleszar, a NATCA rep- controllers, as in their pilots, in particular, has not heard of the concept resentative and a controller at the Los Angeles U.S. counterparts at of compartmentalizing [as taught to naval avia- Air Route Traffic Control Center. the FAA Academy, tors],” he said. “As one of the lessons learned In late 2010, the ATO also will institute an on the Langen from this forum, maybe we … need to come ATC quality control program, said Michael Mc- campus of Deutsche up with an industry-accepted set of [skills] that Cormick, acting executive director of the ATO Flugsicherung, the should be added to the training curriculum.” Terminal Service Unit. “It will provide an ability air traffic services Active monitoring and challenging of each to take a look at the performance of individuals, provider. other are critical safety tasks for a captain and first the organization and individual service delivery officer, Continental’s Berman added. “To address points to ensure [that the values, mission and the very tiny percentage of things not being done level of professionalism are] consistent with our professionally, however, we have to make sure we expectations of the organization,” he said. don’t shut down the flow of communication. … Professionalism is instilled at the FAA That would have more of a negative safety impact Academy, in closely supervised initial experience than all of the many safety threats out there that in ATC facilities, and in recurrent training, said are not directly related to professionalism.” Jennifer Allen-Tallman, manager of the ATO crew resource management program. “We liter- Air Traffic Control ally go through the traits of an expert controller In the ATC domain, FAA Air Traffic Organiza- … the attributes of operating professionally in the tion (ATO) managers and National Air Traffic control room.” she said. Controllers Association (NATCA) representa- To read an enhanced version of this story, go to the FSF tives told the NTSB that organizational change Web site
O bWhen sa cloud cis not a ucloud it becomes r e more d of a hazard.b yby EdF Brotak o g
t 0841 local time on April 10, 2010, a crystals are so small that gravity has a negli- Tupolev 154M passenger jet carrying gible effect, and thus they remain suspended. the president of Poland, his wife and In fact, mountainous locations in the clouds numerous government officials crashed simply report it as fog. For example, at the Aabout 1 km (0.6 mi) from the Smolensk Airport same time Seattle was reporting a visibility of in Russia, killing all 96 people aboard. Short of 10 mi (16 km) and an overcast layer at 3,800 the runway, the plane struck trees and broke ft, nearby Stampede Pass, at an elevation of apart. Preliminary reports say the flight crew nearly 4,000 ft, was reporting ¼ mi (403 m) had been warned of reduced visibility and was visibility and a vertical visibility, or ceiling, of told to divert to another airport, and that they 100 ft. attempted the landing anyway. Regardless of Fog occurs when a low layer of air be- whatever factor is eventually designated as the comes saturated and atmospheric water vapor primary cause of the crash, fog clearly limited begins to condense. There are two ways satu- the airport’s visibility. ration and condensation occur in the atmo- Aviation accidents in which fog plays a major sphere — moisture is added to the air, or the role often prove fatal. The worst aviation disas- air is cooled. Cooling the air lessens its water- ter of all time, the collision of two Boeing 747s holding capacity. The dew point, a measure of in Tenerife, Canary Islands, involved fog. The moisture in the atmosphere, is the tempera- captain of the departing aircraft and the traffic ture at which saturation occurs. When the control tower could not see that the landing 747 air temperature drops to the dew point, you was still on the runway, leading to the crash that have saturation, that is, 100 percent relative killed 583 people. humidity. Condensation, the process of water To review the basics, fog is simply a cloud vapor turning into liquid water, occurs instan- near or in contact with the earth’s surface taneously at this point, too. — usually flat ground. Low clouds that may At temperatures above freezing, fog is obscure mountainous terrain generally are composed of tiny water droplets. “Freezing fog” not defined as fog. For aviation interests, the occurs with temperatures below the freezing point is moot since physically clouds and fog point but still consists of liquid fog droplets. are the same thing — minute water droplets This “supercooled water” also poses an icing or ice crystals suspended in the air. With problem for aircraft. At very cold tempera-
both fog and clouds, the water droplets or ice tures — below 14 degrees F (minus 10 degrees 1/ iStockphoto.com © traveler_no
28 | flight safety foundation | AeroSafetyWorld | June 2010 FlightOPS
C) — ice fog is possible, with fog com- Meteorologists have classified six saturated and condensation, or fog, prised of ice crystals. different types of fog based on the will form. In fact, meteorologists often Fog occurs from the Arctic to the formation process. Ground fog — or use the dew point to forecast fog. If tropics. Counterintuitively, even deserts radiation fog as it is officially called the overnight low is forecast to drop are plagued by fog — cool water coastal — is the most common type of fog. It to the dew point, fog is likely. In its deserts may go years without rain, but can occur anywhere there is sufficient lightest form, ground fog may only have fog nearly every day. Although moisture in the air. It is most common consist of wisps a few feet thick. In O b s c u r e d b y F o g many locations have seasons when fog in the early morning. After the sun more extreme cases, the fog may have is more prevalent, fog also can occur sets, the earth’s surface “radiates” heat a vertical depth of several hundred at any time of the year. Fog is most out into space and cools. The layer to 1,000 ft. For pilots, a thin layer of common in the morning hours, but it of air just above the surface is cooled ground fog may appear fairly trans- can occur at different times of the day, from below. If the temperature drops parent from above. But when viewing depending on location and conditions. to the dew point, the air becomes from the horizontal — for example,
www.flightsafety.org | AeroSafetyWorld | June 2010 | 29 FLightOps
when flying an approach — visibility can be reported 1/8 mi visibility in freezing fog. The drastically reduced since the pilots are looking temperature at the time was minus 42 degrees through much more of the fog. F (minus 41 degrees C), and these conditions Ideal conditions for ground fog formation persisted through the next day. include clear skies and light to calm winds. The Frontal fog, obviously, is associated with clear skies allow maximum radiational cooling. fronts and primarily occurs in the cold season. Ideal conditions Light or no wind inhibits the mixing of different Normally this type of fog occurs north of a warm batches of air. In these situations, warmer air is front — south in the southern hemisphere — in for ground fog above in an inversion condition. Mixing brings the colder air. Occasionally, frontal fog occurs this warmer air down and slows the fog forma- behind — to the north or west in the northern formation include tion. However, the cool air is denser and tends hemisphere — a cold front. Fronts have a vertical clear skies and light to collect in lower elevations; valleys are prime temperature structure that favors fog develop- locations for ground fog. When the sun rises, ment, colder air under warmer air. The warmer to calm winds. the ground and air warm and the fog begins air aloft is also moist. In frontal fog situations, rising. As the air mixes, it dries and the fog dis- there are often clouds above the fog deck and pre- sipates or “burns off.” cipitation may be falling. This type of fog is usu- A good example of radiation fog can be ally widespread and consistent. It can occur day shown at Charleston, West Virginia, U.S., in the or night and persist for hours until the weather central Appalachian Mountains where dense systems move. Snow on the ground often makes fog is common in the fall. On Oct. 25, 2009, the fog worse, since it significantly cools the air the high of 63 degrees F (17.2 degrees C) was while providing moisture from below. reached at 1600 with a dew point of 36 degrees F Frontal fog can cause massive problems (2 degrees C). There were clear skies, visibility of with aviation since its effects are so far reaching more than 10 mi, and calm winds. Temperatures and last so long. On Jan. 23, 2010, a complex fell quickly after sunset and reached 36 degrees frontal system produced a warm, moist airflow F by 0300. Visibility was 8 mi (13 km), with which overrode colder air near the surface in wind still calm. By 0318, however, visibility had the eastern half of the United States. Fog and dropped to ¼ mi in dense fog. The tempera- low ceilings were reported from the southeast ture and dew point merged at 36 degrees F (2 northward through the Ohio Valley and into the degrees C). The fog persisted until 0800, when Midwest. Atlanta Hartsfield Airport reported it burned off. Even during the foggy morning, visibilities of ¼ mi for nine hours. At the same occasionally light breezes increased visibilities time, the municipal airport in Mason City, Iowa, to 6 mi (10 km), only to have them drop to 1/8 reported ½ mi (805 m) visibility in fog. mi (201 m) a few minutes later. In Charleston, Another type of fog that often proves prob- this cycle can persist for days in the fall. The fog lematic to aviation is marine or sea fog. Marine usually lifts about the same time each morning. fog forms over bodies of water when the water In much of the mid-latitudes, ground fog is is colder than the air above it. This is a prob- most common in the warmer months. Higher lem over some lakes in the summer and over moisture content of the air and less wind are ocean areas dominated by cold currents. In contributing factors. In some locations, a type each case, the air is cooled from below by the of ground fog can develop in the winter. The cooler water. The cooling of the air in conjunc- worst situations involve valleys with extreme tion with the influx of moisture from below cold air flowing through. Sometimes the fog is causes the fog to form. so dense it reflects the heating rays of the sun, Marine fog tends to be very thick and especially at higher latitudes. In these cases, the can be long lasting. It can alternately lift and fog may persist for days. For example, at 2353 descend, never really dissipating. When it lifts on Feb. 4, 1999, the Fairbanks Alaska airport off the ground, it becomes a low stratus cloud
30 | flight safety foundation | AeroSafetyWorld | June 2010 FlightOPS
deck. Although surface visibilities may occurs over water when the water is at the airport dropped from 5 mi (8 improve, low ceilings are still an avia- warmer than the air above it. Usually km) to ¼ mi in 12 minutes. tion concern. Any type of onshore wind steam fog does not cause great reduc- Another bad combination is dense brings this fog over land where it can tions in visibility. However, steam fog fog and thunderstorms. This seems con- cause great problems for coastal areas. can produce icing when the air tem- tradictory, involving extremes in stabil- If the wind shift is abrupt, visibility may perature is below freezing. ity and instability, but it can occur. The drop quickly. If the wind shift is unex- Upslope fog forms due to orographic warmer marine fog develops with air pected, pilots may be caught off guard. lifting. When winds are blowing up a masses than can support thunderstorm In middle and higher latitudes, fairly gentle slope, condensation and fog development. Also, colder, more stable marine fog is primarily a summer can develop. This is fairly common in the air near the surface can be overridden occurrence. In tropical regions along Great Plains of the United States, when by warmer, unstable air above in frontal cold-water coasts, marine fog is east winds occur in the winter. On Jan. 22, situations. Thunderstorms can develop prevalent all year. The Tenerife accident 2010, the interaction of a low-pressure in this warmer air, but their effects such occurred in a region known for marine area coming out of the Rocky Mountains as lightning, gusty winds and turbulence, fog. Although we normally associate and a high-pressure area near James Bay can be felt down to the ground. marine fog with colder waters, it is the in Canada combined to produce a strong For fog detection, the only other difference in the temperature of the southeast air flow over the Central Plains. tool besides actual observations that air and water that is most important. At North Platte, Nebraska, U.S., this com- can be useful is weather satellite visible Even warmer waters can initiate fog bination resulted in ¼ mi visibility in fog imagery. Obviously, this is limited to if the air above is warmer still. In the with a vertical visibility of 100 ft. And the daylight hours. Infrared imagery can- winter, a type of marine fog can occur wind was blowing from 130 degrees at 16 not distinguish low-lying fog from the with oceanic storms. For terminals near kt, with gusts to 22 kt. ground surface since their temperatures the coast, this can mean the danger- ous combination of low visibility and Fog combining with smoke produces some of the worst effects strong winds. On Jan. 15, 2010, Astoria, on visibility. Not only does the smoke reduce visibility on its own, Oregon, U.S., was in the warm sector of a strong winter storm. At one point, but smoke particles act as condensation nuclei. the airport reported ½ mi visibility in heavy rain and fog with southerly Fog combining with smoke pro- are too close. On visible images, fog winds of 23 kt gusting to 41 kt. duces some of the worst effects on can be picked out from other clouds by Less of a problem for aviation is visibility. Not only does the smoke its low-lying nature. Often fog follows precipitation fog. Whenever rain or snow reduce visibility on its own, but smoke topographic features, in valleys but exists, some of it evaporates into the air particles act as condensation nuclei, below ridge tops. Fog does not show up and then recondenses as fog. This type accelerating the fog-making process. on radar due to the very small size of of fog isn’t very dense, and reductions in This often happens in the aftermath the droplets involved. visibility due to the precipitation itself are of a major wildfire. Even after the fire Fog can form quickly when the air more of a problem. Frontal fog and some is controlled, smoldering remains can temperature reaches the dew point. At marine fogs occur with precipitation, but emit great amounts of smoke into other times, the wind may blow a fog this is a “true” fog not just formed by the the air. For example, in April, a major bank over an airport, quickly reduc- precipitation. Visibilities in these cases wildfire burned near North Myrtle ing visibility. But it seems that many of can be reduced significantly. Beach, South Carolina, U.S. Even the fog-related accidents occur when Steam fog occurs when moisture though the fire was contained within the fog is readily apparent, and not a evaporates from a surface and saturates 24 hours, for several days afterward surprise. the air above it. A simple example is the combination of fog and smoke in Edward Brotak, Ph.D., retired in May 2007 after when wet pavement, just after a rain the morning brought air travel and 25 years as a professor and program director in when the sun comes back out, seems other forms of transportation to a the Department of Atmospheric Sciences at the to have steam rising from it. Steam fog standstill. One morning, the visibility University of North Carolina Asheville. www.flightsafety.org | AeroSafetyWorld | June 2010 | 31 Causalfactors
he pilots of a Boeing 737-800 did not heed The final report by the Dutch Safety Board indications of a significant decrease in (DSB) concluded that the Feb. 25, 2009, accident airspeed until the stick shaker activated on “was the result of a convergence of circumstanc- final approach to Runway 18R at Amster- es,” including air traffic control (ATC) handling Tdam (Netherlands) Schiphol Airport. Their re- that brought the aircraft in high and close to the actions to the stall warning were uncoordinated runway for an instrument landing system (ILS) and incorrect, and maximum thrust was applied approach, a radio altimeter malfunction that too late to prevent the aircraft from stalling at an caused the autothrottle system to prematurely dds altitude from which recovery was not possible. reduce power to approach idle while the autopi- Five passengers, a flight attendant and the lot compensated by increasing the pitch attitude three pilots were killed, and 117 passengers and to maintain the glideslope, and the flight crew’s three flight attendants were injured when the nonadherence to standard operating procedures aircraft struck terrain 0.8 nm (1.5 km) from the — chiefly, their neglect or dismissal of indications runway. Six passengers escaped injury. that a go-around was required. at O at
A 737 stalled when a radio altimeter malfunction caused the autothrottle and autopilot to diverge during an approach to Schiphol.
BY MARK LACAGNINA tion a Autom
32 | flight safety foundation | AeroSafetyWorld | June 2010 Causalfactors
The aircraft, operated by Turkish Airlines clouds at 600 ft, a broken ceiling at 1,100 ft and as Flight TK1951, was en route to Amsterdam an overcast at 1,300 ft. The ATIS advised that from Istanbul. “As this was a ‘line flight under the ceiling was becoming broken at 600 ft and The aircraft broke supervision,’ there were three crewmembers in that visibility was expected to decrease tempo- into three pieces the cockpit, namely the captain, who was acting rarily to 2,500 m (about 1 1/2 mi). when it struck as instructor; the first officer, who had to gain The first officer was not authorized to con- the ground short experience on the route of flight and who was duct Category II or Category III landings, so the of the runway. accordingly flying under supervision; and a crew briefed for the Category I ILS approach to Runway 18R before beginning the descent to Schiphol.
‘Short Lineup’ The aircraft was descending through 7,000 ft with the autothrottle and right autopilot engaged when the captain established radio communication with Schiphol Approach at © /Associated Press 1015. The approach controller told the safety pilot who was observing the flight,” the crew to descend to 2,000 ft and to maintain a report said. heading of 265 degrees. The controller then All three flight crewmembers held 737-800 amended the heading to 210 degrees and cleared type ratings. The captain, 54, had about 17,000 the crew to conduct the ILS approach to Runway flight hours, including 10,885 hours in 737s 18R (Figure 1, p. 34). with 3,058 hours as pilot-in-command. The first The report said that the controller did not officer, 42, who was flying the aircraft from the ask the crew if they could accept a “short lineup” right seat, was making his 17th line flight under before issuing these instructions, which did not supervision and his first flight to Schiphol. He allow the crew to intercept the glideslope from had 4,146 flight hours, including 44 hours in below in level flight, as required by International type. The safety pilot, 28, had 2,126 flight hours, Civil Aviation Organization (ICAO) standards including 720 hours in type. Turkish Airlines and by Netherlands ATC standards. requires a safety pilot on the flight deck during a “This heading ultimately resulted in in- trainee pilot’s first 20 line flights under supervi- terception of the localizer signal 5.5 nm [10.2 sion because of the extra instructional workload km] from the runway threshold,” the report imposed on the captain. said. It noted that the aircraft would have had The aircraft was over Germany at Flight to intercept the localizer course no less than Level 360 (approximately 36,000 ft) at 0953 6.2 nm (11.5 km) from the runway threshold Amsterdam time when the crew listened to the to intercept the glideslope from below while automatic terminal information service (ATIS) flying level at 2,000 ft. As a result of the short broadcast for Schiphol. Surface winds were lineup, “the aircraft had to lose speed and from 200 degrees at 7 kt, and visibility was 3,500 descend in order to intercept the glide path,” m (about 2 1/4 mi) in mist. There were a few the report said.
© Alessandro Savarese/Airliners.net © Alessandro www.flightsafety.org | AeroSafetyWorld | June 2010 | 33 Causalfactors
attempt to engage the left autopilot. Al- Short Lineup at Schiphol though a “single-channel” message on the primary flight displays (PFDs) showed A9
Heading 265 degrees 1 that only one autopilot was engaged for 2,000 ft 2 the ILS approach, the first officer an- A7 nounced “second autopilot engaged.” The 3 1022:00 8 NM N203 1 Arrives at 2000 ft report said, “The approach was executed A22 221 kt without further discussion.” 2 1022:17 Flaps 1 220 kt The crew selected flaps 15 and 7 NM 1023:32 Flaps 5 extended the landing gear before the 3 195 kt A8 autopilot intercepted the localizer course ILS glideslope 4 4 1023:49 Flaps 15 intercept at 6.2 NM 185 kt at 1024. The aircraft was above the 2,000 ft when 6 NM published 5 1023:58 Gear down glideslope, and the crew initially used the procedure is 5 175 kt followed altitude selector to manage the descent, Zaanstad 6 1024:09–1024:23 6 Localizer intercepted selecting 1,200 ft initially and 700 ft 5 NM 175 kt
“V/S” mode activated shortly thereafter. However, the resulting Activation ‘retard flare’ mode Throttles idle descent rate was not sufficient to capture Leaves 2000 ft the glideslope, so the crew changed to 4 NM 7 1024:46 1300 ft 7 169 kt the vertical speed mode and selected a Glideslope intercepted descent rate of 1,400 fpm. The aircraft 8 1025:10 900 ft 158 kt was descending through 1,300 ft when 3 NM Flaps 40 8 the autopilot captured the glideslope. 9 1025:23 750 ft The report said that the captain, as 9 Speed drops below 144 kt pilot monitoring, did not make several 2 NM 1025:47 460 ft 10 Stick shaker activation required callouts during the approach, Haarlemmerliede N200 A200 including changes in flight mode annun-
A10 Heading degrees 184 ciations. “The times when these callouts 1 NM 10 should have been made coincided with the times that the captain was communi-
Ground track 210 degrees cating with ATC,” the report said. A9 TK 1951 Line-up 8 NM
Runway 18R Unstabilized Approach
ILS = instrument landing system ; V/S = vertical speed Turkish Airlines’ criteria for a stabilized
Source: Dutch Safety Board approach in instrument meteorologi- cal conditions include completion of Figure 1 the landing checklist before the aircraft reaches 1,000 ft above runway touch- Turkish Airlines trains its pilots to not selected the approach mode. Con- down zone elevation; a go-around is re- conduct ILS approaches with both auto- sequently, they unintentionally switched quired if this is not accomplished. “This pilots engaged. However, when the crew from using the right autopilot to using the provision is not confined to Turkish attempted to engage the left autopilot, it left autopilot. The left autopilot would not Airlines, in fact, but is a general rule,” the would not engage; moreover, the right engage, however, because it was receiving report said. “Being stabilized is impor- autopilot disengaged. Several factors an erroneous height measurement from tant not only to ensure that the aircraft is were involved in this. The autopilots the left radio altimeter system. in the correct configuration and power cannot be engaged simultaneously un- The crew subsequently re-engaged selection for the landing but also to pro- less the ILS frequency is tuned and the the right autopilot and selected the ap- vide the pilots with a chance to monitor approach mode is selected. The crew had proach mode but did not make another every aspect of the final approach.”
34 | flight safety foundation | AeroSafetyWorld | June 2010 Causalfactors
The landing checklist typically is conducted that the aircraft was below 27 ft, another precon- after flap 15 is selected and the landing gear is dition had been satisfied: The crew had selected extended. However, the pilots did not begin the flaps 15, the minimum flap position required for landing checklist until after they selected flaps activation of the retard flare mode. 40 as the 737 descended through 900 ft. The Shortly before the captain established radio report said that the delay likely was caused by communication with the airport traffic control- the extra workload involved in capturing the ler and received clearance to land, the safety glideslope from above. pilot apparently saw the erroneous height The airline requires the captain, even if indication on the captain’s PFD and remarked he or she is not the pilot flying, to make the that a radio altimeter failure had occurred. The decision about a go-around. Although the 737 captain confirmed the failure, but there was no captain had made a callout when the aircraft further discussion or action taken about it. “The descended through 1,000 ft, he did not com- cockpit crew did not have information regarding mand a go-around. the interrelationship between the failure of the Recorded flight data showed that the left left radio altimeter system and the operation of radio altimeter system — the primary source of the autothrottle,” the report said. height measurements for the autothrottle — had The crew completed the landing checklist as begun to provide erroneous data shortly after the aircraft descended below a height of 500 ft. As the aircraft takeoff from Istanbul. As the aircraft descended The last item on the checklist was to instruct the from 2,000 ft, the height measured by the left flight attendants to take their seats; the captain descended from radio altimeter and displayed on the left, or asked the safety pilot to do this. captain’s, PFD changed to minus 8 ft. As airspeed decreased, the right autopilot, 2,000 ft, the height Investigators were unable to determine why which was receiving correct height information measured by the this error occurred or why the radio altimeter from the right radio altimeter system, contin- computer did not recognize and flag the error, ued to trim the aircraft nose-up, increasing the left radio altimeter which would have caused the autothrottle to angle-of-attack to maintain the lift required to resort to using heights measured by the right radio keep the aircraft on the glideslope. changed to minus 8 ft. altimeter system, which was functioning normally (Figure 2). “The only indication of the defect in Unheeded Warnings the left radio altimeter system was the minus 8 ft An indication of the autothrottle mode change, indication on the left PFD,” the report said. The “RETARD,” was displayed on both PFDs. “When right PFD, which is channeled to the right radio subsequently the airspeed reached 126 kt, the altimeter system, provided accurate height indica- tions to the first officer. Systems Channeling ‘Retard Flare’
The autothrottle had been set to adjust engine Radio altimeter system Radio altimeter system Primary signal left right thrust to hold an airspeed of 160 kt. However, the Secondary signal erroneous height measurement provided by the left radio altimeter prompted the autothrottle to change from the airspeed-hold mode to the “retard flare” mode and reduce thrust to the approach idle Autopilot Autothrottle Autopilot setting at about the same time the crew had begun left right the descent from 2,000 ft. The retard flare mode “is normally only acti- Source: Dutch Safety Board vated in the final phase of the landing, below 27 ft,” the report said. In addition to the indication Figure 2 www.flightsafety.org | AeroSafetyWorld | June 2010 | 35 Causalfactors
frame of the airspeed indicator also 350 ft, was insufficient for a recovery,” altimeter antennas and the fuselage changed color and started to flash,” the the report said. skin, and wrapped the connectors to report said. “The artificial horizon also At 1026, the aircraft struck ter- block moisture. But this did not elimi- showed that the nose attitude of the rain in a 22-degree nose-up pitch nate the problems. The greatest success aircraft was becoming far too high.” attitude and banked 10 degrees left. was achieved by replacing the antennas, The report said that cockpit voice re- “The aircraft came to a standstill in a but tests of some of the removed anten- corder data provided no indication that field relatively quickly due to the low nas did not reveal why the problems the crew observed any of these warnings forward speed [on] impact,” the report had occurred. “It is almost impossible or that they noticed that the autothrottle said. There was no fire. to take the correct measures if the cause did not command an increase of thrust “A few passengers exited the aircraft of the fault cannot be identified,” the after flaps 40 was selected. The latter through the tear on the right-hand side report said. would have been indicated in part by of the fuselage in front of the wing,” the Boeing in 2004 added a warning forward movement of the thrust levers. report said. “The other passengers used in the 737-800 dispatch deviation “Because the cockpit crew, including the two emergency exits above the right guide that an autopilot or autothrottle the safety pilot, were busy completing the wing, the front emergency exit above must not be used during approach and landing checklist, no one was engaged in the left wing and the opening at the landing if its associated radio altim- the primary task of monitoring the flight rear of the main section of the fuselage.” eter is found to be inoperative before path and the airspeed of the airplane,” the flight begins. However, the report the report said. “The reduction in speed Similar Incidents noted that the aircraft’s quick reference and the excessively high pitch attitude of Investigators found that inadvertent handbook and flight crew operating the aircraft were not recognized until the activations of the retard flare mode had manual do not contain similar guid- approach-to-stall warning (stick shaker) occurred during flights by the accident ance for a radio altimeter malfunction went off at an altitude of 460 ft.” aircraft on both days preceding the ac- that occurs during flight. The first officer responded immedi- cident. “After the accident, four similar Investigators also found that the ately to the stick shaker by moving the incidents were brought to the attention ATC handling that resulted in the thrust levers forward and pushing his of the DSB,” the report said, noting that accident aircraft’s interception of the control column forward. However, he in each case the aircraft was landed localizer course high and close to the stopped when the captain announced that without further incident after the crew runway, without prior consultation with he was assuming control of the aircraft. disengaged the autothrottle. and approval by the crew, was not an The first officer had moved the thrust Moreover, the report said, “Radio isolated event but was characteristic of levers only slightly more than halfway altimeter system problems within the more than 50 percent of the approaches forward. “The result of this was that the Boeing 737-800 fleet had existed for to Runway 18R at Schiphol. autothrottle, which was not yet switched many years.” For example, Turkish Based on the findings of the off, immediately pulled the thrust levers Airlines had complained to Boeing investigation, the DSB recommended back again to the position where the en- about fluctuating and negative height improvement of the reliability of the gines were not providing any significant measurements that caused landing 737-800 radio altimeter system, evalua- thrust,” the report said. During this time, gear warnings, autopilot discon- tion of the benefits of installing an aural airspeed decreased to 107 kt. nects and ground-proximity warning low-speed warning in the aircraft, and The aircraft was descending system warnings. “Turkish Airlines monitoring to ensure that air traffic through 420 ft at 1025 when the captain and other operators dealt with the controllers in the Netherlands adhere to disengaged the autopilot and pushed problems as a technical problem and ICAO and national standards for lining his control column full forward. About not as a safety problem,” the report up aircraft for approach. six seconds later — or about nine sec- said. “As a result, the pilots were not This article is based on the DSB accident report onds after the stick shaker activated — informed of this issue.” “Crashed During Approach, Boeing 737-800, he moved the thrust levers full forward. Suspecting that corrosion was Near Amsterdam Schiphol Airport, 25 February “At that point, the aircraft had already causing the problems, Turkish Airlines 2009,” May 2010. The full report is available at stalled, and the height remaining, about installed gaskets between the radio
36 | flight safety foundation | AeroSafetyWorld | June 2010 seminarsCASS Back to Basics Many current safety challenges demand a renewed emphasis on airmanship, SOPs and lessons learned. © Jim Parkin/Dreamstime.com
BY RICK DARBY | FROM TUCSON
everal speakers at the 55th an- accidents continue to involve failures of flight school. The data are telling us nual Corporate Aviation Safety basic airmanship. that the lessons are not being learned. Seminar suggested — to para- John Cox, CEO, Safety Operating So we face a challenge, not only for the phrase Oscar Wilde — that to Systems, said that “loss of control in next generation of aviators but the gen- loseS one airplane may be regarded as flight continues to be the number one eration of aviators in flight decks today.” a misfortune, but to lose more looks cause of accidents in the commercial Among maneuvering accidents, like carelessness. Many recent acci- fleet. And unfortunately, the trend is Cox said, the top category is stalls: dents have been similar to others in not improving. It’s static.” “This is simple stuff. Don’t get too the past that have been analyzed and He discussed stall prevention on slow, don’t stall the airplane. You learn from which lessons have been learned. takeoff and during climb as well as loss it in Piloting 101. But we continue But those lessons, incorporated into of control in flight. “This is airman- to have that accident type. We’re not standard operating procedures (SOPs), ship,” he said. “This is something that adequately addressing this, and the are not always heeded. Moreover, some people believe that you learn in primary statistics show it.”
www.flightsafety.org | AeroSafetyWorld | JUNE 2010 | 37 seminarsCass
Cox cited a study that reviewed reports of The NTSB determined that the probable accidents involving purpose-built business jets cause was “the captain’s inappropriate response — that is, not airliner derivatives — worldwide to the activation of the stick shaker, which from 1991 through 2007.1 “Of the 389 reports led to an aerodynamic stall from which the found and analyzed, 59 — that’s almost one out airplane did not recover.” The “flight crew’s of seven — involved loss of control,” he said. “Of failure to monitor airspeed in relation to the 35 fatal loss of control accidents, we believe that, rising position of the low-speed cue” was a in 14, upset recovery training could have had a contributory cause. positive effect.” In-flight loss of control was not the only type Cox said that an upcoming rewrite of U.S. of accident involving “lessons not learned” that Federal Aviation Regulations Part 121, subpart attendees heard about during the seminar. N, Training Operations, and subpart O, Crew- In his presentation titled “Reducing the Risk ‘Why should we in member Qualifications, has a very high likeli- of Runway Excursions,” James M. Burin, FSF hood of including upset recovery training as director of technical programs, reported on a corporate aviation mandatory for air carrier pilots. “Why should just-competed update of approach-and-landing we in corporate aviation be any different?” Cox accident data. “The top factors such as omission be any different? And asked. “And more important, why do we have to of action, poor professional judgment/airman- more important, why wait for a regulation?” ship and crew resource management deficien- Analyzing some recent corporate avia- cies are still there. The order has changed do we have to wait tion accidents, Robert Sumwalt, member, U.S. slightly, but not much.” National Transportation Safety Board (NTSB), An aspect of approach and landing accident for a regulation?’ discussed causal factors in the fatal runway reduction that is not improving is runway excur- overrun accident involving a Learjet 60 at Co- sions, Burin said. He said that the data support lumbia, South Carolina, on Sept. 19, 2008 (ASW, these conclusions: 5/10, p. 24). • “Unstable approaches increase the risk of Following tire failures, the captain hesitated, an excursion; then rejected the takeoff at a speed greater than • “Crews will get away with not going V1. Sumwalt pointed out that U.S. Federal Avia- tion Administration (FAA) guidance in Advi- around when they should 99 percent of sory Circular AC 120-62, Takeoff Safety Training the time. But most of the accidents are in Aid, cautions pilots not to reject takeoffs at high that remaining 1 percent; speed because of tire failures. • “Contaminated runways increase the risk In its report, the NTSB assigned as probable of excursions; cause “the operator’s inadequate maintenance of Cox • “Combinations of risk factors increase the the airplane’s tires, which resulted in multiple tire risk by more than their sum; failures during takeoff roll due to severe under- inflation, and the captain’s execution of a rejected • “The aviation community has been search-
takeoff after V1, which was inconsistent with her ing for over 20 years for a universal stan- training and standard operating procedures.” dard of runway condition measurement Sumwalt then turned the audience’s attention and reporting. We need to stop searching to Colgan Air Flight 3407, which crashed with a and come up with something; [and,] loss of 50 lives on Feb. 12, 2009 (ASW, 3/10, p. 20). • “Good SOPs — and good adherence The investigation found that the pilots violated to SOPs — will reduce the risk of an basic cockpit discipline by engaging in non- excursion.” pertinent conversation while neglecting important Sumwalt SOPs such as conducting an approach briefing, Burin said, “We found that many basics are for- the descent checklist and the approach checklist. gotten — or maybe never learned. For example,
38 | flight safety foundation | AeroSafetyWorld | JUNE 2010 seminarsCASS
flying a stabilized approach to include meeting managing director, V2climb, pointed to the all stabilized approach criteria and touching lack of widespread voluntary reporting sys- down in the touchdown zone is a large risk tems in corporate aviation. The only widely reduction factor. recognized reporting program is the Aviation “But there are some basics besides flying a Safety Reporting System, maintained by the stabilized approach which need to be learned, or U.S. National Aeronautics and Space Admin- re-learned. Reverse thrust is nice on a dry run- istration, he said. However, “it is a program way, but it is critical on a contaminated runway. that typically collects minimalist reports but “It was estimated that in 98 percent of land- does not offer much usable output for opera- ing excursions, the calculated stopping distance tors,” Chisholm said. was before the end of the runway. Unfortunately, He urged business and corporate aviation many excursions do not meet all the conditions to follow the lead of airlines. “Our segment Charbonneau the calculations are based on. If you calcu- of the industry is an anomaly for its failure late that you can land on a 9,000-ft [2,743-m] to develop a just culture and formal volun- runway, then land one-third of the way past the tary safety reporting programs,” Chisholm touchdown zone — you just landed on a 6,000-ft said. “In fact, while corporations continue to [1,829-m] runway, and your calculations are no gain efficiency and improve safety through longer valid.” sharing of best practices, airlines are moving Stephen Charbonneau, senior manager, avia- into the second generation of ASAP [aviation tion safety and security, Altria Client Services, safety action program] where they will share asked a relevant question: If stabilized approach- information across the industry. Meanwhile, es are SOP in every flight department and are voluntary safety and operational reporting the first line of defense against an approach remains a foreign, if not threatening, concept Chisholm and landing accident or runway excursion, to corporate aviation.” “why do pilots continue to attempt to salvage He recommended a process “to collect unstabilized approaches?” reports from corporate aviation operators, He cited four possible reasons: “Exces- de-identify them, run root cause taxonomy sive confidence in a quick recovery; excessive and produce highly valuable insights. Broadly confidence because of runway or environmental incorporating that program into corporate avia- conditions; inadequate preparation or lack of tion safety management systems will allow other commitment to conduct a go-around; or absence operators to identify hazards before experienc- of decision because of fatigue or workload.” ing them in a surprising operational situation. ‘Our segment of Stabilized landing criteria are derived from It is time for corporate aviation to recognize the guidelines established by the FAA, manufac- safety opportunities offered by ASAP.” the industry is an turer’s performance certification data, safety re- Adopting a program that has proven its worth search and empirical data gathered from review in other industry segments will enable corporate anomaly for its failure of corporate flight operational quality assurance aviation operators to “share experiences and [C-FOQA] reports, Charbonneau said. leverage their lessons learned, so that the industry to develop a just “The criteria consider the effects of excessive discovers how to mitigate risk before even recog- culture and formal height, airspeed, groundspeed, landing beyond nizing the hazards,” Chisholm said. the touchdown zone, and insufficient or ineffec- Cox of Safety Operating Systems summed voluntary safety tive braking. Each of the criteria will need to be up the overall corporate aviation situation: “We met, within reasonable tolerances, in order for a have work to do.” reporting programs.’ landing to be considered as stabilized.” Keeping up with best safety practices is not Note only the responsibility of pilots. Management 1. Veillette, Patrick R. Aviation Week & Space
Photos: J.A. Donoghue J.A. Photos: has its own part to play. W. Todd Chisholm, Technology, May 6, 2009.
www.flightsafety.org | AeroSafetyWorld | JUNE 2010 | 39 40 | hum I scientific data,scientific or to cope with changing driven by industrial pressures or new crewmembers.flight scheme for limiting fatigue among originally were conceived as asimple to limitations time as flight (FTLs), and limits,rules collectively referred rules and otherrules constraints. These its, limits, time flight minimum rest areules regulated by duty lim- time n commercial aviation, crew sched- Over time, FTLshaveOver evolved, anfactors The Best Rest BY DAVID HELLERSTRÖM, HANSERIKSSON,EMMAROMIGANDTOMASKLEMETS A comparisonofdiffering regulatory efforts ments and other safeguards, they do a and, combined with labor agree- regulations findings. with new the toit compare becomes useful existing andsleep work-related fatigue inhand, and airline competitiveness. crew productivity, — crew alertness in different of parts world the affecting major differences among FTLschemes aircraft capabilities. Today, there are FTLs are relatively straightforward, With results the of research new on to control pilotfatigue. flight safety foundation scientific knowledge of fatigue and has been directed toward increasing outside limits the is inherently unsafe. limitsthe is inherently safe, flying while create —suggesting that within to fly of FTLsis illusion the of safety that they But by far most the troublesome aspect limit operational flexibility and efficiency. ly, FTLs tend to be extremely rigid and under most circumstances. Unfortunate- reasonable jobof protecting alertness In recent years, considerable effort |
World AeroSafety | June 2010 June
© Monika Wisniewska/iStockphoto HUMANFactors
alertness. By combining new knowledge of fa- Analytical Methods tigue with safety and risk management processes, To build the schedules for comparing FTLs, we the concept of the fatigue risk management used the system illustrated in Figure 1. Our sys- system (FRMS) was created. In previous work, we tem centers on an “optimizer,” which considers an have demonstrated that a properly implemented airline’s timetable and a set of rules and objectives and managed FRMS can be vastly superior to to build crew schedules. In each of our FTL com- FTLs in managing alertness while maintaining parisons, we created a schedule using one airline’s or improving productivity.1 Whereas FTLs are timetable and one of the FTL sets as a constraint. not feedback-driven and often lack a scientific To simulate an FRMS, we created schedules with- basis, an FRMS is by definition intended to be a out the constraint of an FTL set, instead using the closed-loop, data-driven process. In addition to predictions of our alertness model. the stronger scientific basis of an FRMS, an added The FTL sets used were EU-OPS with Sub- benefit is increased operational flexibility. part Q — abbreviated as Joint Aviation Require- FRMSs are built around predictive tools ments (JARs); U.S. Federal Aviation Regulations including, but not necessarily limited to, (FARs) Part 121; and China Civil Aviation mathematical models of fatigue and alertness. Regulations (CCARs) 121 Rev 3. Each FTL Models predict crew alertness from planned and scheme has a different focus: actual schedules and inferred sleep and wake • JARs focus on duty-time limitations with history. Models also consider known physiologi- reduced daily limits based on the number cal phenomena, such as circadian rhythms and of legs and time of day. Duty time can be sleep propensity, and make predictions based extended twice in seven days. Minimum on these considerations. Unfortunately, while rest between duty periods is 10 hours. There models have been developed and validated in a may be no more than seven days of work laboratory environment, more work is required between rest periods of at least 36 hours. to validate the models in a commercial aviation environment. Without validation and other checks, the use of any specific model on FRMS Tools and Conditions Used in Schedule Creation in scheduling is ill advised. Thus, we are faced with a dilemma. FTLs United States Timetable/ are imperfect, but well understood and easy to European Union schedule apply. An FRMS is better for managing fatigue- FARs China JARs Airline networks related risk but must be developed and validated CCARs to be trusted. Until FRMSs are widely proved FTL and implemented, the goal must be to refine conditions FTLs to be as close as possible to an FRMS- Rules and based approach. A refined FTL should strive to Optimizer Crew schedule objectives guarantee an equivalent or better level of flight safety while allowing airlines to efficiently and Alertness flexibly operate their businesses. model
For this article, we analyzed three different BAM sets of FTLs for productivity and alertness. We compared these regulatory formulations to a model-based FRMS. The analysis used a fatigue BAM = Boeing Alertness Model; CCARs = China Civil Aviation Regulations; FARs = U.S. Federal Aviation Regulations; FTLs = Flight time limitations; model within crew scheduling optimization JARs = Joint Aviation Requirements (referring to EU-OPS with Subpart Q) software on the timetables of three short-haul Source: David Hellerström, Hans Eriksson, Emma Romig and Tomas Klemets airline fleets. Finally, we demonstrated our sug- gested alternative for improving FTLs. Figure 1 www.flightsafety.org | AeroSafetyWorld | June 2010 | 41 humanfactors
• FARs limit block time and lack real duty- solutions were hard to map to a single descriptive time limits. Minimum rest between duty value or statistical measure; therefore, we chose to periods is eight hours. There must be report and compare the lowest level of predicted weekly rest of at least 24 hours in every alertness, as well as the average alertness value of seven-day period. the lowest 1 percent, 5 percent and 10 percent of flights within the schedule. • CCARs address both block time and duty To quantify the relative productivity of the time limits. Minimum rest between duty solutions, we created a composite measure of periods is 10 hours. The weekly rest require- productivity called the “Resource Index (RI).” ment is 48 hours in any seven-day period. RI values are a measure of how much less ef- In addition to the three FTL sets, we created an ficient a solution is than a theoretically “perfect” “FRMS” rule set based on a model’s predicted solution. Using all three airline data sets, we ob- alertness. The rule set was created using the served the same trend in the RI: The FARs were Boeing Alertness Model (BAM), a bio-math- the most flexible and most efficient of the FTL ematical model of alertness.2,3 In this rule set, schemes, followed by the CCARs and finally the there were no rules on flight time, duty time, JARs. The flexibility of the FARs comes primari- or rest time; instead, an alertness limit was set, ly from the lack of duty-time limits and the pos- under which no flights would be scheduled. sibility of a rest period as short as eight hours. It is possible to build Alertness is predicted on a scale from zero (least However, the BAM outperformed all three FTL alert) to 10,000 (most alert), which we call the sets in terms of the resource index. solutions that protect Common Alertness Scale.4 When we considered average block time per against fatigue JARs and CCARs consider duty time to in- duty day — another measure of productivity — clude briefing and debriefing; for this analysis, we we saw similar performance on predicted alert- without sacrificing set the parameters for briefing time to 45 minutes ness from BAM and the FTLs. Only when applied before active duty and 30 minutes before passive to the Chinese data set did the FARs generate a productivity. duty.5 Debriefing time was set to 15 minutes. solution more efficient than that created by BAM. CCARs define “rest at rest location” as being rest Under the U.S. airline operating conditions, at a hotel, rather than at an airport; therefore, 20 with relatively fewer legs and legs of longer minutes at each end of the rest interval were used duration, the JARs outperformed the CCARs in for local transport and not regarded as valid rest. terms of crew productivity per day; in all other cases, the JARs were the least efficient of the FTL Data Sets schemes. The performance shortfall on the other Three large data sets — derived from publicly FTL sets probably stemmed from the reduction available flight timetables of China Southern in duty-time limits for many sectors under the Airlines, Lufthansa and Northwest Airlines — JARs. We also noted that the FARs — without were used to compare the properties of the FTLs any real duty-time limit — consumed much more with respect to productivity and alertness. duty time than the other FTL schemes. All flights were two-pilot operations in Airbus Figure 2 shows the level of fatigue is highly A320 aircraft. Average flights in the Europe and dependent on the data set because legs sched- China data sets were less than two hours, while uled very early or very late always cause low flights in the U.S. data set averaged 2.5 hours. alertness. As shown in the figure, the FARs To compare the solutions, we relied on met- provided the least protection against fatigue; rics representing the resources needed to imple- the CCARs and JARs were comparable to each ment a solution for each flight and the predicted other, but the JARs provided somewhat better alertness level of flight crewmembers. A low level protection. The solutions produced by BAM of predicted alertness on a flight is associated were better at protecting against fatigue — with higher risk. The alertness properties in the not surprising because when constructing a
42 | flight safety foundation | AeroSafetyWorld | June 2010 HUMANFactors
schedule with BAM, Alertness Comparison predicted alertness is a primary objective. European Union United States The BAM solutions 3,500 3,500 BAM were interesting 3,000 3,000 BAM because they showed 2,500 2,500 JARs CCARs that it is possible to JARs 2,000 CCARs 2,000 FARs build solutions that FARs 1,500 1,500 protect against fatigue
Alertness (CAS) 1,000 Alertness (CAS) 1,000 without sacrificing productivity. 500 500 Worth noting is 0 0 Lowest Average Average Average Lowest Average Average Average that many of the FTL- value 1% 5% 10% value 1% 5% 10% permissible flights associated with low China alertness would not be 3,500 allowed under BAM- 3,000 BAM based rules. 2,500 JARs CCARs 2,000 FARs Improving the Rules 1,500 The tools used for
Alertness (CAS) 1,000 this productivity and 500 alertness compari- 0 son can be extended Lowest Average Average Average into a framework to value 1% 5% 10% improve prescriptive BAM = Boeing Alertness Model; CAS = Common Alertness Scale; CCARs = China Civil Aviation Regulations; FARs = U.S. Federal rules, such as an FTL Aviation Regulations; JARs = Joint Aviation Requirements (referring to EU-OPS with Subpart Q) scheme, to help the Source: David Hellerström, Hans Eriksson, Emma Romig and Tomas Klemets FTL scheme provide better protection Figure 2 against low alertness while also maintaining or improving productiv- From the first two solutions, we can identify ity. In this application, the optimizer can be used the productivity and protected level of alert- to analyze the properties, including productiv- ness of our original rule set, and the maximum ity and alertness, of an evolving rule set. The productivity and protected level of alertness. In method identifies overly restrictive rules and the third solution, bad patterns of productivity loopholes in the existing rule set. and alertness are easy to identify. The improvement begins with the creation For every iteration, researchers must decide of three reference solutions. One solution is if they want to tighten the rules to improve on based solely on the alertness model with no alertness, or relax an overly restrictive rule to in- other limiting rules. The second solution is crease productivity. When the increased produc- based on the limits in the prescriptive rules. The tivity option is selected, the revised rule set also third solution is a stress test solution, also based changes the alertness outcome — probably for on the limits in the prescriptive rules. In the the worse. Likewise, when alertness is improved, stress test, the researcher activates an incentive the rule set usually causes loss of productivity. so that the optimizer will produce the most tir- Changes that improve productivity or alertness ing solutions allowed under an FTL. — without one affecting the other — are ideal. www.flightsafety.org | AeroSafetyWorld | June 2010 | 43 humanfactors
Improving Alertness all protection of alertness is sacrificed. In our In our effort to improve the protected level of system, it was possible to apply the prescrip- alertness of an FTL set, we compared the crew tive rule set to the BAM reference solution. schedules produced by the optimizer with the This resulted in “flags” of rule violations in the best version of the prescriptive rules. Crew BAM solution. To determine the most limit- schedules were sorted according to the lowest ing rules in terms of productivity, we compiled levels of alertness, and flights with low crew statistics for the number of violations of each alertness were highlighted. In the crew sched- rule. By looking at the frequency of rule viola- ules leading up to the flights with low alertness, tions — and in some cases the degree of the we identified a combination of duty and sleep rule violations (for example, looking at by how opportunities that created a fatiguing pattern. many minutes a block or duty time limit was After looking at these fatiguing patterns, exceeded) — we were able to gain insight into we proposed a few rules to prevent these pat- where the prescriptive rules were unnecessarily terns from occurring. The proposed rules were constraining productivity. Examples are shown implemented, and their impact was estimated in Table 1. by analyzing the number of rules violations From these insights, new FTL-scheme solu- they created in tions were created from the prescriptive rules, the solution. We with the proposed relaxations added. One new Most Violated Rules also evaluated solution was created for each relaxed rule, as Violated Rule Times the impact of the well as a few solutions in which combinations of Minimum rest time after a duty 475 newly proposed rules were relaxed. The productivity of the new Maximum flying time in a duty 393 rules on the refer- solutions, as well as protected level of alertness, Maximum duty time in a duty 172 ence solution that then could be analyzed. One or several of the Obligatory weekly rest in any seven days 157 was based on the best candidates for a new rule set then could be Maximum flying time in seven days 92 alertness model, chosen for further refinement. Maximum flying time between valid weekly rest 28 and adjusted the The research has validated the methodology
Source: David Hellerström, Hans Eriksson, Emma Romig and Tomas Klemets proposed rules as by applying it to the CCARs rule set and the warranted. data set representing the Chinese airline. Table 1 The final im- In three iterations, nine rule changes were tried pact of new rules was then analyzed by generat- and five rule changes were introduced. The final ing a set of new solutions from the prescriptive result was a rule set in which the average block rule set and the newly proposed rules. One new time per day was increased by 6 percent from 5 solution for each added rule, and a few solutions hours 59 minutes to 6 hours 21 minutes and alert- using combinations of new rules, were generat- ness was improved between 250 and 700 points on ed. The productivity and level of alertness were the Common Alertness Scale. Differences in alert- analyzed for each solution, and the data were ness are compared in Figure 3, where the new rule plotted on a chart. One rule, or a few rules that set is named CCARs+. The new solution’s resource collectively improved alertness, were chosen to index also dropped 8.5 percent. move forward. The following rule changes were introduced:
Improving Productivity • Prohibiting pilots from being asked to report To examine possibilities for improving produc- for duty more than once in a 24-hour day; tivity, the BAM reference solution became the • Reducing the maximum duty time for duty starting point. As noted, this solution had no periods that fall partly within 2300 to 0330; constraints other than maintaining a protected level of alertness. Theoretically, then, it should • Relaxing the rule governing maximum be the most productive solution possible, unless block time in a duty period;
44 | flight safety foundation | AeroSafetyWorld | June 2010 HUMANFactors
• Relaxing the rule governing minimum rest In the meantime, assuming that current FTL after duty; and, schemes are to be moved toward FRMS, we have described a method for improving an existing • Adding a complementary rule for maximum FTL scheme to better protect against low alertness duty time after short rest periods — rest while improving or maintaining flexibility and periods that became legal when the original productivity. Finally, we note that the methodology minimum rest-after-duty rule was relaxed. used in this study for The parameter changes tested in the case study analysis and improve- Protected Alertness Levels were large and had a large impact on produc- ment of rules can just tivity and alertness. More refined parameter as well be applied by an 3,500 changes could be tested to find a better trade-off operator in scheduling 3,000 BAM between alertness and productivity. as an essential part of 2,500 CCARs CCARs+ The final rule set was stress-tested. The test an FRMS. 2,000 showed that the protected level of alertness had David Hellerström 1,500 increased by 250 to 450 points on the Common and Hans Eriksson are 1,000 Alertness Scale. business analysts with 500 Common alertnessCommon scale Jeppesen Systems. Emma 0 Romig is principal Lowest Average Average Average Conclusions value 1% 5% 10% investigator, flight deck Of the three tested FTL schemes, none com- research and development, pletely protected against low alertness in the BAM = Boeing Alertness Model; CCARs = China Civil with Boeing Commercial Aviation Regulations; CCARs+ = New rule set developed crew schedules. The most concerning bad Airplanes. Tomas Klemets from China Civil Aviation Regulations patterns encountered in the FTL-controlled is product manager with Source: David Hellerström, Hans Eriksson, Emma Romig and Tomas Klemets crew schedules were the planning of unusable Jeppesen Systems. rest during daytime periods, when it would be Figure 3 difficult for the pilots to sleep, and duty periods Notes of maximum length ending close to midnight. 1. Romig, Emma; Klemets, Tomas. “Fatigue Risk These situations are legal and appeared in solu- Management in Flight Crew Scheduling.” Aviation, tions generated from all FTL schemes. Space, and Environmental Medicine Volume 80 The JARs and CCARs rule sets are compa- (December 2009): 1073–1074(2). rable in many aspects, both in productivity and 2. Åkerstedt, T.; Folkard, S. “The Three-Process Model in the protection against low alertness. The JARs of Alertness and its Extension to Performance, FTLs are slightly better at protecting against Sleep Latency, and Sleep Length.” Chronobiology fatigue but less productive if there are many International 14(2), 115–123, 1997. legs in the average duty. The FARs FTLs are the 3. Åkerstedt, T.; Folkard, S.; Portin, C. “Predictions most efficient of the three FTLs but allowed for From the Three-Process Model of Alertness.” very long duty times. FARs FTLs also performed Aviation, Space, and Environmental Medicine 2004; 75(3, Suppl.): A75-83. worst in protecting against low alertness. The levels of alertness predicted by BAM for 4. This scale has been anchored to the Karolinska the FTLs should be viewed with caution because Sleepiness Scale, a widely used scale for rating sleepi- ness. The Common Alertness Scale, and the interface the model is not yet fully validated in airline by which BAM connects with the scheduling operations. When the model is shown to be software, has been formalized in a document shared valid, the safety and business case for FRMS will with leading fatigue modelers, with the intention be further strengthened. Our results indicate that other commercial models can be integrated into that FTLs do not appear to protect well against crew scheduling as BAM has been. low alertness — and within an airline’s FRMS, 5. Passive duty is duty time during which the crew- model-based scheduling should be both safer member flies as a passenger to be positioned for and more productive. further duty. www.flightsafety.org | AeroSafetyWorld | June 2010 | 45 Strategicissues
Safety
ByRenewal Edvaldo Pereira Lima | From São Paulo, Brazil
n November 2008, the International Civil Aviation Organization (ICAO) established the Regional Aviation Safety Group–Pan America (RASG-PA), taking its next big step toward coordination of safety initiatives in Central America, the Caribbean, North America and South America. Parameters for the group’s mission were taken from the ICAOI Global Aviation Safety Plan, a strategic action plan for 2008–2011 to accomplish a reduction in the number of fatal accidents and fatalities irrespective of the volume of air traffic, a significant decrease in the global accident rate and regional rates no more than twice the global figure. In cooperation with the Latin American and Caribbean Air Transport Association (ALTA), the RASG-PA hosted the 1st Pan American Aviation Safety Summit, a major col- laborative effort and historic event for the region’s commercial aviation community, draw- ing about 200 attendees here on April 19–23. Loretta Martin, regional director for ICAO’s North American, Central American and Caribbean Office, defined safety for purposes of the summit as “a condition in which the risk of harm and damage is limited to an acceptable level.”1 Worldwide, the hull-loss accident rate of Western-built transports, measured by airline domicile, was 1.0 per million departures in 2000–2009. The rate for the United States and Canada was 0.5, and the countries of Latin America and the Caribbean had a rate of 2.3, Martin said. States targeted by RASG-PA had a combined 31 fatal accidents, with 1,254 fatali- © John Woodcock/iStockphoto © John ties, she said.2 The good news: There were no hull-loss accidents involving Western-built
46 | flight safety foundation | AeroSafetyWorld | June 2010 Strategicissues
commercial jet aircraft operated by Latin in states in other regions of the world. In 2007, American or Caribbean air carriers in 2009, the local airline industry boarded 14.4 million Regional summit down from a rate of 2.5 the year before; the rate total passengers. Last year, that figure was 16.3 focuses Pan decreased from 0.58 to 0.41 for the United States million; so as traffic and operations grew, the and Canada combined. number of accidents decreased.4 American aviation Within Pan American subregions, the safety leaders on loss picture may differ radically for specific states or A Major Culprit of control, CFIT, aviation stakeholders, which made the summit a Despite encouraging numbers, safety issues valuable opportunity for dialogue, data exchange, remain in Colombia and elsewhere in the region. unstabilized and sharing experiences, expertise, research find- The no. 1 threat is runway excursions. According approaches and ings and training methods, Martin added. to the International Air Transport Association runway excursions. “All of these different organizations have (IATA), Latin America had a rate of 1.34 runway their own training programs, but they never excursions per million flights in the 2004–2008 really get the opportunity to come together and period, while North America had a rate of 0.36. find out what the other side is doing, and how Between 2004 and 2009, Latin America recorded they are approaching different things,” Martin 28 of these events, the second highest number said. “The point was to share those experiences. worldwide. North America recorded 21. And we were dealing with different levels of Hideki Endo, a captain and assistant direc- development, as well. These states have highly tor, IATA Safety, Operations and Infrastructure, developed systems, under-developed systems brought to the summit a detailed picture of the and systems that are developing. It could be very global situation. Runway excursions during challenging to bring all of these aspects together landing represented 83 percent of the total 161 at different stages of development.” excursions in the 2004–2009 period; runway One case study discussed was Colombia, excursions during takeoff were 17 percent, Endo where the number of civil aviation accidents de- said. Inadequate rejected takeoff performance, creased from 0.62 per 10,000 sectors in 2002 to unstabilized approaches and poor go-around 0.45 in 2009, with fatalities coming down from decisions have been the main causal factors 28 in 2003 to five last year.3 This was achieved in worldwide, he said. Accidents can be prevented a strongly growing market. The global economic through “training, awareness of the threats and crisis seems not to be affecting the Colombian applying good judgment to reduce the risk,” air transport industry as badly as air transport Endo added. Edvaldo Pereira Lima A story of success was related by Geraldo “Harley” Meneses, a captain and safety officer at TAM Linhas Aéreas, which in 2001 became the largest Brazilian airline in its home market. It has continued to expand and now operates into 43 domestic and 17 international destinations, with an average of 730 daily flights. The com- pany’s estimated growth in revenue passenger kilometers for 2010 is 14 to 18 percent, and the fleet likely will increase from 148 aircraft at the end of this year to 165 by late 2014. As the airline prepared for the safety chal- lenges of such rapid growth — taking advantage of a home market that, like Colombia, did not seem to be affected as badly by the economic crisis in other parts of the world — a decision
www.flightsafety.org | AeroSafetyWorld | June 2010 | 47 Strategicissues
was made to reduce unstabilized ap- region’s advocates of such programs committee of the Line Operations proaches. Taking Flight Safety Founda- often encounter hindrances, however, Safety Audit (LOSA) Collaborative — tion’s Approach and Landing Accident in the form of inherent resistance to concluded from LOSA data analysis Reduction Tool Kit5 as a reference, the change and lack of flexibility in today’s that the industry had failed to deal air carrier used its flight data moni- globally competitive market, Arroyo adequately with the challenges of pilot toring program to analyze existing said. This mentality is a companion monitoring. “He designed the idea flight operations, which had shown to funding problems, as the imple- of pilot monitoring training,” Arroyo 38 unstabilized approaches per 1,000 mentation of science-based predictive said. “As soon as he started doing this, flights in 2004. As the safety campaign measures may require financial input, the Asociación Sindical de Pilotos progressed, TAM flight crews reduced he added. Aviadores de México, the associa- this rate to 30 the following year, 10 in He nevertheless sees signs of hope tion of Mexican airline pilot unions, 2006, fewer than five in 2007 and 2008, for fatigue risk management solutions invited him to come share his thoughts.” and 2.08 last year, Meneses reported. in the region. “We lack resources [in When Curzio became director of flight our countries] but there is much good standards at Aeroméxico, he moved LOC-I Solutions will,” Arroyo explained. “It is necessary immediately to turn Sumwalt’s ideas Loss of control in flight (LOC-I) has to make use of these free training initia- into actions. been ranked no. 2 on RASG-PA’s priority tives by RASG-PA and IFALPA. We “Six years later, we have implemented list of regional safety risk areas. Another have found again a way to communi- a cultural shift,” Arroyo said. “We growing concern is flight crew fatigue cate and share all this information.” provide monitoring skills during each and possible links to LOC-I, said Carlos recurrent training and evaluate them at Arroyo Landero, an Aeroméxico captain Pilot Monitoring each training event.” and representative of the International Another case of leveraging interna- Safety hindrances in countries tar- Federation of Air Line Pilots’ Associa- tional best practices for regional safety geted by RASG-PA also have to do with tions (IFALPA). About 20 percent of the has been advanced training for effec- geographical aspects of the environment. voluntary reports received by the U.S. Na- tive pilot monitoring. Monitoring and “For example, Benito Juárez International tional Aeronautics and Space Administra- cross-checking are seen as a crucial Airport in Mexico City is a high-altitude tion (NASA) Aviation Safety Reporting layer of defense, with each crewmem- airport at 7,300 ft,” Arroyo said. “Some System mention fatigue-related factors, ber effectively checking the flight path, 70 percent of the airspace is occupied he said. NASA’s fatigue countermeasures aircraft systems and each other’s ac- by mountains, volcanoes included. The program for civil aviation began target- tions. Arroyo co-authored a presenta- final approach requires a 90-degree turn ing safety issues related to fatigue, sleep tion with another airline captain, Juan within 6 nm [11 km]. Predominating and circadian rhythms in 1980. This early Carlos González Curzio, that said that winds mean one of the two runways is research evaluated more than 500 pilot poor pilot monitoring was found to active 90 percent of the time. We overfly volunteers in line operations, flight simu- be a factor in 84 percent of 37 crew- the city, which produces heat and turbu- lators and sleep laboratory settings. Sleep caused accidents studied by the U.S. lence because of the large paved surfaces loss and circadian rhythm disruption are National Transportation Safety Board and buildings. This used to make our still found to be primary causes of com- (NTSB). Despite this, implementation approaches unstabilized. Thanks to mercial aircrew fatigue, Arroyo said. of more effective monitoring so far has flight monitoring — with LOSA and A particular problem for aircrew has not been a priority task in the region, a flight operational quality assurance been that the body’s circadian-rhythm they said. And to make it happen is [FOQA] program — we identified “clock” is not able to adapt quickly to not easy or intuitive. where we could improve that situation. changes such as time-zone crossings Arroyo recounted a success story So we reduced unstabilized approaches and sudden duty/rest rescheduling. As about the spread of pilot-monitoring by 95 percent.” a positive, science-based response to improvements, however. A few years Technical advice on developing this challenge, fatigue risk management ago, he said, Robert Sumwalt — now solutions like these also has been avail- programs are employing both preven- an NTSB member, then a US Airways able to the region in other ways. The tive and operational strategies. The captain and member of the steering U.S. Commercial Aviation Safety Team
48 | flight safety foundation | AeroSafetyWorld | June 2010 Strategicissues
(CAST) has been one of them. Kyle Olsen, a an investigation tool.’ This [response] upset our team member and U.S. Federal Aviation Admin- crews. Therefore, we had to take the opportunity istration consultant, came to the summit with a of using safety and accident prevention training mission to share the latest CAST safety enhance- to sell them on the program as a non-punitive ments designed to reduce LOC-I events. initiative. Later, both voluntary and mandatory “We would like to see all the pilots in these reporting began to happen. Our Latino culture Pan American countries have the latest version is a bit reactionary to reporting … with a lot of of upset recovery training,” Olsen said. “The machismo [bravado] and a lack of transparency. next safety improvement we would like to see is On the flight deck, there was also a high degree of for all operators and regulators to discontinue vertical authoritarian power [to overcome].” the use of the term ‘pilot not flying’ and use It took time, but this mentality was changed ‘pilot monitoring,’ which has a different connota- successfully as FOQA data provided information tion. In North America and in Europe, [opera- for safety enhancements that resulted in better tors] have developed guidelines on what tasks operational performance, Mojica recalled. the pilot monitoring should be accomplishing. The cultural shift to data-driven safety The third area is related to the use of automa- initiatives also brought significant results to the tion. Some crews over-use it or under-use it, and LAN group of airlines, said Jaime Silva Rivera, there is a balance for the appropriate use of au- a LAN captain and corporate safety director. tomation. There have been some human factors He described the group’s package of integrated studies done on that issue in North America, reactive, proactive and predictive programs. Europe and Asia. We want to use that material LOSA was implemented five years ago, and to provide guidance in [other] Pan American these airlines also have found the IATA Safety countries. We need expertise from the [local] Audit for Ground Operations to be “an excellent training people at airlines, as well as govern- tool to tackle this complicated issue of ground ment authorities and other interested people to [risks],” Rivera said. LAN has fully implemented help us to really flesh out these [CAST] safety a safety management system (SMS), including enhancement projects in the region.” a personnel drug-testing program and a fatigue Implicit in all the summit presentations risk management program for its crews. was that the region is now being called upon Analytical tools in its flight data monitor- Martin, top, and de Gunten to make a paradigm shift — beyond reactive ing program also have allowed LAN to detect or even proactive models to a data-driven unsafe situations in routine operations. “We predictive model — and local resistance must encountered ice obstruction on the pitot tubes be tackled head-on and mentalities changed of our Airbus A340 and A320 fleets,” Rivera said. accordingly. This is not a comfortable task, how- “We enhanced procedures, changed equipment ever, presenters agreed. and enhanced training, and the modifications to Miguel Antonio Mojica, a captain and flight airspeed indicators meant that we had to send safety director at TACA, told a relevant story: crews to simulator training.” “We began a tremendous transition from the reac- tive mode to the predictive mode by attempting Diversified Goals to introduce FOQA in 2002 and 2003. We fol- Controlled flight into terrain (CFIT), the lowed ICAO’s recommendation that the program third-ranked risk area in summit discussions should be nonpunitive and anonymous. Never- of RASG-PA strategy, generated a dialogue theless, it also has a reactive part, as an investiga- between the air traffic control (ATC) repre- tive tool. So we asked our CEO, ‘What should sentatives and other segments of air transport. be our policy?’ He said, ‘If the staff reports on a Alex Figuereo, vice president Americas, Inter- voluntary basis, we will establish an immunity national Federation of Air Traffic Controllers’ policy. Otherwise, it definitely will be used as Associations (IFATCA), highlighted the role of Lima Pereira Edvaldo www.flightsafety.org | AeroSafetyWorld | June 2010 | 49 Strategicissues
ATC in this issue and tried to clear up a mis- Additional monetary support will be needed to conception. “ATC, as defined by ICAO, is not launch other safety programs, Martin said. responsible for separation from terrain during In addition to the summit’s safety themes of climb and descent phases, except when radar- high-level technical, organizational and cor- vectoring [aircraft],” Figuereo said. porate issues, and human factors, there was an Along the same lines, IFATCA policy says inspirational reminder. When Steven Chealander, that ATC “MSAW [minimum safe altitude a captain, vice president, Training and Flight warning] systems must be fully implemented Operations Support, Airbus Americas, and for- without delay, with the necessary operational mer NTSB member, stepped on stage to deliver requirements and appropriate ATC procedures his presentation, he carried a poignant book. He and training on a worldwide basis, in order to quoted from The Empty Chair: Love and Loss in significantly reduce the numbers of CFIT acci- the Wake of Flight 3407 by Gunilla Theander Kes- dents.” This policy, however, also states, “It must ter and Garyl Earl Ross, an independent anthol- be kept in mind that an aircraft ground proxim- ogy6 of spontaneous poetry, essays, songs, diaries, ity warning system can often perform better memoirs and other writings by family members than ATC MSAW systems.” and friends of the 50 people killed in the crash The role of states in providing safety enhance- of Colgan Air Flight 3407 on Feb. 12, 2009, near ments was covered for summit attendees by Buffalo, New York, U.S. (ASW, 3/10, p. 20). Carlos Pellegrino, operational safety superinten- Chealander used the book to remind his dent at Brazil’s Agência Nacional de Aviação Civil peers in RASG-PA that it takes just one accident (ANAC), the national civil aviation agency. Brazil to forever affect the lives of many, and that a is pioneering the first stage of implementation of normal flight operation in seconds can turn into a state safety program for aviation. This is being a tragedy. “We move lives, we can never forget done under the joint civilian-military arrange- that,” he said. Creating a safety culture is “para- ment the country applies in aviation, in coopera- mount … a leadership issue … to prevent the tion with the Comando da Aeronáutica, Força accident now,” he added.
Aérea Brasileira, the aeronautical command of Edvaldo Pereira Lima is an aviation writer living in Brazil. the Brazilian Air Force, he said. A presentation by Líbano Miranda Barroso, Notes Arroyo CEO of TAM, also received a positive response 1. This definition was developed by the CAST/ICAO from the audience as he detailed the airline’s Common Taxonomy Team.
top-down safety commitment, its SMS structure, 2. Some summit presenters used preliminary IATA principles of balancing safety and operational data for 2009. Another source was: IATA. Safety costs, and safety impact on business continuation. Report 2008. 45th edition. April 2009. Data are for Alex de Gunten, ALTA’s executive direc- hull losses per million sectors. tor, said he considered the summit successful 3. Data are from the Aeronáutica Civil de Colombia, but emphasized that the work discussed is not the civil aviation authority of Colombia. yet done. “Latin America improved in safety 4. Aeronáutica Civil de Colombia. last year, but we’re still not where we want to be,” he said. “We want to reach the levels of 5. Detailed explanations of stabilized approach as a safety defense are in the newly revised version of the United States and Europe in incident rates.” the FSF ALAR Tool Kit at Edvaldo Pereira Lima Pereira Edvaldo safety events and translate key safety documents. center/1>. 50 | flight safety foundation | AeroSafetyWorld | June 2010 DataLink BY RICK DARBY Changing Course Australian commercial aviation last year reversed unfavorable safety trends in two key areas. he safety record of Australian- provides a prescriptive list of the types years following a low point in 2005 registered charter aircraft of occurrences that are required to be and 2006 (Figure 1, p. 52). improved in 2009 after two years reported to the ATSB. This increase may “About one in 10 accidents involved in which the numbers of aircraft also reflect a better reporting culture.” a fatality, and there [were] about three Tinvolved and accidents had risen, ac- In Australian commercial air trans- fatal injuries for each accident that in- cording to a report from the Australian port, the 3,864 aircraft involved in inci- volved a fatality,” the report says of the Transport Safety Bureau (ATSB) com- dents in 2009 were fewer than those in 11-year period. For the first time since paring accident data in the 1999–2009 the previous two years (Table 1). Aircraft 2004, there were no fatalities in 2009 in period.1 In commercial air transport, involved in serious incidents also de- commercial air transport. the number of aircraft involved in clined in number in 2009 compared with The numbers of high-capacity, serious incidents also declined in 2009 the two previous years. The 26 aircraft regular public transport (RPT) air- after a couple of years of increases.2 involved in serious incidents represented craft involved in incidents and serious “A general increase has been ob- a 43 percent decrease from 2008. incidents in 2009 were lower than the served in the number of VH- [Austra- The 11 total accidents for 2009 were previous two years (Table 2).3,4 Fatal lian-] and foreign-registered commercial the lowest of any year in the study period, accidents in this category continued to air transport aircraft incidents over the and 38 percent of the previous year’s total. flatline at zero. Accidents per million 11 years of observation,” the report says. Data for accidents per million departures in 2009, at 2.1, were the low- “This increase may be attributed to the departures were not yet available for est in the study period. introduction of the Transport Safety 2009. The trend for the study period The accident rate declined from Investigation Regulations 2003, which has been increased rates in recent its highest point in 1999 — 23.9 per Accidents and Injuries, Australian Commercial Air Transport, 1999–2009 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 Number of aircraft involved Incidents 3,185 3,213 3,142 3,011 2,695 3,464 4,119 3,708 3,915 4,053 3,864 Serious incidents 2 9 9 10 15 30 33 16 45 46 26 Serious injury accidents 0 2 1 3 1 0 2 0 1 3 2 Fatal accidents 3 4 4 4 2 0 2 1 2 3 0 Total accidents 32 33 38 27 31 16 12 12 22 29 11 Number of people involved Serious injuries 2 3 4 8 4 0 2 0 1 15 3 Fatalities 10 19 10 12 8 0 18 2 2 6 0 Rates Accidents per million departures 28.0 28.8 34.6 26.8 30.9 14.4 10.8 10.8 18.6 25.0 — Fatal accidents per million departures 2.6 3.5 3.6 4.0 2.0 0.0 1.8 0.9 1.7 2.6 — Source: Australian Transport Safety Bureau Table 1 www.flightsafety.org | AeroSafetyWorld | June 2010 | 51 DataLink million departures — to 3.2 per million depar- Accident Rates, Australian Commercial Air Transport, 1999–2009 tures in 2002 (Figure 2). Aside from a slight 70 “bump” in 2007 and 2008, the rate has stayed s e r Accident u 60 within a 2 to 3 per million departures range. r t Fatal accident a p 50 e The 10 serious incidents in 2009 were de- d 40 on scribed by the report as follows: “engine compres- 30 sor blade damage, a breakdown of separation, milli r e 20 p an aircraft commencing to land with the landing e t 10 a R gear retracted, a separation of the nosewheel 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 from an aircraft, an in-flight windscreen fire, a Source: Australian Transport Safety Bureau cabin depressurization, an in-flight warning, and three occurrences involving crew incapacitation.” Figure 1 The number of incidents involving low- capacity RPT aircraft has decreased by about Accident Rates, Australian High-Capacity RPT, 1999–2009 30 percent during the study period, the report said.5 Twenty accidents in the category were 80 s e Accident r 70 recorded during the period, with one in 2009. u Fatal accident r t a 60 There were four serious incidents in 2009. The p e d 50 report said, “Two occurrences involved flight on 40 control systems, one being a trim system failure 30 milli r e 20 and nose pitch-up, and the other being a nose p e t 10 a pitch-down event of unknown origin. The other R 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 two serious incidents related to airspace separa- tion and an airprox.”6 RPT = regular public transport Between 1999 and 2003, the fluctuation Source: Australian Transport Safety Bureau in the number of charter aircraft involved in Figure 2 occurrences was relatively stable. But between Accidents and Incidents, Australian High-Capacity RPT, 1999–2009 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 Number of aircraft involved Incidents 1,672 1,711 1,733 1,776 1,478 1,976 2,391 2,184 2,242 2,457 2,404 Serious incidents 1 4 5 6 6 10 12 4 16 20 10 Serious injury accidents 0 1 1 1 1 0 1 0 1 1 1 Fatal accidents 0 0 0 0 0 0 0 0 0 0 0 Total accidents 7 3 3 1 1 1 1 1 3 3 1 Number of people involved Serious injuries 0 2 1 1 4 0 1 0 1 12 1 Fatalities 0 0 0 0 0 0 0 0 0 0 0 Rates Accidents per million departures 23.9 9.3 8.8 3.2 3.1 2.6 2.5 2.4 6.9 6.2 2.1 Fatal accidents per million departures 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 Accidents per million hours 9.9 3.9 3.8 1.4 1.3 1.1 1.1 1 3 2.7 — Fatal accidents per million hours 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 — RPT = regular public transport Source: Australian Transport Safety Bureau Table 2 52 | flight safety foundation | AeroSafetyWorld | June 2010 DataLink Accidents and Incidents, Australian Charter Operations, 1999–2009 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 Number of aircraft involved Incidents 424 435 357 411 374 445 522 577 689 712 599 Serious incidents 1 0 0 1 3 9 6 6 13 13 11 Serious injury accidents 0 1 0 2 0 0 1 0 0 2 1 Fatal accidents 3 3 4 4 2 0 1 1 2 3 0 Total accidents 21 26 32 20 26 15 9 10 18 26 8 Number of people involved Serious injuries 2 1 3 7 0 0 1 0 0 3 2 Fatalities 10 11 10 12 8 0 3 2 2 6 0 Rates Accidents per million departures 43.3 56.4 71.3 45.2 60.2 30.4 18.8 21.1 33.2 52.5 — Fatal accidents per million departures 6.2 6.5 8.9 9.0 4.6 0.0 2.1 2.1 3.7 6.1 — Accidents per million hours 41.3 54.2 68.2 44.6 60.2 31.0 18.6 20.8 32.9 49.9 — Fatal accidents per million hours 5.9 6.3 8.5 8.9 4.6 0.0 2.1 2.1 3.7 5.8 — Source: Australian Transport Safety Bureau Table 3 2004 and 2008, the range was about 48 percent higher, comparing the means of Accident Rates, Australian Charter Aircraft, 1999–2009 7 each range (Table 3). The 599 charter 80 s e Accident r 70 aircraft involved in incidents in 2009 u Fatal accident r t a 60 marked a reversal of the seven-year p e d 50 trend, however. on 40 Of all air transport operations, char- 30 milli r e 20 p ters had the highest rate of aircraft in- e t 10 a volved in accidents and fatal accidents R 0 per million departures in the most 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 recent year for which data are available, Source: Australian Transport Safety Bureau 2008 (Figure 3). This aircraft accident rate — 52.5 per million departures — Figure 3 was a 58 percent increase over 2007. at BOOKS cargo safety, with the ultimate goal of assisting all types of airport and aircraft operators and Does Your Aircraft Have a Drinking Problem? all other responsible bodies in achieving high Guide to Hygiene and Sanitation in Aviation: Module 1, standards of hygiene and sanitation, to protect Water; Module 2, Cleaning and Disinfection of Facilities travelers and crews engaged in air transport.” World Health Organization (WHO) Press. Third edition. 2009, Although public health specialists have the released April 2010. 60 pp. Figures, tables, references, annexes. responsibility to see that, for example, the source his supersedes the previous edition of the of water coming into the airport and aircraft Guide, published in 1977. Although it says is disease-free, they cannot monitor the entire Tthat basic principles of hygiene have not supply chain. Airport and operator management changed since then, the aviation world has, with personnel, as well as cabin crewmembers, need new health threats as a consequence. to keep an eye out for possible contamination. Besides the growth in air traffic, “the current Besides the original source, the aircraft trend in international civil aviation is toward drinking water supply chain has three additional aircraft of larger passenger-carrying capacity stages: and greater range,” the Guide says. “The intro- The airport water system. This includes the lo- duction of air services into areas with inad- cal area distribution system. Some airports have equate public health infrastructure, such as food their own water treatment facilities; handling and storage, water supply, and waste The transfer point. This, the Guide says, “is disposal, creates a challenge for aircraft opera- typically a temporary interconnection between tors. To protect public health, the application the hard-plumbed distribution system of the of high standards of hygiene should form an airport (e.g., at a hydrant) and the aircraft integral part of airport and aircraft operations.” water system, by means of potable [drinkable] Occasional reports of incidents involving water vehicles and carts, refillable containers food-borne illness associated with international or hoses. This water transfer process provides travel are reminders of the importance of ensur- multiple opportunities for the introduction of ing the quality of food and drinking water aboard contaminants into the drinking water”; and, aircraft, the Guide says. The boldest headlines, The aircraft water system. This includes “the however, have been generated by the potential water service panel, the filler neck of the aircraft for the transmission through commercial aircraft finished water storage tank and all finished flights of communicable diseases such as severe water storage tanks, including refillable con- acute respiratory syndrome (SARS) and extreme- tainers/urns, piping, treatment equipment and ly drug-resistant strains of tuberculosis. They plumbing fixtures within the aircraft.” Next stop, have created a renewed interest in an aircraft the aircraft’s galley and lavatory outlets serving environment conducive to health, the Guide says. passengers and crewmembers. This edition of the booklet addresses “wa- The Guide says that random testing of water ter, food, waste disposal, cleaning and disinfec- on aircraft by Health Canada, the U.K. Associa- tion of facilities, [disease] vector control and tion of Port Health Authorities and the U.S. 54 | flight safety foundation | AEROSafetyWorld | June 2010 InfoScan Environmental Protection Agency has raised aircraft in a sanitary condition at all times; de- aircraft water health concerns. The Canadian signing and building aircraft to facilitate proper and U.S. studies revealed the presence of total cleaning and disinfection; and having onboard coliforms on 15 percent and E. coli bacteria on procedures to prevent the spread of disease and as many as 4 percent of aircraft. contain infection at the source. “Most total coliforms are not pathogens per Standard disinfection procedures are se, but a positive test is an indicator of inad- described. equate sanitation practices; E. coli are indicative — Rick Darby of recent fecal contamination, and some E. coli are human pathogens,” the Guide says. Toe-to-Toe in the Sky In response, the Guide offers detailed health How Boeing Defied the Airbus Challenge: guidelines for water management, with a list of An Insider’s Account indicators to gauge whether each is being followed. Pandey, Mohan R. CreateSpace, On-Demand Publishing. 2010. 242 pp. References, index. The guidelines include plans for each compo- nent of the water supply chain; meeting WHO o take the most obvious issue first, Pandey, a Guidelines for Drinking-Water Quality or national longtime Boeing employee, says that his book standards; monitoring water quality; ensuring an T“in no way represents Boeing’s position; it is appropriate response when a risk is detected; mak- only my personal perspective. I hope I have rep- ing potable water available in sufficient quantity, resented all sides — Boeing, Airbus and various pressure and temperature throughout the supply industry positions — fairly and accurately.” Using chain; and independent surveillance of water qual- the pronoun “we,” meaning Boeing — as in “at ity by a qualified authority. the end we outmaneuvered Airbus” — does not The other module includes equipment clean- inspire confidence in the book’s objectivity. Read- ing, primarily “the removal of dirt or particles,” ers will make their own judgments about fairness. and disinfection, or “measures taken to control, Nevertheless, pilots, aviation industry man- deactivate or kill infectious agents, such as agers and flight enthusiasts will find much of viruses and bacteria.” interest in Pandey’s description of the techni- The Guide says, “Commercial air transport cal, economic and political issues involved in is potentially an efficient means for spreading producing new airliner types. Primarily, this is communicable disease widely by surface contact an account of the development of the Boeing and proximity to infected persons.” 777, part of its manufacturer’s response to Disease vectors are not limited to cough- competition from Airbus, and particularly the ing and sneezing passengers. Every so often the A340 four-engine, long-range passenger jet and news media report, in a humorous tone, about a its twin-engine stablemate, the A330. “SWAT team” searching an entire airliner after a Pandey describes the Airbus A320 family rat is spotted. The risk is real, however. Rodents as having frayed nerves at Boeing, taking a big and insects are efficient carriers of infection. bite out of the market for the Boeing 737 series. Flies should not fly — on airliners. The A330/340 model threatened to challenge After outlining the routes of infection the long-range dominance of Boeing’s “jumbo” transmission that can occur aboard aircraft, jet, the 747, and its 767. “After looking at various the Guide again provides guidelines along with options, including a three-engine 7J7, by the late indicators of their observance. These include 1980s, Boeing concluded that to attack both the keeping an airport in a sanitary condition at all A330 and the A340, its new airplane had to be times; designing and building airports in a way a fuel-efficient big twin,” Pandey says. That was that facilitates proper cleaning and infection; the genesis of the 777. having post-event disinfection procedures to One of the many hurdles, other than techno- prevent contamination from spreading; keeping logical and production, that Boeing had to deal www.flightsafety.org | AEROSafetyWorld | June 2010 | 55 InfoScan with for its 777 to pay off was extended opera- with Bombardier and Embraer moving into the tions (ETOPS) regulations. “Boeing had to secure medium-capacity, medium-range market and go- ETOPS approval for these big twins,” Pandey says. ing toe-to-toe with Boeing and Airbus. The team “But there was a wrinkle. The FAA [U.S. Federal names will change, but the game will be the same. Aviation Administration] requirements stressed — Rick Darby the importance of in-service experience.” The FAA and other regulatory agencies WEB SITES internationally — which would have a say in the long-haul routes the 777 was designed for — re- News From EASA quired that a new type-and-engine combination EASA General Publications, 56 | flight safety foundation | AEROSafetyWorld | June 2010 OnRecord Tail Strike Follows Bounced Landing The A320’s nose was raised too high after the hard touchdown. BY MARK LACAGNINA The following information provides an aware- said the report by the U.S. National Transporta- ness of problems in the hope that they can be tion Safety Board (NTSB). Recorded flight data avoided in the future. The information is based indicated that the tail wind component had on final reports by official investigative authori- increased to 11 kt. ties on aircraft accidents and incidents. The descent rate was about 800 fpm when the airplane was 50 ft above touchdown. “The JETS first officer stated that he attempted to arrest the sink rate with larger-than-normal aft stick Tail Wind, Excess Thrust Were Factors deflection,” the report said. “During the flare, Airbus A320-211. Substantial damage. Four minor injuries. passing 20 ft above the runway, the automated s the A320 neared Denver International ‘retard’ callout [was generated three times]. This Airport with 147 passengers and seven automated callout is designed to remind the pi- Acrewmembers the afternoon of May 4, lot to move the thrust levers to the idle detent.” 2009, the automatic terminal information ser- This action causes the ground spoilers to deploy vice (ATIS) reported winds from 240 degrees at on touchdown. 4 kt and 10 mi (16 km) visibility. The flight crew Despite the automated callouts, the thrust planned for a visual approach to Runway 16L, levers were not retarded. During the flare, the using the instrument landing system (ILS) as a airplane’s pitch attitude was increased to 8 de- backup, and an approach speed of 139 kt. grees nose-up, and airspeed decreased to 132 kt, The first officer, 48, was the pilot flying. He or 7 kt below the target. The autothrottle system had 5,901 flight hours, including 200 hours as commanded an increase in engine power to second-in-command of A320s, and held type recover airspeed, and N1 (fan speed) increased ratings for the Boeing 707 and Douglas DC-9. from 54 percent to 64 percent in three seconds. The captain, 49, had 14,619 flight hours, includ- “The airplane touched down on both main ing 2,677 hours as an A320 pilot-in-command. landing gear with a vertical load of about 1.56 The airplane was 1,000 ft above the runway g [i.e., 1.56 times standard gravitational accel- touchdown zone elevation (5,347 ft) when the first eration],” the report said. “The airplane then officer announced that the approach was stable. bounced as a result of the excess thrust and the Shortly thereafter, the airport traffic controller position of the thrust levers forward of idle, cleared the crew to land on Runway 16L and ad- which prevented deployment of the spoilers.” vised that the wind was from 260 degrees at 5 kt. During the bounce, the first officer re- About 750 ft above touchdown, the crew tarded the thrust levers to idle and moved his disengaged the autopilot and engaged the flight control stick fully aft, increasing the airplane’s directors and autothrottles. “During the final ap- pitch attitude to about 12.5 degrees nose-up, proach, the crew noted an increasing tail wind,” which is greater than the maximum pitch angle www.flightsafety.org | AEROSafetyWorld | June 2010 | 57 OnRecord of 11.7 degrees specified in the flight crew passengers and two pilots for a private flight to operating manual. Pau, France. “It was not possible to ascertain the “The captain attempted to add nose-down exact role of each pilot during the flight,” said ‘The captain pitch to prevent the tail strike but was too late,” the report, which identified the left-seat pilot the report said. “The airplane experienced heavy as “Pilot A” and the right-seat pilot as “Pilot B.” attempted to add abrasions, dents and perforations of the skin; the Both held single-pilot certification in the Cita- aft galley drain mast and two airplane anten- tion 500. nose-down pitch to nas were broken; the auxiliary power unit air Pilot A, 57, was employed by the aircraft intake sustained damage, and the rear pressure owners. He had 8,278 flight hours, including 18 prevent the tail strike bulkhead was buckled and cracked.” Four flight hours in the Citation. “He had recently complet- but was too late.’ attendants reported minor injuries; the report ed a type conversion onto the aircraft, and it is did not specify the nature of the injuries. believed that he had wished to fly with another Shortly after the A320 accident, the crew pilot who had more hours on type, acting as of an Embraer 145 conducted a go-around mentor, until he gained more experience,” the from an approach to Runway 16R because the report said. indicated tail wind component exceeded 10 kt. Pilot B, 63, had 4,533 flight hours. The report Air traffic control subsequently changed the said that his time in type is unknown but that he active runways. An official weather observation had “in excess of 70 hours” in Citation 500s. 35 minutes after the accident indicated that The airport traffic controller, who cleared surface winds were from 330 degrees at 13 kt, the pilots for takeoff from Runway 21 at 1332 gusting to 17 kt. local time, said that the takeoff appeared The report noted that Airbus had developed normal. The pilots made a right turn to the an A320/A321 flight warning computer modi- northeast, in accordance with their instrument fication — a “pitch pitch” callout designed to flight rules clearance. increase pilot awareness of an impending tail At 1334, Pilot B radioed, “We’re making an im- strike — but none of the A320s in the acci- mediate turn to return to the airport.” When asked dent airplane operator’s fleet had received the the nature of the problem, the pilot said, “We don’t modification. know, sir. We’re getting engine vibration.” The vibration detected by the pilots was not Puzzling Power Loss caused by an engine but by the failure of the Cessna Citation 500. Destroyed. Five fatalities. inlet fan for the air cycle machine, which condi- precautionary but unnecessary engine tions engine bleed air before it enters the cabin. shutdown, a flameout of the other en- Nevertheless, in the likely scenario devel- A gine due to a mechanical failure of the oped by investigators, the pilots decided to thrust lever, and a rushed and unsuccessful check each engine separately to troubleshoot attempt to restore power from both engines the vibration. They began by reducing power might have led to the Citation’s crash near from the right engine. Because of the conse- England’s Biggin Hill Airport the afternoon quent reduction of bleed air flow to the air of March 30, 2008. However, the absence cycle machine, the vibration caused by the bro- of flight recorders aboard the 33-year-old ken inlet fan also decreased, causing the pilots aircraft precluded a conclusive reconstruction to perceive that the right engine was producing of the events leading to the accident, accord- the vibration. Accordingly, they shut down the ing to the report by the U.K. Air Accidents right engine. Investigation Branch (AAIB). Meanwhile, the pilots had begun a left turn Visual meteorological conditions (VMC) at 1,800 ft to return to Biggin Hill and had prevailed when the Citation, of Bermudan retarded the left thrust lever to reduce power to registry, departed from Biggin Hill with three begin a descent. The thrust lever inadvertently 58 | flight safety foundation | AEROSafetyWorld | June 2010 OnRecord was moved into the fuel-cutoff position be- Aviation Organization expand the requirement cause of the failure of a mechanism designed to for flight recorders to include jets weighing prevent this from occurring. Normally, when 5,700 kg/12,500 lb or less. a thrust lever is moved to the idle position, a smaller lever riveted to the thrust lever is Crew Departs on Wrong Runway trapped by a gate that prevents further move- Boeing 737-600. No damage. No injuries. ment of the thrust lever to the fuel-cutoff eviations from the crew resource man- position. To intentionally move the thrust lever agement (CRM) concept” manifested to the fuel-cutoff position, a knob on the thrust “Din faulty communications caused the lever must be raised to lift the smaller lever out 737 flight crew to take off from Runway 32 at of the gate. Sweden’s Luleå–Kallax Airport after they had However, investigators found that a rivet read back a clearance to depart from Runway 14, securing the smaller lever to the thrust lever had according to the Swedish Accident Investigation become detached, allowing the thrust lever to be Board (SHK). moved aft of the idle position without resistance, The incident occurred in darkness and low shutting down the engine. visibility the morning of Feb. 27, 2007. The The pilots attempted to restart both en- SHK report, issued in March, said that the gines. Examination of the engines revealed commander programmed the 737’s flight man- that both were producing power on impact agement system for a departure from Runway but had not accelerated sufficiently to provide 32 while the aircraft was still at the gate. After enough thrust to recover from the descent. the 88 passengers boarded, the commander “Interpretation of available data suggests requested and received clearance to taxi to the that one engine had not completed its start deicing ramp. sequence before an attempt was made to start Surface winds were light, and the controller the other,” the report said. “A sense of urgency gave the crew the option to depart from Runway [might] have led to a deliberate attempt to 14 rather than Runway 32. The controller also start the second engine before the first engine issued a slot time that required the crew to had reached idle speed.” be airborne within 10 minutes. Although this The report noted that a successful restart initially “had a stressful effect on the course of and acceleration of just one engine “could have events,” the slot time later was extended indefi- produced sufficient thrust in the time available nitely to accommodate the 737’s departure, the to prevent ground impact.” report said. Lacking sufficient power, the Citation con- Visibility deteriorated rapidly and was about The airport does not tinued to descend. Its left wing struck a house 2 800 m (1/2 mi) when the 737 was taxied from nm (4 km) north-northeast of the airport. “The the deicing ramp. The copilot, who was han- have ground radar, aircraft then impacted the ground between this dling radio communications, requested and and another house and caught fire,” the report received clearance to taxi to Runway 14. The and the controller, said. “There were no injuries to anyone on the commander, however, taxied the aircraft to who could not see ground, but all those on board the aircraft were Runway 32. “When the aircraft was approaching fatally injured.” Runway 32, the [copilot] notified that they were the aircraft, cleared The report said that the “lack of recorded ready for takeoff at full length Runway 14,” the data meant that the investigation was short of report said. The airport does not have ground the crew for takeoff. critical information which would have provided radar, and the controller, who could not see the further insight and a clearer understanding of aircraft, cleared the crew for takeoff from Run- the factors leading to the loss of the aircraft.” way 14. The copilot acknowledged the clearance, Among recommendations generated by the and the commander performed a rolling takeoff investigation was that the International Civil from Runway 32. www.flightsafety.org | AEROSafetyWorld | June 2010 | 59 OnRecord The crew was not aware of the error until visibility reported as 3,000 meters. Land at your the controller filed a report on the incident the own discretion. Wind 050 at 5 kt.” next day. The cockpit voice recording by then The first officer, the pilot flying, conducted had been overwritten, which hindered inves- the approach with the autopilots and autothrot- tigators’ efforts to determine what caused the tles engaged. “At the decision height of 200 ft, incident. The report said that the commander both pilots [said that they] had more than the likely was focused on departing from Runway minimum visual reference required and could 32 and on maneuvering the aircraft on slippery see ‘all the approach lights and a good section of taxiways and in low visibility. The copilot likely runway lights,’” the AAIB report said. believed that the commander had accepted the The first officer disengaged the autopilots controller’s offer to depart from Runway 14 and and began to flare the A340 between 75 ft became so busy in communicating with the and 50 ft radio altitude. “The aircraft floated controller and with copying route clearances for a few seconds before it entered an area of that he did not notice that the aircraft was be- fog,” the report said. Both pilots lost sight of ing taxied toward Runway 32 and “did not note the runway. The first officer applied left rud- the ‘180-degree error’ on the compasses” when der, apparently inadvertently, and the aircraft the commander began the rolling takeoff on drifted left. “The commander became aware Runway 32, the report said. of the left runway edge lights moving rapidly Although the cause of the incident could not closer to him [and] called, ‘Go around,’” the be determined conclusively, “it has been estab- report said. lished [that the crew deviated from] the part of The first officer immediately moved the CRM relating to communication and coopera- thrust levers fully forward, but the A340 tion,” the report said. touched down on the main landing gear and veered off the left side of the runway. “The left Drifting Fog Blankets a Flare main landing gear ran off the paved runway for Airbus A340-313. Minor damage. No injuries. a distance of 180 m [591 ft]” before the aircraft he A340 was en route from London to became airborne, the report said. Nairobi, Kenya, with 108 passengers and The crew diverted the flight to Mombasa, T14 crewmembers the morning of April 27, where VMC prevailed, and landed the aircraft 2008. Before beginning the descent from cruise without further incident. Examination revealed altitude, the flight crew obtained an ATIS report scratches and abrasions on the lower left fuse- indicating that surface winds were from 040 de- lage, and minor damage to the left aft wheel on grees at 3 kt, visibility was 7 km (4 mi), the ceil- the left main landing gear. ing was broken at 1,600 ft, and both temperature and dew point were 15° C (59° F). TURBOPROPS However, the aircraft operator’s charts for Nairobi noted that “the weather can include Misrigging Causes Wheel to Jam morning fog … the ATIS has been reported as Swearingen Metro II. Substantial damage. No injuries. unreliable, and so crews should note that condi- he Metro was inbound to Winnipeg, Mani- tions may not be as they expect.” toba, Canada, with eight passengers and two Before handing off the flight to the airport Tpilots the afternoon of March 3, 2009. Sur- traffic controller, the approach controller told the face winds were from the south at 20 kt, gusting A340 pilots that the crew of a preceding aircraft to 30 kt, and visibility was 15 mi (24 km) with had reported that landing visibility was 3,000 m drifting snow. (nearly 2 mi) and the cloud base was at 300 ft. When the flight crew attempted to extend Before clearing the crew to land on Run- the landing gear on final approach, the right way 06, the airport traffic controller said, “The main landing gear did not extend fully. “The 60 | flight safety foundation | AEROSafetyWorld | June 2010 OnRecord crew carried out a missed approach, declared The pilot, who had logged 394 of his 8,500 an emergency and entered a holding pattern to flight hours in type, flew part time for the attempt gear extension,” said the report by the company that owned the aircraft. The intended Transportation Safety Board of Canada (TSB). destination of the accident flight was Grand The King Air entered The crew performed emergency gear- Turk. “Weather conditions at the time were an ‘excessive’ right extension procedures, but the gear-position good, but it was after nightfall,” the report said. indicators showed that the right main gear re- “The moon had not risen, and there was little bank over water mained in transit. A visual check from the cabin cultural lighting in the area.” indicated that the inboard right tire apparently The King Air turned right, toward the in- and descended was hung up in the wheel well and that the gear tended initial course, soon after taking off doors were partially open. from the coastal airport but then entered an in a right turn. After consulting with company maintenance “excessive” right bank over water and de- personnel, the crew performed a touch-and-go scended in a right turn. The pilot apparently landing on the left main landing gear in an at- had nearly leveled the wings and had begun to tempt to jar the right main gear free. However, pull out of the dive when the aircraft struck a the attempt was unsuccessful. shallow lagoon “with only a moderate rate of With minimum fuel remaining, “the crew descent but at relatively high forward speed,” elected to conduct a gear-up landing into the the report said. wind on Runway 18 with aircraft rescue and The pilot was killed. “A postmortem toxico- fire fighting personnel standing by,” the report logical examination showed that the pilot had said. “Over the threshold of Runway 18, prior to a level of blood alcohol [0.03 percent] which, touchdown, the crew shut down both engines although below the prescribed limit, was signifi- and feathered both propellers. The aircraft came cant in terms of piloting an aircraft and would to a gradual stop on its belly on the centerline.” have made him more prone to disorientation,” No one was injured during the landing the report said. or the evacuation. Examination of the Metro Noting that local regulations required two revealed damage to the propellers, flaps and aft pilots for a night public transport flight under fuselage. instrument flight rules, the report said, “The Investigators determined that the interfer- presence of a second pilot would have provided ence between the inboard right tire and inboard a significant measure of protection against the gear door was caused by a combination of fac- effects of the flying pilot becoming disoriented.” tors, including misrigging of the gear door and a retreaded tire that “grew” about 1/2 in (1 cm) Towplane Hits Chute on Low Pass beyond new-tire limits after it was installed 16 De Havilland Twin Otter. No damage. One serious injury. days before the accident. he pilot said that after 20 skydivers jumped from the airplane, he descended and flew Spatial Disorientation on Night Takeoff Ta 45-degree entry to the downwind sec- Beech King Air 200C. Destroyed. One fatality, four serious injuries, tor of the landing pattern at Orange County one minor injury. (Virginia, U.S.) Airport the evening of June 13, patial disorientation amplified by the pilot’s 2009. He said that the “windshield began fog- consumption of alcohol and the absence ging up” and he decided to make a 360-degree Sof a second pilot aboard the King Air were right turn while he wiped the windshield with among the factors that likely were involved in a rag. The pilot said that the Twin Otter was at the aircraft’s descent into the sea during a de- 2,000 ft when it struck a descending skydiver’s parture from North Caicos Airport in the Turks parachute. and Caicos Islands the night of Feb. 6, 2007, However, the skydivers said that the pilot according to a report issued by AAIB in April. was conducting a low pass about 30 ft above www.flightsafety.org | AEROSafetyWorld | June 2010 | 61 OnRecord ground level when the airplane’s propeller struck Stall Over an Outdoor Gathering the parachute. The skydiver fell 20 ft and was Beech A55 Baron. Destroyed. Five fatalities. seriously injured when he struck the ground, the itnesses saw the Baron make two or NTSB report said. The Twin Otter was landed three low passes over an outdoor without further incident. Wgathering near Minden, Nevada, U.S., The report said that the probable causes of the afternoon of May 9, 2009. “On the final the accident were “the pilot’s improper decision pass, the airplane was slightly above the tops of to perform a low-level maneuver over a popu- the local houses, between 100 and 300 ft above lated skydive landing area and his inadequate ground level,” the NTSB report said. “Recovered visual lookout.” GPS [global positioning system] data indicated that the airplane was traveling … at 120 kt PISTON AIRPLANES groundspeed.” The Baron then entered a steep climbing left Engine Fire Erupts on Rotation turn with nearly 90 degrees of bank. Witnesses Cessna 421B. Destroyed. One fatality. said that the airplane appeared to decelerate at mployees of a fixed-base operator at Fort the top of the climbing turn and then descend Lauderdale (Florida, U.S.) Executive Airport in a steep nose-down attitude into an open field. Esaw the 80-year-old pilot “rather haphaz- “The witnesses noted that the engines could be ardly” pouring oil into the 421’s right engine heard ‘running perfectly’ throughout the ma- before starting both engines and running them neuver,” the report said. at mid-range power for about 20 minutes the morning of April 17, 2009. Ditching Follows Fuel Exhaustion The pilot then taxied the airplane to Run- Cessna 310R. Substantial damage. One serious injury, three minor injuries, two uninjured. way 08 for departure. Witnesses saw flames and smoke emerge from the right engine he pilot had conducted a charter flight with shortly after rotation. The pilot radioed the five passengers from Marco Island, Florida, airport traffic controller, “I’m having some TU.S., to Key West, Florida, the morning trouble here. I’m going to have to come of June 26, 2008. He told investigators that he around and land.” He did not secure the right did not refuel the airplane or visually check the engine or feather the propeller, as required fuel tanks before departing from Key West that by the 421’s “In-Flight Wing or Engine Fire” afternoon for the return flight to Marco Island. checklist. The airplane banked right at low “Rather, he relied on gauge readings and his fuel altitude and descended into a residential calculations,” the NTSB report said. “He thought area, striking a house. No one on the ground he had an adequate fuel supply for the flight.” was hurt. The pilot entered the fuel quantity shown The NTSB report said that the probable on the 310’s gauges — 280 lb (127 kg) — on the causes of the accident were “the pilot’s failure to weight-and-balance form he prepared before maintain aircraft control and secure the right departure. However, investigators determined engine during an emergency return to the air- from refueling records that the airplane actually port.” The cause of the engine fire could not be had only 119 lb (54 kg) of fuel in its tanks when determined conclusively because of the severe it departed from Key West. “Historical fuel impact and fire damage. The report noted that records associated with the accident airplane an exhaust leak was found at the no. 4 cylinder revealed the average fuel burn was approxi- and that the fuel line leading to that cylinder mately 35.09 gallons [211 lb (96 kg)] per hour,” was broken. However, investigators were unable the report said. to determine whether the fuel line broke before After takeoff, the pilot initially climbed to or during the crash. 3,000 ft but shortly thereafter descended to 62 | flight safety foundation | AEROSafetyWorld | June 2010 OnRecord 2,500 ft and maintained that altitude until near- Quebec, Canada, to Québec the morning of ing Marco Island. The report did not specify the June 19, 2008. He turned back toward a poten- power setting used for cruise but noted that the tial landing site on the heavily wooded shore- fuel-air mixture controls remained in the “full line of Lac á l’Épaule, 28 nm (52 km) from the rich” position. destination. The 310 was about 15 nm (28 km) from the “While overflying the lake at low altitude to destination and at 1,500 ft when the right engine verify the chosen landing spot, the pilot turned lost power due to fuel exhaustion. The pilot on the demist hot air to clear the front wind- was attempting to restart the right engine when shield of condensation,” the TSB report said. the left engine also lost power. He announced “The windshield immediately misted up; the on the Marco Island common traffic advisory helicopter lost altitude and struck the surface frequency that he was ditching the airplane and of the water. The pilot and passenger sustained required assistance. His call was relayed to a minor injuries and evacuated the aircraft police aviation unit, which dispatched a rescue successfully.” helicopter. The helicopter sank about 500 ft (152 m) The pilot, who had logged 200 of his 18,000 from shore. Occupants of a small boat assisted hours in type, feathered the right propeller but the pilot and passenger to shore. Both were was unable to feather the left propeller. He ex- transported to a hospital, where the passenger tended full flaps but left the landing gear retract- subsequently died of cardiac arrhythmia from ed. “He slowed to 93 kt, and just before ditching exposure to the cold water and to intense stress, he placed his arm in front of the 10-year-old the report said. passenger seated in the copilot’s seat,” the report said. “The airplane first contacted the water with Tail Rotor Effectiveness Lost the curved portion of the bottom of the fuse- Robinson R44. Destroyed. Two serious injuries, two minor injuries. lage and lunged forward, then rebounded.” The he passengers were filming and pho- ditching occurred about 34 minutes after the tographing a residential development departure from Key West. Tsite about 10 km (5 nm) east of Cairns All of the occupants exited through the cabin (Queensland, Australia) airport the morning door and stayed on the right wing momentarily of June 18, 2008, when the helicopter, which until the 310 began to sink. One passenger had was being maneuvered sideways to the left not been able to find a life vest and clung to two about 200 ft above the ground and facing rising other passengers until the police helicopter and terrain, suddenly yawed right, began to rotate a boat alerted by the helicopter crew arrived rapidly, descended into trees and struck the about 24 minutes after the ditching. ground. The pilot and front-seat passenger The pilot told investigators that just before were seriously injured. ditching the 310, he noticed that the left and The chief pilot of the aerial-photography right fuel gauges indicated 70 and 100 lb (32 and company told investigators that company pilots 45 kg), respectively. had been instructed to conduct filming opera- tions no lower than 500 ft and to maintain 20 to HELICOPTERS 30 kt airspeed to ensure directional control. “This accident highlighted the risk of loss Fogged Windshield Blocks Pilot’s Vision of tail rotor effectiveness associated with the Eurocopter EC 120B. Substantial damage. conduct of aerial filming/photography and other One fatality, one serious injury. similar flights involving high power, low for- he pilot did not receive a preflight weather ward airspeed and the action of adverse airflow briefing and encountered heavy rain and on a helicopter,” said the report by the Austra- Tlow ceilings en route from Lac des Neiges, lian Transport Safety Bureau. www.flightsafety.org | AEROSafetyWorld | June 2010 | 63 OnRecord Preliminary Reports, April 2010 Date Location Aircraft Type Aircraft Damage Injuries April 1 Huatulco, Mexico Learjet 25D-XR destroyed 6 none The Learjet was destroyed by fire after a gear-up landing. April 1 Wlotzkasbaken, Namibia Cessna 210 destroyed 1 fatal The 210 broke up in flight during a charter flight from Twyfelfontein to Swakopmund. April 2 Cairo, Egypt Airbus A330-200 substantial 207 none The flight crew followed a taxi route that did not provide adequate clearance for large aircraft. The A330’s wings were damaged when they struck light poles. April 2 Princeton, Kentucky, U.S. Mitsubishi MU-2B substantial 1 minor The MU-2 veered off the runway and struck a fence and a ditch after a tire burst on landing. April 3 Runnells, Iowa, U.S. Embraer 170 none 1 serious, 29 none The Embraer encountered turbulence shortly after the captain asked the flight attendants to be seated. One flight attendant, who had not yet fastened her seat belt, was thrown from her seat and sustained a hip fracture and head contusion. April 6 Center, North Dakota, U.S. Beech B55 Baron substantial 1 serious, 1 none The Baron struck several mallards during a training flight at 4,200 ft. One of the ducks penetrated the windshield, injuring the flight instructor. April 7 Mexico City, Mexico Boeing 737-300 none 1 fatal, 1 serious One mechanic was killed, another was seriously injured when a hydraulic jack supporting the nose landing gear failed. April 7 Ponce, Puerto Rico Cessna 404 substantial 3 none The pilot feathered the propeller after the engine failed on takeoff, but the 404 continued to descend. The pilot landed the airplane straight ahead in a grassy area. April 9 Los Angeles, California, U.S. Boeing 737-300 substantial 109 none A ground worker did not turn off the motor or engage the emergency brake after parking a baggage tug that had inoperative “deadman switches.” The tug rolled into a hydrant fuel cart and then into the left engine and fuselage of the 737, which was being pushed back from the gate. April 10 Smolensk, Russia Tupolev 154M destroyed 96 fatal The Tu-154 crashed about 1,000 m (3,281 ft) short of the runway during a nonprecision instrument approach in heavy fog. April 12 Anjozorobe, Madagascar Aerospatiale SA318C destroyed 3 fatal The Alouette helicopter crashed during a charter flight from Ivato to Antalaha. April 13 Manokwari, Indonesia Boeing 737-300 destroyed 10 serious, 34 minor, 66 none The 737 overran the wet runway on landing, struck trees while traveling down a steep slope and stopped in a river bed. April 13 Monterrey, Mexico Airbus A300 B4-200F destroyed 6 fatal The cargo airplane reportedly stalled on approach in instrument meteorological conditions and crashed on a road. Among those killed was a motor vehicle driver. April 21 near Angeles City, Philippines Antonov 12BP destroyed 3 fatal, 3 serious The flight crew landed the An-12 in rice paddies after an electrical fire erupted during a cargo flight from Cebu to Angeles City. April 21 Newfane, Vermont, U.S. MD Helicopters MD500E substantial 1 serious, 1 minor The crew was installing equipment on a power line structure when the pulling rope snapped and wrapped around the main rotor mast. The helicopter descended out of control. April 24 Riyadh, Saudi Arabia Boeing 737-300 minor 9 none The flight crew returned to the airport and landed the 737 without further incident after a partial loss of power from both engines occurred during takeoff. April 27 Arlit, Niger Beech King Air 200 destroyed 10 none The landing gear collapsed when the King Air touched down short of the runway during a night nonprecision instrument approach with visibility reduced by blowing sand. April 27 Hazard, Kentucky, U.S. Beech 58 Baron destroyed 2 fatal The Baron crashed under unknown circumstances during a private flight from Frederick, Maryland, to Olive Branch, Mississippi. This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed. 64 | flight safety foundation | AEROSafetyWorld | June 2010 Step into our Web You’ll be glad to be caught Flight Safety Foundation (FSF) has launched its newly upgraded Web site. This redesign creates a more interactive forum for the aviation safety community, a place you can depend on to stay informed on developing safety issues and Foundation initiatives that support its mission of pursuing continuous improvement of global aviation safety. Follow our blog, and get updates on FSF events and comment on issues that are important to the industry and to you. Follow us on Twitter, Facebook and LinkedIn — join these social networking groups and expand your aviation safety circle. Follow AeroSafety World magazine on line with your free subscription to the digital issue. Follow us around the globe — click on the interactive world map that documents current safety issues and the locations of FSF affiliate offices. Follow the industry news — stay current on aviation safety news by visiting the Latest Safety News section of the site, or check out what interests other people as noted under the Currently Popular tab. Follow FSF initiatives such as ALAR, C-FOQA, OGHFA and others, as the Foundation continues to research safety interventions, provides education and promotes safety awareness through its tool kits, seminars and educational documents. Join us, become a member of FSF and be a part of the team that leads or actively participates in all of the world’s major safety efforts to improve aviation safety. Here’s where it all comes together: flightsafety.org Click on the donate button and help us continue the work. f o n d a z io n e 8 ott ob re 2 0 0 Hosted by 1