Proceedings 2007.Pmd

VOLUME 11

Publisher ISASI (Frank Del Gandio, President) Editorial Advisor Air Safety Through Investigation Richard B. Stone Editorial Staff Susan Fager Esperison Martinez Design William A. Ford Proceedings of the ISASI Proceedings (ISSN 1562-8914) is published annually by the International Society of Air Safety Investigators. Opin-

38th Annual ISASI 2007 PROCEEDINGS ions expressed by authors are not necessarily endorsed or represent official ISASI position or policy. International Seminar Editorial Offices: 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA. Tele- phone: (703) 430-9668. Fax: (703) 450- 1745. E-mail address: [email protected]. Internet website: http://www.isasi.org. ‘International Cooperation: Notice: The Proceedings of the ISASI 38th annual international seminar held in From Investigation Site Singapore, Republic of Singapore, features presentations on safety issues of interest to the aviation community. The pa- To ICAO’ pers are presented herein in the original editorial content supplied by the authors. Copyright © 2008—International Soci- Aug. 27–30, 2007 ety of Air Safety Investigators, all rights reserved. Publication in any form is pro- Singapore, Republic of Singapore hibited without permission. Permission to reprint is available upon application to the editorial offices. Publisher’s Editorial Profile: ISASI Pro- ceedings is printed in the United States and published for professional air safety investigators who are members of the Interna- tional Society of Air Safety Investigators. Content emphasizes accident investigation findings, investigative techniques and experiences, and industry accident-prevention developments in concert with the seminar theme “International Coopera- tion: From Investigation Site to ICAO.” Subscriptions: Active members in good standing and corporate members may ac- quire, on a no-fee basis, a copy of these Proceedings by downloading the material from the appropriate section of the ISASI website at www.isasi.org. Further, active and corporate members may purchase the Proceedings on a CD-ROM for the nomi- nal fee of $15, which covers postage and handling. Non-ISASI members may ac- quire the CD-ROM for a $75 fee. A limited number of paper copies of Proceed- ings 2006 is available at a cost of $150. Checks should accompany the request and be made payable to ISASI. Mail to ISASI, 107 E. Holly Ave., Suite 11, Ster- ling, VA 20164-5405 USA ISSN 1562-8914

ISASI 2007 Proceedings • 1

Proceedings 2007.pmd 1 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS Positions, Investigators Training &Education, Human Factors, Government AirSafety, General Aviation, 2 Flight Recorder, Corporate Affairs, Cabin Safety, Ladislav Mika(Co-Chair)([email protected]) Air Traffic Services, W Seminar, Reachout, Nominatin Membership, Code ofEthic Bylaws, Board ofFellow Ballot Certification, Award, Audit, C Rocky Mountain, Pacific Northwest, Northeast, Mid-Atlantic, Los Angele Great Lakes, Florida, Dallas-Ft. Worth, Arizona, Alaska, C U SESA-France Chap., Russian New Zealand, American, Latin European Canadian, Australian, S N United States, New Zealand, International, European Canadian, Australian, C Treasurer, Secretary, Vice-President, Executive Advisor, President, O Southeastern, San Francisco, United States, OCIETY OMMITTEE HAPTER OUNCILLORS • ATIONAL AND ([email protected]) Braithwaite Graham R. ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) NITED ([email protected]) ([email protected]) ([email protected]) FFICERS ORKING Dr. MichaelK.Hynes ISASI 2007 ISASI GaleE.Braden([email protected]) Craig Bledsoe , VsvolodE.Overharov ([email protected]) Darren T. Gaines([email protected]) Ben Coleman([email protected]) Bill Waldock ([email protected]) Barbara Dunn([email protected]) ChrisBaum([email protected]) , DavidKing([email protected]) , AnneEvans([email protected]) Ken Smart ([email protected]) Tom McCarthy([email protected]) Frank DelGandio([email protected]) James P. Stewart([email protected]) g, Tom McCarthy([email protected]) s, Inactive David W. Graham([email protected]) Barbara M.Dunn([email protected]) Barbara Dunn([email protected]) Lindsay Naylor([email protected]) Lindsay Naylor([email protected]) s, JohnP. Combs([email protected] Matthew Kenner ([email protected]) Tom McCarthy([email protected]) Joann E.Matley([email protected]) Ron Schleede([email protected]) Inactive Curt Lewis([email protected]) Caj Frostell ([email protected]) Curt Lewis([email protected]) Peter Williams ([email protected]) Ron Chippindale([email protected]) Ron Schleede([email protected]) Peter Axelrod s, Ron Chippindale([email protected]) S GuillermoJ.Palacia (Mexico) Michael R. Poole Michael R. P Richard Stone([email protected])

Gary R. Morphew Gary R. Curt Lewis([email protected]) John W. Purvis([email protected]) William (Buck)Welch TATES Kevin Darcy ([email protected]) Richard Stone([email protected]) P G RESIDENTS Tom McCarthy([email protected]) John A.Guselli(Chair) Vincent Fave Proceedings RESIDENTS ROUP Willaim L.McNease C HAIRMEN R R EGIONAL 2 C EGIONAL HAIRMEN ISASI Information t) Flight AttendantTraining Institute atMelvilleCollege Finnair Oyj Federal Aviation Administration Exponent, Inc. EVA Corporation Airways European Aviation SafetyAgency Era Aviation, Inc. Emirates Airline Embry-Riddle Aeronautical University Embraer-Empresa BrasileiradeAeronautica S.A. EL ALIsraelAirlines Dutch Transport SafetyBoard Dutch AirlinePilots Association Directorate ofFlyingSafety—ADF Directorate ofFlightSafety(CanadianForces) Directorate ofAircraft AccidentInvestigations— Delta AirLines,Inc. Defence ScienceandTechnology Organisation (DSTO) DCI/Branch AIRCO Cranfield Safety&AccidentInvestigationCentre COPAC/Colegio OficialdePilotos delaAviacion Continental Express Continental Airlines Comair, Inc. Colegio DePilotos Aviadores DeMexico, A.C. Civil Aviation SafetyAuthorityAustralia Design Cirrus China Airlines Charles Taylor Aviation, Singapore Centurion, Inc. Cavok Group, Inc. Cathay Pacific Limited Airways Bundesstelle furFlugunfalluntersuchung—BFU Bombardier Aerospace Regional Aircraft Boeing Commercial Airplanes Board ofAccidentInvestigation—Sweden BEA-Bureau D’EnquetesetD’Analyses Avions deTransport Regional (ATR) Aviation SafetyCouncil Australian Transport SafetyBureau Atlantic SoutheastAirlines—DeltaConnection Association ofProfessional FlightAttendants ASPA deMexico Aramco AssociatedCompany AmSafe Aviation Search &Survey,American Underwater Ltd. American EagleAirlines Allied Pilots Association CompanyLimited All NipponAirways Alitalia Airlines—FlightSafetyDept. Alaska Airlines AirTran Airways Airservices Australia Aircraft &RailwayAccidentInvestigationCommission Aircraft MechanicsFraternal Association Aircraft AccidentInvestigationBureau—Switzerland Airclaims Limited Airbus S.A.S. Air NewZealand,Ltd. Air LinePilots Association Air CanadaPilots Association Air AccidentsInvestigationBranch—U.K. Air AccidentInvestigationUnit—Ireland Air AccidentInvestigationBureau ofSingapore Aerovias DeMexico, S.A.DeC.V. AeroVeritas Aviation SafetyConsulting,Ltd. Aeronautical &MaritimeResearch Laboratory Accident Investigation&Prevention Bureau Accident InvestigationBoard/Norway Accident InvestigationBoard, Finland AAIU MinistryofTransport Bulgaria C ORPORATE Namibia Comercial M EMBERS 1/14/2008, 9:43 AM WestJet Volvo Aero Corporation University ofSouthernCalifornia University ofNSWAviation UND Aerospace U.K. CivilAviation Authority Transportation SafetyBoard ofCanada Transport Canada State ofIsrael Star NavigationSystemsGroup, Ltd. Southwest AirlinesPilots’ Association Southwest AirlinesCompany Southern CaliforniaSafetyInstitute CivilAviation Authority South African Airways South African SNECMA Moteurs Singapore Airlines,Ltd. Skyservice Airlines,Ltd. Sikorsky Aircraft Corporation SICOFAA/SPS Saudi ArabianAirlines Braathens SAS Sandia NationalLaboratories RTI Group, LLC Royal NewZealandAirForce Royal NetherlandsAirForce Rolls-Royce, PLC Republic ofSingapore AirForce Raytheon Company Qwila Air(Pty),Ltd. Limited Qantas Airways Pratt &Whitney Phoenix International,Inc. Parker Aerospace Nigerian MinistryofAviation andAccident NAV Canada National Transportation SafetyBoard National BusinessAviation Association National AirTraffic Controllers Assn. MyTravel Airways Lufthansa GermanAirlines Lockheed MartinCorporation Learjet, Inc. CommunicationsAviation RecordersL-3 Kreindler & Kreindler,LLP Korea Aviation&RailwayAccidentInvestigationBoard KLM Royal DutchAirlines Jones Day JetBlue Airways Jeppesen Japanese Aviation InsurancePool Japan AirlinesDomesticCo.,LTD Irish Aviation Authority Irish AirCorps Interstate Aviation Committee Int’l Assoc.ofMach.&Aerospace Workers Independent Pilots Association IFALPA Hong Kong CivilAviation Department Hong Kong AirlinePilots Association Honeywell Hellenic AirAccidentInvestigation Hall &Associates,LLC Gulf FlightSafetyCommittee,Azaiba,Oman Global Aerospace, Inc. GE Transportation/Aircraft Engines Galaxy ScientificCorporation Flightscape, Inc. Flight SafetyFoundation—Taiwan Flight SafetyFoundation Investigation Bureau & Aviation SafetyBoard ◆ Table of Contents

SESSION 4—Moderator Richard Breuhaus 2 ISASI Information 82 Convair 580 Accident Investigation: 4 Preface: Welcome to Singapore A Study in Synergy By Frank Del Gandio, President, ISASI By Ian McClelland, TAIC, New Zealand 5 Opening Address: Importance of International 87 Tenerife to Today: What Have We Done in 30 Years Cooperation in Aircraft Accident Investigation To Prevent Recurrence? By Raymond Lim, Minister for Transport and Second Minister By Ladislav Mika, Ministry of Transport, Czech Republic, for Foreign Affairs, Singapore and John Guselli, JCG Aviation Services

6 Keynote Address: Sharing Experience 95 Flight Data: What Every Investigator Should Know ISASI 2007 PROCEEDINGS and Knowledge By Michael Poole, Flightscape, Inc., and Simon Lie, Boeing By Mark V Rosenker, Chairman, U.S. National Transportation Safety Board 103 Sound Identification and Speaker Recognition 8 Lederer Award Recipient: ‘Independence and For Aircraft Cockpit Voice Recorder Integrity’ Mark Tom McCarthy By Yang Lin, Center of Aviation Safety Technology, CAAC and Wu Anshan and Liu Enxiang, General Administration of Civil Aviation of China, CAAC By Esperison Martinez, Editor SESSION 1—Moderator David McNair SESSION 5—Moderator Danny Ho 10 Royal Australian Navy Sea King Accident 110 International Cooperation and Challenges: Investigation—Indonesia April 2, 2005 Understanding Cross-Cultural Issues By Nicholas Athiniotis and Domenico Lombardo, Defence Science By Dr. Wen-Chin Li, National Defense University; Dr. Hong-Tsu Young, and Technology Organization, Australia Taiwan, ASC; Thomas Wang, ASC; and Dr. Don Harris, Cranfield 22 Russia/France: Safety and Cultural Challenges University In International Investigations 115 Very Light Jets: Implications for Safety and By Alexey N. Morozov, Interstate Aviation Committee and Accident Investigation Sylvain Ladiesse, BEA By Dr. Robert Matthews, Ph.D., FAA 26 International Cooperation Paves the 123 Enhanced Airborne Flight Recorder (EAFR)— Runway for a Safer Sky The New Black Box By Guo Fu, East China Administration, CAAC By Jim Elliot, Smiths Aerospace 126 RSAF: Analysis and Investigation; SESSION 2—Moderator Sue Burdekin Tools and Techniques 31 Winter Operations and Friction Measurements By Lt. Col. Suresh Navaratnam, Republic of Singapore Air Force (RSAF) By Knut Lande, Accident Investigation Board, Norway 134 Wet Runway Accidents— 46 Utilization of the Web-Based GIS to Assist The Role of Fatigue and Coercive Habits Aviation Occurrence Investigation By Capt. A. Ranganathan By Tien-Fu, Yeh, Wen-Lin Guan, and Hong T. Young, Aviation Safety Council 51 Use of Reverse Engineering Techniques to SESSION 6—Moderator David King Generate Data for Investigations 136 ISASI International Working Group on Human By Peter Coombs, AAIB, UK Factors: A Progress Report 56 Using Checklists as an Investigator’s Tool By Capt. Richard Stone, ISASI and Dr. Randy Mumaw, Boeing By Al Weaver 139 International Coorperation During Recent Major Aircraft Accident Investigations in Nigeria SESSION 3—Moderator Alan Stray By Dennis Jones, NTSB 60 Finding Nuggets: Cooperation Vital in Efforts 143 Critical Aspects of International Incident to Recover Buried Data Investigations By Christophe Menez and Jérôme Projetti, BEA By Deborah J. Lawrie, Robert N. van Gelder, and Jan Smeitink, 65 International Investigation: General Aviation Independent Safety Investigation & Consultation Services Accident in Atlantic Waters 148 National Transportation Safety Committee of By Joseph Galliker, ASC International, Inc. Indonesian Presentation 68 Standardizing International Taxonomies for By Tatang Kurniadi, Chairman, National Transportation Data-Driven Prevention Safety Committee, Indonesia By Corey Stephens, Air Line Pilots Association; Oliver Ferrante, BEA; 150 Going the Extra Mile Kyle Olsen, FAA; and Vivek Sood, FAA By Donald F. Knutson (Accepted for presentation, but not orally 74 Midair Collision Over Brazilian Skies— delivered due to exigent circumstances.) A Lesson to Be Learned 155 ISASI 2007 Pictorial Review By Col. Rufino Antonio da Silva Ferreira, José Mounir Bezerra Rahman, Photos by Esperison Martinez and Carlos Eduardo Magalhães da Silveira Pellegrino, Brazilian Aeronautical Accident Investigation Commission (CENIPA); William English, NTSB; and Nick Stoss, TSB Canada

ISASI 2007 Proceedings • 3

Proceedings 2007.pmd 3 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 4 • everyone’s citizensflyinaircraft operatedunderforeign flags. before thetermbecamepopular, andwerecognize that understand thataviationwasatrulyglobalindustrylong the worldreflects onallofus.We alsodoitbecausewe it becauseweunderstandthatamajoraccidentanywhere in the world.We dothisforbasicmoralreasons, butwealsodo countries, butwealsoseektoprevent accidents elsewhere in sented here todayseektoprevent accidentsintheirrespective investigation authoritiesandcivilaviationrepre- accident investigation.Ataminimum,allthe are really inthebusinessofaccidentprevention aswell everyone inaviation. practical useunlessthatlearningiseffectivelyshared with whatever welearnbyinvestigatingaccidentswillbeoflittle gation SitetoICAO.” Thepointofthethemeisthis: istrulyaninternationalprofessionalISASI society. Asia. Muchlike Taipei, thisisapowerfulconfirmationthat This week’smeetinginSingapore introduces toSouth ISASI Safety Investigatorswasindeedaninternationalorganization. was apowerfulindicationthattheInternationalSocietyofAir we hadmetinAsia,andImadethepointthenthatTaipei at theSingapore Aviation Academy. continue tobethefirststepin accidentprevention and programs. Whatwelearninaccidentinvestigationswill generations ofFOQAprograms andvoluntaryreporting has beenthefoundationfordefiningriskinfirst the knowledgewehaveamassedfrom accidentinvestigation and seriousincidentsstillbeginsattheaccidentsite.Infact, operations toidentifynewrisksbefore theyleadtoaccidents. time, wereally havebeguntoanalyzeincidentsandroutine aviation safetycommunity. Oneresult isthat,forthefirst These newanalyticaltoolsholdreal promise fortheentire capacities, communicationtechnology, dataminingtools,etc. much more capablebystillrelatively newdataprocessing range ofnewtoolsoratleastolderthathavebeenmade ISASI 2007 ISASI Today, theprocess ofaccident The themealsosuggeststhatallofusinthisroom today Our themeis“InternationalCooperation:From Investi- Five metinTaipei. yearsago,ISASI Thatwasthefirsttime Yet, acquiringafundamentalunderstanding ofaccidents Proceedings to organize lastweek’stutorialprograms their workandtoeveryonewhohelped members oftheseminarcommitteefor seminar. Also,ourthankstoallthe hard toensure thesuccessofthis Barbara Dunn,who,asalways,worked Investigation Bureau ofSingapore, and Wing Keong, director oftheAirAccident thanksourseminarhosts,Chan ISASI 4 Welcome toSingapore! prevention employs awide By Frank DelGandio,President PREFACE elsewhere intheworld. also seektopreventaccidents in theirrespectivecountries,butwe here todayseektopreventaccidents aviation authoritiesrepresented A is proud tobeinSingapore andwesincerely thankourhosts. share data,safetyknowledge, andgoodsafetypractice. remains thebestvehiclebywhichsovereign countriescan experience willmake thesystemsafereverywhere. ICAO information from theaccidentsiteandfrom operational approaches. For eithergroup ofcountries,sharing many countriescanstillbenefitgreatly from more basic dents really are rare events.Yet, wealsounderstandthat accident prevention inthosecountrieswhere majoracci- That iswhyweseeknewapproaches andnewtoolsfor 2006, despiteanincrease inoperations. accidents decreased worldwidefrom 110 in2005to77 the safestyearonrecord. ByIATA’s count,aircarrier crisis; itisnot.Infact,asIATA recently reported, 2006was resulting in857fatalities. that makes ituseful toeveryoneinourcommunity. way wecandothatisbysharinginformationinamanner accidents. Thetasknowistodriveriskevenlower. Theonly scenarios that,notmanyyearsago,explained mostmajor come impressively closetoeliminatingthoseaccident that datasharingisICAO. Theaviationcommunityhas findings availabletotherest oftheworld.Thevehiclefor ICAO memberstatesmake theirdataandinvestigative criminalizing accidents. not complicatedbythestillfar-too-commonpracticeof serious incidents.Italsorequires thatsuchinvestigationsare on detached,professional investigationof allaccidentsand must beshared withtheentire aviationcommunity, based recommendations for corrective action. issues, buttheyalsoproduce newknowledgeand mitigation. Investigationsoftenconfirmwell-understood With that,Iwillclose,butallowmetoremind youthatISASI As allofusrecognize, accidentscanoccuranywhere. This doesnotmeanthataviationsafetyisontheverge of Since wemetlastyear, wehavehadninemajoraccidents, “From InvestigationSitetoICAO”alsorequires thatthe However, tobeuseful,anyunderstandingweachieve investigation authoritiesandcivil investigation t aminimum,alltheaccident 1/14/2008, 9:43 AM and using ◆ OPENING ADDRESS Importance of International Cooperation in Aircraft Accident Investigation By Raymond Lim, Minister for Transport and Second Minister for Foreign Affairs

resident of the International Society of Air Safety In players to collaborate

vestigators, Mr. Frank Del Gandio, distinguished closely, in areas such as ISASI 2007 PROCEEDINGS Pguests, ladies and gentlemen—Let me first warmly technical expertise, welcome all of our overseas friends to Singapore. equipment, facilities, Singapore is honored to be selected to host this 38th and training platforms, annual seminar of the International Society of Air Safety to achieve effective Investigators, the premier international event of its kind investigation. This will for air safety investigators to exchange views and experi- help to smoothen out ences and discuss issues of common interest. I am heart- problems that an ened to see so many of you here, as it underscores the individual country’s importance of inter-national cooperation in aircraft investigation bodies accident investigation and your endless pursuit in honing may encounter, as a the skills required in this area. result of the complexity

With the growing affluence of individuals and the E. MARTINEZ of aircraft and air globalization of businesses, international air traffic is set for Minister Raymond Lim addresses transport systems. It is brisk growth ahead. In Asia, passenger volumes are ex- attendees at ISASI 2007. also worthwhile for pected to grow 7.9% annually over the next 5 years, accord- those which lack ing to the Airports Council International (ACI). Globally, resources of their own to tap into an international network with an average growth rate of 4% over the next 20 years, we of investigators and safety professionals who can support will see a more than doubling of the current 4.2 billion them in their investigations, as well as share and exchange passengers to some 9 billion passengers a year. views on experiences, techniques, best practices, and However, we must not allow ourselves to be lulled by the relevant issues. euphoria of a buoyant air travel industry and lose our focus On the part of Singapore, we are continually striving to on air safety. Infrastructure and air traffic management contribute to such cooperation initiatives. For one, the Air systems often lag behind the intense traffic growth in fast- Accident Investigation Bureau of Singapore, or AAIB for growing aviation markets. This, coupled with the difficulty short, has recently set up a flight recorder readout facility to in maintaining the quality and experience level of pilots, air download and analyze data from the cockpit voice and flight traffic controllers, and other safety-related manpower data recorders. resources needed to cope with the rapid growth, would pose Our AAIB is more than happy to offer to other organiza- serious threats to safety standards. tions the use of its flight recorder readout facility as this is Therefore, it is imperative that we strengthen our safety one of the most important areas of aircraft investigation and accident investigation frameworks. With proper procedure. In addition, AAIB has also assisted several regulatory and enforcement actions in place, the valuable regional countries in their aircraft investigations and in insights gained from accidents and near accidents could drafting accident investigation manuals. help prevent similar accidents from happening in the Singapore is happy to do our part to contribute to air future. In addition, the willingness to openly and profession- safety. More importantly, we hope that together with many ally share ideas, experiences, and lessons learned from other likeminded states, we can all do our part to cooper- accident investigations is an important element in upgrad- ate and collaborate closely so that professional investiga- ing the safety standards in the aviation industry, which is the tion resources are readily available when needed, contrib- core purpose of this important annual ISASI seminar. uting ultimately to making air travel safer for the traveling Aviation-related accident investigations are by nature public. complex as the causes for accidents are seldom the result of On this note, I wish all of you a rewarding seminar, and a single factor. It is vital for governments and industry an enjoyable stay in Singapore. ◆

ISASI 2007 Proceedings • 5

Proceedings 2007.pmd 5 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 6 • Europe, theMidEast,andRussia. Lookingfurther, Africa are wellrepresented. Andweseerepresentation from allof right awaythatourfriendsfrom SouthAsiaandNorth have representation from allcontinentsoftheglobe.We know Montreal. I’velooked atthedelegatelistandnotethatwe the InternationalCivilAviation Organization (ICAO)in careful analysis alongtheway, to the officesandstaffof information from anaccidentsiteanywhere intheworld,with and recommended practices,and,further, totransfervital within thecooperativeframeworkofinternationalstandards Site toICAO.” Ibelievewecantake thattitletomeanworking seminar title:“InternationalCooperation:From Investigation variety ofnewtechnologyintooureverydaylives. Singapore, for showingsuchleadershipinintegratinga for marineshipmovement.Socongratulationstoyou, automatic surveillancebroadcast oftheship’sGPSposition methods. Infact,itisalready usingtechnologysimilarto the the industrywithatrackingsystemequaltoouraviation ship channelsandlimiteddocksideberths.Singapore leads risks; themarinesectorhassimilarchallengeswithnarrow and departure rates,withrunwayincursionandexcursion ever-increasing airtrafficvolumeandlimitedairportarrival similar tothoseinaviation,where aviationisfacedwith of containershiptraffic.Theseaporttrafficissuesare very Singapore isNo.1intheworldforhandlingmovement there isasimilar challengeattheSingapore Port Facility. are allinterested inthesurfacemovementofaircraft—and mode here inSingapore, themaritimesector. Ofcourse,we present themselvesinthe airlineenvironment. observe themaintenanceandcrew trainingissuesasthey how bigtheairplaneis,anditisequallyinteresting to the A380intoairlineroute structure. We are allaware of technology. Iwasbriefedonthechallengesofintegrating rate officialsatSingapore Airlinestoviewsomeofthatnew ments thatare takingplace.Yesterday, Ivisitedwithcorpo- am amazedatthecontinuedgrowth andtechnicaladvance- my firstvisitmore than20yearsago,eachtimeIreturn, I in Singapore andtothelovelyStamford hotel. Bureau, pleaseallowmetowelcomeyouourvenuehere and thestaffatSingapore AirAccidentInvestigation Wing Keong Chong(whoalsogoesbyChanWing Keong) and guests—onbehalfoftheorganizers 2007, ofISASI M ISASI 2007 ISASI Sharing ExperienceandKnowledge Now it is time to talk about ISASI 2007.Let’sstartwiththe Now itistimetotalkaboutISASI I’m alsointerested inviewinganothertransportation It isalwaysapleasure toreturn toSingapore; andsince visitors, ladies andgentlemen,membersofISASI, visitors, Foreign RaymondLim,distinguished Affairs, inister forTransport andSecondMinisterfor Proceedings By MarkV. Rosenker, Chairman,U.S.NationalTransportation SafetyBoard 6 KEYNOTE ADDRESS nar; however, weshouldalsorecognize thatmanyofthesafety —and youwillhearmore about someofthemduringthesemi- tion in2006.Certainly, werecognize theaccidentsthattook place than 2billionpassengerstraveledbycommercial airtransporta- departures—that take placearound theworldeveryday. More for amomentthenumberoftravelers—or try—and theongoingsafetyeffortsaround theworld.Consider the milestonesalongsafetyroadmap. to itslong-termsustainablesafetyresponsibilities …andtomeet be lookingtoward eachandeverystate’shigh-levelcommitment technical competence,willbewellknown.Thereafter, weshould those requiring assistancetoimprove theirinfrastructure and 2009, thestatesnotmeetingtheirsafetyoversightresponsibilities, among statestorelease ICAOauditinformationtothepublicin audit cyclebecomescompletein2008,andwiththeagreement state’s capabilitiestoprovide adequate safetyoversight.Asthe part. TheICAOUSOAPauditresults provide identificationofa Safety OversightAuditProgram (USOAP)playsaveryimportant intended safetyobjectives.Thatiswhere theICAOUniversal to address thecommitmentofstatesandoperatorstoreach the destination. InthecaseofGlobalAviation SafetyPlan,wehave direction totake—but itrequires acommitmenttoreach your we discusstheroadmap, oranymap,weknowitwillshowyouthe aviators, Ibelieveyouwillbequicktorecognize mypoint.When Aviation SafetyRoad Maptosupport theplan. Aviation SafetyPlan,andtheindustrydevelopedGlobal impact. AndIbelieveweallcanfullyendorseICAO’sGlobal Kobeh. Hispersonal attentiontosuchissueswillhavelasting achievable planofaction.”Ifullyendorsethewords ofPresident “There isanurgent needtoimplementaconcrete, realistic, and the StrategicAviation SafetySummitinBali,Indonesia,declared, the ICAOCouncil,Roberto Kobeh Gonzalez,duringanaddress to And weare certainlynot alone.Justlastmonth,thepresident of give thehighestprioritytoreducing theriskofarunway collision. saving livesandavoidingamajordisaster. Asoneexample, we keep thefocusonthoseissuesthatoffergreatest potentialfor our “MostWanted” listofsafetyrecommendations. We tryand My agency, theU.S.NTSB,maintainsanInternetwebsiteposting action byregional organizations, andwithintheglobalframework. avenues. There are localnationstateopportunities,aswell nities toapplymultipleaviationsafetyinitiativesthrough various change ofideasandinternationalcooperation. global approach desired byICAOtopermitthegreatest ex- Canada wehaverepresentation. Thisrepresentation istrulythe and Australiaare here, andfortheAmericas,from Chile to Let’s take a momenttoviewtherecord oftheaviation indus- But IhavetoaddsomethingabouttheICAORoad Map.As Now whatdowewiththeseideas?There are ampleopportu- 1/14/2008, 9:43 AM from Indonesia, from Brazil, and from the oceanic area, to name a few. The airframes discussed will range from the general aviation Cessna and Cirrus to include the very light jets (VLJs) and extend to the most modern commercial transport airplanes—the complete spectrum of our industry. As members of this unique professional Society, ISASI, I’m certain you are interested in the advancing investigative techniques. You won’t be disappointed. Of course, flight recorders will be addressed, with views from several different perspectives. Also, there are several papers on the techniques

E. MARTINEZ and protocols of investigation with particular emphasis on the

Chairman Rosenker addresses the assembly. aspect of international cooperation. The cultural challenges AMERICA DAY TUESDAY—LATIN of our variety of social systems that combine during an improvements that aviation safety professionals and groups such investigation are present in almost every investigation. as ISASI have promoted over the years are now providing the National borders have become transparent in many ways—in benefits we predicted. I’m referring to the professional crew train- the manufacture of the airframe and the various components, ing and the elevated standards of SOPs, adherence to the stabi- in the crew makeup and training of our personnel, in lized approach criteria, improved reliability of aircraft power- maintenance facilities, and with air traffic service providers. plants, and the very specific enhancements such as satellite navi- We are truly a multinational and fully global industry. Several gation systems, moving map airport displays, and Enhanced speakers will discuss these cross-cultural challenges as they Ground Proximity Warning and Traffic Collision Avoidance Sys- affect the workings of an air safety investigation. tems. What we have to do now,…today’s challenge, is to maintain Before closing, I’d like to make added mention of the that momentum for an ever-increasing level of aviation safety. importance of international cooperation and the need for As the industry moves to adopt the Safety Management harmonized best practices in investigation. This is especially Systems (SMS) approach, we have a unique opportunity to true for those of us representing airplane-manufacturing increase the level of safety—and to involve all the stakeholders states. Our industries desire to provide the most airworthy in the solution. The industry has readily endorsed SMS aircraft possible for the market place. To do this, we need to objectives to find more efficient methods of safety data collec- know how the aircraft perform in the market place, and tion and to analyze that incident data in a proactive way to when deficiencies do become apparent, to move swiftly to reduce the accident potential in our operations. With the SMS correct them—and avoid recurrence. As an effort to harmo- approach, the objective is to identify multiple risk factors and nize and promote efficiency in air safety investigation, in the reduce or eliminate those risks, thereby providing intervention fall of 2008, ICAO will convene an Accident Investigation in the causal chain of events, with the end result to prevent and Prevention Divisional meeting (AIG 2008) for all ICAO major accidents before they occur. state and interested organizations. The chief of the AIG However, we must be realistic—aviation is a human endeavor; Division, Marcus Costa, is with us for this seminar. He will unfortunately, air accidents and serious incidents will continue to make an address to us during the seminar. I would ask all occur. And related safety recommendations originating from attendees to pay particular attention to the message from those unfortunate events will be necessary. At every level of Mr. Costa. AIG 2008 will be an opportunity for all of us to government and industry, we must be prepared for major refine and modernize ICAO Annex 13 and our accident accidents. We can see from the most recent occurrences that a investigation process to be as efficient as possible. major accident can quickly become a national crisis—with And now, as delegates to ISASI 2007, I hope I have ad- international consequences far beyond aviation interests. dressed some of your objectives in attending the seminar—and So, we are gathered here today to share our experiences and that I have addressed some of the safety challenges facing our knowledge in order to produce the best possible air safety aviation industry. I encourage everyone to take advantage of investigations. We have a unique opportunity at ISASI 2007 to the multiple opportunities throughout the seminar to ex- gain further insight into aviation safety initiatives from an change and gather information, and equally important, to outstanding group of presenters. And the topic list holds some meet your colleagues in this productive environment. very valuable subjects for each of us. We will hear about some I thank you for your attention, and I wish you the most recent investigations from a variety of locations, from Africa, stimulating and fruitful seminar. ◆

ISASI 2007 Proceedings • 7

Proceedings 2007.pmd 7 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 8 • ous safetyregulations effectingtechnicalrefinements, in-depth accidentinvestigations, whichresulted innumer- of thattime,hewasanaviation safetyofficerwhoperformed and retired asalieutenantcolonel.For more thanadecade fighter pilotintheU.S.AirForce whoservedfor22years investigator mentoringprograms. Hewasacommand safety, through accidentinvestigationandinsupportof technical expertise, and‘cando’ spirittoimprove aviation Tom hasdedicatedhistalents,endlessenergy, in-depth infancy. Tom McCarthyalsofillsthatrequirement. leadership role intheworldofaviationsafetysinceits was created bytheSocietytohonoritsnamesake forhis the fieldofaircraft accidentinvestigationandprevention. It Award isconferred foroutstandinglifetimecontributionin bottom ofmyheart.” withouthim,andheknowsImeanthatfromISASI the Gandio toldtheassembledaudience,“Ireally can’t exist in system andapersoncanunderstandwhyPresident Del ment ofahighlyeffectivefinancialandbudgetreporting Society incursforofficespaceandtaxes andinhisdevelop- reducing bythousandsofdollarstheoperational coststhe maintenance man,etc.Allbecause“Ithastogetdone.” doing jobssuchasplumber, windowwasher, boxmover, chairman; andis“Mr. Ready” attheheadquartersoffice, 2003seminartechnical tion Committee;wastheISASI for more thantwodecades;serveswiththeBallotCertifica- has chaired theMembershipandNominating Committees and hisachievements“are nothingshortofphenomenal.”He As President DelGandiotoldit,Tom in1981 joinedISASI truth, thatisprobably thelesserofhisservicetoSociety. treasurerwho hasservedatISASI’s forthepast12years.In and aprivilege”topresent theLederer Award totheman selves hisnature, includinghisexuberance. F. Lederer Award, were abletoquicklydiscernforthem- Awards 2007Jerome BanquetwhenheacceptedtheISASI Tom before, 2007 butsatintheaudienceatISASI confident, andstaunchintegrity. Thosewhoneverheard of man: friendly, soft-spoken, patient,disciplined,deliberate, T ISASI 2007 ISASI President DelGandiotellswhy: “For thepast54years, But theLederer Award isn’t aboutservingISASI—the Add toallofthistheacumenTom hasdemonstratedin PresidentISASI Frank DelGandiodeclared itan“honor ‘Independence andIntegrity’ Mark he many ASIs whoknoworhaveworkedhe manyASIs withTom and deportment, which signalthenatureand ofthe McCarthy are familiarwithhiswarm,brightsmile Proceedings 8 LEDERER AWARD RECIPIENT Tom McCarthy By EsperisonMartinez,Editor Aircraft Management Office.Again,analyticalskillsand policies. Later, becomingthedirector hejoinedNASA, ofthe concerning aircraft engineering,maintenanceprocesses, and airport operations,CFRresponse, aswellhighlightingissues procedural changestoflightoperations,dispatch,airtraffic, improvements totheNationalAirspaceSystem,whichcaused resulting innumerous safetyrecommendations andnoteworthy tenure, heinvestigatedapproximately 100aircraft accidents, charge ofmajor‘goteam’investigations. DuringhisNTSB tation SafetyBoard, eventuallymovingtoseniorinvestigatorin this dayintheAirForce. operational policies,andprocedures thatare stillcurrent to an understatement. I am a bit overwhelmed. Itistrulya an understatement.Iamabit overwhelmed. abbreviated: place atthelectern.Following ishisacceptanceaddress, presentation ceremony tookcenterstage.ThenTom tookhis 2007 Jerome F. Lederer Award presented annuallybyISASI. truly worthyofbeingselectedastherecipient ofthecoveted Airspace SystemandourSocietyare monumentalandmake him prevent aircraft accidents.HiscontributionstotheNational accident investigation,andtosafetymentoringprograms tohelp have shownhimtobedeeplydedicatedaviationsafety, to operated aircraft.” Committee forAviation Policy andappliedtoallfederally safety recommendations were adoptedbytheInteragency fleet.Many ofTom’soperation andmaintenanceoftheNASA lifelong experiences helpedbringnumerous changestothe — is notpossible.” accident investigationandprevention Integrity, withoutittrueprogress in outside influenceorpressure.… Independence todotheworkwithout have: independenceandintegrity. “…two thingsaninvestigatormust “Following hisretirement, hejoinedtheNationalTranspor- “Thank youverymuch!To“Thank saythatIamhonored wouldbe A thunderous applausefilledthebanquethallasAward President DelGandioclosedhistalkthisway: “Tom’s actions Gerald “Tom” McCarthy 1/14/2008, 9:43 AM ideas on developments in both the art and science of aircraft accident investigation.” “As I sat at the opening of this 2007 seminar, I marveled at the intuition of Jerry Lederer and the growth of the seeds that he planted. Here we are, gathered in one of the premier cities of the world with hundreds of international delegates refining the art and science of aircraft accident

investigation and prevention. The progress I’ve seen is ISASI 2007 PROCEEDINGS astounding. “Over the years’ seminars, the demonstrated improvements in accident investigation and prevention are gratify- ing. I’m proud to be a part of all this. Let me give you a feel for Jerry Lederer. Did you know, for instance, that he inspected Lindbergh’s aircraft before the history-making flight? That Jerry was a founder of the Flight Safety Founda-

E. MARTINEZ tion? That he became NASA’s safety director as a result of President Del Gandio (right) presents the Lederer Award to Tom the Apollo module fire and helped save the to-the-moon McCarthy. With the formalities over, Tom exhibits the exuberant program? And that he was designated by the U.S. Congress side of his nature. as the Father of Aviation Safety? “My own career in the business started in the early 1960s. privilege to be in the estimable company of past selectees such I was stationed in Minot, N.D., flying a wonderful new as John Purvis, Ron Schleede, Ron Chippindale, and Caj fighter, the F-106 Delta Dart. We got a new squadron Frostell who are all present here tonight. “The very first Society commander, Col. Jack Broughton. He observed for a short of Air Safety Investigators (SASI) international seminar was while, had a meeting, and laid out his plan for the held in November 1970 at the Sheraton-Park Hotel in Wash- squadron’s future. I agreed with his ideas except for one that ington, D.C., with 159 delegates in attendance. Jerry Lederer, Capt. McCarthy was to be the flight safety officer. I ap- SASI’s second president, opened the seminar. These are his proached him after the meeting and asked to be relieved of words: that job since I was about to become a flight commander. He “I want to welcome you to the first international seminar on looked me in the eye and said, ‘You work for me, and I want air accident investigation. It’s an experiment, which we hope will you to be the FSO.’ I answered, ‘Yes sir,’ and have been go far. It is an idea that meetings such as this would have positive eternally grateful ever since. I joined a group of truly bright effect by getting people to know one another before accidents folks who are dedicated to saving lives. happen in foreign lands. You’ll have an opportunity to meet with “George van Epps, New York office, hired me at the people and discuss mutual problem areas. In addition, we will be NTSB. He was a great and humble man. He said, “This job able to exchange ideas on new techniques as well as old proven is easy—all you have to do is work hard and tell the truth.” I techniques on aircraft accident investigations. have never forgotten that. There are two things an investiga- “Much of the progress in the development of aviation tor must have: independence and integrity. Independence safety has come from lessons learned from accident investiga- to do the work without outside influence or pressure and the tion. There is reason to believe that this will continue and that independence that comes when the investigator has the new techniques will be developed to aid the investigator to knowledge and wherewithal to accomplish the required task. determine probable causes in less time with greater accuracy Integrity speaks for itself. Without it, true progress in than in the past in spite of the incredible growth and com- accident investigation and prevention is not possible. plexity of aviation. The use of recorders, X-ray, improved “I want to thank Frank; my fellow Council members, past photography, improved search and rescue, better training, and present; Ann; and the Awards Committee for their help formalized safety engineering, and the system approach to in making this possible. investigation are some techniques developed in the past “There is truly no way to express my feelings. I’m decade or two that are transforming accident investigation humbled, I’m honored, I’m extremely grateful. But most of from an art to a science. But it still remains a considerable art. all, I’m pleased that you are all here to share this wonderful We are here to help each other uncover and disseminate new moment with me. Thanks!” ◆

ISASI 2007 Proceedings • 9

Proceedings 2007.pmd 9 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS exercise thatsimulatedthecrashofasmall airliner. also hasparticipatedinanAustralian Transport SafetyBureau field investigations (fiveonhelicopters andthree onfixed-wingaircraft). He helicopters. Lombardo hasbeeninvolvedineight aircraft accident the fatigueloadson,andliftingprocedures for, dynamiccomponentson all ADFhelicoptertypes.Mostofhisworkhasinvolvedunderstanding conducted research andprovided adviceonstructural integrityissuesfor structural integrityissues.Sincereturning from theU.S.in1992,hehas he workedwithbothU.S.ArmyandNASAengineersonhelicopter Structures Directorate, Research NASALangley Center, Va., U.S.,where 1991 toNovember1992wasassignedtheU.S.ArmyVehicle helicopter structures group, andaspartofthisdevelopment,from October structural fatigueinvestigations.Inmid-1990,hehelpeddevelop a new 1987 tomid-1990,Lombardo workedinsupportofF/A-18 andF-111 degree, majoringinartificialintelligencetechniques,from RMIT. From 1997, hereceived amasterofappliedscience(informationtechnology) bachelor ofengineering(aeronautical) degree (withdistinction).In crash ofasmallairliner. an Australian Transport SafetyBureau fieldexercise thatsimulatedthe aircraft.involving fixed-androtary-wing Healsohasparticipatedin accidents. Athiniotis hasbeeninvolvedin17accidentinvestigations development ofimproved capabilityforinvestigationofaircraft ing aircraft, includingassistanceonoroffsite,andidentification technical supportforinvestigationsofaccidentsandincidentsinvolv- operation oftheaircraft andthefleet.Healsoprovides scientificand assessing thesignificancetostructuralintegrityandeconomic scientific analysisoffailures anddefectsincomponentssystems His current dutiesincludeproviding theADFwithdirect supportwith aircraft forensic engineeringandaircraft accidentinvestigationarea. the areas offatigueandcorrosion. Athiniotis iscurrently headof the 10 • ISASI 2007 ISASI Accident Investigation—Indonesia, By NicholasAthiniotisandDomenicoLombardo, DefenseScienceandTechnology Organization, Royal AustralianNavySeaKing aircraft structures andcomponents, research in edge andexperienceinmetallurgical investigationsof failure analysis,andhasamassedextensiveknowl- work forDSTOinthearea ofdefectassessmentand engineering, withhonors.In1989hecommenced 1988, havingobtainedadegree inmetallurgical Nicholas Athiniotis Melbourne InstituteofTechnology (RMIT)witha December 1986aftergraduatingfrom theRoyal ofADFhelicopters.HejoinedDSTOin airworthiness resolve structuralintegrityissuesthataffectthe current dutiesare toassisttheADFunderstandand the helicopterstructuralintegrityarea ofDSTO. His Domenico Lombardo Proceedings 10 graduated from RMITin isaseniorresearch engineerin April 2,2005 Melbourne, Australia(CP0134) the variousinternationalagencies. cess, andthewelcomesupportcollaborationprovided by 02,” thedifficultiesencountered duringtheinvestigationpro- paper presents theinvestigationinto crashofSeaKing“Shark much longerandtheentire investigationseverely delayed.This this support,theon-siteinvestigationprocess wouldhavetaken together withthesupportfrom theRussianUNMi8.Without Forces), theSingaporean AirForce, andtheUnitedStatesNavy, the Tentara NasionalIndonesia(TNI—IndonesianArmed port andcollaborationfrom severalmilitaryagenciesincluding modeling. Thecrash-siteinvestigatorsreceived exceptional sup- metallurgy, cockpitsoundfrequency analysis,andaircraft flight and drew uponexpertise from variousspecialistfields,including was thelargest outbythe AustralianDefenseForce, evercarried fire. Nineoftheelevenpersonsonboard died.Theinvestigation to anuncontrollable nose-downmotion,impact,andsubsequent linkage separatinginoneoftheflightcontrol systems,whichled ogy Organization foundthatthecauseofcrashwasduetoa Australian DefenseForce andtheDefenseScienceTechnol- the IndonesianislandofNias.Theinvestigationteamfrom the Assist II”andcrashedonapproach tothevillageofTuindrao, on part oftheAustralianhumanitariansupportoperation“Sumatra copter N16-100(callsign“Shark02”),deployedtoIndonesiaas At approximately 4p.m.localtimeonApril2,2005,RANheli- Abstract tralian Navy(RAN)SeaKingHelicopterN16-100 On April2,2005,atapproximately 1605hourslocal,Royal Aus- Introduction tion atDSTOMelbourne. was recovered andtransportedtoAustraliaforfurtherinvestiga- members oftheRAN’sClearance DivingTeam 4(CDT4). to supporttheAAIT. Thisteamwasalsoaugmentedbyseven whichbuiltandmaintainedacampattheaccidentsite (ECSS), of theRAAF381ExpeditionaryCombatSupportSquadron to jointheteam.Later, theAAITwassupportedby adetachment the DefenseSection,AustralianEmbassy, Jakarta,were alsosent Indonesia tocommencetheon-siteinvestigation.Personnel from to onApril3andtraveledbyRAAFC-130J ficers leftCanberra two DefenseScienceandTechnology Organization (DSTO)of- Force SafetyAircraft AccidentInvestigationTeam (AAIT) and result oftheaccident,aDirectorate ofDefenseAviation andAir Amandraya, ontheislandofNias,Indonesia(Figure 1).Asa soccer fieldnearthevillageofTuindrao, intheregion of Subsequent totheon-siteinvestigation, theaircraft wreckage 1/14/2008, 9:43 AM 1 crashedona On March 28, 2005, the island of Nias, located off the west coast of northern Sumatra, Indonesia, was hit by a devastating earthquake. Approximately 1,300 people were killed by the earthquake, mostly on the island of Nias. HMAS Kanimbla, which had already departed Indonesia and was temporarily at anchor in Singapore, enroute to Australia, was immediately recalled to sail for the earthquake-affected island. On March 30, 2005, HMAS Kanimbla sailed for Nias and commenced Operation Sumatra Assist II. RAN Sea King N16-100, with a crew of four, a team of seven aeromedical evacuation (AME) personnel, and their supplies, was one of the two Sea Kings from HMAS Kanimbla designated to assist earthquake victims on the island of Nias, Indonesia. On the day of the accident, the aircraft took off from HMAS Kanimbla to conduct a Medevac (medical evacuation) of personnel from Figure 1. Location of the Sea King crash site. Tuindrao. The plan for the sortie task involved the AME team being inserted at Tuindrao to assess casualties and for “Shark 02” to continue on to Teluk Dalam, a town on the southern tip of Nias. The crew of “Shark 02” was then to offload approximately 200 pounds of medical supplies and return to HMAS Kanimbla with any casualties and await notification by the AME team when they required extraction from Tuindrao. When “Shark 02” arrived at Tuindrao, the local soccer field, SESSION 1—Moderator David McNair located at the nearby school, was chosen to land the aircraft. As the aircraft entered the boundary of the soccer field, from the north, immediately to the eastern side of a set of soccer goal posts, it pitched nose down and fell, the main rotor blades striking the ground, resulting in a violent impact with the ground. The aircraft came to rest on its port side and sustained extensive damage as a result of the subsequent intense fire (Figure 2 and Figure 3) that continued for more than 90 minutes2. Of the eleven Figure 2. Aerial photo of the crash scene, 90 minutes after people aboard the helicopter, only two survived. Eyewitnesses the accident. indicated there were some small explosions and smoke shortly after the aircraft impacted the ground, and several assisted in the extraction of the two survivors from the wreckage before several larger explosions and fire prevented any further rescue attempts. The second Sea King from HMAS Kanimbla, N16-239, “Shark 21,” landed twice at the site, once to pick up the two survivors and once to search for more survivors. A Republic of Singapore Air Force Chinook helicopter also hovered over the accident site at some stage.

International collaboration Following confirmation of the Sea King accident on April 2, an Figure 3. Ground photo of the crash scene. Crash data recorder AAIT was immediately established late that night and deployed visible in foreground. from Australia to Indonesia by C130J Hercules aircraft early on the morning of April 3, arriving in Jakarta that evening for a few Background hours’ stay, where personnel from the Defense Section of the Australian Defense Force (ADF) personnel assisted the Indone- Australian Embassy joined the team. The team of 14 was then sian government authorities as part of the Australian govern- transported on the C130J to Sibolga3, arriving at approximately ment program of humanitarian relief following the 2004 Boxing 0715 hours local time (April 4). Day tsunami. The Australian relief assistance, known as Opera- The Indonesian National Defense Force (TNI) conducted a tion Sumatra Assist, was part of a cooperative effort involving the memorial ceremony to honor the lives lost in the accident in Nias, ADF, the AusAid section of the Department of Foreign Affairs and the AAIT was requested to form part of the honor guard and Trade (DFAT), and Emergency Management Australia. Wa- lining the runway as the caskets containing the remains of the ter, tents, medical supplies, blankets and other emergency provi- nine victims were loaded onto the C130J for transport to Austra- sions, and logistical support were provided, with the aid of the lia. Immediately following the ceremony, a Republic of Singapore Royal Australian Navy’s ship HMAS Kanimbla, with two Sea King Air Force (RSAF) Chinook, laden with humanitarian supplies, helicopters on board. flew the AAIT to the crash site. Due to the extent of supplies on

ISASI 2007 Proceedings • 11

Proceedings 2007.pmd 11 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS HMAS HMAS the nearbywharf,collectingasmallamountofsuppliesfrom tion therathernoisylocallivestock. ing thedeathscausedbydevastatingearthquake, nottomen- the nightcomingfrom anumberofceremonies beingheldfollow- hausted andsleepdeprived,wasdifficultwithwailingthroughout for planningfurtherRSAFsupport.SleeptheAAIT, ex- with theRSAFdetachmentcommander, whichalloweddiscussions the officer-in-charge (OIC)oftheAAITattendedaUNmeeting for recharging batteriesandpoweringequipment.Thatevening, the RSAFprovided some additionalfoodandaccesstoelectricity the assistanceofRSAF. Asthe AAIThadonlylimitedsupplies, sonnel. Anovernightcampintheschoolyard wasestablishedwith HMAS school complex. Four membersofthe AAIT were transferred to 12 hospital hadbeenestablishedneara“Stadium” capital ofNias(Figure 4)where aRSAFheadquartersandfield to Australiafordownloadofdata. the accident,tobecollectedandsubsequentlytransportedback data recorder (CDR),whichwasejectedfrom theaircraft during Chinook waslowonfuel,butthisbriefstopallowedthecrash from boxes). Limitedtimewasavailableatthecrashsite,as loading” wasused(i.e.,anumberofseatshadtobeimprovised board, there were notenoughseatsforalltheteamand“combat site hadnoelectricity, andfoodsupplies were ataminimum.It tive placefortheconductof theinvestigation—sincecrash center fortheAAIT, andestablishedasafe,efficient,effec- port theAAITtoresort. Theresort became theoperations could accommodatetheAAIT, totrans- wasarranged andaferry star backpackers hotelwithairconditioningandarestaurant) resort island(SibolgaMarineResort—the equivalentofathree- Negotiations bythelinguistandlocalsestablishedthata small to thecity; however, there were noaccommodationsavailable. Sibolga. TheAAIT, through bustransport thelinguist,arranged andevacuatedallninepersonnel to copter (police)arrived offloaded toremain withtheteam. problem, theAAITmemberhadrecovered sufficientlytobe the panel,thenreturn totheship.Duringdelaycausedbythis the rear ofthetailpylonandaircrew wasauthorizedtoremove tail boom.Thispanelturnedouttobeanon-structuralfairingfor was signaledtoreturn duetoaloosepanelbeingnoticedonthe team. Ondeparture, withtheAAITmemberonboard, theaircraft on HMAS HMAS land; however, anIridiumsatellitephonelinkwasestablishedwith ing ontwooccasions.Communicationswere difficultontheis- site, thismembersuffered severe heatstress andstoppedbreath- of onemembertheAAIT. atthecrash Immediatelyafterarriving sonnel onthemission,whichresulted inheatdistress andcollapse quent delaywithaTNI-AU SuperPumaaddedextra stress toper- rived byRSAFChinook. of theAAITtocrashsite,whileremaining membersar- to theaccident.AnIndonesianSARhelicoptertransportedtwo nications andlogistics,assistedininterviewingeyewitnesses lian embassystafflinguist,whoplayedacrucialpartincommu- A localtruckdrivertransportedsomemembersoftheAAITto The RSAFChinooktransportedtheAAITtoGunungSitoli, A TNI-AU VIPSuperPumaandoneadditionalpassingheli- Delays inreceiving suppliesandtechnicalproblems andsubse- • ISASI 2007 ISASI Kanimbla Kanimbla Kanimbla Kanimbla Kanimbla Kanimbla Kanimbla Kanimbla Proceedings with arequest forMedivac.ThesecondSeaKing via boattobegintheprocess ofinterviewingper- and, importantly, meetingupwiththeAustra- was deployedtothecrashsitewithamedical 12 4 andassociated bers oftheAAITatGunungSitoli. Figure 4.RepublicofSingapore AirForce Chinookwithmem- ger restrictions meantthatfourpersonnelhadtostaybehind at crash site,approximately 1houraway, eachday(Figure 5).Passen- some membersoftheAAIT to betransportedandfrom the andMi8 crewstiations betweentheOIC-AAIT pavedthewayfor lief effort,were stayingattheSibolgaMarineResort aswell.Nego- built MilMi8heavy-lift helicoptersandcrews, supportingthere- from thecrashsite.However, itsohappenedthattheUNRussian- viceable laterinthedayatMedanandwasunabletoprovide airlift crash site.Unfortunately, theTNI-AU helicopterbecameunser- for theremaining daysleadinguptopermanenttransferthe airlift theAAITtoandfrom thecrashsitefollowingday, and tosupply aSuperPumato vided goodsupportandhadarranged damaged, andmostbridgerepairs were unsound.TheTNIpro- urgent casualtyevacuation.Theroads were narrow, earthquake and Teluk Dalamwere unsuitableforre-supply or incaseofan reasonable time.Roads betweentheNiastownsofGunungSitoli Helicopters were theonlywaytoreach thesitefrom Sumatrain Transportation Russian Mi8. Figure 5.MembersoftheAAITwaitingtoboard theUN the operationscentertocrashsite. and establishafunctionalcampsitetopermittheAAITmove atthecrashsite wouldarrive Combat SupportSquadron (ECSS) 381Expeditionary would beanother5daysbefore theRAAF’s 1/14/2008, 9:43 AM The camp supplies were based upon an establishment of 25 personnel. The camp initially provided the bare essentials, rely- ing on ration packs that were used by the camp site chef to produce hot meals. On April 17, additional supplies (fresh food and water, and other equipment required for the investigation) were transported to the site by several USN MH-60S helicopters (Fig- ure 6) via sling loading, from Sibolga and the USS Tippecanoe. The Mi8 helicopter was also tasked to conduct heavy-lift supply of equipment for the recovery phase. About 100 locals assisted with clearing the supplies from the drop sites. On April 15, a USN helicopter was to redeploy the AAIT to Sibolga to meet the representatives of the New South Wales state coroner, who was conducting a separate inquiry into the crash. However, thunderstorms at Sibolga prevented the helicopter from landing and so it diverted to the U.S. naval hospital ship, USNS Figure 6. USN MH-60S helicopter delivering supplies to the Mercy (after refueling on USS San Jose), and the AAIT was wel- campsite adjacent to the crash site. comed onboard and given accommodation for the night including medical check and treatment for minor skin irritations (Fig- ure 7). The USN helicopter then transferred the AAIT to the crash site the following morning.

Accident site The accident site was a level soccer field (as was shown in Figure SESSION 1—Moderator David McNair 1) in the Indonesian village of Tuindrao. Tuindrao is situated at an elevation of approximately 45 meters above sea level in coastal rainforest on the western side of a small ridge, one kilometer inland from the Indian Ocean, on the southwestern side of the island of Nias. From the eastern side of the soccer field, the terrain slopes down to a river several hundred meters away. The main village of Figure 7. U.S. Naval hospital ship, USNS Mercy. Tuindrao was located along this river and comprised a collection of dwellings of concrete with thatched roofs. From the western side of the soccer field, the terrain rises gently to a ridge approximately 150 meters away. Two buildings are located near the western boundary of the soccer field: a police station on the southern end, and the local government building (the mayor’s office) on the northern end. Sited in front of these buildings are flag- poles, and behind the local government building is a radio mast. The school at Tuindrao is located approximately 100 meters further along the slope to the north and is a substantial complex of single-story buildings and open areas. The impact of the earthquake meant that there were no supplies of fresh food, clean water, or electricity. The majority of school buildings had varying earthquake damage, and earth tremors were frequent. The local school, adjacent to the crash site, was temporarily suspended, which allowed the AAIT to use some of the schoolrooms to store technical equipment and to use as offices. School recommenced during the investigation so the AAIT Figure 8. Members of the AAIT with full PPE in preparation for had to move its equipment. Minor tremors were still occurring applying the floor wax solution over the burned carbon fiber. daily. A larger tremor occurred on the evening of April 10, regis- tering 6.8 on the Richter scale (epicenter Siberut Island, south- the resort each day, undertaking administration duties. The team west coast of Sumatra). traveling to the crash site was also required at times to assist with Once the 381 ECSS established a functional camp site adja- the ongoing humanitarian support provided by the UN Mi8. cent to the crash site, the AAIT was able to relocate from Sibolga, This became the routine for the AAIT until 381 ECSS arrived allowing more investigation time per day at the site. Due to the to establish a camp at Tuindrao. Once the camp was deemed to extreme weather conditions, and the fact that the AAIT was wear- be suitable, the engineering part of the AAIT relocated to ing personal protective equipment (PPE)—initially full PPE to Tuindrao to continue the crash site investigation. The non-engi- apply the floor wax solution over the burnt carbon fiber (Figure neering parts of the team returned to Australia. 8), then PPE with P2 masks for the wreckage examination—three

ISASI 2007 Proceedings • 13

Proceedings 2007.pmd 13 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 14 of thewreckage consistentwithafuelburn. the fuselageregion, andaburntgrassarea adjacenttoandeast also contributedtothefire). Thefire damagewascontained to (butane cansinappropriately intheaircraft carried wouldhave spread through theaircraft andresulted inaseriesofexplosions came intocontactwithhotenginecomponents,whichrapidly intense. the accident,anduponnightfall,revealed thatthefire wasstill which wastaken atleast90minutesaftertheestimatedtimeof and magnesium/aluminumstructure). Photographicevidence, rial (amixture ofaviationfuel,oils,medicaloxygen cylinders, The post-impactfire wasveryintense,fuelledbyonboard mate- Post-impact fire reached itsfinalposition. from thetimeaircraft departednormalflighttowhenit impact marksandwreckage thathelpedtoformapicture ofevents main fuselagewreckage were anumberofkey areas ofground from theforward fuselage atapproximately fuselagestation 493. pact fire. Ground impacthadcausedthetailconetoseparate rotor gearboxwere damagedtoalesserextent bythepost-im- lon, tailundercarriage, tailrotor intermediategearbox,andtail in Figure 12.Part oftherear fuselage(tailcone),connectingpy- west prevented majorfire damagetothemainrotor hub,asshown gearbox area; however, thedirection ofthewindfrom thesouth- sive post-impactfire damagewasassociatedwiththemainrotor below thestarboard (right)engine,asshowninFigure 11.Exten- were locatedontopofeachother, withtheport (left)engine substantially consumedbythepost-impactfire. Thetwoengines of thewreckage, forward ofstation493,hadbeenengulfedand from whichithadapproached thefield(Figure 10).Themajority field. Theaircraft waslyingsuchthatitfacingthe direction mately 80square meters,northeastofthecentersoccer The mainfuselagewreckage wascontainedinanarea ofapproxi- Wreckage distribution during thecourseofinvestigation(Figure 9). the fire, causedsignificantdeteriorationoftheaircraft wreckage and occasionalnightrain,togetherwiththeheatdamagefrom addition, themonsoonalconditionsofextreme heat,humidity, cant proportion offuselagemakingidentificationdifficult.In wreckage examination. Theintensefire haddestroyed asignifi- labeled duringeitherthemappingstagesorsubsequentdetailed Where possible,allwreckage wasidentified,photographed,and Investigation communications, butsuccumbedtothehumidityafter2days. phones. TheNERASaturn-B satellitetelephoneprovided good reliable whencommunicatingwithlandlines, butnotmobiletele- coverage atthesite.Portable Iridiumsatellitetelephoneswere fairly investigation were initiallydifficult.There wasnomobilephone fortable andeffective. acclimatize, afterwhichtheybecameprogressively more com- exhaustion. Ingeneral,ittookaboutaweekforpersonnelto sunlight, wasallthatcouldbeachievedtoprevent heatstress and shifts of10-40minutes The fire wasinitiatedwhenresidual fuelfrom theengineoroil Between thefirstsetofmainrotor bladestrike marksandthe Communications betweenthesiteandotherssupporting • ISASI 2007 ISASI Proceedings 14 per day , dependingontheintensityof significant deteriorationtothewreckage. damage causedbythefire. Themonsoonalconditionscaused Figure 9.Photograph ofthewreckage showingtheextentof outside thecoverageofOptus satellite,anditwasnotpos- tions (Optus)satellite,however inthiscase,theislandofNiaswas ters nal toprovide accuracyofthe mappedpointstowithincentime- Normally, DSTOconductsmappingusingadifferential GPSsig- The wreckage wasplottedusingaGPSmappingunit(Figure 13). Wreckage mapping Figure 11.Photographoftheport(No.1)andstarboard engines. which ithadapproached thefield. position wasonitsport(left)side,facingthedirection from Figure 10.Aerial photographoftheaircraft wreckage. Itsfinal 5 . Thedifferential GPSsignal isobtainedfrom acommunica- 1/14/2008, 9:43 AM Figure 14. Schematic of the flight control system. Note: To simplify the schematic, the inputs to the mixing unit (i.e., collective, Figure 12. Although the fire was so intense that it consumed the fore/aft, lateral, and yaw) are not shown in the correct order. magnesium gearbox casing, the main rotor hub was less affected by fire due to the wind direction. SESSION 1—Moderator David McNair

Figure 13. Photograph showing the GPS wreckage mapping of the main rotor ground strike marks. Figure 15. Diagrams showing the mixing unit and fore/aft sible to modify the unit in the time available to access an alterna- bellcrank assembled together (left) and an exploded view of the tive satellite. Hence, the wreckage was mapped using standard significant items (right). The numbers shown in the exploded GPS. There are two problems with using standard GPS for wreck- view correspond to item numbers from the Sea King illustrated age mapping. First, the error is much greater than that of differ- parts breakdown manual. The split pin, washers, nut and bolt, ential GPS (potentially an order of magnitude greater) and, sec- items 52, 53, and 55, respectively, connect the fore/aft bellcrank ond, the error is not constant so that the apparent location of a to the mixing unit. fixed point will change over time and may appear to move several meters. In light of this, steps were taken to provide a partial matic flight control system (AFCS) compartment (known as the error correction capability. “broom closet”) behind the first pilot’s seat, is connected mechanically to the control linkages by push pull rods, hydraulically Flight control systems to the auxiliary hydraulic system and electrically to the AFCS Damage to the flight control systems was extensive due to the and beeper trim system. intense heat of the post-impact fire. The majority of aluminum The ASE pack had experienced damage to the auxiliary ser- and copper alloy components had melted. The control runs from vos and electrical system, and the heat of the post-impact fire the cockpit to the auxiliary servo equipment (ASE) pack and back had resulted in melting and fusion of the aluminum components. to the primary servos were significantly damaged due to impact The aluminum control rods connected to the push-pull rods of and subsequent fire. The aluminum alloy control rods had melted, the ASE pack had melted away leaving their steel rod ends con- leaving the steel control rod eye ends visibly attached to their nected to the push-pull rods. associated steel bolts, heat affected but unmelted. On April 9, the high strength steel mixing unit shaft was found The ASE pack provides servo assistance through four separate in the main fuselage wreckage. The mixing unit couples and di- channels, fore/aft (pitch), lateral (roll), collective (altitude), and rects pilot control inputs to the main and tail rotor systems of the directional (yaw) to the control linkage of the primary servo jack helicopter. A detailed view of the mixing unit and fore/aft bellcrank units and tail rotor. The unit, which is located within the auto- assembly is shown in Figure 14 and Figure 15. The mixing unit

ISASI 2007 Proceedings • 15

Proceedings 2007.pmd 15 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 16 fore/aft bellcranktothesteel mixingunitlugs fore/aft bellcrank,or ofthesteelboltandnutthatattached not exceed themeltingtemperature ofthehighstrength steel the temperature ofthefire intheregion ofthemixingunitdid aluminum alloybellcranksandattachmentfittingshadmelted, out ofthelugsasaresult oftheaccident.Whileadjacent for theattachmenttomatingbellcrankhadnotbeenforced of anydamageordeformationstrongly suggestedthatthebolt tion totheinternalandexternal surfacesofbothlugs.Thelack magnifying glassrevealed noevidenceofdamageordeforma- ing unit(fortheattachmentoffore/aft bellcrank)witha10X lated nutandsplitpinwere notimmediatelylocatable. by (Figure 17)forward ofthemixingunit.Theboltandcastel- mixing unitmainshaft.Thefore/aft bellcrankwaslocatednear the highstrength steelfore/aft bellcranktothematinglugsof melted. Itwasevident,however, thatthere wasnoattachmentof main shaft.Ineachcase,anyaluminumwasherspresent had steel taperpinsandnutswere stillattachedtothemixingunit ciated aluminumalloyassemblies,theirrespective highstrength aluminum alloylateral,collective,andyawbellcranks,asso- tion intheaircraft (Figure 16).Althoughfire hadconsumedthe where itislocatedintheaircraft andorientatedasperitsposi- position, approximately intheregion (relative tothewreckage) tion rotates the centralshaft.Theunitwaslyinginahorizontal selections are made,butrotate asawholewhencollectiveselec- levers onacentralshaftthatcanoperateindividuallywhencyclic collective pitchchanges.Thisisachievedbyfittingfreely mounted also allowsthesamecontrol rods tobeusedforbothcyclicand for theattachmentoffore/aft bellcrank. Figure 16.Locationofthemixingunit,showinglugs the investigation. provided bythestainlesssteelsplitpin. which couldonlyoccurifthere hadbeenalossofthesecurity the bolt,i.e.,nuthadspunoff,allowingbolttowithdraw, c. separationofthecastellatednut(Part NumberAN320-6)from steel splitpin,or b. failure ofboththecastellatednutandassociatedstainless a. aboltfailure before orduringtheimpact, might haveoccurred asaresult oflossthesecuringboltby On-site examination ofthehighstrength steellugsofthemix- Hence, findingtheboltandnut becameanimportantpartof The separationofthefore/aft bellcrankfrom themixingunit • ISASI 2007 ISASI Proceedings 16 7 . 6 bolt, discovered underdebris. Figure 18.Area oflocationthefore/aft bellcrankattachment mixing unit. Figure 17.Location ofthefore/aft bellcranknearthe nation ofthewreckage atDSTOMelbourne. This on-siteconclusionwasconfirmed bythelaboratoryexami- age from theimpact withtheground andthepost-impactfire. all observedfeatures ofthewreckage were consistent withdam- features orfailures inthewreckage. Thissearch determinedthat rest oftheaircraft todetermineifthere were anyotherunusual some membersoftheAAIT, othermembers were examining the required attheDSTOLaboratoryinMelbourne. that meticuloussiftingoftheaircraft wreckage debriswouldbe mixing unitfailedtofindtheassociatedsplitpin.Itwasapparent unique item.Further examination ofwreckage surrounding the attachment ofthefore/aft bellcranktothemixingunitisnota the internalthreads. Unlike thebolt,castellated nutforthe piece intheaircraft. Thenutwascompleteandhadnodamageto wreckage (Figure 19),whichwasnotnormallyassociated withthis onApril17.Thenutwasfusedtoameltedpieceofaircraftunit tellated nutwasdiscovered inthegridarea comprisingthemixing or splitpin.Theboltwascompletewithnovisibledamage.Acas- attached toanypartoftheaircraft structure ormatingnut,washer, the area adjacenttothemixingunit(Figure 18).Theboltwasnot 15, aboltofsimilardescriptiontothemissingitemwasfoundin rial, headsize,andshankdiameterhasthesamelength.OnApril bolt (intheAustralianDefenseForce inventory)ofthesamemate- mixing unitintheSeaKinghelicopterisuniquethatnoother While thesearch fortheboltandnutwas beingconductedby The boltthatconnectsthefore/aft bellcrank tothelugson 1/14/2008, 9:43 AM Figure 19. On-site photograph of the located bolt and nut (fused to aluminum).

Figure 22. DSTO investigators carefully sifting through the sieved wreckage at DSTO Melbourne.

The entire wreckage was removed from the crash site and pack- aged into ADF “G”-sized containers (2x2x1 meter) for return flight to Australia. Australian quarantine requirements meant that the SESSION 1—Moderator David McNair containers were sent direct to the AQIS facility in Darwin, North- ern Territory, to be cleaned of any soil or organic matter, or for subsequent sterilization at a recognized facility, to make the contents benign. Smaller, more fragile items contained in boxes in nine containers were subsequently transferred to Steritech Pty. Ltd. for treatment with gamma radiation and ethylene oxide gas.

Figure 20. Aerial photograph showing the adjacent grid, which DSTO laboratory examination correlated to the grid developed for the wreckage to enable Wreckage sieving and sifting identification of the location of the wreckage. A high priority was placed on sorting through material removed from the site in the area of the mixing unit, looking for the existence of a split pin. Due to the scale of this process, it was necessary to hire an industrial sieve with a 6 millimeter and 1 millimeter coarse mesh size (Figure 21). Material that had been captured by the 1 mm mesh (material 1 millimeter to 6 millimeter size range) was then passed to investigators who sifted carefully through the material using smaller kitchen-type sieves, brushes, and tweezers (Figure 22).

Wreckage melting The fire had led to the formation of many lumps of melted aluminum alloy. Although the sieving/sifting process was designed to identify small components, there was a possibility that small parts, like split pins, could have been trapped within a lump of aluminum. An industrial furnace was hired to melt the lumps of aluminum and capture any steel components that may have been trapped in the molten aluminum.

Figure 21. DSTO investigators sieving the wreckage at DSTO Mixing unit, nut, and bolt Melbourne. The laboratory examination confirmed the on-site examination results—the surfaces of the lugs and lug bores were undamaged, Wreckage recovery from the crash site, Nias, Indonesia and there was no evidence of thread marks on the bore walls of To facilitate controlled recovery of the wreckage back to Austra- the lugs. The pivot bolt found in the wreckage was the only bolt lia, the investigators developed a grid referencing system over of that type recovered and, therefore, was most probably fitted to the wreckage and duplicated this on the field adjacent to the the fore/aft bellcrank; the slight damage to the threads was con- wreckage (Figure 20). The grid was designed such that wreckage sistent with it extracting from the bearing as a result of normal could be identified as coming from a one meter square area. flight vibrations, and not through a sudden and dynamic separa-

ISASI 2007 Proceedings • 17

Proceedings 2007.pmd 17 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 18 a vocalresponse from the crew accompaniedbyabriefincrease craft occurred atapproximately EOR-2.5; atthispointthere was indication thatthecrew wasaware ofany problem withtheair- and, atEOR-05:00, thecrew performedapowercheck.Thefirst off occurred atEOR-49:10. Theaircraft climbedatEOR-10:30 Figure 23.The mainrotor wasengagedatEOR-59:57 andtake- rotors are uptospeedtheendofCDRdata)isshownin departure from controlled flightduringthelandingapproach. were nounusualproblems withtheaircraft priortothesudden sis oftheCDRcrew vocalizationssupportedthe viewthatthere the accidentsiteandlaboratoryassessmentanalysis.The analy- aircraft rotating propulsion systemcomponents.This supported did notshowanyevidencetoindicateafailure intherest ofthe the mainrotor gearboxandengineswere workingcorrectly and propulsion systemcomponentsoftheaircraft. be related tothevariousfrequencies generatedby therotating sis ofthebackground sounds,asthefrequencies obtainedcould download wasprovided toDSTOperformafrequency analy- as therotor speedencoder, RSE,channel).AcopyoftheCDR phone (CAM)aswellrecording mainrotor speed(referred to pilot microphone, thecopilotmicrophone, cockpitarea micro- undamaged. with theground andwaslocatedsouthofthemainwreckage, beacon airfoilunit(BAU), hadejectedduringtheaircraft impact The crashdatarecorder (CDR),whichiscontainedwithinthe CDR frequency analysis confirming theCDRfrequency analysis. hydraulics were examined. Nomechanicalfailures were found, box, tailrotor gearbox,tailrotor, hydraulicpumps,andservo All mechanicalcomponentsassociatedwiththemainrotor gear- Mechanical componentexamination at thetimeofaccident. the CDRfrequency analysisthattheengineswere providing power Examination oftheenginebyDSTOandRolls-Royce confirmed Engine examination cordance withmaintenancedocumentation. this case,theinstallationofundersizedsplitpinswasnotinac- contained undersizedsplitpins.Althoughproviding securityin age. Othersecured connectionsassociatedwiththemixingunit the fore/aft bellcrankinthemixingunitwasfoundwreck- should havebeenfittedtothepivotboltandnutconnectionof split pintocauseitfail.Noofthetype(3/32inch)that they hadfailed.There are noforces actingonacorrectly installed Of thesplitpinsrecovered, noneexhibited anyevidencethat wreckage, togetherwithcuttails(trimmingsduringinstallation). merous usedandun-used splitpinswere recovered from the Split pinningprovides redundancy inconnectionsecurity. Nu- Split pins (they were stillattachedtotheirrespective components). the wreckage. Allothernutsofthesametypewere accountedfor also theonlyloosenutofcorrect typetoberecovered from tion asaresult oftheaccidentsequence.Thecastellatednutwas The mainrotor speedovertheentire mission(from thetime The CDRanalysisofthemicrophone channelsconfirmedthat The CDRisafour-channelunit,capturingsoundfrom the • ISASI 2007 ISASI Proceedings 18 power turbineandMRGBhigh-speedinputshaftonceperrev. pumps, (C)enginegasgeneratoronceperrev, and(D)engine Frequency componentsare (A)epicyclicgearmesh,(B)auxiliary Figure 24.Spectrogram ofCAMchannel(final6seconds). Figure 23.Graphofthemainrotor speedfortheentire mission. A: frequency componentsinFigure 24: input shaft(D)are allidentifiable(asmarked) inthisFigure. (B), enginegasgenerator(C),andpowerturbine/MRGBhigh speed 800 Hz.Noisefrom theepicyclictoothmeshing(A),auxiliarypumps the final6secondsbefore forthefrequency EOR, region below in rotor speedfollowedbyalarge drop inrotor speed. piston pumpsdrivingatthe samespeed(i.e.,theyallproduce pump, andsecondarylubrication pump,allofwhichare nine- pumps. Theseare theauxiliaryhydraulicpump,utility hydraulic iary drivespeedandisrelated tooneormore oftheauxiliary B: EOR. varies withmainrotor speedasexpected andcontinuesuntilthe The followingobservationswere madeinrelation tothemarked Figure 24showsaspectrogram oftheCAMchanneldataover Auxiliary pumps Epicyclic gearmesh 1/14/2008, 9:43 AM . Thisfrequency isatninetimestheauxil- . Thenoisefrom theepicyclicgearbox sound at the same frequency). The noise from these pumps ap- be performed in flight, but this was not a problem as the Sea pears to stop at EOR-3.7. The fact that the noise from these pumps King hydraulics system is set up to isolate the control system from stop does not indicate that there was any failure as these are con- all aerodynamic loads generated by the main rotor. A Sea King stant-pressure, variable-flow piston pumps that operate on de- control system only experiences the loads generated when the mand. Examination of the noise from these pumps in early por- pilot moves the cyclic, collective, or pedals. Hence, a ground- tions of the flight indicated that it comes and goes and was present based simulation, with rotors stopped and hydraulics on, was a more or less constantly (with fluctuating levels) for about 90 sec- suitable simulation. onds before it stopped at EOR-3.7. The outcomes of this simulation were that (i) the pivot bolt is C: Engine gas generator. The frequency of the once-per-revolu- loose enough in the bellcrank to fall out under normal flight vibration noise from the engine gas generator begins to increase at tions if it is not restrained by the nut and split pin, (ii) the control EOR-3.7, coinciding with noise ceasing from the auxiliary pumps. system moves to a position corresponding to a full forward cyclic The frequency continues to increase until approximately EOR- position (i.e., full nose down), and (iii) no possible combination of 1.8, when it becomes difficult to distinguish from the background pilot inputs would be effective in restoring control. noise. At this point, the rotor speed has already dropped significantly, there were vocalizations indicating that the crew was aware Mathematical simulation of a problem, and there was an increase in general background The DSTO staff that attended the flight control systems tests at noise. The fact that the gas generator once-per-rev frequency HMAS Albatross, used this information together with a number was still noticeable and increasing after the sudden drop in rotor of initial conditions and assumptions, including information made speed indicates that an engine failure is unlikely to have been the available from the AAIT, to develop a Sea King mathematical cause of the accident. flight model of the events leading to loss of aircraft control. The D: Engine power turbine/MRGB high-speed input. This fre- flight model also took into account the loss of the fore/aft bellcrank quency is the once per rev of the engine power turbine shaft, bolt by disconnecting the pilot longitudinal cyclic control to have which is connected to the high-speed input of the main rotor no effect on the rotor longitudinal cyclic pitch angle. SESSION 1—Moderator David McNair gearbox (MRGB). This varies in speed with the main rotor speed The flight model closely simulated the events that led to the which is to be expected as they are mechanically linked. Although accident, based on the evidence of the initial main rotor blade the high speed input shaft frequency and power turbine speed ground scars at the crash site. The flight model indicated that cannot be separately identified, there are freewheel units on the the aircraft would have exhibited a rapid change in pitch rate input intermediate shafts of the MRGB that would allow a failed and a pitch forward 0.5 seconds after the bellcrank had detached engine to run down in speed with the other engine still driving from the mixing unit lugs. The pilot’s instinctive reaction would the gearbox. No evidence of this happening is observed, making have been to pull aft cyclic, which now had no connection to the it unlikely that there was a loss of drive from either engine. In the flight control system. The aircraft, however, would have contin- event of failure of the input from an engine to the gearbox (such ued to pitch forward rapidly. According to the simulation, 2.3 as shaft, coupling, gear, or freewheel unit failure), the sudden seconds after detachment of the bellcrank, the main rotor tip release of load on the power turbine would cause it to overspeed would have hit the ground with an aircraft pitch attitude of 55 and the overspeed trip governor would shut down the engine. degrees nose down. Again, there is no evidence of this occurring. The DSTO frequency analysis revealed the following: DSTO investigation summary 1. There were no indications of mechanical failure of the rotating The assessment and analysis of the wreckage at the crash site propulsion system components. suggested that a number of lines of potential causes of the acci- 2. There was power to the engines when the aircraft suddenly dent were able to be discounted. These views were supported by pitched nose down. examination of components at DSTO Melbourne and HMAS 3. The crew vocalizations indicated that they became aware of Albatross. The following failure scenarios were therefore dis- problems approximately 2.5 seconds before the CDR ceased counted as probable hypotheses: working on the pilot/copilot/CAM and RSE channels. 1. Engine failure (single or double)—the on-site assessment, the en- 4. A rapid reduction in main rotor RPM (approximately 4%), and gine disassembly at HMAS Albatross, and the DSTO assessment an increase in engine gas generator RPM in the 1.5 seconds before of melted blades and stators from the engines, showed no evi- the CDR ceased working are indicative of an increased torque re- dence of an inflight engine failure. All indications are that both quirement, e.g., such as occurs with a rapid collective input. engines were working normally at the time of the accident. The significant damage to the No. 1 engine was due to a very intense, Simulation magnesium-fuelled fire, post impact. Two simulations were performed during the investigation, a ground 2. Fuel system failure—analysis of the CDR indicated that the air- simulation on a Sea King and a mathematical simulation. craft was under power at the time the aircraft nose-dived. Analy- sis of the fuel showed that its condition was acceptable. There is a Ground simulation high level of confidence that a fuel system failure did not occur. The first was a simulation on a Sea King at HMAS Albatross, 3. Fuel starvation—evidence of a fuel-rich fire discounted lack of Nowra, NSW. This simulation involved a step-by-step process of fuel as a factor. assessing the effect on a Sea King control system of removing the 4. Transmission failure—no evidence was found of main rotor, in- pivot bolt from the fore/aft bell crank in the mixing unit. termediate gearbox, or tail rotor gearbox transmission failure. Due to the critical likely effects of this simulation, it could not 5. Main rotor head failure—the assessment made at the crash site

ISASI 2007 Proceedings • 19

Proceedings 2007.pmd 19 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 20 the pivotpointofmixing unit. fore/aft bellcrankwasremoved duetosuspected lateralplayin dent, bySeaKingdetachment personnelonFeb. 4,2005.The occurred onHMAS The lastknownmaintenanceactivityonthefore/aft bellcrank maintenance Aircraft sium, andoxygencylinders,consumedmostoftheaircraft. and theintense,post-impactfire, fuelledbyaviationfuel,magne- nose-dive andground impactcausedsignificantfuselagedamage, an fuselagepitchattitudeof55°nosedown.Theunrecoverable of thebellcrank,mainrotor tipwouldhavehittheground with lation indicatedthatapproximately 2.3secondsafterdetachment swashplate. There wasnochancetorecover theaircraft. Thesimu- vented fore/aft cyclicstickmotionsfrom beingtransmittedtothe disconnection ofthefore/aft bellcrankfrom themixingunitpre- pilot withthecyclicstickwouldhavebeenineffectivebecause to anose-divetoward theground. Anyfore/aft inputsmadebythe than asecond,causetheaircraft topitchforward rapidly, leading its contactwiththefore/aft lugsofthemixingunitwould,inless that theforward motionofthebellcrankanditsdetachmentfrom rectly torque, afindingthat wasacceptedbytheBoard. mixing unit.Theunwindingofthenutsuggestedfailure tocor- out ofthelugs,permittingbellcranktoseparatefrom the fore/aft bellcrank ontothemixingunitlugs.Theboltthenslid cured castellatednutdetachedfrom theendofaboltholding the mixingunit.Thephysicalevidenceindicatedthatanunse- system failure, duetodisconnectionofthefore/aft bellcrankfrom may havecontributedtotheaccident. the post-impactfire showed noevidenceofstructuralfailures that 11. Structuralfailure— suggest thatahydraulicfailure hadcontributedtotheaccident. systems. Ofthosesystemsexamined, noevidence wasfoundto pact fire damageprevented athorough assessment ofallhydraulic 10. Hydraulicfailure (singleordouble)— than from thepost-impactfire. bearings were complete,showingnoevidenceoffailure other drive shaftcouplingsplineswere undamaged.Thedriveshaft when thetailconehadbroken openduringground impact.The drive shaftcouplingtotheintermediategearboxhaddisconnected failure. Thedriveshaftwascompletealongtheentire run.The 9. Tail rotor driveshaftfailure— with theground orfuselage. buckling damage,indicativeoflowrotational speedandimpact and/or fuselage.Theremaining fourbladeshadcompressive load failures attheirroots, indicativeofimpactwiththeground flight. Allsixtailrotor bladeswere located.Two bladeshadover- 8. Tail rotor bladefailure— ures thatmayhavecontributedtotheaccident. at DSTOindicatedthatthere wasnoevidenceofstructuralfail- 7. Tail rotor hubfailure— fastened tothemainrotor hub. pact andthepost-impactfire. Allbladeroots were foundsecurely or blade-root failure. Alldamagewasconsistentwithground im- 6. Mainrotor bladefailure— failures thatmayhavecontributed totheaccident. and atDSTOindicatedthatthere wasnoevidenceofstructural The SeaKingflightmodelingdevelopedatDSTOindicated The mostsignificantevidencefoundsuggestedaflightcontrol • ISASI 2007 ISASI Proceedings examination ofthewreckage remaining after Kanimbla, 20 the assessmentmadeatcrashsiteand there wasnoevidenceofbladefailure in there wasnoevidenceofinflightblade there wasnoevidenceofdriveshaft 40flighthoursbefore theacci- the extent ofthepost-im- led totherapidconsumptionofaircraft by fire.” ing fuel,internalcargo andstores, andflammableaircraft linings intheaircraft.priately carried The subsequent ignitionofleak- another engineoiltankorbutanecylindersthatwere inappro- rapidly through theaircraft as aresult oftheexplosion ofeither about5minutes,thefirehot enginecomponents.After spread the engineoroilfrom afractured reservoir cameincontactwith 57 daysbefore theaccident.” mixing unitassembly. Thismaintenanceactivityoccurred some and nutthatsecured thepivotboltoffore/aft bellcranktothe tions, whichultimatelyledtothedeficientfitmentofsplitpin ries oferrors andnon-complianceswiththemaintenanceregula- the aircraft’s mixingunit.Thisseparationwastheresult ofase- tion ofthefore/aft bellcrankfrom thepitchcontrol linkagesin dent wasafailure oftheflightcontrol systemcausedbysepara- findings and256recommendations forimproving aviationsafety. 21, 2007.Itisapproximately 1,700pages longandconsistsof759 copied andgeneratedinthecourseoftheseproceedings). website (andinexcess of1.5millionpagesA4paperhadbeen of transcripthadbeenproduced andmadeavailableon theNavy the conclusionofInquiry, justmore than9.5thousandpages for 111days,heard 161witnesses,andtendered 566exhibits. At and concluded,almost1yearlater, onSept.6,2006.TheBOIsat aviation. tors expertise, andacivilianwithexperience incommercial viding specialistaviationoperator, engineeringandhumanfac- val officerofcommodore rank), three seniormilitaryofficerspro- ity, establishedtheSeaKingaccidentBoard withapresident (na- The maritimecommanderofAustralia,theappointingauthor- Board ofInquiry 100 beganwiththeon-siteinvestigation supportwithspecialist DSTO supportfortheinvestigation ofthecrashRANN16- Summary bellcrank from themixingunitpivotpoint. tellated nut,extraction ofthebolt,andseparationfore/aft missing splitpinthatultimatelyledtotheunwindingofcas- and, therefore, prompt toinspectthecriticalitem noticethe maintenance andinspections.Itisthislackofdocumentation maintenance tasktoactasaprompt forthenecessaryassociated was nodocumentedrecord ofacriticalmaintenanceoperation final inspectionsofthefore/aft bellcrank.Thismeantthatthere recorded theremoval, serviceabilityassessment,reinstallation, or the activity, noaircraft maintenancedocumentationexisted that fitted. Whilethoseundertakingthemaintenancewere aware of point, withthecastellatednutnottorqued andwithnosplitpin late watchwiththefore/aft bellcranklooselysecured atthepivot outbytheearly watchhandedoverthetaskto activity carried reinstallation ofthefore/aft bellcrank. exists intheAircraft ServicingManual(300)fortheremoval and unserviceability. Nospecificauthorizedmaintenanceprocedure decided tore-install forward the theitem,andcarry The post-accidentfire “wasinitiatedwhenresidual fuelfrom The Board determinedthat“theprimarycauseoftheacci- The Board ofInquiryreport wasreleased tothePubliconJune, The Board of Inquiry(BOI)commencedonSept.5,2005, Due tothedifficultyofreinstalling theitem,maintenance While there wasnospare bellcranktoreplace theitem,itwas 1/14/2008, 9:43 AM materials and structural assessments of the wreckage, and wreck- its contact with the fore/aft lugs of the mixing unit would, in less age mapping, followed by analysis by a larger DSTO team with than a second, cause the aircraft to pitch forward rapidly, leading assistance from a number of DSTO specialists. to a nose-dive toward the ground. Any fore/aft inputs made by The crash-site investigation analysis suggested that initial con- the pilot with the cyclic stick would have been ineffective because tact with the ground was by the main rotor blades. Four blades the disconnection of the fore/aft bellcrank from the mixing unit had contacted the ground before there was evidence of first im- prevented fore/aft cyclic stick motions from being transmitted to pact of the aircraft fuselage with the ground. The distance be- the swashplate. There was no chance to recover the aircraft. tween the blade marks indicated that the aircraft had some for- The simulation indicated that approximately 2.3 seconds af- ward velocity and was in a steep nose-down, pitch attitude. ter detachment of the bellcrank the main rotor tip would have Following the initial blade strikes, the first fuselage ground hit the ground with a fuselage pitch attitude of 55° nose down. impact occurred to the lower-front port side, damaging the cock- The unrecoverable nose-dive and ground impact caused signifi- pit area. The fourth blade strike then scooped out a large section cant fuselage damage, and the intense post-impact fire, fuelled of ground, indicating that the fuselage was probably near to, or by aviation fuel, magnesium, and oxygen cylinders, consumed over, vertical. This strike would have rotated the aircraft further most of the aircraft. ◆ around the impacted nose. The main rotor head struck the ground further forward from Acknowledgements this initial impact. The next two main rotor blade strikes indi- Indispensable support was provided to the AAIT by members of cated that the pitch control rods had failed in overload allowing the RAAF 381 Expeditionary Combat Support Squadron. With- the two blades to rotate freely. out the members of the 381 ECSS, the AAIT could not stay on At this stage, the aft fuselage and, therefore, the tail rotor blades, site and the investigation process would have been delayed sig- had not made contact with the ground. The last two blade strikes nificantly. pushed the fuselage away from the ground for a brief period Significant, essential, and very welcomed support was provided before it hit the ground again, coming to a stop with the nose of to the AAIT by Indonesian, Singaporean, American, and United SESSION 1—Moderator David McNair the aircraft facing the direction in which it had approached the Nations personnel. Without that support, the investigation would field. have been severely hampered in its ability to conduct the investi- The intense post-impact fire destroyed most of the aircraft. gation in a timely and efficient manner. The CDR analysis of the microphone channels confirmed that the main rotor gearbox and engines were working correctly and In memoriam did not show any evidence to indicate a failure in the rest of the In memory of the nine young brave Australian men and women aircraft rotating propulsion system components. This supported who tragically died on April 2, 2005, serving their country. the accident site and laboratory assessment and analysis. The analysis of the CDR crew vocalizations supported the view that Endnotes there were no unusual problems with the aircraft prior to the 1 The aircraft is also known by its RAN side number, 902, and also as “Shark 02.” sudden departure from controlled flight during the landing ap- 2 News footage of the scene taken at night shows the fire still burning. proach. 3 Sibolga is the major town on the island of Sumatra nearest to Nias. It was The most significant evidence found suggested that a flight the assembly point for mission personnel and supplies. 4 The stadium was a large soccer field situated near a school complex and control system failure occurred due to disconnection of the fore/ was being used as a helicopter landing zone for the earthquake relief effort aft bellcrank from the mixing unit. The physical evidence indi- to the island. cated that an unsecured castellated nut detached from the end of 5 The accuracy being referred to in this case is the accuracy of the position of each point relative to the positions of all the other points. The absolute a bolt holding the fore/aft bellcrank onto the mixing unit lugs. accuracy of each mapped point in terms of its position on the earth is a The bolt then slid out of the lugs, permitting the bellcrank to different matter, and one that is not relevant here. separate from the mixing unit. 6 Melting temperature of AA 2024-T4/7079-T6 ~ 640°C, Aircraft Structural Metals Handbook, Vol. 3, 1992. The Sea King flight modeling developed at DSTO indicated 7 Melting temperature of 4140/4340 ~ 1500°C, Aircraft Structural Metals that the forward motion of the bellcrank and its detachment from Handbook, Vol. 1, 1992.

ISASI 2007 Proceedings • 21

Proceedings 2007.pmd 21 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS Sylvain holdsacommercial pilot’slicense. the frameworkofaEuropean project aimedatimplementingtheJARs. Sotchi andIrkutsk. including theA320andA310accidentsthatoccurred in2006 that time,hehasmanagedtheinvestigationsofseveralmajoraccidents sible forallIACactivitiesinthefieldofaccidentinvestigation.Since previous position,hewaspromoted tobeIACvice-chairman,respon- Accident InvestigationCommissionandfrom 2006,keepingthe Support Commission.In2005AlexeybecamethechairmanofAir 22 work forbilateralormultilateral cooperationincaseofanacci- standards fortechnicalinvestigations,andthusprovides aframe- Annex 13totheChicagoConventionsetsoutinternational 2. Background as adaptabilityandthecapacityfordialogue. can beovercome byinvestigatorsapplyingbasichumanvaluessuch to acommonagreement onworking methods.Theseimpediments to acorrect understandingoftheapproach taken, andconsequently, on board. manufacture, operations,registration, orthrough thepassengers cooperation betweenstates,whethertheyare Involvedindesign, order tofurther internationalcooperation. of theirusualorbit,andtounderstandculturaldifferences in for humanstoadaptthemselvessystemsandactivitiesoutside transfer ofknowledgeandknow-how. Ithashighlightedtheneed Globalization hascreated manychallengestosocietyintermsof 1. Introduction Language barriers andcultural differencesLanguage barriers are themainobstacles Aviation accidentinvestigationsrequire closeinternational • ISASI 2007 ISASI Russia/France: SafetyandCultural Air Accidents InvestigationScientificandTechnical Division, andin1998thevice-chairmanofIAC 1997 hebecametheheadofFDRResearch Interstate Aviation Committee(IAC)in1994.In aircraft control systems,andflighttests.Hejoinedthe Aviation Universityasaspecialistinflightdynamics, Alexey N.Morozov, 2007, heisresident twinningadvisorinUkraine group leaderonmanyinvestigations.AsofSeptember investigator-in-charge, accredited representative, or (ENAC). HejoinedtheBEAin1999andactedas from theFrench NationalCivilAviation School in aerospace engineeringandaviationoperations Sylvain Ladiesse Proceedings By Alexey Morozov, IAC(InterstateAviation Committee)andSylvainLadiesse,BEA Challenges inInternational 22 (Bureau d’Enquêtesetd’AnalysespourlaSécurité del’Aviation civile) , 31,received amaster’sdegree 36,graduatedfrom Moscow Investigations of safety. mind andshowedastrong desire toworktogetherforthebenefit tigation intotheIrkutsk accidentreflected thispositivestateof and toovercome culturaldifferences. Theprogress oftheinves- get toknoweachotherbetter, todevelopaclimateofconfidence, two eventsthatoccurred in2006allowedtheIACandBEAto brought tolightdifferent workingmethods.Nevertheless,the accident toanA310thatoccurred in1994.Thiscollaboration nity toworktogetherinthecontext oftheinvestigationinto the in 1993,whichwasrenewed in2005.Theyhadtheopportu- as stateofdesign. and d’Analysespourlasécuritédel’aviationcivile)participated ducted theinvestigations,andFrench BEA(Bureau d’Enquêtes in JulyatIrkutsk. TheInterstateAviation Committee(IAC)con- airplanes. Thefirstoccurred inMaynearSochiandthesecond On May2,2006,at22h13minUTC,anA320registered EK- 3.1 Sochi 3. TheEvents suffered three majoraccidents bodies andfailtomeetourgoalofimproving safety. promise themutualconfidencenecessarybetweeninvestigative investigative bodyare nottaken intoaccount.Suchcasescom- at thedestinationwithnowarning,orcommentsissuedbyan isolation withoutanyinteraction.Equally, attimes,reports arrive there are plentyofcaseswhere thevariousparticipantsworkin tion astotheconcrete outcomeofthiscooperation.Inpractice, dent. However, thisframeworkleaveswidescopeforinterpreta- The twostateshadsignedamemorandumofunderstanding During 2006,theCommonwealthofIndependentStates(CIS) 1/14/2008, 9:43 AM 1 , ofwhichtwoinvolvedAirbus 32009, operated by Armavia Airlines, was undertaking a passen- oper and manufacturer (U.S.A.), as well as their advisers from Air- ger flight from Yerevan, Armenia, (CIS) to Sochi, Russia, (CIS) at bus and P&W, participated in the investigation. night in instrument meteorological conditions and crashed into During the course of the investigation, the commission re- the Black Sea near Sochi Airport. The Interstate Aviation Com- quested information about the cabin reconfiguration carried out mittee (IAC) was advised of the accident on May 3, 2006, at 02 h by Lufthansa Technik (Germany). In accordance with ICAO An- 15 min Moscow time. nex 13, this information was provided via the BFU (Bundesstelle The IAC’s final report concluded that the crash resulted from für Flugunfalluntersuchung), which also appointed an accred- controlled flight into terrain while attempting a climbing ma- ited representative. neuver after an aborted approach to Sochi Airport at night, with The IAC completed the technical investigation in May 2007 weather conditions below the established minima. While perform- and concluded— ing the climbout with the autopilot disengaged, the captain, while The cause of the accident to the A310 F-OGYP operated by Sibe- under stress, made nose-down control inputs due to a loss of ria airline was erroneous and uncontrolled actions by the crew pitch and roll references. during rollout after landing in a configuration with one thrust Subsequently the captain’s pitch inputs were insufficient to reverser deactivated. After touchdown, the captain, while acting prevent the accident. Along with the inadequate control inputs on the reverse thrust lever of the right engine, inadvertently and by the captain, contributory factors to the accident were the lack in an uncontrolled manner moved the throttle lever of the left of necessary monitoring of the aircraft descent parameters (pitch engine, whose thrust reverser was deactivated, from the “idle” to attitude, altitude, vertical speed) by the copilot and the absence significant forward thrust position. Inadequate monitoring and of proper reaction by the crew to the EGPWS warnings. call-outs of aircraft speed and engine parameters by the copilot The high degree of cooperation between the French and Rus- did not allow the crew to perform the necessary actions, either of sian investigators ensured that the lessons learned in the course moving the left throttle back to idle or of shutting down the en- of this investigation, both in technical and human terms, could gine. The crew had enough time to recognize the situation. subsequently be applied in case of another accident. These les- SESSION 1—Moderator David McNair sons were able to be applied only 3 months later at Irkutsk. 4. IAC—BEA: Two organizations, two approaches 4.1 The Interstate Aviation Committee (IAC) 3.2 Irkutsk The Interstate Aviation Committee (IAC) was established in De- cember 1991 pursuant to the Intergovernmental Agreement on Civil Aviation and Use of Air Space, which was concluded by 12 newly independent states (CIS) with a view to • preserving common aviation rules and airworthiness standards, • maintaining a unified system for certification of aviation equipment and its manufacturers, international categorized aerodromes and their equipment, • conducting independent investigation of aircraft accidents, and • coordinating the efforts in the area of civil aviation development and harmonize the national programs development of air traffic organization systems. The IAC operates on the basis of, and in full compliance with, applicable international law and national laws of the member states, exercising the powers vested in it by presidential and gov- ernmental decrees and appropriate legislative acts. Its headquarters is located in Moscow. The principal aim of the IAC is to ensure safe and orderly On July 8, 2006, at 22 h 44 min UTC as it was landing at Irkutsk development of civil aviation and efficient use of air space by the Airport, an A310 registered F-OGYP, operated by OAO states that are party to the Agreement. Aviakompania Sibir, landed, overran the runway end at approxi- The Interstate Aviation Committee investigates all aircraft ac- mately 180 km/h and at a distance of 2,140 m and on a magnetic cidents that involve aircraft from its member states whether they bearing of 296° from the aerodrome reference point, collided occur on their territories or elsewhere, as well as other aircraft with the perimeter fence. It then broke apart and burst into flames. accidents covered by the appropriate international agreements. As a result of the accident, 125 people died, including both pilots IAC activities related to investigations fully conform to recom- and 3 cabin crew, while 60 passengers and 3 cabin crew suffered mended international practices, in particular Annex 13. physical injuries of various degrees of severity. The investigation into the accident was conducted by a commis- 4.2 The BEA sion appointed by the Interstate Aviation Committee (IAC). Spe- Created in 1946, the BEA is attached to the Ministry of Trans- cialists from the Federal Transport Oversight Authority, Rosaviatsia, port. The BEA carries out investigations and issues its reports in Rosaeronavigatsia, Irkutsk Airport, the airlines Aeroflot—Rossiskiye a completely independent manner. Its offices and technical ser- avialinii and Sibir, as well as the accredited representative from the vices are located in the Paris Region at Le Bourget Airport. It BEA as state of design, manufacturer and registry (France), and also has regional offices in Toulouse, Bordeaux, Rennes, and Aix- from the NTSB, who represented the state of the engine devel- en-Provence.

ISASI 2007 Proceedings • 23

Proceedings 2007.pmd 23 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 24 dent site(Irkutsk, in easternSiberia)wasalongwayfrom the especially duringthefirstfew daysoftheinvestigation.Theacci- were numerous challenges.Initiallytheywere environmental, ies (theIAC,theBEA,NTSB, theAAIB,andBFU),there In aninternationalinvestigationinvolvingfiveinvestigative bod- 5.1 Environmental challenges 5. Challenges the investigation. Safety Agency, theBEAkept theAgencyinformedthroughout had beentransferred from theDGAC totheEuropean Aviation since theresponsibility for A310s forcontinuingairworthiness technical advisersfortheAccredited Representative. Inaddition, as stateofdesign,manufacture, andregistry. Airbusprovided the BEAnominatedanaccredited representative initscapacity plied uponrequest. port are usuallymadepublic,therest ofthereport beingsup- at theendofinvestigation.Onlyfinalsectionsre- nautical world,anditorganizes aconference specifically forthem report isfullycompletedbyforeign partiestotheinvestigation. port before theconsultationprocedure onthewholedraftfinal the IAChastoprovide the“Conclusion” oftheinvestigationre- be informedrelatively rapidlyonthecausesofaccident.Thus, supportforthefamiliesofvictims hasto dent andtoarrange sion thatisusuallycreated todealwiththeaftermathofan acci- a bridgetothesafetyrecommendations thatfollow. by theCommissionincourseofinvestigationandactsas “Shortcomings” andgroups togetherallofthefailingsidentified with theformatrecommended bytheICAO, whichisentitled within thesub-commissionsorworkinggroups. tion gathered byinvestigators,buttheyare notinvitedtowork and provide reports totheCommission. commissions andworkinggroups. Thelatterworkindependently tor-in-charge directs thisCommission,whichitselfsupervisessub- chosen fortheirspecializedtechnicalknowledge.Theinvestiga- bers mayornotcomefrom theIAC,buttheyare generally the role ofinvestigator-in-charge inacollegialmanner:Itsmem- tures include: dures, whichmaydiffer. Someexamples ofthesespecificfea- recommendations setbyAnnex 13aswelltointernalproce- The IACandtheBEAworkaccording tothestandards and 4.3 Different workingprocedures liability topersonsorcompaniesinvolvedintheevent. specifically forbidsthatinvestigationsaimtoapportionblameor French passengers. • anaircraft operatedby aFrench airline(AirFrance, Corsair...). • example AirbusandATR airplanes,Eurocopter helicopters). anaircraft ofFrench designormanufacture orregistry (for • incident involving France outabroad ininvestigationscarried foranyaccidentor For theinvestigationintoaccidentthatoccurred atIrkutsk, reportsThe IAC’s are mainlyintendedforthoseintheaero- In thecaseofamajorinvestigation,governmentCommis- The Final Report includesanadditionalparagraph,compared Accredited representatives haveaccess toalloftheinforma- The IACdesignatesaCommissionofInquiry, whichthatplays The European directive onaviationaccidentinvestigations In addition,inthecontext ofAnnex 13,theBEArepresents • ISASI 2007 ISASI Proceedings 24 comment onthefindingsand theconclusionofreport be- clusions” oftheinvestigation veryearlyon,andtheBEAhadto the IAC,duetopublicpressure, hadtocommunicate the“con- The IACwasnotyetready tocommunicatethisdata.Equally, pressure thatitwasunderfrom operatorstocommunicatedata. airplane manufacturer relayed totheIACandBEA theFDRreadout,jor challengeinthisinvestigation.After the made onboththeRussianandEnglishversions. its work,sinceithadtotake intoaccountallofthecomments sion asabasisfordiscussionalsomeantthattheIACduplicated “observation, monitoring,andfeedback.”UsinganEnglish ver- ample, theRussianword “Kontrol,” whichsimultaneouslymeans report turnedouttobeveryhard totranslate,suchas,forex- to workwith.Someconceptsessentialanunderstanding ofthe tion validatedbytheIACinorder tohaveacommondocument airplane’s operationalenvironment inRussia. tionship betweenSibir, Rosaviatsia, andtheFTOA,aswell Russian airplanes.For theBEAitmeantunderstandingrela- documentation, anditsergonomics—so different from thatof aswellgettingtogripswiththeA310’s systems,its and theEASA, meant understandingtherelationship betweenAirbus,theDGAC, lenge thathadtobetaken upbybothsides.For theIAC,this plied somethingsbeingoverlooked. BEA sometimeshadtheimpression thatthissustainedpaceim- its requests, whichseemedtoitbeurgent, whileforitspartthe times hadtheimpression thattheBEAwasslowinresponding to the BEA,whichthushadtorespond tothepace.TheIACsome- very demandingpace.Thispressure wasnaturallypassedonto to enormousmediapressure, whichobligedthemtokeep upa 400 people.TheIACandtheCISaviationsystemwere subjected gate three majoraccidentsthatcausedthedeathsofmore than During 2006,inthespaceof4months,IAChadtoinvesti- 5.2 Challengesinherent inculturaldifferences members oftheCommissionInquiry. attend, theycouldnotunderstandtheinformationshared bythe sian, andeveniftheBEA-Airbusteammemberswere invitedto example, theeveningworkprogress meetingswere heldinRus- sion were causedbythisabsenceofacommonlanguage.For spoke English. sion andsub-commissionspresent inIrkutsk, fewinvestigators spoke anyRussian,andamongthemembersofCommis- ering thefacts.Within theBEA-Airbusteam,fewinvestigators naturally theworkinglanguageinIrkutsk duringworkongath- advisers. come inorder tobringintheaccredited representatives andtheir on aSundaywasoneofthechallengesthatIAChadtoover- citizens canonlyenterwithavisa.Gettingholdofdozenvisas and there isa5-hourtimedifference. laboratories where theCVRwasread out),is8,000kilometers Irkutsk andMoscow, HQislocated(andthusthe where theIAC’s cated communications.Asanexample, thedistancebetween headquarters ofeachtheseinvestigativebodies,whichcompli- Communicating factstooutsideorganizations wasalsoama- The report hadtobetranslatedintoEnglishandthetransla- Understanding adifferent aeronautical systemwas alsoachal- Lots ofthedifficultiesincommunicationandincomprehen- Russian isoneofthesixofficialICAOlanguagesandwas Further, Russiaisacountrywhere European UnionandU.S. 1/14/2008, 9:43 AM fore having access to the factual and analytical sections. “slowness” and the IAC’s supposed “overlooking” things, and Investigative cultures differ, and these differences came to light finally during the various revisions to the final report. in the final report and the comments that the BEA made during The difference in culture implied long meetings, during which the consultation phase. The report includes, for example, in the certain paragraphs could be discussed for several hours, but all of part entitled “Additional Information,” some points of view— the participants maintained their desire for a consensual approach. thus not factual—expressed by specialists who participated in the In fact, the key to successful cooperation is certainly the capacity investigation. On the other hand, some comments made by the and the will to listen to one’s interlocutors, to understand the cul- BEA were quite unexpected and presented the IAC with some tural and historic differences, and to make compromises. difficulties in integrating or adding them to the report. This desire for cooperation and consensus was present throughout the investigation. It made it possible to complete the investi- 6. Cooperation gation and publish the report within 10 months of the accident. The approach decided on from the very beginning of the investi- All of the participants reached a common understanding of the gation was complete openness. Each investigative body had access event and, in addition, the BEA and the NTSB had no further to all the data. The investigators passed on any new data signifi- comments to make on the final report following the various con- cant to the understanding of the event as soon as they got it. sultations. The IAC published the most important parts of the Subsequently, the IAC took the time, despite heavy media pres- report (the analysis, the findings and the conclusion, the short- sure and the urgency of publishing the report rapidly, to consult comings, and the safety recommendations) on its website. the BEA before communicating any facts relating to the event. The best example of this cooperation concerns the safety rec- Airbus communications, with its operators on elements relating to ommendations. The BEA proposed several improvements to the the investigation, were done on the basis of a consensus reached safety recommendations written by the IAC, so as to extend the between Airbus, the IAC and the BEA. The final report was then application of some of them to operators outside the CIS and for considered at a preparatory meeting in the presence of the accred- others to be addressed to all airplane manufacturers, underlin- ited representatives before being sent out for consultation. Finally, ing the fact that some themes were specific neither to the CIS nor SESSION 1—Moderator David McNair at the request of the BEA, the IAC organized a review meeting to the Airbus A310. In the final wording of its safety recommen- with the accredited representatives and the advisers from Airbus in dations, the IAC took into account all of the comments. ◆ order to discuss the integration of the various comments. Both the BEA and the IAC remained patient and open-minded Endnotes throughout the investigation—initially, during the fact-gather- 1 The third was the accident on Aug. 22, 2006, to a Tupolev 154 operated by ing phase in Irkutsk, then when faced with the BEA’s supposed Pulkovo Airlines in Ukraine (CIS).

ISASI 2007 Proceedings • 25

Proceedings 2007.pmd 25 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS public administrationfrom ShanghaiJiaotongUniversity. in computertechnologyapplication).Healsohasamaster’sdegree in 26 safe eventsfrom happeningbysettingup certificationcriteria, pose offeedforward managementistoprevent anticipatedun- agement, andfeedbackmanagement. We allknowthatthepur- phases intermsoffeedforward management, concurrent management activitiescanbeclassifiedintothree different areas or According tothebasicmanagementtheory, aviationsafetyman- 2. Theroleofinvestigation our investigationbenefitsalotfrom internationalcooperation. ternational anddomesticregulations andstandards. Therefore, nism aswell.Ourinvestigationpracticesare abidedbybothin- ciples, andguidelinesforinvestigation,butacooperativemecha- tion markets. vestigation aspects,thoughChinaisoneofthefast-growing avia- accidents andincidents.We are notexperienced enoughinin- most criticalmeansinsafetymanagement,andinvestigateboth preventive measures adopted,wetake investigationasoneofthe occurrences isincreasing accordingly. Inadditiontotheroutine air trafficvolumewithinlast20yearsinChina,thenumberof an investigationisoneofthemosteffectivewaystoimprove safety. the wholesystemorindustrytotake action.Anditisobviousthat cate oraccessthecause(s),andreveal findingsinorder toalert so topromote safety, it’simportantthattheinvestigation canlo- vestigation istoprevent thesameoccurrence from repeating— It iscommonsensethatthepurposeofanaccident/incidentin- 1. Introduction cooperation. investigation andsafetymanagementbenefitfrom international tional cooperationinaccident/incidentinvestigation,andhow In thispresentation, youwillseethereal importanceofinterna- tion cooperationbecomesmore andmore importantnowadays. tion andtheinfluenceofglobalization,internationalinvestiga- and accidentprevention. With therapiddevelopmentofavia- safety investigationplaysanactiverole inimproving aviationsafety As oneoftheeffectivemeanssafetymanagementactivities, Abstract Annex 13provides uswithnotonlystandards orbasicprin- With anannual average growth rateofmore than16%oftotal • ISASI 2007 ISASI International CooperationPaves the Shanghai No.2Polytechnic University(withamajor of China,withamajorinavionicsand2000from Fu graduated in1982from CivilAviation University Guo Office ofEastChinaAdministrationCAAC. and isnowthedeputydirector oftheAviation Safety Administration ofCivilAviation ofChina (CAAC) Guo Fu Proceedings 26 isanaccidentinvestigatorwiththeGeneral Runway foraSaferSky By GuoFu, EastChinaAdministration,CAAC Case 1: An MD-11F cargoCase 1:AnMD-11F flight accidentinShanghai,China. play amajorrole inaviationsafetymanagement. as equallyimportantothersafetymanagementmeasures and of feedbackmanagement.Hence,theinvestigationactivitiesare poses andfunctionsoftheinvestigationare justthesameasthose which fallsintothefeedbackmanagementcategory. Thepur- takeoff orlandifasectionpartoftherunwayfails. flight. Therefore, youcanneverimagethataflightwouldsafely a solidfoundationcanbetaken asaconcrete runwayforsafe lapse ifoneofthesupportsfails.From theaviationpointofview, feedforward, concurrent, andfeedbackmanagement.Itwillcol- speaking, thefoundationissupportedbytripodscomposedof acts justasasolidfoundationforsafeoperation.Symbolically even regulations toprevent reoccurrence. modifying oradjustingstandards, procedures, policies,programs, suggestions. Meanwhilethelessonslearnedwillbefedbackfor standards, andthenmakes guidelinesforcorrective actionsor finds, oraccessesto,andanalyzesthecausesofdeviationfrom management examines results orconsequencesofoperation, Thus, itcanalsobecalledsimultaneousmanagement.Feedback and theplansare properly implementedorobjectivesachieved. observed duringoperationsothatperformanceisbackontrack dard condition,deviationfrom thestandard, oranyviolationis sures immediate,corrective actionsbetaken ifanybelow-stan- monitor oroverseeoperationalactivitiesinprocesses anden- organizational objectives.Concurrent management isappliedto guidelines orprocesses forimplementingaplan,orachieving mainly basedonprevious experiences orlessenslearned,andset programs, maintenanceprograms, budgets,andetc.,thatare policies, operationalstandards, procedures, manuals,training Aviation safetyinvestigationisakindofmanagement, All theseactivitiesprovide asafeoperationplatform,which 1/14/2008, 9:43 AM In an investigation, we collect evidence, check all the relevant 4.1 Rules to follow aircraft systems and its operational support equipment and fa- We have many rules to follow if we conduct an air safety investi- cilities, gather all the information associated with an incident or gation in China. They include both international and domestic accident, review all the relevant documents, procedures, standards standards. In addition to Annex 13, our investigation will be in and regulations, and try every means to find out, or access the compliance with the following regulations: causes of an event. We make safety recommendations in order to • Law of Civil Aviation of PRC alert the whole system or industry to take actions to prevent or • Law of PRC on Work Safety improve on the basis of findings, including any defect or latent • Civil Aircraft Flight Accident & Incident Investigation unsafe condition found in the fields of management, design, (CCAR395) manufacturing, equipment, operation and maintenance, and • Civil Aircraft Flight Incident (MH2001-2004) human factor issues in, or lessons learned from an event. • Procedure of Civil Aircraft Accident Investigation (MD-AS- With all these measures practiced, the investigation functions 2001-001) as one of the most effective tools of safety protection, and helps • Classification Standard for Aircraft Flight Accident (GB14648- the aviation industry promote safety. 93) • Classification for Ground Accidents of Civil Aviation (GB18432- 3. Cooperation in investigation 2001) In Annex 13 to the Convention on International Civil Aviation, • Response to Aircraft Accident and Family Assistance (CCAR- the most frequently used words are the state of occurrence, the 399) state of registration, the state of the operator, the state of design, • Civil Aviation Safety Information Management (CCAR-396) and the state of manufacture, which shows a very clear picture A two-leg investigation system is adopted in our investigation that an aviation investigation is a multinational endeavor, and we practices. According to our regulations, an investigation will be can also find the obligations and the rights are shared among all conducted by different organizations depending on the conse- these nations in the Annex. From these points of view, the Annex quences of an event. Traditionally speaking, the investigation SESSION 1—Moderator David McNair provides us with not only standards or basic principles and guide- function is shared between the CAAC and the State Council or its lines for investigation, but a cooperative mechanism as well. So, authorized department. To be more specific, the State Council is it sends a strong signal that investigation cooperation is the in- responsible for the investigation into a significant major air trans- ternational standard for aviation safety investigation. port accident and major air transport accident, while CAAC in- We have many reasons for cooperation in the conduct of an vestigates accidents and incidents. Usually a major accident in- investigation. Though ICAO plays a key role in enhancing co- vestigation used to be organized by a temporary organization set operation, there are many other factors that drive the investi- up by the State Council, but things have changed since the State gation itself to seek for international cooperation. Aviation is a Administration of Work Safety (SAWS) was established in 2001. complex system that is an interacting combination, at any level The SAWS is an affiliated organization of the State Council, of complexity, of people, material, machines, tools, software, and it acts as the executive office of the Work Safety Committee facilities, and procedures1. Furthermore, with the affect of glo- of the State Council. One of its major functions is to supervise balization and rapid development in aviation, the investigation the national work safety and conduct or coordinate investigation will be influenced by different factors, such as new technologies of significant major accidents, and major accidents occurring introduced in aviation, technical expertise or know-how, differ- within the territory of mainland China. However, its actual inves- ent cultural backgrounds, language, political systems, etc. It is tigation activities involve other accident investigations, includ- evident that an investigation has become a global challenge that ing general aviation accident investigation and ground aviation needs global cooperation and solutions. One nation’s resources accident investigation. SAWS will conduct these types of investi- sometimes are not adequate to fulfill the requirements of an gation when it has enough professionals to do so. investigation. Only when an internationally cooperative rela- The aviation geographical purview of mainland China is di- tionship is established can an efficient and beneficial investiga- vided by seven regional administrations. Within CAAC, the in- tion be achieved. vestigation is arranged according to the geographical purviews To investigate an occurrence, we need help and assistance from of the regional administrations. Each regional administration is • investigation authorities with resources and power to help co- responsible for conducting an investigation when the following ordinate and communicate, has occurred in its region: • investigators and experts of other nations with knowledge of • An incident involving a commercial air transport, or a general their nation’s safety regulations and policies, operational stan- aviation aircraft. dards, expertise or know-how of the aircraft and its equipments • A ground accident. or systems, and For a major accident, or foreign carrier accident investigation, • other operational supportive facilities, from organizations with it is the general CAAC’s (headquarters) responsibility to investi- special investigation equipments or facilities—otherwise, we gate. It can also delegate its investigation authority to relevant couldn’t have a good investigation. regional administrations accordingly.

4. Investigation practices in China 4.2 Investigation regulation introduction In this part, you will see that investigation practices in China CCAR395, Civil Aircraft Flight Accident & Incident Investiga- benefit from international cooperation in terms of technical sup- tion, outlines all the requirements for the investigation. The main port and coordination. contents are organization of investigation, investigator, notifica-

ISASI 2007 Proceedings • 27

Proceedings 2007.pmd 27 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 28 • no otherorganization orindividualisallowedtointerfere. • ducted. Four basicprinciplesmustbeabidedbyifaninvestigationiscon- 4.2.2 Basicprinciplesforinvestigation tion (GB18432-2001)inasimilarway. and sodoestheClassificationforGround AccidentsofCivilAvia- Accident (GB14648-93)definesandclassifiestheflightaccident ground aviationaccident.ClassificationStandard forAircraft Flight dents inourclassifications—oneisflightaccident,andtheother the precursor oftheaccident.There are twodifferent typesofacci- 2004), givesthedefinitionofincidentandlistsitemsconsidered as explained. For instance,CivilAircraft FlightIncident(MH2001- classifications forthelevelsofaccidentandincident,itemsare almost thesameasthoseinAnnex 13,there are more detailed regulation. Althoughdefinitionsoftheaccidentandincidentare It isrequired toinvestigateboththeaccidentandincidentby 4.2.1 Scopeofinvestigation formation oftheregulation. similar tothoseofAnnex 13.Thefollowingistheimportantin- Annex 13.Actually, themaincontentsofregulation are quite tures oftheregulation iscooperation,whichreflects thespiritof tion, investigation,andreport. Oneofthemostimportantfea- • scientific andcannothaveanyintentofsubjectivity. the stateofregistry, thestateofoperator, andICAOaccord- as thoseofAnnex 13. tion, preliminary report, andformatfinalreport are justthesame clusion andrecommendation. Therequirements ofthenotifica- evidence collection;facts,preliminary report, andanalysis;con- cation through finalreport. We maydescribethemasrescue and The investigationprocess usuallyhasthree phases,from notifi- 4.3.2 Investigationprocess tion, siteclean,andaftermathassistanceneedtobecoordinated. and someperipheralgroups involved—forexample, siteprotec- tion medical,survivalfactors,humansafetymanagement, ers, failure analysis,ground handling,weightandbalance,avia- teorology, aviationsecurity, airportmanagement,flightrecord- tors from ATS, flightoperation,airworthiness, aeronautical me- of theoccurrence. Afullgo-teamwillbecomprisedofinvestiga- size oftheteamwilldependonconsequenceandsignificance upon receiving anoccurrence according totheauthorization.The In mostcases,aninvestigationteamwillbeformedimmediately 4.3.1 Investigationorganization 4.3 Investigationpracticesandcases dent, buthavepotentialimpacttoflightsafetyandrelated issues. lyze anddeterminefactorsthatare notdirectly related theacci- the causeofaccidentandcontributingfactors,butalsoana- • cies, andregulator’s rulesandregulations andimplementation. tenance, personneltraining,andcompany’smanagementpoli- defect concerningaircraft design,manufacture, operation,main- the accidentorincidentandcontributingfactors,includingany We must informtheauthoritiesofstatemanufacture, Detailed Objective Independent Thorough • ISASI 2007 ISASI : Investigationshallanalyzeanddeterminethecausesof : Investigationshallbefactdriven,objective,fair, and : Investigationshallnotonlyanalyzeanddetermine : Investigationshallbeconductedindependently— Proceedings 28 Case 2:ACRJ-200passengerflightthatcrashedinBaotou,China. (CAAC) forwarded notificationoftheaccidenttostate of and apost-crashfire. The airplanewastotallydestroyed byhigh-energy impact force board. Itcrashedataconstructionsite3minutesafterliftingoff. national cargo flightwithtwopilotsandonetechnicianon International Airport,operatingasaregularly scheduledinter- departedatShanghaiHongQiao On April15,1999,anMD-11F cargo4.4.1 MD-11 accidentonApril15,2005,inShanghai,China 4.4 Cases vestigation andforsafetyimprovement. troductions willshowhowvaluablecooperationisinasafety in- which madeourinvestigationssuccessful.Thefollowingcase in- cooperation from our foreign partnersinsafetyinvestigations, if theyare accepted,orattachedifdenied. reviewed andcorrections oramendmentstothereport willbetaken port isreleased, allthecommentsorsuggestionsreceived willbe it issenttorelevant organizations forreview. Before thefinalre- rence. Thedraftfinalreport isapproved bytheteamleaderbefore event. Itisasked tobesubmittedwithin30daysaftertheoccur- reports andcontainsthefactualinformationassociatedwith report iscompiled bytheteamleaderandisbasedonallgroup different opinionwillbeattachedifthere isany. Thepreliminary man withthesignature ofeveryparticipant thegroup, anda group report afterfieldinvestigation.Itisdone bythegroup chair- draft finalreport, andthefinalreport. Eachgroup mustfinishits adopted. Theyare thegroup report, thepreliminary report, the submitted duringtheinvestigation,butfourare commonly industry. sults ofthecooperationare fruitfulandbeneficialtotheaviation national partnersduringaninvestigation.Itisobviousthatre- have shared agoodexperience workingtogetherwithourinter- accident andincidentinvestigation.There isnodoubtthatwe assistance from manyforeign investigativeauthoritiesbothin from therelevant authorities.Inourpractices,wehavereceived we havespeedyresponses withwillingnesstoprovide assistance are ready toofferhelpundermostcases.Andofthetime ingly, eventhoughthefieldrepresentatives ofthemanufacturer After theaccident,CivilAviation AdministrationofChina After We havereceived muchvaluableassistanceandinternational Usually, severaldifferent kindsofreports willbefinishedand 1/14/2008, 9:43 AM manufacture, the state of registration, the operator, and ICAO. A joint investigation team was formed in accordance with the provisions of Annex 13. The investigation received technical support from the relevant investigation authorities, aircraft manufacturer, engine manufacturer, airlines, and component manufacturers during the investigation. The team made a thorough search of the crash site, and found the memory circuit board of the solid-state cockpit voice recorder (SSCVR) and pieces of tape from the quick access recorder (QAR) in addition to all recovered engines, control systems and surfaces, and other most important components. The SSCVR’s memory circuit board, all collected pieces of QAR tape, and the electronic engine controllers (EEC) were sent to the United States for data retrieval. The whole contents of the SSCVR and EEC were successfully retrieved in the NTSB lab and engine manufacturer’s lab, respectively, which helped investigators understand what had happened in the cockpit and the engines’ performance before the crash. A joint bulletin of the accident, signed by these corrective measures have raised both management’s and the three parties, was released in three nations on April 27, 1999, frontline personnel’s concentration on the contamination issues. and excluded the possibilities that the accident was caused by any explosion, sabotage, or ATC mishandling. 4.4.3 Engine IFSD incident investigation Members of the joint investigation team and their advisors On March 3, 2007, a Boeing 747-200, enroute from PVG to KIX, gathered at the Boeing flight safety facilities in Long Beach, Ca- experienced No. 2 engine IFSD followed by an audible loud boom SESSION 1—Moderator David McNair lif., for flight simulation tests. The simulation was performed more and a drop in engine parameters. The aircraft returned to PVG than 100 times. and landed uneventfully. This event is considered to be an inci- The accident scenario was at last understood on the basis of all dent as per Civil Aircraft Flight Incident of CAAC. the analyzed, collected factual information; tests conducted; re- Since we focus on aircraft with a relatively long time of service, corded information retrieved; and key systems, parts, or compo- this aircraft had experienced three IFSD within 4 months. In or- nents examined. der to investigate the cause of this IFSD event, a notification was The probable cause of the accident was the flight crew’s loss of sent to the state of engine manufacture, and an investigation team altitude situational awareness resulting from an altitude clear- was formed with the experts from the engine manufacturer since ance wrongly relayed by the first officer and the crew’s overreac- the state of manufacture appointed a non-travel accredited rep- tion with abrupt flight control inputs. resentative. With all the help and assistance from our foreign partners, we In the investigation, we found that one cluster of the fourth could then reconstruct the accident scenario and better under- stage LPT stator of the engine exhibited displacement and outer stood the accident. shroud forward OD hook fracture, which resulted in the cluster’s rubbing against the fourth stage LPT rotor blades and conse- 4.4.2 CRJ-200 accident on Nov. 21, 2004, in Baotou, China quently rupturing some of the blades, and the ruptured fly-away On Nov. 21, 2004, a CRJ-200 aircraft departed Baotou Airport at blades cut away all the blades/vanes on the fourth, fifth, and sixth 08:21 (Beijing local daylight time) for a scheduled passenger flight stage. Several other fourth stage LPT blades displayed fatigue in from Baotou to Shanghai, and 1 minute later it crashed in a park the airfoil fracture just above the root platform. Further lab ex- nearby. amination revealed that the vane clusters’ displacement/fatigue The investigation was instituted and organized by SAWS. CAAC fractures were resulted from their sharp radii at the OD forward was on the technical investigation team since it was a significant foot due to improper engine overhaul. major accident. The technical investigation team was comprised The advantages of the manufacturer’s involvement were not of the state of occurrence, the state of aircraft manufacture, and only that it knew its product and was able to provide expertise in the state of engine manufacture. the investigation, but also that it took immediate actions or gave One of the probable causes of the accident was wing contami- professional instructions if problems were found. nated with frost. At the beginning of the investigation, it was very Though incident investigation seems not as urgent as accident hard for most of us to believe that frost contamination would investigation to some extent, we can still promote aviation safety result in such a tragedy though we knew that ice or snow would by revealing defects found in the system and making safety rec- impair the wing’s performance if it was contaminated with them. ommendations. We also can prevent the accident from happen- Through the discussion and demonstration of performance of ing by investigating the incident since we define an incident as a supercritical airfoils without leading edge devices by the experts precursor of accident in Chinese. of manufacturer, we understood why contamination is so critical to those airfoils. A nationwide cold weather operation training 5. The challenges ahead campaign was adopted with the help of our Canadian colleagues, Through cooperative efforts, the aviation community has resolved and the cold weather operation program was revised and imple- many problems that impair safety, but we still have to face those mented to prevent the same disaster from happening again. All safety-related challenges. From the investigator’s point of view, the

ISASI 2007 Proceedings • 29

Proceedings 2007.pmd 29 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 30 ence, knowledge,andlessonslearnedbyseminars,conferences, to findtechnicalsolutionsaswell.We share information,experi- dards, procedures, andpolicies,butoptimize technologiesinorder software andhardware. We needtonotonlyrationalizethestan- tive measures toimprove theoperationalenvironment byboth aviation communitystepupandwidencooperationtotake effec- rences associatedwithlanguagedifficulty. phony inair-ground communication,westillhavesomeoccur- guage. Thoughwecantrainpilotsandstandardize radiotele- whose mothertongueisnotEnglish,sinceittheaviationlan- addition, languageisanotherworldwideissueforthosepilots between nationsusingdifferent altitudeassignmentsystems.In different nationstoprevent aflightcrew’s confusionwhile flying cessful solutiontodifferent ATC altitudeassignmentadoptedin resolve problems confronting ussincetheyare globalchallenges. extent. Insomecases,onenation’s competenceisnotenoughto ment thatwillreduce human-factors-related issuestothegreatest whole communitytoworkhard toprovide anoperationenviron- count foralarge amount ofoccurrences. Thatiswhyweneedthe biggest challengenowishuman-factors-related issues,whichac- Therefore, itisstrongly recommended thattheinternational The cockpitmeter/feetchange-overswitchoffersaverysuc- • ISASI 2007 ISASI Proceedings 30 1 Barry Strauch:InvestigatingHumanError: Incidents,Accidents,andCom- 1 Barry Endnote forces tomovetheaviationindustryinafavorabledirection. cooperation, whichwillfunctionasoneofthepowerfuldriving whole aviationcommunitywillsurely benefitfrom investigation tional standards ininvestigationwithacooperativeattitude.The embrace theglobalizationtrend andstrictlyfollowtheinterna- will make ahugedifference toouraviationsafetyrecord ifwe matter whatkindofinvestigation(accidentorincident)itis,we sharing expertise, experience, andinformation.Asaresult, no increasingly activerole inpromoting investigationefficiencyby scope isbeingwidened,internationalcooperationwillplayan plays afairlysignificantrole inimproving aviationsafety. Asits flight, alongwithothersafetymanagementactivities,andthus gation laysasolidfoundationforthesafeoperationand From theabovediscussion,wemayconcludethatsafetyinvesti- 6. Conclusion creating smallgadgetsornewtechnologies. training andreachout programs. We canresolve bigissuesby plex Systems. 1/14/2008, 9:43 AM ◆ Winter Operations and Friction Measurements By Knut Lande, Inspector of Accidents, Accident Investigation Board, Norway—AIBN (CP0140)

Knut Lande has background as a mechanical and there is no internationally agreed method of correlating mea- aeronautical engineer, fighter pilot, test pilot, offshore sured FC to the ABC. Complicating the picture, there are nu- helicopter pilot, project pilot, and chief technical pilot, merous approved friction measurement devices giving different with more than 10,000 flying hours in more than 50 results on each measurement on the same contamination, but types of airplanes and helicopters. During his test related to only the same SNOWTAM table. pilot period in the Royal Norwegian Air Force The AIBN accident and incident investigations have shown Material Command, he was involved in friction that the trust in friction measurements and use of FC in aircraft testing measurements and correlation trials with fighter aircraft on landing performance calculations are not justified due to the lack snow-covered runways. As chief technical pilot, he was a member of the of scientific data. The AIBN can document that use of measured JAA Performance Working Group and a member of the JAA Human FC on wet snow and ice is very uncertain. Further, the ICAO Factors Steering Group. Lande is a member of the Society of Experi- SNOWTAM table, which gives the FC in 1/100th, is only accurate mental Test Pilots and has presented papers at several aviation to 1/10th at best. The AIBN suggests that the SNOWTAM table conferences in Europe and the U.S. In 2000, he started working as an be modified and an agreed correlation algorithm be adopted. SESSION 2—Moderator Sue Burdekin inspector with the Aircraft Accident Investigation Board of Norway Finally, the AIBN fully supports the U.S. NTSB in its recommen- and is involved in the investigation of accidents and incidents related dation to stop giving credit for use of thrust reversers when cal- to slippery runways, in addition to investigations related to all types of culating the actual landing distance on snow- and ice-contami- airplanes and helicopters. nated runways just before landing.

Summary Accidents and incidents in Norway related to winter The Accident Investigation Board Norway (AIBN) has investi- operations and friction measurements gated 24 accidents and incidents related to winter operations and Due to the Norwegian climate with freezing temperatures and friction measurements during the last 8 years. In Norway there snowfall during the winter season, and the difficulty of removing seems to be an increase in the frequency of these types of mis- the contamination, Norwegian aircraft operations have been al- haps, even though friction measurements have been used for lowed to continue on snow- and ice-contaminated runways. Fur- more than 50 years. ther, many of the Norwegian airports are located along the coast The Chicago Midway accident of Dec. 8, 2005, where a Boeing causing frequent freezing and melting of snow and ice on the 737-700 slid off the departure end of the runway, indicates that runways. The practice of operating on contaminated runways the winter challenges are international. The similarity of the seemed to function relatively well over the years with very few Norwegian mishaps and the Midway mishap is that operations runway excursions. In Norway, friction measurements on snow- performance computers (OPC) were used to calculate the air- and ice-covered runways have been performed on a regular basis craft stopping distances. Behind the OPC computations are two since 1949. Over the years the friction numbers from these mea- uncertain variables: the measured friction coefficient (FC) with surements have been used successfully by aircraft commanders its measuring tolerance and the airplane braking coefficient. in a conservative way, and very few runway excursions occurred Trials of runway friction measurements on winter contaminated as a result of slippery runways. In recent years, however, the air- runways started at Oslo Fornebu and Gardermoen Airports dur- lines have initiated performance calculations based on use of ing the late 1940s by the airport manager Ottar Kollerud. He cor- operations performance computers where the measured FC is related the results with similar measurements in airplanes. Early used as input for actual landing distance calculations. on, he concluded that the aircraft deceleration was about 50% of Since 1999, the Accident Investigation Board of Norway (AIBN) the vehicle deceleration. Hence, a correlation was established that has received 24 reports related to operations on slippery run- the airplane braking coefficient (ABC) was half of the measured ways. Most of these excursions were minor incidents, but there friction coefficient. This was later called the Kollerud method. have been some accidents and serious incidents as well. Based on Later trials in the U.S. and Canada have indicated different a seemingly increase in reported incidents, the AIBN has initi- correlation factors, but in general agreement with Kollerud’s ated a special investigation into these incidents. results. These early trials in Norway led to further international trials Recent accidents and serious incidents in Norway include that again led to the development of internationally agreed 2-11-2000—ENHF DH-8-103 slid off the runway during land- (ICAO) measurement methods and equipment. This was the ba- ing. AIBN REP 23/2002 sis for the ICAO SNOWTAM format and friction table. Wx: METAR ENHF 2050Z 01013G24 260V080 9999 SCT010 Today, there are several correlation algorithms available, but 01/M02 Q0967=

ISASI 2007 Proceedings • 31

Proceedings 2007.pmd 31 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 32-33-31 (Skiddometer/SKH). Runway status:Rwycovered by8mmofwetsnow. Measured FCwas SCT005 BKNM02/M03Q1007= Wx: METAR ENTO261850Z03009KT 9999 –SNFEW003 ing. Underinvestigation. 3-26-2006—ENTO A321slidofftheendofrunwayafterland- 25-26 (Skiddometer/SKH). Runway status:Rwycovered bywet ice, sanded.Measured FCwas24- 400 FT23050G64KT=BKN025 02/M01QNH965hPa WIND1 Wx: METAR ENEV301350Z21026G42KT SCT015 9999VCSH on therunway. Underinvestigation. landing buttheCommandersucceededinkeeping theaircraft 1-30-2005—ENEV B737-400lossofdirectional control during Measured FCat1950was34-32-32(Skiddometer/SKH). Runway status:Rwycovered snowontop. bysandedicewith8mmofdry M04/M06 Q1018 Wx: ENEV252050Z34006KT 9999–SHSNSCT015BKN030 Under investigation. 11-25-2004—ENEV A320slidofftherunwayduringtake off. tual ABCwasPoor. sanded Measured FCat1150Zwere 48-52-48(Griptester/GRT). Ac- Runway status:Frost andiceontherunway, partlycovered bysnow, M16 Q1014ARCTICSEAFOG= Wx: METAR ENVD1250Z17009KT 0700BCFGICVV004M14/ AIBN REP33/04 1-6-2003—ENVD DH-8-103 slidofftherunwayduringlanding No measured FC.Actual ABCwasPoor. Runway status:Rwycovered bywetsnowandslushfrom recent showers. M03 Q1020TEMPO0500+SHSNGRVV005 Wx: METAR ENZV192028009KT2000SHSNGSXX012M02/ ing landingAIBNREP77/2000 slidofftheendofrunwaydur- 5-11-2000—ENTC DC-9-87 tual ABCwasPoor. sanded.Measuredon top,rwy FC47-47-44(Skiddometer/SKH).Ac- Runway status:Rwycovered bycompactsnowwith1-3mmofwet BKN035 01/M01Q1002 SCT020 Wx: METAR ENML2020Z32016KT FEW010 9999VCSH AIBN REP17/2001 3-14-2000—ENML F-27-50 slidofftherunwayduringlanding. Actual ABCoreffectiveFCwasintheorder of0.05(Poor). sanded.Measuredslush ontop,rwy FC32-34-33(Griptester/GRT). 32 Runway frictioncoefficientmeasured withapproved equipment. • Runwaysanded. • Wet ormoistcontamination. • of compactsnoworice. Sometimescovered bylooseslushorwetdrysnow ontop • Runwayscontaminatedbycompact snoworice. • (sanding/gritting). Specially prepared winterrunwayaccording toregulations • incidents Common factorsduringNorwegian Runway status • ISASI 2007 ISASI : Rwycovered bycompactsnowandicewith3-4mmof Proceedings 32 = (SWOP, afinalreport willbeavailablelaterin2007). SafeWinter OperationsProgram 2003-2007—Norwegian • gram (JWRFMP). 1997-2004—JointWinter RunwayFriction Measurement Pro- • tion-measuring equipmentandbrakingtrialswithaircraft. 1992-2000—Transport Canada/Boeing/ICAOtrialswithfric- • 1992—DrydenReport. • action. 1987—ICAOworkingpaperAN-WP/6081-Runway braking • Kjeller AirBase. 1978—FFA highpressure tire/BV-11/SFT/F-5B trialsatRNoAF • 1976—FFA BV-11 correlation trialswithaircraft. • 1965—BV-6 inuseatOsloAirportFornebu. • 1964—ICAO-SNOWTAM formatdeveloped. • 1955—ICAOCircular 43-AN/38,Kollerud methodenclosed. • tion withScandinavianAirlines. 1950s—Todays SNOWTAM tablewasdevelopedincoopera- • Decelerometer. tests atOsloAirportsFornebu andGardermoen usingGMC/ 1946-49—AirportManagerO. Kollerud performedfriction • and measuredfrictioncoefficients Some internationalhighlightsrelatedtowinteroperations shortrunways incombinationwithprecipitation andlowvisibility. • at runwaysurfacetemperature offreezing closetozero °C. precipitation intheformofsnow, supercooledrain,andhail • useofTapleymeter onrunwayswith snow, slush,andfrost. • runwayswithsmoothmacro/micro texture. • large timelapsebetweenthemeasured numbersand landings. • measured FCdueto enced brakingaction(airplanecoefficient,ABC) and The results showedlarge differences betweenthepilots’experi- ish CCAsandScandinavianAirlinesduringthree winterseasons. andSwed- This wasaScandinaviantrialinvolvingtheNorwegian during 1972-75 Scandinavian trialproject“ Griptester(GRT)—Tested during 1994andintroduced later. • high-pressure tire in1978. Tests withSKH,SFT, andF-5B—Tests atKjellerAirBasewith • SFT—In usewithhigh-pressure tire 1976. • suring wheel1973. SaabSurfaceFriction Tester (SFT)—Modifiedelectronics/mea- • In usefrom 1972. SkiddometerBV-11 (SKL)—Tests atOsloFornebu from 1969. • Mumeter—Tests atOsloFornebu andBergen Fleslandin1969. • use from 1965. SkiddometerBV-6—Tests atOsloFornebu during1963-64.In • Tapley meter—Tests atOsloFornebu in1957.Inusefrom 1959. • Gardermoen from 1949. GMCtruck/decelerometer—Tests atOsloFornebu and • Car/stopwatch—Tests atOsloFornebu from 1946. • wintertrialson contaminatedrunways Some Norwegian including belowfreezing). Smallspread (<3K)betweenOAT anddewpoint(moisture, • Landingdatacalculatedbyacockpitperformancecomputer. • AcceptableFC. • UseofICAOSNOWTAM table. • 1/14/2008, 9:43 AM Slippery Runways” Norwegian aviation regulations 1 Poor friction level—0.25 and below The Norwegian aviation regulations are based on ICAO Annexes 9 Not to be estimated and JAA/EASA regulations. Hence, runway design, winter prepa- rations, friction measurements, and reporting conform to inter- 2.6 Friction-measuring devices and acceptable conditions national standards as laid out in ICAO Annex 14 and ICAO Doc. 9137 AN/898 Airport Services Manual, Part 2, Pavement Surface 2.6.1 The following friction-measuring devices are accepted for Conditions, Fourth Edition, 2002. use at Norwegian aerodromes: Norwegian Aeronautical Information Publication (AIP Norway) GRT—Grip Tester From AIP Norway, EN AD 1.2-2 (Reference 3): SFH—Surface Friction Tester, high-pressure tire SKH—Skiddometer BV 11, high-pressure tire “Winter maintenance RUN—Runar 2.1 General VIN—Vertec Inspector TAP—Tapleymeter 2.1.1 All Norwegian aerodromes may experience winter conditions of variable frequency and duration. The CAA Norway’s requirements 2.6.2 In general, there is great uncertainty related to measure- for maintenance of the movement area at Norwegian aerodromes ment carried out under wet conditions. The snow and ice is then are based upon ICAO SARPS and covers the following: at its melting point. For instance is TAP not accepted under wet Inspections for identifying contamination (rime, snow, slush, ice, etc). conditions. Ref. is made to item 2.7 below for more information. Snow clearing for the removal of contamination. Treatment for obtaining the best possible friction. 2.6.3 A measured friction level is associated with the measuring Reporting of the conditions. device and can not be used as an isolated number. The acceptable conditions for the measuring devices are 2.3.3 For the removal of contamination and for the treatment of SKH/SFH: SESSION 2—Moderator Sue Burdekin the movement area the following mechanical means are used: Dry snow up to 25 mm Snow ploughs Dry compact snow any thickness Sweeper blowers Dry ice any thickness Snow blowers Slush up to 3 mm Spreaders for liquid and solid chemicals Wet snow up to 3 mm Spreaders for sand. Wet ice GRT/RUN/VIN: 2.5 Reporting Dry snow up to 25 mm Dry compact snow any thickness 2.5.1 The international SNOWTAM format is used for reporting Dry ice any thickness the winter conditions at the movement area. The format is de- Slush up to 3 mm scribed in ICAO Annex 15, Appendix 2. Wet snow up to 3 mm TAP: 2.5.2 The conditions at the movement area are reported to the Dry snow up to 5 mm ATS using a special format from which the ATS will issue a Dry compact snow any thickness SNOWTAM. 2.7 SNOWTAM format item H 2.5.2 H Friction The table used under item H, with associated descriptions, was The level of friction on a runway may be reported as measured or developed in the early 1950s from friction data collected only on estimated. If the aerodrome operator can not answer for the fric- compact snow and ice. The friction levels should not be regarded tion level or if the conditions exceeds those acceptable for the as absolute values, and they are generally not valid for other sur- measuring devices, then the number 9 shall be reported. Mea- faces than compact snow or ice. Nevertheless it is accepted that sured friction level may only be reported when the conditions are friction level may be reported when conditions with wet snow or within those acceptable for the measuring device. Measured fric- slush up to 3 mm depth are present and a continuous measuring tion level is reported for each third of the runway as viewed from device is being used. A numerical expression regarding the qual- the threshold having the lower runway number and is reported in ity of the friction levels reported in the SNOWTAM can not be 2 digits (0 and point is omitted) followed by the sign for the fric- provided. Tests show that the accuracy indicated in the table tion-measuring device. Ref. item 2.6 and 2.7 below for further in- can not be provided using today’s friction-measuring devices. formation. The friction may be estimated by a qualified person. While the table uses numbers with two digits, the tests show Estimated friction level is reported for each third of the runway as that only numbers with one digit can be of operational value. viewed from the threshold having the lower runway number and is Utmost caution should, therefore, be taken when using the re- reported in 1 digit according to the following table: ported friction levels, and the use of the table must be based 5 Good friction level—0.40 and above upon the aircraft operators own experience.” 4 Medium/good friction level—0.36-0.39 3 Medium friction level—0.30-0.35 Friction measurements 2 Medium/poor friction level—0.26-0.29 In 1946 the airport manager of Oslo Airport started friction test-

ISASI 2007 Proceedings • 33

Proceedings 2007.pmd 33 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS on asurfacewithnilbraking(CRFI=0.0). (CRFI =0.80)andaminimumvalue(rolling resistance) of0.02 a conservativemaximumvalueof0.34onbare anddrysurface be usedintheequationforstoppingdistance,andisbounded by eral termsusingtheequation: used topredict theminimumaircraft brakingcoefficient ingen- against theCRFI,onefoundthatvalueofCRFIcanbe findings from theJWRFMP. Runway Friction Index (CRFI)tablesandfurtherdevelopedupon the JamesBrake Index (JBI)tables,laterrenamed toCanadian Canada developedtheKollerud methodfurther suring device,itchoosethe 34 In 1974ICAOpublished braking between frictionmeasurementsandaircraft Correlation betweenfriction-measurementdevicesand where introduced andusedoperationallybystates. best intention,newfriction-measuringdevicesofdifferent makes and theneedforcorrelation andharmonizationarose. With the different results whenmeasuringatthesamesurfaceconditions pancy time.” form withanaccuracyof0.01andrequired ashortrunwayoccu- provided theincipientskiddingfrictioncoefficientina graphical procedures andregulations. From thereport: ther developmentsoffriction-measuringdevicesandassociated participated. Two oftheserepresentatives becamecentralinfur- ments inaircraft like andDC-6. DC-4, theDC-3, of thevehicle.Theresults were correlated withsimilarmeasure- decelerometer mountedinatrucktomeasure thedeceleration ing onacompactsnow- andice-covered runwayusinga wheel GMCtruck. for theaircraft wasfoundtobehalfthebrakingactionfor10- Fornebu. Kollerud concludedthattheeffectivebrakingaction Gardermoen andoperationalexperience from Oslo Airport outunderwinterconditionsatOsloAirport tests carried manager OttarKristianKollerud. Thisreport wasbasedupon the decelerometer Routes andGround AidsDivision,representatives from Sweden noted: way brakingaction.” exists betweenvarioustypesofequipmentusedinthemeasuring of run- objective oftheprogram was“ tional program forcorrelating friction-measuringdevices.The length underwinterconditionsatOsloAirport,Fornebu we findthe mark, and Norway in1959 mark, andNorway reasons, andwhentheNordic countriesFinland, Sweden,Den- by usinganotherprincipleofmeasurements. belief thatmore accurateandreliable results couldbeobtained The “recommended” aircraft isto brakingcoefficient,MuR, From JWRFMP findings When Canadain1970 However, oneexperienced thatthedifferent principlesgave “One statereported thatavehiclehadbeendeveloped In theICAOCircular “In theevaluationofreduced testdatathefollowingwas From theconclusions: Using alarge truckwasfoundtobeimpracticalforvarious In 1962 • ISASI 2007 ISASI 4 , attheseventhsessionofICAO, Aerodromes, Air Report ontheprocedure forcorrection ofminimumrunway Proceedings Aircraft µ Tapleymeter 34 1

9 Ice andSnowonRunways, 6 thefinalreport from thefirstinterna- introduced theuseofafriction-mea- 8 3 eff :—Exclusive ofaircraft type,plotted agreed uponastandardized device, James BrakeDecelerometer =0.5Measured µ. waschosen.However, there wasa to definethedegree ofcorrelation that MuR =0.40×CRFI+0.02. 7 anddeveloped AttachmentB, 2 , . Transport by airport 5 plying processes.” continue thedevelopmentof bothmeasuringvehiclesandap- ing ofbrake numberstopilotsisofimportance,itnecessary to Figure 2.NASAAircraft/SAAB testerfrictioncorrelation. Figure 1.NASAformulaeforpredicted aircraft braking(Mueff). search InstituteofSwedenconcluded continued inSwedenandScandinaviatheAeronautical Re- parison tablesandinthecorrelation classification.” 4. TheinverseDBDSDR(1/SDR)canbeincludedinthe com- (under 40mph)andonthelowerfrictionsurfaces. Even greater lackofprecision isevident atthelowertestspeeds 3. Alackofprecision isevidentamongmeasuringdevicestested. changes insurfacetextures.… 2. Correlation varieswidelybetweenequipmentpairsandwith 1. Somedegree ofcorrelation exists amongthedevicestested. In theU.S.,there were several testandresearch activities. New The aircraft wasbrought intotheloopandresearch activities 1/14/2008, 9:43 AM 10 in1980that“ifreport- The CRFI method is used only in Canada. See Figure 3 and Ref- erences 4 and 7. Through ASTM, as part of the JWRFMP, an International Runway Friction Index (IRFI) has been developed. The ASTM Standard E 2100-0414 defines and prescribes how to calculate IRFI for winter surfaces. IRFI is a standard reporting index to provide information on tire-surface friction characteristics of the movement area to aircraft operators. The IRFI method typically reduces the present variations among different GFMDs from 0.2 down to 0.05 friction units. If we summarize the situation of today, we find that the accuracy one was reported to have in 1962 are five times better than the accuracy one is told to get using the ASTM standard of today Figure 3. Canadian Runway Friction Index (CRFI). (See Table 1). No states are using this standard. AIBN comments regarding implementation of a IRFI is that Norwegian experience shows that all of the approved friction- measurement devices in use show a similar accuracy/uncertainty and a possible difference falls within the data scatter. Hence, it is considered of no value to correlate one device to another.

Correlation algorithms available today: SESSION 2—Moderator Sue Burdekin Kollerud: All airplane types—μb = μf x 0.5

DeHavilland (Bombardier): DH-8-100/300—μb = 0.6 x μ measured cont / μ measured dry DH-8-400—μb = 0.5 x μ measured cont / μ measured dry

NASA/ICAO: All airplane types—μb = {0.2 x μf + 5/7 x (μf )²}

Figure 4. Different correlation curves between measured and Transport Canada: aircraft μ. All airplane types (CRFI)—μb = 0.02 + 0.4 x μf

correlation charts were developed. In March 1988 NASA pub- Figure 4 shows a comparison between the different correlation lished11 correlation charts based upon findings from a joint FAA/ curves. From the Figure, some significant conclusions may be NASA research program. drawn: Figures 1 and 2 are from a paper prepared for the Air Line • With an uncertainty of the order of ± 0.10, a measured FC of Pilots Association, International, by Walter B. Horne, 199012. 0.30 (MEDIUM) may for all practical purposes be between 0.20 AIBN comments to the NASA correlation curve in Figure 2 is (POOR) and 0.40 (GOOD). that it is not obvious that the friction test data correlate with the • Depending on the correlation curve in use, measured 0.30 curve, taking into account the uncertainty of the measured FC. (MEDIUM) may give an airplane braking coefficient (or Effec- See Figures 3 and 4, and Table 1. tive μ) between 0.07 (POOR) and 0.13 (MEDIUM). In 1990 NASA published a report13 referring to the same re- • Depending on which correlation curve in use, the landing dis- search program and among the major test findings were: tance required (LDR) may differ significantly. “For wet-runway conditions, the estimated aircraft braking performance from the ground-vehicle friction measurements was Norwegian CAA (CAA-N) within ± 0.1 friction coefficient value of the measured value, ex- Figure 5 includes a CAA-N-approved correlation curve for the cept for some rain-wet data.” B-737 based on Boeing data in Table 5. “For snow- and ice-covered runway conditions, the estimated aircraft braking performance from the ground-vehicle measure- Friction measurement uncertainties ments was within ± 0.1 friction coefficient value of the measured The ICAO SNOWTAM table does not contain any tolerances or values.” uncertainties. The measured FC values are used as measured to The next major research program was the Joint Winter Run- a 1/100th accuracy. way Friction Program (JWRFMP). Over the year, several trial results have indicated that there is Through JWRFMP, the Canadian Runway Friction Index, an uncertainty in the measured friction values. Table 1 show some CRFI, was further developed and is in operational use in Canada. documented measured FC uncertainties.

ISASI 2007 Proceedings • 35

Proceedings 2007.pmd 35 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS Figure 5.CAA-N-approved B-737correlation curve(blackline). measurements. mum frictionlevel(MFL)for runwaysbywetrunwayfriction of maintainingthedesignobjective level(DOL)andthemini- deviation toICAOwithregard totherecommended procedure Airport ServicesManual,Part hasfileda 2,Chapter3.Norway use ofwetrunwayfrictionmeasurements asperICAODoc.9137, continued thepracticeofmeasuringrunwayfrictionvalues by the order of±0.10-0.20.Basedonthesetestresults, Avinor dis- 36 with SKHandGRTondifferent MTDsurfaces. Figure 6.NorwegianwetrunwayFCmeasurement results Table 1.Friction measurement uncertainty. numbers different runwaysurfacetextures identifiedbyindividualsurface way testingbyAvinor from testingSKH(BV-11) andGRT on 90NS .0Aircraftintheloop UseofASTMstandard Reportedbyastate Compactedsnowand Wetsurfaces ±0.20!0.05 ±0.10 ASTM ±0.15,0.10 NASA ±0.20,0.15 2005 ±0.01 1990 ICAO ICAO 1974 ICAO Remark 1974 Accuracy—Uncertainty 1962 Organization YEAR Figures 6and7showsome results from wetrun- Norwegian • ISASI 2007 ISASI 15 . Ascanbeseenfrom theFigure, theuncertaintyisof Proceedings 36 E2100-04 ice surfaces entirely suitablefortheintendedpurposes.This makes thepro- tained frictionvaluescanbeconsidered accurateand reliable, and of theallowablesurfacecontaminant conditions.Thus,theso-ob- structions, allofthemwillprovide similarfrictionreadings forany ing properly andcalibratedinaccordance withmanufacturers’ in- Transport Canadaconfirmthat aslongsuchequipmentiswork- outtodatebytheFAAtion-measuring equipmentcarried and and CFMEs,noted—Extensiveteststrialsofvarious fric- to rare occasions....” operations inaccordance withJAR-25 AMJ25X1591are limited 2. “An adequateoveralllevelofsafetywillonlybemaintainedif commander istowaituntiltherunwaycleared.…” 1. “Inthecaseofacontaminatedrunway, thefirstoptionfor See JAR-OPS 1.490(c)(3) Takeoff—Runway surfacecondition IEM OPS1.490(c)(3) quired speed rangefortheexisting runwayconditions.” braking coefficientoffrictiontheairplanetypeoverre- correlating themeasured runwaycoefficientandtheeffective runway frictioncoefficient,theoperatorshoulduseaprocedure “If theperformancedatahasbeendeterminedonbasisof See JAR-OPS 1.485(b) General—Wet andcontaminatedrunwaydata IEM OPS1.485(b) JAR-OPS 1SubpartGAMC/IEMG-Performance classA JAR OPSregulations (See Endnote16). Figure 7.NorwegianAvinor MTDrunwayfrictiontestsurfaces “A report of theBoeing737-700accident ing coefficientoftheairplanetype. between themeasured runwaycoefficientandtheeffectivebrak- the useofmeasured runwayfrictioncoefficientandcorrelation ment andReporting Group The followingisfrom anNTSBfactualreport ofinvestigation We andEuropean seethatEASA Aviation Authorities approve 18 produced byTheWinter RunwayFriction Measure- 1/14/2008, 9:43 AM 16 19 addressed correlation between DECs 17 atChicagoMidway: cess very convenient and easy to use, because it is not necessary to specify what equipment was used to obtain such information when transmitting such friction readings to the various users. Any of the approved friction-measuring equipment will give the same results under similar surface conditions. Furthermore, this applies irrespective of whether one uses a CFME or DEC type of equipment. The only difference between the results obtained from these two generic types of equipment is that the former provides a continuous record of friction over any desired length of pavement, while the latter gives what is known as the spot value of friction, which represents the short length of the pavement over which the friction is measured. The above difference in the fundamental way in Figure 8. CRFI equivalents. which the friction measurement is obtained is, however, of no operational consequence, because in any case such readings are taken specific, and there is no approved correlation between various over the entire length of the runway and then averaged for each measuring devices and different airplane braking coefficient third of it (the touch down, the midpoint, and the rollout zones). (ABC). Thus the actual friction-measuring process and the kind of equip- And in Cert Alert 05-01, 1/14/2005, Airport Winter Operations ment used is entirely transparent to the ultimate user of such in- (Friction Measurement Issues): formation, who is simply provided with a single friction value for each of the three zones. This eliminates any possibility of misun- “Although the International Civil Aviation Organization (ICAO) derstanding and misinterpretation and [en]sures consistency in has published a comparison table for “mu” readings and brak- the friction-taking process as well as in its ultimate use.” ing action, the FAA is not in harmony with ICAO on this deter- mination and publication. The FAA has no approved publica- SESSION 2—Moderator Sue Burdekin Correlation of friction tests with aircraft tion that provides a comparable assessment rating between “mu” braking performance readings and braking action. Further, the FAA feels that there is currently no conclusive correlation between braking action and FAA mu value. Braking action is subjective and dependent on may The FAA’s policy is that it is not possible to predict aircraft brak- factors, whereas mu value is an objective measurement. Either ing performance from mu values obtained from runway friction mu values or braking action reports are acceptable for reporting surveys. FAA’s Aeronautical Information Manual (AIM) asserts: pavement conditions to the notice to airman (NOTAM) system. However there is no correlation between the two. THEY ARE “No correlation has been established between mu values and the NOT INTERCHANGABLE!” descriptive terms ‘good,’ fair,’ ‘poor,’ and ‘nil’ used in braking action reports.” ICAO ICAO Annex 14, Aerodromes, Attachment A, provides a com- Similarly, FAA Advisory Circular (AC) 150/5200-31A, Airport parison table between “measured friction coefficient” and “esti- Winter Safety and Operations, states: mated braking action.” The text preceding the table cautions:

“While it is not yet possible to calculate aircraft stopping distances from “The table below with associated descriptive terms was developed friction measurements, data have been shown to relate to aircraft stop- from friction data collected only in compacted snow and ice and ping performance under certain conditions of pavement contamination should not, therefore, be taken to be absolute values applicable and are considered helpful by pilots’ organizations.” in all conditions. If the surface is contaminated by snow and ice and the braking action is reported as ‘good,’ pilots should not The FAA position was restated in Cert Alert 95-06, Oct. 1, 1995, expect to find conditions as good as on a clean dry runway (where Reporting Braking Action and Friction Measurements: the available friction may well be greater than that needed in any case). The value ‘good’ is a comparative value and is intended to “The FAA does not support this table* because there is no corre- mean that airplanes should not experience directional control or lation between braking action and mu value. Braking action is braking difficulties, especially when landing.” subjective whereas mu value is quantitative. A pilot should know how the aircraft will react to a given mu value. Whereas what is Canadian Runway Friction Index (CRFI) considered ‘good’ braking action for one person may be ‘poor’ In Canada, a method of measuring and reporting friction on con- or ‘nil’ to another.” taminated runways has been in use for about 30 years. Runway friction values obtained from decelerometers are reported as Canadian * These comments are related to Ground Friction Reading Cor- Runway Friction Index (CRFI) values, and are included in surface relation Table, presented by Thomas J. Yager at the International condition reports and NOTAM information. (See Figure 3.) Aviation Snow Symposium in Buffalo, NY, 1988. See Note 11. In addition, Transport Canada has published (Reference 4) FAA considers that the actual airplane FC is an objective, quan- average equivalent values of CRFI produced by typical runway titative value, whereas the pilot experienced braking action is a surface conditions and may be used as a guide when CRFI num- subjective assessment. However, the measured FC is instrument bers are not available. As can be seen from Figure 8, it is not

ISASI 2007 Proceedings • 37

Proceedings 2007.pmd 37 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 38 Ideally itwouldbepreferable torelate airplanebrakingperfor- 7.3.3 Useofground-friction-measurement devices used givenappropriate conservativeassumptions. is availableforamodelpredecessor orderivativethismaybe the permittedwearrangeremaining. Where limitedtestevidence contaminated surface,itshouldbeassumedthatthere is20%of wear statesignificantlyaffectsthebrakingperformanceon the and brake energy characteristicsare unaffected.Where thetire can beused.Itassumedthatwheelbrake torque capability contaminant underconsiderationoraconservativeassumption appropriate tothebrake andanti-skidsystembehavioronthe should beconsidered. Brake efficiencyshouldbeassumedto provided inTable 2,anumberofotherbrake-related aspects evidence orassumedfrictionvaluesotherthanthedefault values In developingairplanebrakingperformanceusingeithertest 7.3.2 Otherthandefaultvalues braked wheel/tire. sent theeffectivebrakingcoefficientofananti-skidcontrolled as definedinTable 2maybeused.Thesefrictionvaluesrepre- in theabsenceofanydirect testevidence,defaultfriction values To enableairplaneperformancetobecalculatedconservatively 7.3.1 Defaultvalues of airplanebrakingcoefficientorwheelcoefficient. the applicantmayoptionallyprovide performancedataasafunction test evidenceandassumedvalues(seeparagraph7.3.2).Inaddition, either theminimumconservative‘default’values,giveninTable 2or be impaired. Performance datashowingtheseeffectscanbebasedon On mostcontaminantsurfacesthebrakingactionofairplanewill “7.3 Brakingfriction(allcontaminants) From Book2isextracted: theCS-25 EASA Certification cific reading ofCRFI. possible toaccuratelycorrelate atypeofcontaminationtospe- Table 2.EASAcontaminantdefaultfrictionvalues. • ISASI 2007 ISASI Proceedings 20 38 a JBD12…. Tapley meterreads 0.36,amu meter reads 0.4,aSFTreads 0.43, Results demonstratedpoorcorrelation. For instance,whena measuring vehicles. aircraft andtocompare theresults withthoseobtainedfrom aircraft. Theadoptedmethodwastoconductsometestswithreal measuring vehiclesandtheactualbrakingperformance ofan comes theproblem ofcorrelating thefigures obtainedfrom these operate atmuchlowerspeedsandweightsthananaircraft. Then The onlywayoutistousesomesmallervehicles.Thesevehicles pretty costly! the airportshoulduseasimilarspare A340....Quitedifficultand an A340landingat150,000kg,140ktwithtire pressure 240PSI, In otherwords, togetagoodassessmentofthebrakingaction pressure, andanti-skidsystem efficiency. forces depend ontheload,i.e.,aircraft weight,tire wear, tire interaction ofthetire/runway. Moreover, theresulting friction What mustbefoundistheresulting lossoffrictionduetothe adherence characteristics. nated runwayisthatitdoesnotdependsolelyonsurface The maindifficultyinassessingthebrakingactiononacontami- formation onthesemeasuringvehicles. Refer toICAO, AirportServicesManual,Part 2,forfurtherin- Decelerometer (JDB),Tapley meter, DiagonalBraked Vehicle (DBV). as Skiddometer, SaabFriction Tester (SFT),mumeter, JamesBrake surements are madewithagreat varietyofmeasuringvehicles,such friction-measuring vehiclesandaircraft performance.Thesemea- —The correlation betweenmeasurements madewithtestdevicesor lation chartshavebeenestablished. —The correlation betweentestdevices,eventhoughsomecorre- evaluation oftherunwaycharacteristicsare: The twomajorproblems introduced bytheairportauthorities “C3.4.2 Difficultiesinassessingtheeffective Customer ServicesDirectorate, 1999(Reference 5),isextracted: Weather Operations,”AirbusIndustrie,FlightOperationsSupport, From anAirbusIndustriedocument,“GettingtoGripswithCold Airbus Industrieview erator andtheoperatingauthority.” index measured byaground frictiondevicewillfallontheop- snow, orice.Theresponsibility forrelating thisdatatoafriction for runwayscontaminatedwithwetsnow, drysnow, compacted cient orwheelbrakingcoefficientconstantwithground speed ing performancedataasafunctionofanairplanebrakingcoeffi- the applicantmayoptionallychoosetopresent takeoff andland- friction devices.Notwithstandingthislackofacommonindex, of aninternationallyacceptedfrictionindex measured byground the present timetodetermineairplaneperformanceonthebasis ground frictionmeasuringdevices.Henceitisnotpracticableat However, there isnot,atpresent, acommonfrictionindex forall that wouldbereported aspartofasurfaceconditionreport. mance toafrictionindex measured byaground frictiondevice 1/14/2008, 9:43 AM 21 μ —the displacement drag. —the impingement drag. These two additional drags (required to be taken into account by regulations) require knowing the type and depth of the contaminant.

In other words, even assuming the advent of a new measuring friction device providing a reported μ equal to the effective μ, it would be impossible to provide takeoff and landing performance only as a function of the reported μ. Airbus Industrie would still require information regarding the depth of fluid contaminants.

C3.4.3 Data provided by Airbus Industrie Please refer to § C6 for further details on contaminated runway performance provided by Airbus Industrie. Figure 9. Boeing airplane braking coefficient (ABC). Hard contaminants For hard contaminants, namely compacted snow and ice, Airbus Industrie provides the aircraft performance independently of the amount of contaminants on the runway. Behind these terms are some effective μ. These two sets of data are certified.

Fluid contaminants SESSION 2—Moderator Sue Burdekin Airbus Industrie provides takeoff and landing performance on a runway contaminated by a fluid contaminant (water, slush, and loose snow) as a function of the depth of contaminants on the runway.

For instance, takeoff or landing charts are published for ‘1/4 inch slush,’ ‘1/2 inch slush,’ ‘1/4 inch water,’ and ‘1/2 inch water.’ For loose snow, a linear variation has been established with slush.

In other words, pilots cannot get the performance from reported μ or Braking Action. Pilots need the type and depth of Table 3. Boeing-defined airplane braking coefficients. contaminant on the runway.

To date, scientists have been unsuccessful in providing the indus- Correlation between reported μ and braking performance Please, try with reliable and universal values. Tests and studies are still in bear in mind: Airports release a friction coefficient derived from progress. a measuring vehicle. This friction coefficient is termed as ‘reported μ.’ As it is quite difficult to correlate the measured μ with the actual μ, termed as effective μ, the measured μ is termed as ‘reported μ.’ The actual friction coefficient, termed as ‘effective μ’ is the result of the interaction tire/runway and depends on the tire pres- In other words, one should not get confused between: sure, tire wear, aircraft speed, aircraft weight, and anti-skid sys- 1. Effective μ: The actual friction coefficient induced from the tem efficiency. tire/runway surface interaction between a given aircraft and a given runway, for the conditions of the day. To date, there is no way to establish a clear correlation between 2. Reported μ: Friction coefficient measured by the measuring the ‘reported μ’ and the ‘effective μ.’ There is even a poor corre- vehicle. lation between the ‘reported μ’ of the different measuring vehicles.

Particularities of fluid contaminants It is then very difficult to link the published performance on a Moreover, the aircraft braking performance on a runway covered contaminated runway to a ‘reported μ’ only. The presence of fluid by a fluid contaminant (water, slush, and loose snow) does not contaminants (water, slush and loose snow) on the runway sur- depend only on the friction coefficient μ. face reduces the friction coefficient and may lead to aquaplan- ing (also called hydroplaning) and creates an additional drag. As presented in chapters C2.2 and C2.3, the model of the air- This additional drag is due to the precipitation of the contami- craft braking performance (takeoff and landing) on a contaminant onto the landing gear and the airframe and to the displace- nated runway takes into account not only the reduction of a fric- ment of the fluid from the path of the tire. Consequently, brak- tion coefficient but also ing and accelerating performance are affected. The impact on

ISASI 2007 Proceedings • 39

Proceedings 2007.pmd 39 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS of contaminant lishes thetakeoff andlandingperformanceaccording tothe by areduction ofthe snow andice)onlyaffectthebrakingperformanceofaircraft 40 and isnotvalidatedonwet conditions. Further, thetabledoes based onfrictionmeasurements ondry, compactsnowandice with theAmericancontinental climate.TheSNOWTAM tableis a coastalclimatewithchanging winterconditions,incomparison coefficients doesnotreflect winterconditions,with theNorwegian tion measuringdevicesandcorrelation withairplanebraking Airport ServicesManual,Part 2.Theinformationrelated tofric- tions theinformationandrecommendations inICAODoc.9137, involving runwayexcursions onslipperyrunways,theAIBNques- Surface Conditions,Fourth Edition2002 ICAO Doc.9137,AirportServicesManual,Part 2Pavement tions oncontaminatedandslipperyrunwaysasindicatedbelow: substantiated recommendations andguidelinesrelated toopera- Norway. Theinvestigations haveuncovered weaknessesandun- reflected inrecent reports from theAIBNonseriousincidentsin and Friction Measurements.” ered Operations byanAIBNspecialinvestigationinto“Winter ports ledtoseparateinvestigationreports, whiletherest are cov- ing andreporting offrictioncoefficient(FC).Somethesere- accidents andincidentsrelated toslipperyrunwaysandmeasur- During thelast8years,AIBNhasreceived 24reports on AIBN investigationresults to airplanebrakingcoefficient. Boeing doesnotcorrelate ways, 2001(Reference 6),thefollowinginformationisextracted: From aBoeingpresentation oncontaminatedandslipperyrun- Boeing’s view of thecontaminantfortakeoff. the acceleratingperformanceleadstoalimitationindepth medium, andpoorbrakingaction. Boeing’s testvaluesforfixeddefaultdry, wet,good, see thatBoeing’sviewisinlinewiththeFAA andisbasedon Table 4.Boeing’sABCdefaultvaluesforslipperyrunways.We From severalinvestigationsintoaccidentsandseriousincidents This investigationisongoing,butseveralofthefindingsare • ISASI 2007 ISASI 22 , andtothe Proceedings friction coefficient. 40 “friction depth Hard contaminants

vehicle reported of fluidcontaminants.” Airbus Industriepub-

runway friction” (compacted type contaminants. Table 5.Boeing-definedABC vs.runwaydescriptive 0.05 (brakingactionpoorby Boeingdefinition),anddrysnow wet snowbelow10mmhas resulted inABCsoftheorder of agree experience. withNorwegian TheAIBNhasfoundthat mm, wetsnow, drysnow below10mm,anddrysnowdonot by Kollerud’s duringthelate1940s. testinginNorway and 0.05valueforwetice.Thesetwovalueswere firstestablished are notsubstantiated,except the0.20valuefordrycompactsnow ing coefficientoreffectiveMu)defaultvaluesaslistedinTable 3 contaminant(airplanebrak- The AIBNhasfoundthattheEASA EASA contaminantdefaultfrictionvalues from anAirbus321. Figure 10.Effectiveairplane(ABC)basedonFDRdata another. general datascatter. Hence,itisnotrealistic tocorrelate oneto ties referred toabove.Theindividualtolerancesfallwithinthe surement are devices inuseNorway subjecttotheuncertain- experienceNorwegian showsthatalltheapproved frictionmea- fixed correlation betweenthedifferent friction-measuringdevices. the order of±0.20atwetconditions. the uncertaintyisoforder of±0.10atdryconditionsand not containanytolerancesanditisproven through testingthat The listedvaluesof0.17(seeTable 2)forwetsnow below5 Further, theAIBNhasfoundthatthere isnotanynoticeable ofiin Action Coefficient ipaePltRpre Runway Pilot Reported Airplane rkn rkn Description Braking Braking .5Po/i Wet Ice,Slush, Poor/Nil 0.05 . odWet Ice,Compacted Runway, Medium/Fair Good Friction limited 0.1 Approximates 0.2 0.4 1/14/2008, 9:43 AM r uwycertification dry runway Melting CompactedSnow, Jar certificationfor Standing Water compact snow values snow This is where the effect of spoilers and reverse thrust is reduced and braking to a stop is based on wheel braking alone. Hence, the effect of displacement drag and impingement drag is not any longer adding to the braking force. The AIBN has found that the use of “fluid contaminant” procedures have led to runway excursions in Norway with Airbus A320/321 airplanes and considers this practice to be dangerous. Figure 11 shows the relative distribution of braking forces versus ground speed for an Airbus 321. Airbus does not promote a correlation between measured FC and ABC.

Boeing’s policy and Norwegian application The AIBN has found that Boeing’s policy reflected in Tables 4 and 5 has proved itself as a sound and practical method as a Figure 11. Distribution of the three braking forces: spoilers, basis for operating on contaminated and slippery runways. reverse thrust, and wheel braking. Based on Norwegian experience operating B-737 on contaminated runways in Norway, the AIBN believes the Boeing-sup- has resulted in ABC of 0.10 (braking action medium by Boeing plied ABC data may be correlated with a limited ICAO definition). SNOWTAM table. The relation for standing water and slush in Table 2 may give A Norwegian B-737 operator has received approval by the a correct Default friction value for water but not for slush during Norwegian CAA to correlate these FCs with the ICAO SNOWTAM landing. The viscosity of water may not be substituted by the vis- table (Figure 5). Hence, the ABC value of 0.05 is correlated with SESSION 2—Moderator Sue Burdekin cosity of slush. Norwegian experience is that the ABC (or effec- the ICAO value of 0.20, 0.10 with 0.30, and 0.20 with 0.40. A line tive airplane mu) is not velocity dependent during landing break- through these points results in a correlation curve that is more ing. The airplane effective mu must be related to gliding friction conservative than the other available correlation curves. rather to rolling friction and is normally of the order of 0.05 (BA The AIBN believes that by using a table based on the Boeing poor). Further, the relation may be more relevant for takeoff con- ABCs correlated with the ICAO FC values of 0.20, 0.30, and ditions than for landing. 0.40, realistic airplane braking performance may be expected. For example, by measured FC 0.34, one will report an FC of Airbus Industrie Policy 0.30, giving an ABC of 0.10. The AIBN has concluded that Airbus Industrie policy is based on EASA CS 25 and is equat- this method will result in higher margins operating on slip- ing slush, wet, and dry snow to an equivalent depth of water pery runways. based on the definition of “fluid contaminants.” Airbus states The AIBN considers this curve to be the most conservative that “the aircraft braking performance on a runway covered by a correlation curve in use today and has proven its value during fluid contaminant (water, slush, and loose snow) does not depend the last 7 years in Norway. We can see that the curve is similar in only on the friction coefficient μ” and that “the displacement drag shape to the NASA/ICAO curve. However, when including a gen- and impingement drag require knowing the type and depth of the eral uncertainty on the measured FC values, the AIBN considers contaminant.” that a limited applied correlation table is more relevant. This is The AIBN has found that the above statements may be true shown in Table 6. for the takeoff conditions but are not correct for the landing con- Based on the Canadian JWRFMP test data, the AIBN also conditions. Further, the AIBN has found that so-called “fluid contami- siders that propeller airplanes may be given a slightly higher nant” (slush, wet, and dry snow) results in effective mu on the ABC at the same FC. This is indicated in Figure 3. order of 0.05-0.10. Slush and wet snow often result in ABC of 0.05 (or FC 0.20 poor), and dry snow give an ABC on the order EASA/JAR OPS 1 of 0.10 (or FC 0.30 medium). JAR OPS 1, Subpart G AMC/IEM OPS 1.485(b), “General-Wet and Figure 10 shows the effective airplane μ deduced from the ac- Contaminated Runway data,” allows an operator to use an author- tual FDR data from an A321 that slid off the runway during land- ity-approved correlation between measured FC and airplane braking on 8 mm of wet snow (see page 32, serious incident 3-26- ing coefficient (ABC). 2006). The measured FCs were 32-33-31 (medium). As can be EASA CS 25 Book 2, paragraph 7.3.3, “Use of Ground Friction seen from the graph, the average effective (or airplane braking Measurement Devices,” allows use of correlation between FC and coefficient in Boeing terminology) was on the order of 0.05 (poor) ABC by stating, “The responsibility for relating this data (takeoff and from 110 to 60 kt by use of maximum manual braking. When landing performance data) to a friction index measured by a ground used in an operations performance computer, such erroneous friction device will fall on the operator and the operating authority.” FCs would calculate a LDR to be about half of the actual. This The AIBN considers that it is neither practical nor advisable incident highlights the danger of using the method of “fluid that individual operators are authorized responsibility for relat- contamination” as used by Airbus. ing take off and landing performance data to a measured friction The problem of braking on a slippery runway is related to a index. Such procedures must be issued by the local aviation au- speed below the normal reverse thrust cut out speed of 70-80 kt. thority and published in the national AIP.

ISASI 2007 Proceedings • 41

Proceedings 2007.pmd 41 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 42 andDH-8sus measured airplanessuperimposed FCforB-737 or contaminatedrunways,the crosswind limitsshouldbereduced. strated crosswind should onlybeusedondryrunways.With wet conditions asgoodonacleandryrunway.” ing actionisreported as‘good,’pilotsshouldnotexpect tofind 14, Aerodromes, Attachment A: above 0.40.ThisisinconflictwiththecautionICAOAnnex maximum demonstratedcrosswind limitationfor reported FC only advisorydata. information intheairplaneflightmanual.Ifitisincluded, itis this isthatthere isnocertificationrequirement toincludesuch have received authorizationbytheCAA-N.Themainreason for limitations maybebasedontheairline’sownexperience and tations thatare notbasedonmanufacturer advisorydata.The airlinesusecrosswindThe AIBNhasfoundthatNorwegian limi- Crosswind limitationsonslipperyrunways braking whenplanningandlandingonaslipperyrunway. ers itadvisabletouseautobrake settingmaxormanual tance withandwithoutuseofreverse thrust.TheAIBNconsid- be usedasasafetymargin. and slipperyrunways,theAIBNconsidersthat20-25%should the uncertaintyofcalculatingactualLDRoncontaminated verse thrustamountsto20-25%ofthetotalbrakingforce. Given way excursion incident.Ascanbeseenfrom thegraph,re- A321run- tive effectofeachbrakingdeviceduringaNorwegian ports theNTSBsafetyrecommendation. Figure 11showstherela- Hersman, andHigginsconcurred withthisrecommendation.” —Acting ChairmanRosenker andMembersEnglemanConners, credit inlandingperformancecalculations.(A-06-16)Urgent eral Regulations Part 121operatorsfrom usingthereverse thrust tion Administration:Immediatelyprohibit all14CodeofFed- Transportation SafetyBoard recommends thattheFederal Avia- in landingperformancecalculations.Therefore, theNational airplanes forwhichthereverse thrustcredit iscurrently allowed Board concludesthatthesafetymargin mustberestored tothose lead toanunsafecondition,asitdidinthisaccident.TheSafety single event,thedelayeddeploymentofthrustreversers, can is allowedinlandingstoppingdistancecalculations.Asaresult, a reduced onacontaminatedrunwaywhenthereverse thrustcredit concerned thatthelandingdistancesafetymargin issignificantly a brakingconditionofeitherfairorpoor. TheSafety Board is cated thatasafelandingonRunway31Cwasnotpossibleunder ping distancecalculationsmadebytheOPC,itwouldhaveindi- “If thereverse thrustcredit hadnotbeenfactored into thestop- ommendation (Reference 8): dated Jan.27,2006,theNTSBissuedanimmediatesafetyrec- calculations. Inaletterfrom theNTSBtoFAA, Ref. A-06-16 lighted theinclusionofthrustreverser credit foractuallanding Dec.8,2005)high- The ChicagoMidwayaccident(B-737-700, actual landingcalculations Credit fortheuseofthrustreverserduring Figure 13showsCAA-N-approved crosswind limitationsver- The AIBNconsidersthattheAFM-listedmaximumdemon- “If thesurfaceiscontaminatedbysnowandicebrak- Further, theAIBNhasfoundthatairlinesuseAFM Figure ground OPC-calculated dis- 12showstheB-737-700 Based onsimilarexperiences inNorway, theAIBNfullysup- • ISASI 2007 ISASI Proceedings 42 ABC basedonNorwegianinvestigations. Table 6.AIBN-suggestedappliedcorrelation tableforFCvs. radic runwayexcursion incidents. Friction measurements have successfully andsafelyduring thelast60years,withonlyspo- airtrafficwinter operationshavebeenperformed Norwegian AIBN findings measurements couldbeusedforthispurpose (Reference 9). the contaminant.TheAIBNconsidersthatinfrared temperature there isaneedformeasurement ofthesurfacetemperatures of an accurateindicationofthesurfacetemperatures. Therefore, ever, OAT andDPare measured 2mabovethe surface andisnot mation maybeapilotindicationofrunwayslipperiness. How- air, andthisinformationtogetherwithTAF andMETAR infor- point) hasbeen<3K.Thisisanindicationofmoisture inthe spread (thedifference betweenairtemperature anddew/frost to wintercontaminationandslipperiness,thedew/frost point The AIBNhasfoundthatinmostcasesofrunwayexcursion due point (DP)maybeasignificantindicatorofrunwayslipperiness. in Norway, themeasured airtemperature (OAT) anddew/frost As indicatedinthelistofrecent accidentsandseriousincidents Temperature measurements and withoutuseofthrustreversers. Figure 12.B-737-700OPC-calculatedground distancewith on limitationspublishedinAIPCanada. 1/14/2008, 9:43 AM • Use of FC restricted to 0.40 (good), 0.30 (medium), and 0.20 (poor) only. • Correlating the above FC with the Boeing ABCs of 0.20 (good), 0.10 (medium), and 0.05 (poor). • Accept the use of all the approved friction-measurement devices with an uncertainty of up to ± 0.10 (based on Table 1). • Sanded wet, compact snow and ice, or sanded loose slush, wet or dry snow on top of compact snow and ice is treated as poor (FC=0.20, ABC=0.05). • Sanded contaminated runway with dew point spread < 3 K is treated as poor (FC=0.20, ABC=0.05). The ICAO SNOWTAM table was developed based on friction measurements on dry, compact snow and ice by use of decelerometers. Later ,continuous friction-measurement devices have been introduced. In spite of the initial restriction related to measurements on wet contamination, these devices have been allowed to be used on wet contamination. Further, the measuring limitations for the individual measurement devices were based on one layer of contamination and not one layer of one type of contamination on top of another type. In these instances, the measuring device measures its own FC related to the top layer whereas the airplane wheel will be subjected to a different FC. Often the top layer of contaminant will SESSION 2—Moderator Sue Burdekin Figure 13. Norwegian crosswind limitations superimposed act as a lubricant between the airplane wheels and the underly- on AIP Canada crosswind limitations vs. CRFI. ing layer. Other significant findings in the AIBN investigations are been in regular use during the last 55 years in Norway. During • Measured FC of 0.30-0.35 on fresh snow has correlated to an the last 8 years, however, The AIBN has recorded an increase in ABC of the order of 0.05. reported runway excursion incidents related to operations on • Measured FC of 0.40-0.45 on sanded compact snow and ice contaminated and slippery runways. has correlated to an ABC of the order of 0.05 during wet condi- AIBN investigations have indicated that a possible causal factor tions or with dew point spread < 3 K. for this increase is that Norwegian airlines have introduced opera- • Measured FC of 0.30-0.35 on sanded loose slush and wet or tions performance computers to allow pilots to “accurately” calcu- dry snow on top of compact snow and ice has correlated to an late an optimum payload or takeoff and landing weight on the ABC of the order of 0.05. available runway. Previously, the measured FC was used in a con- • Measured FC of 0.30-0.35 on sanded wet, compact snow and servative way by the aircraft commanders, while today it is used ice has correlated to an ABC of the order of 0.05. directly as an input to the landing performance calculations. • Measured FC in medium range on so-called “dry” fresh snow With a documented uncertainty of the order of ± 0.10, it is has correlated to an ABC in the poor range. quite clear that the landing distance required (LDR) may be longer • Measured FC in medium-to-good range in so-called “dry” win- than calculated. A crew may be given an FC of 0.40 (good) that ter conditions at air temperatures below freezing with a frost point may actually be more like 0.30 (medium). From the formulae for spread < 3 K has correlated to an ABC in the poor range. stopping distance S= V2/2a, where a=μ*g, it is easy to see how • Measured FC in medium-to-good range in so-called “dry” win- much longer the RLD could be. ter conditions at air temperatures below freezing, with crosswind The AIBN has found that the results from the Norwegian tri- and drifting snow and ice particles polishing the compact snow als during the 1940s and 1950 still hold. Ottar Kollerud con- and ice has correlated to an ABC in the poor range. cluded that the measured FCs were only reliable on dry, compact • Sanding on wet compact snow and ice has reduced effect on snow and ice and not on wet contaminants. Further, Kollerud braking action. established that the airplane braking coefficient was half of the • Sanding on loose masses of slush, wet, or dry snow on top of measured FC. The Canadian JWRFMP test data have resulted in compact snow and ice has reduced effect on braking action. a similar correlation curve, and NASA has found a slightly more • The airplane braking coefficient on snow and ice is affected by conservative correlation curve. (See Figures 3 and 4.) CAA-N has the tire temperature. approved still another correlation curve based on Boeing data • Actual LDR calculations should be based on no thrust reverser. on slippery runways. (See Figure 5.) • There is a requirement for correct measurements of the con- Based on the investigations in Norway, the AIBN has concluded taminant surface temperature and dew/frost point. that the use of friction-measurement devices and correlating the measured FC with the ABC are both practical and safe, provided Conclusions • Measured FC on dry compact snow and ice. Preliminary findings from the AIBN investigations include, but • Measured FC may be erroneous with wet or moist or loose are not limited to The information in ICAO Doc. 9137, AN/898 contaminant on top of compact snow and ice. Airport Services Manual, Part 2, Pavement Surface Conditions,

ISASI 2007 Proceedings • 43

Proceedings 2007.pmd 43 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 44 hundredths andexcluding theuseof interpolation between with theareas good,medium,andpoor, aswell asremoving table byeliminatingtheintermediate levelssothatoneisleft civil aviationauthorityconsiders simplifyingtheSNOWTAM Based onthesecircumstances, theAIBNrecommends thatthe the accuracyofreporting shouldnotbehigherthantenths. warns againstsuchlarge uncertainties inmeasurements that scribes theuseoffriction-measuringequipmentingeneral and vide different de- numbersonthesamesurface.AIPNorway gations showthatthevariousfrictionmeasuringdevices pro- friction-measuring devicethathasbeenused.AIBNinvesti- measured numbersinhundredths and dependsonthetypeof SNOWTAM tableformeasured frictionnumbersisbasedon braking valuesfortherelevant aircraft types.TheICAO foundations andthattheyprovide veryinaccurate/unreliable that severalofthesecorrelation curvesare basedonuncertain lines usedifferent correlation curves/tables.Investigationsshow TheinvestigationsoftheAIBNshowthatvariousair- • safety recommendation SL06/1350-1). andBSLE.(Immediate tion measuringdevicesinAIPNorway considers alteringthemeasurement areas fortheapproved fric- as poor. TheAIBNrecommends thatthecivilaviationauthority reported frictionduringdamp/wetconditionsshouldbereported point temperature. TheAIBNis,therefore, oftheopinionthat with adifference of3°Corlessbetweenairtemperature anddew during damp/wetconditions,includingtemperature conditions that noneoftheapproved friction-measuringdevicesisreliable deviate from measured/reported numbers.Experiencehasshown The AIBNhasdeterminedthattheactualfrictionnumbersoften garding friction-measuringequipmentandmeasurement areas. “AIP regulations andBSLEincludeNorwegian re- Norway • following safetyrecommendations toCAA-N: and practicesrelated towinteroperationsandhaveissuedthe AIBN considersiturgent torevise regulations theNorwegian Based onpreliminary findingsduringtheseinvestigations,the Recommendations based onnothrustreverser (safetymargin). ThecalculatedLDRforactual landingconditionsshouldbe • provided anuncertaintyoftheorder of±0.10 Alltheapproved friction-measurement devicesmaybeused • ice-covered surfaces. show thatallmeasuringdevicesare unreliable onwetsnow-and able onwetsnowandicecovered surfaces.AIBNinvestigations measured CFandairplanebrakingcoefficient(ABC)wasunreli- decelerometer. Thesetestsindicatedthatthecorrelation between based ontestsdry, compactsnowanddryiceusinga TheSNOWTAM tablewasdevelopedduringthe1950sandis • and 0.40. 0.10. Hencethetableshouldonlylistnumbers0.20,0.30, indicates thatthetoleranceoruncertaintyisonorder of± does notspecifyanymeasuringtolerances.Documentresearch TheSNOWTAM tablelistsCFwithtwodecimaldigitsand • on snow- andice-contaminatedrunways. correlation valuesbetweendifferent frictionmeasuringdevices ated. Practical experience doesnotsupporttheICAO inNorway on compactedsnow- and/orice-covered surfacesisnotsubstanti- Thecorrelation chart/tablebetweenfriction-measuringdevices • Fourth Edition,2002,isoutdated,includingthefollowingitems: • ISASI 2007 ISASI Proceedings 44

is respected. 9 ICAO, Program for correlating equipment usedinmeasuringrunwaybrak- 8 TP13943E-EvaluationofAircraft BrakingPerformance onWinter Con- 7 Transport Canada,Commercial andBusinessAviation AdvisoryCircular 6 DepartmentofTransport, AirServices,CivilAviation Branch,Aerodromes, 5 J.Wessel (Delegate),G.Antvik(Alternate),J-O Ohlson(Alternate),G. 4 ICAODoc8298-AGA/593,Aerodromes, AirRoutes andGround AidsDivi- 3 Inter-Nordic meeting,Stockholm,Oct.13and14,1959. 2 March 1954. 1 ICAOCircular 43-AN/38. Endnotes 9. TheSignificanceofWinter OperatedRunwaySurfaceTemperature. 8. Letterfrom theNTSBtoFAA, SafetyRecommendation, confA-06-16, 7. LTR-FR-183 EvaluationofAircraft BrakingPerformance onWinterCon- 6. ContaminatedandSlipperyRunways,BoeingCompany, Performance 5. GettingtoGripswithColdWeather Operations,AirbusIndustrie,Flight 4. AIPCanada,validJanuary2004. 3. AIPNorway, validNovember2004. 2. ICAODoc.9137AN/898AirportServicesManualPart 2,Pavement Sur- 1. Micrometeorological processes onarunwaycontaminatedbyfrozen wa- References SL 06/1350-4).” proved bytheauthorities.(Immediatesafetyrecommendation braking action,andalsoconsiderswhethertheseshouldbeap- lines’ sidewindlimitationsinrelation tofrictioncoefficients/ recommends thatthecivilaviationauthorityassessesair- airlines.TheAIBN servative thanthetablesusedbyNorwegian table ofsidewindversusfrictionnumbers.Thisisfarmore con- by theauthorities.Transport Canadahaspublishedonesuch on experience. Noneofthesidewindtableshasbeenapproved the aircraft, buthavebeenprepared byindividualairlinesbased craft types,thesetablesdonotderivefrom themanufacturer of tic. Theinvestigationshavealsoconfirmedthatforcertainair- tions incombinationwithslipperyrunwaysare fartoooptimis- AIBNinvestigationsshowthattheairlines’crosswind limita- • diate safetyrecommendation SL 06/1350-3). prior tolanding)stoppingdistanceonslipperyrunways.(Imme- sion ofenginereversing inthecalculatedrelevant (within30min civil aviationauthorityshouldconsidernotallowingtheinclu- landing onslipperyrunways.TheAIBNrecommends thatthe force andthatthisbrakingforce shouldconstituteabackup when engines islimitedtoapproximately 25%ofallavailablebraking types. Theinvestigationsfurthershowthattheeffectofreversing aircraft). Suchdatahavenotbeenpublishedforolderaircraft published forneweraircraft types(e.g.,AirbusandnewerBoeing on slipperyrunwaysusingenginethrust(reversing) has been AIBNinvestigationsshowthatperformancedataforlanding • the areas. (Immediatesafetyrecommendation SL 06/1350-2). to measure runway braking actionundertaken by: Canada,France, Sweden, ing action,Final report, 22/2/74 Jointevaluationprogram ofequipmentused Canadian RunwayFriction Index, June2002. taminated RunwaysandPrediction ofAircraft LandingDistanceUsingthe No. 0164,1999.11.03—CanadianRunwayFriction Index. Decelerometer. Information Circular 0/6/70,23rd February—Use ofJamesBrake Kullberg (Adviser). sion, Report oftheseventhsession,Montreal, Nov. 13–Dec.14,1962. Reinhard Mook,2007. dated Jan.27,2006. 13943E, June2002. Canadian RunwayFriction Index, Transport CanadaPublicationNo.TP taminated RunwaysandPrediction ofAircraft LandingDistanceUsingthe Engineer Operations,FlightOperationsEngineering,2001. Operations Support,CustomerServicesDirectorate, 1999. face Condtions,Fourth Edition2002. ter. Reinhard Mook,2006. 1/14/2008, 9:43 AM ◆ Union of Soviet Socialist Republics, United Kingdom, and United States. 14 ASTM Standard E2100-04, Standard Practice for Calculating the Inter- 10 FFA Memo 121, Studies of contaminated runways, K. Fristedt and B. national Runway Friction Index. Norrbom, Stockholm 1980. 15 Avinor Notice 5:2003, Geir Lange, 2004. 11 NASA Technical Memorandum 100506, Summary report on aircraft and 16 AMJ 25X1591 is replaced by CS 25.1591 and AMC 25.1591. ground vehicle friction correlation test results obtained under winter run- 17 Survival Factors Group Chairman’s Factual report of Investigation, NTSB, way conditions during joint FAA/NASA runway friction program, Thomas May 15, 2006. J. Yager, William A. Vogler, and Paul Baldasare, Langley Research Center, 18 An Evaluation of Winter Operational Runway Friction Measurement, March 1988. Section 3.3, Jan. 25, 1995. 12 Correlation Between Aircraft/Ground Vehicle Runway Friction Measure- 19 Comprised of representatives from the FAA, Transport Canada, NASA, ments, Walter B. Horne, prepared for the Air Line Pilots Association, In- Airports Council International, American Association of Airport Execu- ternational, 1990. tives, Regional Airline Association, Air Transport Association, and ALPA. 13 NASA Technical Paper 2917, Evaluation of two transport aircraft and 20 CS-25 Book 2, AMC 25.1591, Amendment 2. several ground test vehicle friction measurements obtained for various run- 21 Getting to Grips with Cold Weather Operations, Airbus Industrie, Flight way surface types and conditions—A summary of test results from joint Operations Support, Customer Services Directorate, 1999. FAA/NASA runway friction program, Thomas J. Yager, William A. Vogler 22 Contaminated and Slippery Runways, Boeing Company, Performance and Paul Baldasare, Langley Research Center, 1990. Engineer Operations, Flight Operations Engineering, 2001. SESSION 2—Moderator Sue Burdekin

ISASI 2007 Proceedings • 45

Proceedings 2007.pmd 45 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 46 grams totranslatecommercial GISdataformatsintotheweb- edit andmanagement,the authors havedevelopedthepro- investigation tasks,andtodismiss thecomplicatedGISdata Furthermore, inorder forinvestigators touseGISeasilyon cost-effective processing procedures investigators. forASC events andflightanimation. site surveydatatoreconstruct thesequenceofoccurrence ofTaiwanthe Aviation SafetyCouncil(ASC) isapplyingthe andrelevantlite imageries,terrains, contents. users toremote accessofthe 3-D digitalworldswithprecise satel- Earth), whichare basedontheInternetplatform,andprovided free web-basedGISbrowsing programs (GoogleMapandGoogle 2005, Google,Inc.,merged theKeyhole Inc.,anddevelopedtwo rain datahavebeenexpensive andnotopentopublicaccess.In plication product oftheDigitalEarth. Geographical InformationSystem(GIS),andproduced anap- developing, whichurged therelated applicationstorelay onthe The computer’scomputingandgraphictechniquesare rapidly Abstract This articledescribestheGISapplicationexperiences and outtheaviation occurrenceIn order investigations, tocarry In thepast,precise resolution ofsatelliteimageriesandter- • ISASI 2007 ISASI Utilization oftheWeb-Based GISto National Taiwan University. Department ofMechanicalEngineeringthe Authority anddeputychairmanofthe (CAA) Pilot Training Program bytheCivil Aviation tor ofNationalTaiwan UniversityCommercial the Aviation SafetyCouncil.Hewasthecoordina- Dr. HongT. Young withtheAviationLaboratory SafetyCouncil. Dr. Wen-LinGuan Aviation SafetyCouncil. Tien-Fu, Yeh Proceedings By

Tien-Fu, Yeh, Wen-Lin Guan,andHongT. Young, Aviation SafetyCouncil,Taiwan Assist AviationOccurrence 46 isaflightrecorders engineerwiththe isthedirector of Investigation isthemanagingdirector of Investigation to browse thegeo-spatialdata. investigators the solution.GoogleEarthisplatformforASC stage, inorder tosolvethisproblem, theweb-basedGISbecame cense, whichprohibited itswidespread Inthecurrent useatASC. a high-costcomputerworkstationthatwaslocked byasingleli- geo-spatial datameantinvestigatorscouldonlyprocess themon GIS hadbecometheon-sceneinvestigativetool,butmassive tigated more than30aviationoccurrences. From anearlystage, tions intoastageofmore extensiveness andreality tion paths,andcreate 3-D modelsthatenhancetheGISapplica- tions foruserstobuild-uptheplacemarks,addtransporta- words. Inaddition,GoogleEarthprovides theinteractive func- place name,street, landmark,lat/longposition,andspecific key- via Internet,andthewonderfulsearching functionisbasedon ing capability. Anyonewithafree browser canaccesstheworld collects worldwideprecise satelliteimageries,withgreat comput- Google Earth,Virtual Earth,andsoon.To date,GoogleEarth resources availableontheInternet,i.e.,World Wind, GoogleMap, rather thanthehigh-endcomputer. forms includePDA,mobilephone,andhome-usedcomputer, is easytoadoptintoroutine transportations.Thecomputerplat- and therelevant commercial software withgraphicinterface,and have rapidlydevelopedsothatGISbecameapopulartechnique, the lastdecade,computer’scomputingandgraphictechniques the complicated,expensive, anduserunfriendlysystems.Butin In thepast,GeographicalInformationSystem(GIS)wasoneof I. Introduction the ASCshallundertakeinvestigation. Whenanaviationoccurrence oftheRepublicChina(hereinafterin theterritory referred toasROC), 6, “W According totheAviation Occurrence InvestigationAct,Article Justify theinvestigativeauthority are asfollows: tion, butalsotovalidatetheinvestigativeauthority. Explanations isnotonlyapplyingGIStoaviationoccurrences investiga- ASC II. DescriptionsofGISapplicationsatASC GIS Keywords: section. based GIS.Thisarticleexplains severaloccurrences inthelast ASC wasofficiallyestablishedonMay25,1998,andhasinves- ASC “Digital Earth”hasdevelopedextremely fast.There are somany hen anaircraft occurrence ofanaircraft ofanynationalityarises GIS,Aviation Occurrence, GoogleEarth,Web-Based 1/14/2008, 9:43 AM 1 . Reconstructing the temporal and spatial relationships of occurrence The individual clues on the occurrence site will furnish the initial directions for investigation; preserving the evidence at the occurrence site is a key action for further analysis and validation. But the major occurrence site is very difficult to fully preserve, i.e., the airport operator expects to re-open airport operation as soon as possible; aircraft crash site located in the seas or lake with adverse effects, including current and wind. “Digitizing the whole occurrence site” is the perfect dream for the forensic investigators! The use of computer graphics to reconstruct the events sequence of occurrence (called flight animation) is well known driven by flight data (FDR, QAR), GPS data, and ground-based surveil- Figure 1. Illustrates the occurrence site in high seas—the lance radar data4. In general, three charts are frequently used by investigation authority thus belongs to ASC. investigators to illustrate the aircraft occurrence site with different scales—occurrence site chart (osc), occurrence perspective chart (opc), and wreckage distribution chart (wdc). The “osc” displays the symbol of north, relative positions of site and nearby airport, access ways, ground navigation facilities, and scale bar. The “opc” presents the flightpath, ground obstacles, terrain pro- files, and relevant impact marks or ground scars. The “wdc” shows the locations of major components of the aircraft, with the attribute of damage conditions (failure modes, fire and explosive SESSION 2—Moderator Sue Burdekin evidence, and so on.). So, the hand sketches are time consuming and inaccurate. GIS is a systemic and sensible tool to record and present the geo-spatial evidence for the forensic investigators! In 2004, ASC developed the three-dimensional GIS (3-D GIS) for occurrence investigation, to present the geo-spatial data and assist the visual simulation. Those commercial GIS system assisted programs developed by ASC investigators could handle different formats of the terrain data, 3-D display of massive satellite images, superposing the occurrence survey data—treetops, ground scars, flightpath (based on FDR, GPS, or radar data) and Figure 2. Demonstrates the result of superposing the geo-spatial interactive to visualizing the occurrence geo-data together. 3-D data (terminal control area, restricted areas, VFR corridors, GIS became the powerful tool to present the sequence of occur- ultralight activity areas, and radio frequencies). rence events.

of an aircraft registered in the ROC or operated by an airline incorpo- Relationship of flightpath and LLWAS data rated in the ROC arises on the high seas or in the territory not subject to A windshear alert system for low level horizontal windshear is any state’s jurisdiction, the ASC shall undertake the investigation.”2 disclosed. The ground-based Low Level Windshear Alert System On March 28, 2005, 1803 local time (0903 UTC), EVA Air (LLWAS) is based upon a network of anemometers placed near Flight BR2196, an Airbus A330-203, carried 251 passengers and runways throughout the geographic area covered by an airport, 16 crewmembers from Chiang Kai-Shek International Airport, for the purpose of detection of low-level horizontal windshear Taipei, ROC, to Narita International Airport, Tokyo, Japan. The and microbursts. Typically, LLWAS consist of 12 to 16 anemom- aircraft encountered severe turbulence during its initial descent eters placed near runway areas and extended to cover about 3 at an altitude of 34,500 ft. The cabin ceiling of this airplane was nm. To date, there are two LLWAS installed in Taiwan’s civil air- damaged; also 46 passengers and 10 crewmembers were injured, ports—Taipei SongShan Airport and Taiwan Taoyuan Interna- including one with a broken neck3. tional Airport5. After the occurrence notification, ASC obtained the flight data In past occurrence investigations, weather-related occurrences recorder and basic weather forecast information. According to were complicated to analyze, such as the relationships of sur- the flightpath of the FDR recording, GIS was used to superpose face winds, flightpath drift, and an aircraft’s lateral operation. the waypoints, flight routes, and flightpath. Based on those data, ASC has been using a module called “tracking analyst” under and superposing the relevant Flight Information Regions (FIRs), the ArcGIS platform to dynamically present the multiple an- and the range of the country’s territorial sea (i.e., 12 nm), the emometers data of LLWAS and 3-D flightpath. The 3-D flight- program can then determine the investigative authority. For ex- path is then reconstructed from FDR recorded parameters ample, Figure 1 illustrates the GIS analysis result; the result in- (ground speed, magnetic heading, drift angle, altitude). All of dicates that BR2196 occurred in high seas and out of Japan’s the FDR recorded parameters are selectable to dynamic link territorial sea, which means the occurrence investigation au- with geo-spatial data (satellite images, terrain, ILS beams, thority belongs to ASC. weather charts, Jeppesen charts). Figure 3 illustrates the LLWAS

ISASI 2007 Proceedings • 47

Proceedings 2007.pmd 47 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 82 encountered severe windshearat120ftAGL). Figure 3.SuperpositionofLLWAS dataandflightpath(anMD- 48 eas. InFigure 3,thebasicsatellitemapsconsistofLandSatdown- ofhelicopters, restrictedcorridors areas, and ultralightactivityar- The geo-spatialdataofTaipei VFR FIR includeswaypoints,airways, the web-basedGIS. translated intoKMLformat,whichisanewstandard formatof bal Mapper, etc.).In2006,mostofTaipei FIRAIPdatawere patible withcommercial GISplatforms(Mapinfo,ArcGIS, Glo- or pre-selected attributes.ThoseTaipei FIRAIPdataare com- into GISlayers,whichwere accessedbyenroutes, airportcodes, ridors, ultralightactivityareas, and restricted areas). tool, tosuperposingthegeo-spatialdata(terminalareas, VFRcor- data andflightdata.Figure developed 2demonstratestheASC they are withoutthestandardized toolstosuperposewithweather lated toenroutes andaerodromes are difficulttoanalyzebecause are published. AD sectionwhere detailsandchartsofallpublicaerodromes The documentcontainsmanycharts;mostoftheseare inthe parts—GEN (general),ENR(enroute), andAD(aerodromes). lates. Thestructure andcontentsoftheAIPs normallyhavethree nent toflyingaircraft inthe particular countrytowhichitre- details ofregulations, procedures, andotherinformationperti- gation. AIPisdesignedtobeamanualcontainingthorough nautical informationofalastingcharacteressentialtoairnavi- tion issuedbyorwiththeauthorityofastateandcontainsaero- The Aer information publication Digitizing thechartsofaeronautical change thelevelsoftransparency entire superposingofGISdataisprogrammable todisplayor onds, andthe3-D flightpathwillupdateevery1second.The data ofSongShanAirport.Thewillupdateevery10sec- onboard dopplerradarcannotdetectandpre-caution. gust exist onthefinalapproach routes andtheflightcrew and for conditionstheFDRdoesnotrecord—the wind,windshear, or useful toevaluatetheaircraft’s maneuversdynamically, especially Figure 4 showsthe3-D GISresults ofArcGIS andGoogleEarth. contractedaprojectIn 2002,ASC totranslateTaipei FIRAIP For thepurposeofoccurrence investigation,thosechartsre- Therefore, integratingthe3-D flightpathandLLWAS datais • ISASI 2007 ISASI onautical InformationPublication(AIP)isapublica- Proceedings 48 6 . flightpath ofGPSdataintoKMLformat. “GPSBABEL” isagreat tooltodownloadandconvertthe aircraft haveinstalledthehandheldGPSreceiver, sothe programs. tracks, androutes betweenpopularGPSreceivers andmapping late theGISdataintoKMLformat.ArcGIS version9.2orhigher KML fileswitha.kmzextension. KML filesare veryoftendistributedasKMZfiles,whichare zipped tilt, heading,andaltitude—whichtogetherdefinea“cameraview.” latitude). Otherdatacanmake theviewmore specific,suchas Google Earth.Eachplacealwayshasaposition(longitudeand polygons, 3-D models,textual descriptions,etc.)fordisplayin The KMLfilespecifiesasetoffeatures (placemarks,images, in turnbyKeyhole, Inc,whichwasacquired byGooglein2004. software thatbecameGoogleEarth;thesoftware wasproduced of GoogleEarth.Theword Keyhole isanearliernameforthe for managingthree-dimensional geo-spatialdataintheprogram KML (Keyhole language Markup Language)isanXML-based KML/KMZ formatandtranslation TWD97, UTM,andWGS84 a program toconvertthecoordinate systemsamongTWD67, program toovercome thisproblem. To hasdeveloped date,ASC need tofindorself-developthemultiplecoordinates conversion only acceptstheWGS84.Therefore, anyusersofGoogleEarth systems ofTWD67,97,andWGS84;butGoogleEarth In Taiwan, mostofGISdataare basedongeodeticcoordinate Coordinate systemsconversion follows. mats. Thepracticalproblems andsolutionsare describedas to batchimportthegeo-spatialdatawithKMLorKMZfor- D modelsintoGoogleEarthusingtheself-developedprograms tigators canimportinteresting placemarks,siteimages, and3- worldwide GISdataatyourfingertipssothattheforensic inves- and3-Dlite imageries,maps,terrain, buildingstointegratethe Google EarthcombinesthepowerofSearch withsatel- III. loaded free from thewebsiteof3-D Warehouse (http:// harbors). Allofthose3-D models couldbesearched anddown- wreckage), andtransportation builds(trainstations,airports, models (aircraft, ground obstacle,airportterminalbuilding, Google Earth,suchasfamousbuildingsintheworld,specific Recently, there havebeenmanyfree 3-D models availablefor 3-D modelingofGoogleEarth alone program called“GPSBABEL” features “extruded” upwards byanattributeorz-value.Thestand- export toKMLcanbeexported aseither2-D features or3-D dataset, inanydefinedprojection, canbeexported. Features of Google Earth.Anygeo-spatialdatapoint,polyline,orpolygon allows userstoexport GISdatainKMLformatforviewingthe of Taipei FIRare availabletoclickviathemouse’sfunction. are independenttoaccessandmodification.Therelevant attributes SPOT-5 images(ground resolution 2.5meters).Allofthoselayers loaded images(ground resolution about15meters In Taiwan, manygeneralaircraft, nationalaircraft andultralight There are twocommercial software programs availabletotrans-

Advanced applicationsofGoogleEarth 1/14/2008, 9:43 AM 8 . 10 canconvertwaypoints, 7 ), andprecise 9 Figure 4. Demonstrates the web-based GIS result of superposing the geo-spatial data (satellite imageries, terrain, waypoints, airways, restricted areas, VFR corridors, and ultralight activity Figure 6. Illustrates the aircraft crash site environment using areas). web-based GIS.

though the runway threshold higher than 50 ft? Where was the touchdown point? How to identify the ground scars and tire marks SESSION 2—Moderator Sue Burdekin that had remained on the runway surface or mud grass? According to the reliable and accurate flightpaths, investigators could answer those questions mentioned above, but they need an interactive platform to integrate all of the factual information in order to validate those answers. Now, Google Earth provides the major features to align with imported flightpaths, (a) add several place marks, i.e., deviated altitude and airspeed from reference glide path, aircraft relative position when radio altitude is 50 ft, touchdown point and tire marks on the runway; (b) image overlay, i.e., doppler weather radar chart, weather satellite image, and Jeppesen charts. All the image overlays are determinated by two known positions, but if the original chart is without the position information of latitude and longitude or is not the WGS84 coordinate system, it could be inaccurate to superpose with Google Earth’s build-in image and terrain; (c) create and import the Figure 5. Superposition of flightpath on the Jeppesen chart with simple 3-D models, i.e., terminal building, tower, ground facili- 50 ft and T/D place marks and 3-D building models. ties, FIR models, and relevant aircraft models. Therefore, KML is similar to HTML and allows users to edit the “virtual” occur- sketchup.google.com/3-Dwarehouse/). But the latest version, 4.x, rence site via available factual data to evaluate the sequence of of Google Earth has not yet provided the 3-D modeling func- occurrence events. tions, so it needs another program—“Google SketchUp” to cre- Figure 5 shows the flightpath of an MD-90 approaching Hong ate and translate the 3-D model into Google Earth. Google Kong international airport via Runway 7R. The place marks SketchUp version 6 is a 3-D modeling software tool that allows and 3-D models include the place marks of the 50 ft and touch- designers and planners to explore, communicate, and present down point, the Jeppesen ILS chart, the ATC tower, and termi- complex 3-D concepts. Its import and export capability gives you nal building. the speed and functionality for use in a professional workflow. Applications in the crash site IV. Results and discussion When an aviation occurrence occurs in the mountain area, the Application in the terminal area of the airport initial stage of investigation will be to survey the wreckage dis- Most typical aviation occurrences take place in the terminal area tribution, the fire burned areas, and impact marks on the tree- of the airport, sometimes accompanied by thunderstorms or slip- tops and terrain surface. According to the site surveying data, pery runway conditions. From the flight operational point of view the investigators could determinate the aircraft’s final maneu- to an occurrence investigation, those essential questions include ver. Did the aircraft collide with the terrain at high or low speed? Which approach mode (IFR or VFR) was selected by the flight The follow-up could launch the investigation directions on crew? Which one of the Jeppesen charts was applied? Between weather, maintenance, flight operational, and structural or en- the approach path of 1,000 ft AGL and 50 ft, did the aircraft pass gine failure, etc.

ISASI 2007 Proceedings • 49

Proceedings 2007.pmd 49 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 50 ity and3-D visualization. browse thegeo-spatialdataonPC,withfeatures ofportabil- occurrence events,where theinvestigatorcouldinteractively become theimportantplatformtoevaluatesequenceof animation system.Theresults showthatweb-basedGIShas analysis result. continuestodeveloptheGISandflight ASC practicality thatleadindividualevidencetopresent consistent investigation techniquesshallhavethefeatures ofreliability and tigation toapportionblameorliability. Therefore, developing rence ofsimilaroccurrences. Itisnotthepurposeofsuchinves- The objectiveofoccurrence investigationistoprevent recur- Conclusions are reconstructed (seeFigure 6,page49). device) thetreetops, broken woodengeometry, and3-D flightpath veying data(collectedbydifferential GPSandalaser-ranging nected betweentheelectricitytowers.Finally, basedonsitesur- craft crashsite,inwhichtheelectricwires are immediatelycon- instance, buildingtheelectricitytowerpatternsnearbyair- models, thensuperposethemwithcollectedgeo-spatialdata.For data,itallowstheusertocreateimageries andterrain the3-D Google Earthhandledthemostcomplicateddataofsatellite is verytedious,time-consuming,andwastescomputerresources. There are twomajorconcernsforfurtherdevelopmentofthe The process toreconstruct thesequenceofoccurrence events • ISASI 2007 ISASI Proceedings 50 of the geo-data dynamically play back and integration, etc. of thegeo-datadynamicallyplaybackandintegration,etc. processing ofthegeo-spatialdata,and(b)enhancingfunctions tem—(a) improving theKMLorKMZmanualtranslationintobatch web-based GIStoassisttheaviationoccurrence investigationsys- 10 9 8 7 6 5 4 3 2 1 References Tian-Fu, Yeh, Ming-Hao, Young, andWen-Lin Guan,“Developingand Landsatsatelliteimagedownloadwebsite:https://zulu.ssc.nasa.gov/mrsid. Tian-Fu, Yeh, Ming-Hao, Young, andWen-Lin Guan,“Applications ofRe- Wen-Lin Yong, Guan1andKay “Review ofAviation AccidentsCausedby NeilCampbell,“FlightDataAnalysisUsingLimitedSets,”2004In- Occurrence Press Release, “EVA FlightBR2196A330-200Encoun- Airways “Aviation Occurrence InvestigationAct,”Aviation SafetyCouncil,website: Technical Paper, You “Things ShouldKnowAboutGoogleEarth,”Educause gpsbabel.org.12NM seaofJapan. territorial asp?dbid=14273. Nov. 2004,Tainan, Taiwan. Aviation Occurrence Investigation,”2004GPSApplicationConference, Applications oftheMulti-Coordinate Translations forthePurposeof Intelligent Transportation SocietyConference, Aug.2005,Shanghai,China. mote SensingTechniques intotheAviation Occurrence Investigation,”2005 of MechanicalEngineers,Vol. 23,No.2,2002,Taipei, Taiwan. Wind ShearandIdentificationMethods,”JournaloftheChineseSociety Australia. ternational SocietyofAirSafetyInvestigatorsSeminar, Aug.2004,Canberra, http://www.asc.gov.tw/asc_en/accident_list_2.asp?accident_no=109. tered Turbulence DuringDescentatanAltitudeof34,500Ft,”website: http://www.asc.gov.tw/prescript_files/aoia(1).pdf. Learning, 2006. ArcGIS DataExporttool,website:http://arcscripts.esri.com/details. GIS DataExportintoGoogleEarthTool, website:http://www. 1/14/2008, 9:43 AM ◆ Use of Reverse Engineering Techniques To Generate Data for Investigations By Peter Coombs, Senior Inspector of Accidents, AAIB, U.K.

Peter Coombs has served as an engineering investigator with the U.K. Air Accidents Investigation Branch since 1972. He has investigated accidents and incidents to most classes of aircraft including large public transport airliners, transport helicopters, military combat aircraft, and many general aviation types. Before joining the AAIB, he trained with the British Aircraft Corporation, gaining experience in manufacture, development and maintenance on a variety of airliner types. He then became a design engineer on the Concorde SST. He gained a master’s degree in aircraft design in 1971 and holds pilot’s licenses on single and multiengined GA aircraft and helicopters. He is also a flying instructor. Figure 1 SESSION 2—Moderator Sue Burdekin

Background those design requirements to the accident circumstances, have Accident investigation has traditionally relied on a variety of come into doubt. sources of evidence. One of the most important has been analyti- On a number of recent investigations, where structural fail- cal data supplied by type certificate (TC) holders or original equip- ures have occurred, a process of “reverse engineering” has been ment manufacturers (OEMs). carried out by the AAIB, under the supervision of the author, to Such information is particularly important in those complex combat these difficulties. This has been done in order to estab- investigations involving structural failure. A number of problems lish important parameters that might previously have fallen in with these sources of data have, however, been encountered in the province of the type certificate holder, but where inadequate recent years. data have come from that source. With mature aircraft types, archived design data in the posses- The two investigations summarized here have been to aircraft sion of TC holders may not be readily accessible. If it is available, in very different categories, suffering very different accident it may be in a form not easily identified, understood, and ma- causes. Similarities in the investigative process for each were, nipulated by their structural, aerodynamic, or systems special- however, considerable. ists. These people will probably be more used to operating with The first of these events was to a medium-sized, offshore, pub- state-of-the-art design tools. They are often inexperienced in the lic-transport helicopter. This suffered a lightning strike resulting use of earlier methods of technical analysis and design data rein damage to a composite tail-rotor blade, which ultimately led cording systems, routinely utilized in the past in the develop- to failure of the tail rotor gearbox attachment making continued ment processes of aircraft and their components. This assumes flight impossible. that the relevant data can actually be located and identified, a Although the gearbox fell from the pylon at the end of the situation which cannot always be guaranteed. flight, somewhat miraculously the hydraulic pipes did not ini- A process of “corporate amnesia” has become common tially fracture. Instead, they continued to support the mass of the amongst manufacturers, brought about by lengthening aircraft gearbox for a brief period. This preserved the longitudinal bal- service lives and shortening career spans of design/development ance of the aircraft, enabling a successful autorotation to take engineers within one employer. Some manufacturers seek out place into a rough sea. Shortly afterward, the pipes failed and long retired engineering specialists to attend meetings with in- the gearbox fell away and sank to the sea bed. The aircraft drifted vestigators in often vain attempts to recapture long forgotten downwind until it also sank. Figure 1 shows the aircraft some design data. Others seem reluctant to part with information they time between the loss of the gearbox and the final sinking, shortly probably possess, either because they find it technically embar- after all the passengers and crew evacuated. rassing in the context of the accident or for reasons about which The occupants escaped by dingy and were subsequently res- we can only speculate. The problem seems to be at its greatest cued. Surprisingly, we were successful in recovering both airframe when the accident under investigation occurs far from the home and tail rotor gearbox from two separate locations, both at depths territory of the type certificate holders. in excess of 700 feet (see Figures 2 and 3). The above phenomenon can be unfortunate in circumstances Recordings of the timing and location of the critical lightning where the compliance of the subject aircraft with the design re- strike were obtained using meteorological recording equipment, quirements, or in some respects the adequacy and relevance of as was a time referenced recording of the final radio distress call,

ISASI 2007 Proceedings • 51

Proceedings 2007.pmd 51 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 52 els inthegearboxattachments resulting from rotor imbalance. rotorcraft. Thesecharacteristics significantlyraisedthestress lev- sponse characteristicsofthetail boomandpylonstructure ofthe of tailrotor imbalanceactinginconjunctionwiththedynamicre- ings inlocalizedareas ofstructure. investigations required precise assessmentofstrength and load- investigations, regardless ofthesizeaircraft involved.Both could beutilizedinwholeormore probably inpartduringfuture the maneuverspeedofaircraft. that thespeed,attimeoffailure, was significantly below acceptable degree of accuracy. Itwasnotedwithsomeconcern after-cast enabledtheairspeedhistorytobecalculatedwith an view oftheseparatedwingisshowninFigure 8. cal conditions.Thewreckage isshowninFigure 7,andanaerial curred whileflyinginsmooth air indaylightvisualmeteorologi- the outboard sectionofawing,indownloadsense.Thisoc- aircraft, which suffered theunusualphenomenonofafailure of tail rotor gearboxattachment. made astheaircraft ditched,followingthefailure ofthenormal Figure 3 Figure 2 The secondinvestigation,to the GAaircraft, tookadvantage The firstalsorequired assessmentofloadingappliedasaresult Both investigationsresulted indevelopmentofmethods that A goodqualityradarrecording andareliable meteorological The secondaccidentwasafataleventtofour-seatmetalGA • ISASI 2007 ISASI Proceedings 52 engineering companiesinEurope andNorthAmerica. major aircraft manufacturers andtootherspecialistaeronautical of fastcombatjetaircraft. They actascontractengineerstoboth namics. Onehasspecificexperience onmaneuverloadanalysis eas rangingfrom finiteelement(FE)analysistostructuraldy- load analysis.Thespecialistcompaniesprovide expertise inar- of structuraldesign,flightmechanics,simulation,anddynamic assistance. Thelatterhasawiderangeofexpertise through areas internationally knownacademicestablishmentalsosupplied such grown upduringthepast25years.Inaddition,aU.K.-based, cialist analyticalcompaniesintheU.K.Thesehavegenerally support oftheseinvestigationswasprovided byanumber ofspe- accurate thanthoseavailabletotheoriginalaircraft designers. aerodynamic loadingfigures. Thesewere thoughttobemore of state-of-the-arttechniquestoestablishstructuralstrength and Figure 5 Figure 4 Figure 6 The expertise required outthe detailedcalculationsin tocarry 1/14/2008, 9:43 AM actual measurements of the casting to create the grid. In Figure 6, you see one of the visualizations of the gearbox showing the varying stress distribution for a unit loading. The number of cycles to failure was known, since the times of both the strike and the final gearbox separation were known from recordings. The initial event time was identified precisely using the atmospheric lightning recording equipment available to the U.K. Met Office, while the failure time was established approximately from timing of the final VHF crew distress call. The rotor speed was known from aircraft data. From these items of information, it was possible to calculate the amount of imbalance that provoked the gearbox fatigue failure and must, therefore, have been brought about by the lightning damage. Figure 7 When first calculated, however, without considering the dynamics of the tail boom, the mass loss from the blade, to create this imbalance, was found to be slightly more than that resulting from damage clearly caused finally by the collision between the blade and the tail boom. See again Figures 4 and 5. This damage had quite clearly only occurred as the gearbox separated, some minutes after the strike; something was undoubtedly wrong with the calculated result. It was, therefore, decided that the dynamic characteristics of the tail boom/gearbox combination would be evaluated theoretically. SESSION 2—Moderator Sue Burdekin This work was carried out using a manufacturer’s dimensioned layout drawing of the tail boom and skin thickness measurements Figure 8 made on the damaged boom by ourselves. The mass of the gearbox was determined simply by weighing the salvaged unit. The accidents The new calculated tail boom dynamic characteristics were The helicopter, an AS 332, lost part of a composite tail rotor blade confirmed by a resonance test of the rear structure of an in-ser- as a result of a lightning strike while descending to an offshore rig. vice aircraft while on the ground and were further corrected theo- Subsequent impact destruction to the remainder of the blade (see retically for the predicted effect of a single, loose tail rotor gear- Figure 4), as the rotor struck the tail boom during gearbox separa- box attachment. By this means, it was determined that the natu- tion, disguised the amount of initial lightning damage. It can be ral frequency of the rear of the aircraft in cycles per second almost seen in Figure 5 that four of the blades have been destroyed by this matched the rotor speed in revs/second. The cyclic forces ap- same impact mechanism, although only the one on the left has plied to the two effective tail rotor gearbox attachments were thus any evidence of the earlier lightning damage. found, as a result of these close frequency similarities, to be far It was required to establish the level and degree of initial light- greater than those initially calculated without taking account of ning damage on this single blade in order to determine the se- the dynamics of the tail boom. verity of the lightning strike that the blade suffered. This was Only a small mass loss resulting from the lightning strike was necessary to establish the practical validity of the lightning certi- now required to create loading to cause failure in the known time, fication requirements to which the aircraft had been qualified. and a realistic assessment of the pure lightning damage required The loss of the machine had cast considerable doubt on the ad- to cause this loss could be made. By comparing this calculated equacy of those requirements. It was feared that aircraft operat- mass loss with the damage inflicted by lightning tests on used ing at low levels, in winter, in the temperate maritime conditions blades, carried out earlier, using known electrical intensity char- over the North Sea, were especially vulnerable. At the time, this acteristics, it was possible to determine the approximate magni- was the busiest area of offshore, long-range, public-transport tude of the lightning strike. helicopter operation in the world. This, although confirming that the certification requirements Tests on a number of ex-service blades were carried out at a then in force were realistic in terms of magnitude for that flight lightning test facility to establish the extent of damage inflicted environment, revealed significant drawbacks in the aircraft’s de- by differing degrees of intensity of lightning strikes. sign process. It showed that the practical effects of bolt slackening It was found, from wreckage examination, that imbalance fol- under vibration loading, together with the similarity of natural lowing the strike had created sufficient vibration to cause one of frequency of the structure to the rotor speed, had not been ad- the three gearbox securing bolts to slacken. This both concen- equately taken into account at the design stage. Certification com- trated cyclic bending on only two attachment lugs and altered pliance merely called for an absence of severe structural damage the natural frequency of the tail boom/gearbox combination. This in (static) lightning test conditions. It did not call for a full assess- alteration brought this structural frequency (in cycles per sec- ment of the structural behavior of the rotor system and mounting ond) close to the rotational speed of the unbalanced rotor with after the limited lightning damage had occurred. No such assess- the damaged blade (in revolutions per second). ment had apparently been carried out on this aircraft type. A finite element analysis of the gearbox was carried out using In the case of the GA aircraft, a PA28R-200-2, a finite ele-

ISASI 2007 Proceedings • 53

Proceedings 2007.pmd 53 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS Figure 9.Finite elementanalysisvisualization. 54 tirely obscure. achieved. Thereason forthewingfailure thusremained en- fail thewingcouldnotreasonably beapproached, still less sulting from a large simultaneous roll control input,the loadto calculated forsuchmaneuversactinginunisonwithforces re- considered. Itwasrealized, however, thatevenwiththoseforces simulations. quired thehighestloadsimpliedbyresults tocarry ofthe wing strength from theFEanalysiswasfarinexcess ofthatre- havior oftheFEmodelunderavaryingdownload. as thevaryingaerodynamic force/time inputtoevaluatethebe- was thenusedtofactorthedistributedforces. Theresult wasused highest negativeloadfactorsachievedinthesimulation series verted toengineeringunits.Thetimehistoryresulting inthe able pilotaction,isshowninFigure 10. time sequenceforthemostsevere effect,whichseemedareason- histories aswellotherflightparameters.Thecontrol input/ trol inputs,creating aseriesofwingdownload-time(negative G) series ofcontrol columndisplacement-timehistories of pitchcon- model oftheaircraft type.Thiswasdonetoproduce arealistic simple simulator, programmed computer withamodifiedNASA model. a furthersamplewing.Figure 9showsavisualization ofthe surements ofpanelthickness madeontheseparatedwingand was created usingamanufacturer’s layoutdrawingandmea- ment (FE)modelofthewingbayinwhichfailure occurred Up tothispoint,onlysymmetricalpitchmaneuvershadbeen outthisexercise,On carrying itwasfoundthatthetheoretical The span-wise negativeliftdistributionwascalculatedandcon- An evaluationofcontrol responses out,usinga wascarried • ISASI 2007 ISASI Proceedings 54 Figure 10 and 13. 11. Visualizations ofthefailure modes are showninFigures 12 The control input-timehistoriesare showngraphicallyinFigure craft structure failedcouldjustbereached attheknownairspeed. influences, failure loadsatthewingstationwhere theactualair- by completereversal ofcontrol inputsinbothaxes. Underthese simultaneous pitchandroll control input,followedimmediately resulted infailure ofthefiniteelementmodelasaresult offull It proved possiblethento create amaneuver/time historythat calculated forcontinuouslyvaryingpitchandroll displacements. data relating tothetype.Thisenabledmaneuverloadsbe entirely bymeasurement ofareal example anduseofpublished and alsotocreate aNASTRAN/PATRAN modelofthemachine, estimate theapproximate massdistributionofthewingstructure fects created byrapidlyreversed control inputs.Itwasableto pany consulteddrew attentiontothesignificanceof inertia ef- insignificant. assumptions applied,thereduction inwingstrength wasstill out;withanumberofmoremodel wasthencarried pessimistic Calculation ofcontrol forces atthis speedindicatedthatthese At thispoint,furtherspecialistassistancewassought.Thecom- A review ofassumptionsmadetocreate thefiniteelement 1/14/2008, 9:43 AM SESSION 2—Moderator Sue Burdekin

Figure 11

Figure 13. Finite element analysis visualization of internal structures.

Conclusions These two investigations demonstrate the way in which capabilities from partners outside the normal areas of expertise usually called upon by investigators can be harnessed to replace data more usually found from OEMs and TC holders when such data are not readily available. Although the absence of manufacturer’s data may seem at first a great handicap, the ever-increasing power of modern computers and the rising sophistication of commer- Figure 12. Finite element analysis visualization. cially available analytical packages compensates for much of this loss. It enables data to be generated and manipulated, which were sufficiently low to enable them to be easily generated by a produces results that are no less accurate than those achieved in front-seat occupant. (Control gearing was established by simply the past by OEMs. These will have used methods that were state- measuring control surface angular movement for corresponding of-the-art at the time of the aircraft’s initial design but may be control wheel travel on an example of the type borrowed for two or more decades old at the time the accident occurs. measurement purposes). Investigations carried out using such methods present a chal- A persuasive scenario to explain the occurrence, based on the lenged to the manufacturers that frequently reengage more fully nature and seating position of the aircraft occupants, in this dual when they see that official investigative bodies are serious about control machine was then devised. finding the root causes of such intricate accidents. ◆

ISASI 2007 Proceedings • 55

Proceedings 2007.pmd 55 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 56 cally themosttimeconsuming inacrashedplaneenvironment, to beexamined bytheengine specialist(Figure 3). be recovered. Thefollowingchecklist identifiesthecomponents an inventoryofthecomponentsalready foundandthosestillto teardown examination ofwreckage parts,itisnecessarytomake should betaken inaccordance totheoverallinvestigationplan. perts mustbeaware thateverystepineachspecialistinvestigation a responsibilityinvestigator-in-charge, ofthe andthesystemex- the investigationteam(Figure 2).Thecoordination workisusually some tasksthatmayoverlapwiththeactivityofothergroups within quires anadequatecoordination. Thefollowingchecklistillustrates grated inthegeneralinvestigationofaccident,andthis re- “Basic Need-to-Know” checklist(Figure 1). provide theanswertosome key questions,whichare listedinthe powerplant investigation,theenginespecialistisexpected to powerplant wreckage. the informationobtainedthrough theexamination ofthe lists provide anessentialguidanceonhowtoread andinterpret the useofchecklistsasaninvestigatingtool.Infact,check- important effectwillbeoneofthekey pointsintheillustrationof or filmincapturingmajoreventsassociatedwiththecrash.This powerplant systemactmuchlike thephotographer’simageplate the ground. Becauseofitsnature, thegasturbineandits that haveoccurred totheaircraft itselfpriortotheimpactwith ist canlearnmuchfrom thepowerplantsrelative totheevents plants were orwere notinvolvedinthecausalchain.Thespecial- aircraft accidentisnotsolelytodeterminewhetherthepower- tive techniquesandtopromote standardization. Checklists canalsobeaneffectivewaytoshare soundinvestiga- examination of thepowerplantsysteminaccidentchain. checklists willbeshowntoensure acomprehensive andquality powerplant investigationfollowinganaircraft crash.Theuseof author haschosentoillustratethistechniquerelative tothe identify andinterpret evidenceinaccidentinvestigations.The This paperillustratestheimportanceofutilizingcheckliststo Abstract The “InventoryofPowerplant Components”checklist istypi- To conductthefieldexamination, recovery, andlaboratory Additionally, theinvestigationofpowerplantmustbeinte- Let’s startwiththebasicsrelative totheaccident.During the The objectiveoftheenginespecialist’sinvestigationintoan • ISASI 2007 ISASI Institute. Course fortheSouthernCaliforniaSafety teaches theGasTurbine Accident Investigation expertise inaccidentinvestigation.Hecurrently career inpromoting flightsafetyinitiativesand having retired from Pratt &Whitneyafteralong Al Weaver Proceedings 56 (MO4465) isaSr. Fellow emeritus Using Checklistsasan Investigator’s Tool By AlWeaver work process. Theinvestigator-in-charge will welcomethethor- serving tostandardize thespecialist groups’ examinations and 17, 18,and19). peculiarities ofeachscenario(Figures 10,11,12,13,14,15,16, specific checkliststhathelptheinvestigatorinfocusingon the need tobeconsidered. Thisin-depthinvestigation callsformore a role inthecausalchain, thensignificantcontributingfactors tributed totheaccident.Ifengineisbelievedhaveplayed be lookingforevidenceofanymalfunctionsthatmayhave con- (CFIT)typeaccident. flight intoterrain crash wastheresult ofanaircraft upsetoritwasacontrolled a quickpointertothegeneraltypeofevent,i.e.,whether the and easilyavailabledatafrom aninitialexamination canserveas and roll attheinstant oftheimpactwithground. Thisbasic ences indamageoneachenginehelpstheassessmentofpitch positions. Inmultienginedaircraft, acomparisonofthediffer- ings isidealforassessingmajorground impactvectorsandclock The typicalcompactandrobust constructionoftheengine cas- engine damageasmountedontheaircraft (Figures 8 and9). the principalpitchandroll axisoftheplaneatimpactfrom the the specialistinvestigatorcanassistoverallteambyassessing a more in-depthinvestigationisnecessary. Any difference from expectations usuallyactsasanindicatorthat lated withexpected aircraft operationleadinguptotheaccident. is usuallynotasstraightforward. of extreme conditionsandthattheinterpretation oftheevidence and 7.Itshouldbemadeclearthatthesepictures are examples terns foreachconditionare easilyrecognizable inFigures 5,6, in thefollowingchecklist(Figure 4).Thetypicaldamagepat- rotational speedoftheenginecomponentsatimpact,asdetailed flight. Anessentialstepinthisanalysisistheassessmentof determine thethrustavailableduringlastmomentsof tailed checkliststoguidetheexpert inthein-depthinvestigation. discussion. Eachiteminthelistcanbeexpanded intomore de- be universallyappropriate toaspecificaccidentinvestigationneed. eral innature andtheirapplicabilitywhilebeingtypicalmaynot a missingcomponentisabsolutelycriticaltotheinvestigation. engine specialistfinallydecidesthatthelocatingandrecovery of components. Onlywhensubsequentpointersare developedthe from different parts,sotheinvestigatorcanworkaround missing coverable. Inmostcasesthesameinformationcanbeextracted because someofthepartsmaynotbereadily availableorunre- The utilizationoftheabove checklists willgoalongwayin Throughout theinvestigation, thepowerplantspecialistwill Once the“BasicNeed-to-Know” questionshavebeenanswered, All informationregarding thethrustsettingmustbecorre- One ofthemostimportanttasksforenginespecialististo Let’s gobacktothe“BasicNeed-to-Know” checklistforfurther For themostpart,checklistitemsillustratedaboveare gen- 1/14/2008, 9:43 AM oughness of the portion of the investigation, However, simply following the checklist does not become a substitute for the need for expertise in understanding how to interpret the findings toward a checklist.

Figure 1. Basic Need-to-Know • Position of the engine controls • What thrust or power was being produced • What malfunctions occurred • What were the indications to the crew

Figure 2. Overall Investigation Plan • Maintenance and material records • Photography • Field examination • Recovery as necessary • Laboratory teardown as necessary Figure 6. Low-speed damage.

Figure 3. Inventory of Powerplant Components • Inlet • Nacelle (including reverser where applicable) •Fan • Compressors SESSION 2—Moderator Sue Burdekin • Burner • Turbines • Exhaust • Externals

Figure 4. High- or Low-Speed Checklist • Blade airfoils —High speed if broken into small pieces —Low speed if complete in length • Splaying or bending of blades to either side —Low speed • Spiral bending —High speed • Blasted appearance to airfoil edges High speed Figure 7. Low-speed impact superimposed on high-speed damage.

Figure 5. High-speed damage. Figure 8. Angle of impact effects.

ISASI 2007 Proceedings • 57

Proceedings 2007.pmd 57 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 58 Engineinternalpartsalongflightpath • Missingstages • Heavybatteringtovanestatorrows, fore, andaft • Longtangentialholesorsplits • Bulgingoutward ofsurrounding case • Figure 13.UncontainedRotor Burst Ifinappropriate crew actions,whatwastheirtraining? • Whatwere thecrew actions? • Diditinvolvemultipleengines? • Figure 12.For Power Loss Whatwastheconditionofextinguishment? • Whatwastheignitionsource? • Whatwastheflammable material? • Figure 11.For InflightFire Alone Was there collateraldamagetootheraircraft systems? • Was there afire? • Was there anignitionsource? • Was there alsoflammablefluidpresent? • Figure 10.For EngineNon-Containment Figure 9.Roll angleeffects. • ISASI 2007 ISASI Proceedings 58 Figure 14.Exampleofruptured rotor disk. Aircraft strikes alongleadingedges • Smellin fandischarge • Down/breast feathers/tuftscaughtincrevices • Softcusps/bends/dents/twists • Cascadedamagetoconsecutiveblades • Figure 16.BirdIngestion Figure 15.Trajectory pathofuncontainedrotor diskfragments. 1/14/2008, 9:43 AM Figure 19. Hard-object ingestion damage. Figure 17. Examples of birdstrike locations on aircraft.

Note: For assessing bird or ice (softbody) damage, it is important to ignore all hardbody damage caused by re-ingestion debris of bits of broken metal. ◆ SESSION 2—Moderator Sue Burdekin

Figure 18. Bird ingestion damage.

ISASI 2007 Proceedings • 59

Proceedings 2007.pmd 59 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS involved inelectronic failure analysisworkinggroups. 2007,offtheSarawakcoast,Malaysia).Heis AS332 (January Airbus A320(May2006,Sochi,Russia) andtheMHSEurocopter international investigationsincludingthoseconcerningtheArmavia dedicated toonboard computerexaminations.Hehasparticipatedin Study Group). in European workinggroups suchastheFRSG(FlightRecorders A320 (May2006,Sochi,Russia) accidents.Hehasalsobeeninvolved 2004,SharmelSheikh,Egypt)andtheArmaviaAirbus (January international investigations.TheseincludetheFlashAirlinesB-737 ment atthebeginningof2006.Hehasparticipatedinanumber the BEAin2003,where hebecameheadofthe EngineeringDepart- the French CivilAviation Directorate (DGAC)for3yearsandjoined 60 out procedure. Faced withthis,investigators inmanypartsofthe of datacouldnotbeperformed usingthestandard direct read- tors haveoftenfoundthemselves inapositionwhere theretrieval tions encountered duringanaccident. For thisreason, investiga- vestigations, theyoffernoprotection againstthesevere condi- for investigations. have beenviewedasanewandvaluablesource ofinformation recorders ingeneralaviation,thesesmalldatastoragedevices investigators afteranaccident.Becauseoftheabsence flight cording capabilities,theyare nowsystematicallycollectedby aviation, andsincemanufacturers haveequippedthemwithre- industry thenstartedtoproduce commercial GPSdevices. was followedin1995byfulloperationalsystemcapability, andthe tion Administration(FAA) approved itsusebyciviloperators.This achieved initialoperationalcapability, andtheU.S. Federal Avia- By December1993theGlobalPositioning System(GPS)had Introduction: From GPStoonboarddatastoragedevices However, asthesedevicesare notprimarilydesignedforin- As theuseofGPSdeviceshasrapidlyexpanded ingeneral Finding Nuggets:CooperationVital in • ISASI 2007 ISASI Efforts toRecover BuriedData with SydneyUniversity(Australia). Heworkedfor (ENAC) in2000aftera1-yearexchangeprogram from theFrench NationalCivilAviation School (U.S.). Hereceived amaster’sdegree inaeronautics internship atCaliforniaInstituteofTechnology engineer from theEcolePolytechnique, afteran Christophe Menez He alsoundertookthedevelopmentofalaboratory on developingtoolsforsolvingdatarecovery issues. then joinedtheflightrecorder group andstartedwork Department in2003asaSafetyInvestigator. He School (ENAC).HejoinedtheBEAEngineering aeronautics from theFrench NationalCivilAviation Jérôme Projetti Proceedings By ChristopheMenezandJérômeProjetti, BEA—Bureau d’Enquêtesetd’Analyses 60 received amaster’sdegree in graduated in1998asan pour laSécuritédel’Aviation civile be displayed). manufacturer’s definition(an accidentflightmighttherefore not recorded duringaflightwhichdidnotterminate as per direct A readout from theVEMDscreen doesnotshowdata • even lost. There isnoguaranteethatthecontents willnotbealtered, or • Suchareadout isnotpossibleiftheprocessor card isdamaged. • screen whentheVEMDwasinapparently goodcondition. bench, sometimescoupledwithadirect readout ontotheVEMD out wasmadebyconnectingtheVEMDprocessor card toareadout for product testing,itwasnotsuitablefor investigations.Theread- though theprocedure usedtoread outthecontentswassatisfactory an accidentwastosenditthemanufacturer, Thales.However, data duringaninvestigation. flight recorders, canmake theVEMDanimportantsource of cording capabilities,aswelltheabsenceinmostcasesofonboard records failure reports, flightreports, andover-limits.Thesere- and limitationsrelated totheengineaswellvehicleand computer usedforflightandground operations.Itdisplaysdata and EngineMultifunctionDisplay).TheVEMDisanonboard involving Eurocopter helicoptersequippedwithVEMDs(Vehicle came from issuesencountered duringinvestigationsofaccidents memories from onboard datastoragedevices—otherthanGPSs— constantly throughout theexamination. can belostatanymomentifthepowersource isnotmaintained tile memories.Volatile memoriesremain problematic becausedata and, ayearlater, asimilaroperationwasmadepossibleonvola- access GPSdatabyreading outtherawdatacontainedinNVMs even withoutpower. From 2003on,BEAinvestigatorsstartedto 90s. Incontrasttovolatilememories,NVMskeep datastored storage, thankstothegeneralizationofflashmemoriesin tor orbatteryissometimesbroken, resulting intotaldataloss. tained inthememory. anaccident, theconnectiontocapaci- After additional capacitororbatteryinorder topreserve thedatacon- turned off.For thisreason, earlysystemswere equipped withan ries. Theseelectronic chipseraseinformationwhenthepoweris ficult sincedatasavingwasthenperformedthrough volatilememo- the readout. outrepairscondition, whichsometimesmeantcarrying priorto consisted ofdirect readouts whentheGPSwasingoodenough in damageddatastoragedevices. world havestartedtolookforwaysofaccessingthedataburied The followingweaknesseswere foundinthisprocedure: The initialprocedure usedfor extracting datafrom aVEMDafter The BEA’s interest outexaminations incarrying ofelectronic Later-model GPSsuseanon-volatilememory(NVM)fordata Data recovery from earlyproduction GPSswasallthemore dif- At theBEA,GPSexaminations startedin1998;initialwork 1/14/2008, 9:43 AM • When power is applied to a VEMD, new data are written and there is a consequent potential loss of data useful to an investigation. • In case of data loss or direct readout failure, it is difficult to know how the loss or failure occurred. • The application of such a method depends on the manufacturer’s interest in maintaining its readout equipment. This way of reading out VEMDs also proved to be unsatisfac- tory in cases where no data could be extracted. In addition, the cost to the BEA of each examination performed by the manufacturer increased our desire to find an alternative solution. With the experience gained from reading out the contents of GPS memories, it was decided to apply the same approach to reading out the contents of NVMs contained in VEMD electronic cards.

A wide variety of data storage devices Along with GPSs and VEMDs, plenty of other onboard data storage devices contain data that could be used for investigations. The appended table shows the wide variety of types of data storage devices examined at the BEA in recent years and illustrates the diversity of the systems that should be considered as potential information sources when conducting an investigation. SESSION 3—Moderator Alan Stray These devices have ranged from health and usage monitoring systems, collision and obstacle avoidance systems, and flight management guidance computers to PDAs and digital cameras. Even for similar aircraft types, there is often significant varia- Diagram 2 tion in the type of onboard data storage devices from one aircraft to another. There is thus a real need for investigators to be able that such an approach endangers the data. Moreover, direct read- to identify systems that can be useful for the investigation. This outs sometimes show only part of the recorded information. BEA underlines the need for close cooperation with manufacturers. investigators and advisers from Eurocopter encountered an in- Diagram 1 shows a Eurocopter AS332 and illustrates the com- teresting example of this during the analysis of data extracted plexity of identifying potential sources of information on an air- from a VEMD. The T4 temperature was displayed by the VEMD craft. New integrated avionics systems bring new challenges to screen as a three-digit number, though it is recorded with greater investigators. Primary flight and navigation displays can also accuracy, resulting in any recorded temperature above 1,000° C record data for maintenance purposes. They not only record being displayed as 999° C. screen failures but also failures transmitted by the AFCS (Auto- The general outline methodology is therefore: matic Flight Control System). Although a CVFDR (cockpit voice • to identify the potential source of information, and flight data recorder) is installed, health data collected by • to remove the corresponding systems from the wreckage, approximately 15 magnetic and vibration sensors can be recov- • to identify and extract the electronic cards and memories as- ered using EUROARMS. sociated with data recording, • to read out the contents of the memory chips, Methodology based on close cooperation • to decode the raw data, and with manufacturers • to validate the results. As mentioned in our introduction, reading out the contents of an The decision to perform the physical examination and the onboard data storage device with a direct “plug-in-and-power- memory readout at the BEA laboratory instead of using the up” method is not advisable after an accident. Experience shows manufacturer’s equipment changed the role of the manufacturer in the investigation process. Nevertheless, this approach—rather Diagram 1 than excluding the manufacturer—increased the necessity for close cooperation. The Diagram 2 shows the various steps in an onboard computer examination, as well as the role of the investigator and the manufacturer. During the first phase, the manufacturer’s knowledge of the systems is essential to know which memory chips store the recorded data. With growing experience, investigators have been developing specific techniques to extract electronic memories without jeopardizing the data. However, when a new system is examined, the manufacturer possesses essential information about the specific characteristics of the system’s electronic cards, their position, and the detailed precautions to take. Manufacturers can,

ISASI 2007 Proceedings • 61

Proceedings 2007.pmd 61 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 62 Example ofVEMDdisplayon takeoff. tify theriskofdamagingpotentiallyavailabledataandto process, animportantpartoftheinvestigators’workistoiden- the accidentbeinginvestigated.Throughout theexamination similar datastoragedevicebefore beingusedonthedevicefrom coding procedure. Theprocedure shouldthenbetestedona tors workwiththemanufacturer ondefiningareadout andde- both partiesbefore startingtheanalysisphase. work alsoensures thatthewholeprocess iswellunderstoodby ists workinparalleltovalidatethevaluesobtained.This standable format),investigatorsandthemanufacturer’s special- sary, convertedintoengineeringunits(oratleasttoanunder- on thedescriptionprovided bythemanufacturer. systems are encountered, sotheyare addedtothesoftware based The numberofalgorithmdecodingfeatures grows whennew ware canthussupplyareadable formatfrom arawdatainput. very different typesofonboard datastoragedevices.Thissoft- capable ofhandlingseveraltypesformatscorresponding to BEA investigatorshavedevelopedsoftware withacore algorithm data intoacomprehensible format.Inorder todothisefficiently, (applicationspecificintegratedcircuits). memory chipsorASICs manufacturer canalsohelpbyproviding datasheetsforobsolete dance withthememorytype.However, duringthisphasethe the contentsofmemorychipsthatcanbeconfigured inaccor- investigators havedevelopedreadout equipmenttodownload of itselectricalproperties (voltmeter, oscilloscope).AttheBEA, vation ofitsphysicalstate(microscope, X-ray) andmeasurement won’t destroy itscontents.Thisphaseincludesbothvisualobser- tion mustbeassessedinorder toensure thatthereadout process out.Beforether workiscarried reading outamemory, itscondi- investigators ensure thatrawdataare preserved before anyfur- making acopyofthecontentsmemories.Bydoingso, gators willhavetoremove toaccessconnectionsthechips. position oftheprotective layeronanelectronic card thatinvesti- power source, aswellprovide informationonthephysicalcom- for example, pointoutthepresence ofavolatilememoryandits As ageneralrule,before examining anewsystem,investiga- Finally, whenthe datahavebeenread outand,where neces- During thethird phase,investigatorshavetoconverttheraw The secondphaseoftheworkconsistsreading outand • ISASI 2007 ISASI Proceedings 62 tions topreserve it. establish technicalsolu- in theinvestigationasa 13, theBEAparticipated were seriouslyinjured. other twopassengers of thepassengers.The killing thepilotandtwo heavy verticalimpact, copter landedwith shut downandtheheli- Turbomeca 2F, Arrius the engine,a During aflighttoDelhi, India in2005 EC120 Colibriin to aEurocopter Example 1:Accident As perICAOannex start-up wastheprobable causeoftheaccident. VEMD datashowedthatthedecisiontocontinueflightafter probable causeof the accidentwithoutsuchanexamination. The accident, whereas itwouldprobably have been identifiedasthe dard wasdefinedasapossiblecontributoryfactortothe ferrule sion-making process. presence ofministersonboard perhaps contributingtothedeci- down. However, thepilotdecidedtocontinueflight—the and shouldresult inhisabortingtheflightandanenginetear- recorded. Suchanexcessive temperature isdisplayedtothepilot able limitof870°C.Duringflight,theT4over-limitwasagain the start-upphaseofflight,whichisfarbeyondaccept- (free turbine inputtemperature/EGT) reached 998.5°Cduring threw newlightontheaccidentscenario. standard in39enginesworldwide. ferrules The enginemanufacturer issuedanall-operator alertforallnon- sulting inthebladeseparation,leadingtoenginefailure. been thecauseoftemperature over-limitintheengine, re- ondary aircoolingsystem,anditwassuspectedthatthishad failure. Later, anon-standard wasidentifiedinthesec- ferrule erator turbinehadseparatedfrom thedisc,resulting inengine ministers andsomesuspicionsofsabotagearose. larly difficultasthetwofatallyinjured passengerswere Indian and Turbomeca. Thecontext oftheinvestigationwasparticu- state ofmanufacture, accompaniedbyadvisersfrom Eurocopter Readout ofNVM(6x8mm)usingprobing station. observation stagerevealed thatthemainboard waspartially the flighttrackwithasample rateof4seconds.Theinternal laboratory wasthekey tosuccessful dataretrieval andanalysis. with theSwissmanufacturer, andthemethodfollowedby was extracted from thewreckage. Cooperation wasestablished age wasrecovered 5dayslater. The pilot,thesoleoccupant,waskilledonimpactandwreck- wasn’t equippedwithanELT andtheradiowasunserviceable. glider crashedintoaforest 3,650feetupinthemountains.It During alocalflightinpoormeteorological conditions,anASW15 Example 2:GlideraccidentinFrance in 2007 Analysis oftherecorded datashowedthattheT4temperature However, theVEMDdata,retrieved anddecodedattheBEA, The engineexamination showedthatonebladeinthegasgen- The systeminquestion,based onGPSpositioning,canrecord An aircollisionavoidancesystemmanufactured byFLARM After analysisofthe VEMDdata,thepresenceAfter ofanon-stan- 1/14/2008, 9:43 AM APPENDIX: Data storage devices examined at the BEA since 1998 In the “content” column, italic text indicates a non-volatile memory and bold text indicates a volatile memory.

bent in different locations and the memory chip was disconnected from the card. It wasn’t possible to connect the memory pads with a standard adaptor. A procedure was validated to obtain the raw data by using very thin probes with the aid of binoculars. Raw data were converted into a track file from a test unit at the manufacturer’s site. The protocol established ensured that this could also be done for obsolete units. Faced with a lack of other available evidence, the flight track obtained brought new light to the accident investigation.

Challenges, limits and, objectives Working in this way requires the manufacturer to provide information on software specifications, and this is sometimes proprietary information or has not been SESSION 3—Moderator Alan Stray stored because of system obsolescence. With some manufacturers, such as Garmin, collaboration has not so far proved fruitful. For such reasons, and also because the data structure is less complex than for big onboard computers, GPS examinations can often be performed by either a direct readout or a simplified version of the general methodology. In addition to this first limitation, some difficulties have been encountered where the manufacturer has worked with a large number of component suppliers. Onboard systems and corresponding software are sometimes produced by two distinct suppliers. In some cases, investigators have to talk to several interlocutors before eventually being able to obtain a proper system description. Work on onboard data storage devices and GPSs has proven to be very challenging. Investigators have tried to find a common way of retrieving and preserving data from a wide variety of systems, but when new systems are encountered, adaptation is necessary and requires some procedural flexibility. For example, decoding a raw file extracted from a memory chip can be performed by the manufacturer if it does not wish to share the product software description with investigators. On the other hand, if a manufacturer does not want to devote time to the investigation process, providing the necessary documents to investigators can greatly help them to get useful data. The decision to find as much possible data at the memory chip level enabled investigators to strengthen their links with manufacturers. Working protocols that follow this approach have been established between the BEA and Eurocopter, Turbomeca and Thales. Manufacturers have expressed great interest in this type of work, which is also beneficial for them as they can obtain more data from the tools and methods developed by investigators. Manufacturers may thus be interested in taking into account knowledge gained dur-

ISASI 2007 Proceedings • 63

Proceedings 2007.pmd 63 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 64 ter informedaboutongoingdevelopments,andare betterpre- was theonlyonecapableofretrieving data.Investigatorsare bet- tion withmanufacturers thanincaseswhere themanufacturer Accessible inReal Time). nance systemcalledSMMART (SystemforMobilMaintenance ions ondatapreservation forthedevelopmentofanewmainte- future systems.Investigators havebeeninvitedtogivetheiropin- ing onboard datastoragedeviceexaminations whendeveloping Investigators havealsolearnedmore through closecollabora- • ISASI 2007 ISASI Proceedings 64 national manufacturers. have themselvesdevelopedtheirownworkingrelationships with investigation boards ofdifferent countriesaround theworld,who and thebestwaytosucceedinthisisworkunisonwith tries. Cooperationinthisfieldneedstobeconstantlywidened, manufacturers aswellmanufacturers from neighboringcoun- knowledge inorder toselectthesystemsbeexamined. pared—in caseofanewaccident—toexploit themanufacturer’s BEA investigatorshavebeenabletoworkcloselywithnational 1/14/2008, 9:43 AM ◆ International Investigation: General Aviation Accident In Atlantic Waters By Joseph Galliker (M03322)

Joseph Galliker is the president for ASC Interna- shield. The engine could not be restarted. tional, Inc. and develops customized airline emer- Gliding from cruising altitude, the pilot was able to reach the gency response and family assistance plans. Previ- first rock islands in the coastal waters of Southern Greenland ously, he worked for Air Canada as a flight safety (approx. 45 nautical miles southwest of Narsarsuaq near the “SI” officer. His experience covers flight safety manage- NDB). ment, aircraft incident and accident investigation and The pilot ditched the aircraft but drowned outside the aircraft. handling, the development of airline emergency response and family assistance plans, as well as liaison with the Site investigation in Greenland—cooperation SESSION 3—Moderator Alan Stray investigator-in-charge on behalf of the operator. While with Air in difficult climate Canada, Galliker developed the first-ever seminar on emergency In Greenland, aviation accident investigation falls into the juris- response management for airlines in 1984, which provided an diction of the Accident Investigation Board of Denmark. incentive for airlines worldwide to improve their emergency response The investigator-in-charge (IIC) proceeded to Greenland to plans and their liaison with the accident investigator-in-charge. conduct the field investigation. On arrival in Narsarsuaq, he He is providing training to airlines and civil aviation authorities in met up with the representative of the aircraft manufacturer, Africa, the Caribbean, Asia, and Europe on airline emergency response engine manufacturer, and the representative for the next of kin planning and liaison with the investigation agency. Most recently he of the pilot. assisted in the accident investigation into a single-engine aircraft The pilots of the remaining two aircraft had already been in- ditching short of the southern Greenland coast (2007) in the capacity terviewed by the investigator-in-charge. of representative for the next of kin of the pilot. He lives in the As both of these pilots had communicated with the aircraft in Montreal area and is married with two grown children. His hobbies are distress, and searched for and located the pilot and the aircraft, private flying, sailing, and snow shoe trekking. they became prime witnesses. The two pilots stated they found their colleague floating about Objective of this presentation 70 meters from the aircraft. The aircraft itself was afloat with the To understand the physical and financial effort involved in con- tail broken (but still attached) protruding above the surface of ducting a general aviation field investigation in the far north. the water. The sea had waves and swells (5-7 feet). Water temperature -1 to +1 C. The accident and its evolution The alarm and mobilization of the local emergency response On Feb. 2, 2007, three identical factory-new Cirrus SR20 were plan had also been initiated immediately, and the first helicopter enroute from Goose Bay, Canada, to Reykjavik, Iceland. While (AS350) reached the area within about 10 minutes. diverting to Narsarsuaq, Greenland, due to weather ahead, the Shortly after, the first rescue helicopter was joined by a second engine of one of the aircraft failed twice due to low engine oil one (Sikorsky S-61). pressure and loss of engine oil. Engine oil appeared on the wind- The S-61 retrieved the lifeless pilot and flew him to the Qaqortoq hospital (30 km), where he was pronounced dead. The S-61 helicopter “froze” the location of the floating aircraft on GPS. The next day it was reported that the aircraft had sunk. The days following the arrival of the IIC were plagued by extremely cold, windy, and snowy weather conditions. Proceeding to the accident site was postponed by the IIC pending safe flying weather for the AS350 helicopter. The two remaining aircraft were hangared in the only hangar in Narsarsuaq, in nice and cozy 20 degrees C. Going to the hangar from the hotel was a different story. High winds (100 km/h) and cold temperatures prevailed for days. The effects were, for example, reading glasses were blown off one of team members One of the two remaining aircraft in the hangar at Narsarsuaq. face, and promptly flew “straight and level” until later the next

ISASI 2007 Proceedings • 65

Proceedings 2007.pmd 65 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 66 sand orsteepinclinescrevasses. Seabedsurface couldbeanythingfrom large rock boulders to • Angleatwhich theaircraft sunktothebottomofseabed. • (icebergs can reach depthsof30metersormore). Icebergs inMarch toMaycrushtheaircraft ontheseabed • Strong currents (north/southandtidaleast/west). • to theaircraft itself: ing concernsabouttheaircraft locationandwhatcouldhappen to liftitandbringashore inthenearest town(Qaqortoq). at theditchinglocation,thensearch fortheaircraft and,if found, required forthenext step todeterminethedepthofseabed preciating whatnature islike outthere. rescue locationsanditsreference totheisland. thing else,butwewere gettingafeelfortheditchingand pilot were theaircraft hadbeenditching. ter. Thelocationwasabout300metersfurtherouttoseafrom floating horizontallyaboutameterunderthesurfaceofwa- for stopit.” sightings. patch inaboutsmetersofwater. disappointment, oncloserinvestigationitturnedouttobeasand shape ofwhatlooked like awhiteairplane.Aminutelater, big turned tohissideofthehelicopter, andindeedcouldseethe premium mineralsodawaterinanybigcity). single shred ofanything,butcrystalclearwater(wouldqualifyas island foranydebrisorotherevidenceoftheaircraft. of anapproximately 30by50meterssolid-rock island. fairly calmsea,atadistanceofabout200metersfrom theshore the siteondayofrescue operation. and wesoonfoundthespotmatchingcoordinates taken at well preserved, somedatingbacktothesecondWorld War. units wasaGarmin295withmapsforGreenland. the locationofaircraft. small rocky islands,andhavethehelicopterpilotcommenton under water, ifanydebriscouldbespottedontheshores ofnearby This wasthetimetoflysite. incorporated fortheflight. sulation” and“EngineWinterization Kit.”Theyhadnotbeen well asservicebulletinstatus. day theywere foundbyasearch party50metersdownwind. By speakingwithlocalfishermen,theyexpressed thefollow- But where inGreenland isitavailableandatwhatcost? We realized boatswithsonarandbarges withcraneswouldbe We returned toNarsarsuaq,somewhatdisappointed,but ap- We searched foranamount oftime,butcouldnotfindany- This timeitwasclearlyapaperpagelike aflightplanorchart, Flying furtheroutfrom theshore oftheisland,another“call We learnedfrom that,aslater, furtheraseathere were similar Suddenly oneteammembershouted,“Iseeit.Iit!”We all Anxiously scanningthesteep,rocky shore, wecouldnotseea We thoughtitwouldbebesttochecktheshore ofthenearest The sitewasopenwater, withsomewhitechunks ofglacierice, The coastalislandswere clearlyvisibleonthemapsofGPSs, On theway, thepilotshowedussomeearliercrashsites—all Equipped withthree GPSunits we setoff.OneoftheGPS The intentionbyallwastoseeiftheaircraft couldbeseen Finally, onaSaturday, thesky cleared andthewindwas calm. Two servicebulletinswere ofinterest, “OilBreather Tube In- The twoaircraft were checked forfuellevelandbalance,as • ISASI 2007 ISASI Proceedings 66 in andmoor. Looking atthenet,itseemedmassivewithsteel bound tobeatseaforafewdays. aircraft andliftingit. and speakingwithpeoplealsoprovided hopeforfindingthe well equippedwithecholots(astheyare calledlocally). ties. Notonlywasheadiver, buthealsoownstwo10-meterboats weather inaremote location. one get,”Ithoughttomyself. where theyhavedocked forthelastfewweeks.“Howlucky can mission tochartthesouthernGreenland seabedoutofQaqortoq, gested contactingthetwoDanishNavyships,whichwere ona has lotsofexperience findingthingsunderwater. Thealso sug- helicopter. had checked thesitefrom timetobyflyingoveritwiththeir in Narsarsuaqbrought forward goodmapsofthesitearea. They to liftit.Howwasnotclearyet. the sitewithanechosounder, theniftheaircraft wasspottedtry to enquire andspeakwithlocalprofessionals inperson. which provided contactstolocalownersofboats. tative forthepilotbegantocontactlocalpolice(Qaqortoq), She feltsheneededtoseetheaircraft. tion toexplore a“low-cost solution” tofindandraisetheaircraft. cost wouldbeprohibitive. by Greenland andDanishauthorities.Itbecameclear that the The investigator-in-charge discussedthesearch fortheaircraft search Aircraft One ofthetworemaining aircraft—oil breather tube. general andsparselymeasured depthsfurtherout(241meters). Thedepthatthesite.There are somerecent chartsthatshow • Walking oneevening onthepier, Isawa20-metertrawlercome No sightofDanishNavyships. Theyhadleftinthemorning, In themeantime,wanderingaround theharborinQaqortoq His wife,however, provided good informationofhiscapabili- ashewasheldbybad It tookawhiletofindthediver(Kaj), They alsosuggestedcontactingtheonlydiverinarea ashe Speaking tocrewmembers oftheDanishIcePatrol Unitbased The planwastofindsomeonewhocouldscantheseabedat The representative proceeded toNarsarsuaq,thenQaqortoq It becamesoonclearthattheresources were limited. With thepermissionandcooperationofIIC,represen- The wifeofthepilotasked herrepresentative totheInvestiga- 1/14/2008, 9:43 AM Trawler with drag net. The two ships surveying the seabed in the site area.

voice, the officer asked for the site coordinates. Ten minutes later we received depths in several locations. We proceeded and found the exact site with the help of the SESSION 3—Moderator Alan Stray GPS coordinates “frozen” last February. Scanning the seabed with two ship echo lots, the seabed showed up as a level plateau bordered by the rock island on one side, by a rise in terrain (42 meters depth) on the north/east side, and a plateau of about 300 meters length, parallel to island (70 meters), then a shallow drop to the open sea. Boat No. 2 was searching the south end of this plateau when he called on the radio, “I got something unusual here. I can not identify it, but there is something here.” We began to drag with the anchor for a while in the area, recording the tracks of the ships at the same time. After about an hour of dragging with the anchor, we felt a net Danish Navy charting ship—SKA-12. could do a better job and began the trip back to Qaqortoq (2.5 hrs). We were satisfied with the work we had performed and infor- balls and huge grommet-like rubber rings. mation we were able to bring back. “What can you do with this net?” The following is a list: “What do you have in mind?” the captain/owner asked. • Checked the shore of the island for evidence—nil found. “Looking for an aircraft out in the Niaqornaq Island area.” • Measured and recorded the depths and make up of the sea- “How big is the aircraft?” After he understood the situation bed in the greater site area. and possible depths, he summarized: “We can find the aircraft as • Confirmed witness statements by helicopter and two Cirrus our drag net can trawl to 300 meters. Also at a depth of around aircraft pilots as to distance from the shore the aircraft and pilot 100 meters, we can snag it with the net and lift it and bring it were located. right into this harbor.” • Checked performance of an immersion suit by wearing it while He then showed and explained the gear and the measuring floating in the sea for a period of time. and navigation equipment—latest state of the art. • Marked the point of “interesting returns” by the echo lot. He suggested that I go with the diver and survey the seabed in • Had the good feeling of having been there. the area around the GPS coordinates of the aircraft last seen to The investigator-in-charge was briefed. provide him a feel for the make up of the ground (level sand, The next step should now be the dispatch of the trawler, fully boulders, or crevasses, etc.) as well as the exact depths a few hun- staffed and accompanied by the diver and his staff. dred meters around the site. The cost should be reasonable, as the trawler is expected to The diver was available the next day, and with good planning complete the search in 1 or 2 days. we went off to the site. Here is an example of cooperation of investigation team with On the way there, one of the Danish Navy ships, the SKA-12, accredited members, local authority (ice patrol, police, Danish appeared on the horizon. The captain contacted it by radio to Navy), local professionals, and general public to help the investi- ask about exact depths in the site area. In a cooperative tone of gation (cause) and the pilot’s family (closure). ◆

ISASI 2007 Proceedings • 67

Proceedings 2007.pmd 67 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS science from Embry-Riddle Aeronauticalscience from University. Embry-Riddle aviation andaerospace operationsandabachelor’s degree inaeronautical GroupStudy sponsored Confusion byCAST. Hehasamaster’sdegree in is amemberoftheCICTTandgovernmentco-chairRunway sector forthelast18years,particularlyinarea ofsafetyanalysis.Vivek flight instructor, anddispatchercertificates. Hehasworkedintheaviation Information AnalysisandSharing(ASIAS)center. Heholdscommercial, Vivek Sood aerospace engineeringfrom theUniversityofSouthernCalifornia. Angeles Aircraft CertificationOffice.Hehasabachelor’sdegree in post-graduate degree inhumanfactorsfrom Paris University. ing from theFrench NationalCivilAviation School(ENAC)anda Board ofCanada.Olivierholdsamaster’sdegree inaviationengineer- ment. Before that,hehasalsoworkedwiththeTransportation Safety Safety) sinceNovember2005underaBEA-FAA cooperationagree- the Federal Aviation Administration(FAA) (ContinuedOperational Sécurité del’Aviation civile(BEA)in2000andhasbeenworkingwith Olivier Ferrante University ofNorthDakota. Missouri StateUniversityandamaster’sdegree inspacestudiesfrom the (NTSB). Hehasamaster’sdegree inaviationsafetyfrom Central United AirlinesandwiththeU.S.NationalTransportation SafetyBoard (CAST—JIMDAT). Corey hasalsoworkedintheSafetyDepartmentof ImplementationMonitoringDataAnalysisTeam(CAST)—Joint as anALPA representative totheCommercial Aviation SafetyTeam 68 The developmentofanindustry-accepted taxonomy Introduction essential role insafety. Itgoesbeyondjustidentifying occurrence • ISASI 2007 ISASI isthemanagerofFAA’s Aviation Safety (AVS) Aviation Safety By Corey Stephens(MO3790),OlivierFerrante (MO4749),Kyle Olsen,andVivek Sood ICAO CommonTaxonomyICAO Team (CICTT)andserves Corey co-chairtotheCAST/ Stephensistheindustry with technicalexpertiseoninternationalaccidents. Federation ofAirLinePilots Associations(IFALPA) Safety Department.HehasassistedtheInternational Line Pilots Association(ALPA)’s Engineering&Air Corey Stephens aanager ofthePropulsion BranchintheFAA Los andwas andMD-11 manager fortheL-1011 since 1997.Kyle wastheFAA certificationproject Directorate. HehasbeendeeplyinvolvedwithCAST Operational SafetyfortheFAA Transport Airplane Division in1970andisnowmanagerofContinued Kyle Olsen Proceedings joinedtheBureau d’Enquêtesetd’Analysespourla Taxonomies forData-Driven Standardizing International 68 joinedtheFAA Aircraft Engineering isaseniorstaffengineerwiththeAir Prevention 1 playsan including theEuropean JointAvia- Aviation Safety Agency(EASA), of internationalorganizations are members andobserversofCAST, to helpimprove aviation safetyaround theworld.Alarge number tem, throughout hasreached itshistoryCAST out internationally cent overthenext 10years. duce theU.S.commercial aviationfatalaccidentrateby80per- industry-government partnership in1997andsetagoaltore- mercial Aviation SafetyTeam cametogetherinaunique (CAST) Comprised ofindustryandgovernmentsafetyexperts, theCom- Commercial Aviation SafetyTeam History oftheCAST/ICAOCommonTaxonomy Team tors andvice-versa? important question:Howcantaxonomies helpsafetyinvestiga- pening, andhowoften?Finally, thepaperwilladdress onelast know thatoursafetystrategiesprevented anaccidentfrom hap- onomies willhelpanswerthefollowingquestions:Howdowe dardized, especiallyforincidentinvestigation.Thesenewtax- paper willalsodiscusssomeworkonnewtaxonomies tobestan- tate datacollectionandanalysisforaccidentprevention. This and giveexamples oftheirapplicationsthathavehelpedfacili- CommonTaxonomyCAST/ICAO Team taxonomies (CICTT) taxonomies canhelpinpreventing accidents.We willpresent some from theinvestigationsitetoICAO. This operationalframeworkillustratesinvestigationcooperation, the core ofthedatainADREPreporting scheme(ICAO, 2001). Aviation Organization (ICAO).Thisstandardized dataalsoforms exchanged amongorganizations andwiththeInternationalCivil ized definitions.Inaddition,theinvestigationresults canbe vestigator studyingworldwidedataisrelying onthesestandard- onomy, itbecomeseven more valuabletoinvestigators.Eachin- tion. Whendataiscollectedandrecorded usingastandard tax- tates trackingtheeffectivenessoftheirmitigationsolutions. enhanced. Thesafetyissuesare commonlydefined,whichfacili- community’s capacitytofocusoncommonsafetyissuesisgreatly munication. With thiscommonlanguage,theaviation language, thereby improving thequalityofinformationandcom- mon taxonomies anddefinitionsestablishastandard industry try-accepted standards aidindatasharing andanalysis.Com- becomes veryapparent fordata-drivensafetyinitiatives.Indus- the importanceofwell-developedandagreed-upon standards for useinreactive (postaccident)andproactive safetyprograms, categories. Asmore datasources andsystemsbecomeavailable Though CAST hasfocusedprimarilyontheU.S.aviationsys- Though CAST This paperwillemphasizehowinternationalcooperationin The investigationsitecanbethestartingpointfordatacollec- 1/14/2008, 9:43 AM tion Authorities (JAA), and other ICAO member states. CAST’s impact and leadership extends to regional safety alliances around the world, and its principles have been incorporated into the newly released ICAO global safety roadmap. CAST has developed an integrated, data-driven strategy to reduce the commercial aviation fatality risk in the United States. To date, CAST has completed 40 of the 65 most promising safety enhancements identified to reduce the leading causes of fatal commercial aviation accidents in the United States. Adoption of these enhancements has been a major factor in the substantial reduction of the fatal accident rate over the past 10 years. CAST is redirecting its efforts to the analysis of incident data to identify emerging safety risks. Figure 2. Worldwide evolution of CFIT accidents (source: To continue to achieve reductions in the accident rate, it is ICAO SISG 2007). necessary to expand into analysis of incident and normal operation data to unearth changing and emerging threats in a proac- by one representative from ICAO and one from CAST. tive manner. Access to the data is thus a vital component of this The original taxonomies established by the CICTT activity were risk analysis. The use of CICTT taxonomies by all organizations Occurrence Categories, Phase of Flight, Aircraft Make/Model/ will be critical to further advancements in aviation safety. The Series, and Engine Make/Model. The Occurrence Categories and absence of a common taxonomy and the lack of industry data- Phase of Flight definitions were completed in 2002. The Aircraft sharing initiatives greatly diminishes the ability to recognize Make/Model/Series values were established in 2004, and the En- SESSION 3—Moderator Alan Stray emerging risks and increasing threats before their manifestation gine Make/Model values activity started in 2006. Both the Air- in an accident or serious incident. craft and Engine taxonomies are updated quarterly. The establishment of these original taxonomies lays the foundation for CAST/ICAO Common Taxonomy Team • worldwide sharing of common accident/incident data, Before the formation of the CICTT, there was no universal stan- • focused, data-driven, coordinated safety agendas, dard for safety data. A focus on safety worldwide at that time • common investigation, reporting, and post accident analysis, resulted in the startup of many disparate efforts. This in turn and made the development of a common worldwide safety agenda • shifting from reactive to proactive safety assessments. extremely difficult. It was decided that an international industry and government standard must be developed, made up of Examples of CICTT product applications common and “non-proprietary” standards. Non-proprietary Use of CICTT Occurrence Categories by industry standards were needed since proprietary or patented taxono- Industry has been gradually implementing CICTT products. Fig- mies had contributed to stove piping of data. ICAO and CAST ure 1 shows how the Boeing Company adopted CICTT defini- jointly chartered the CICTT in 1999. The Team is charged with tions for its annual statistical summary of accidents (Boeing, 2006). developing common taxonomies and definitions for aviation The CICTT Occurrence Categories are also used by the Safety accident and incident reporting systems. CICTT includes ex- Indicator Study Group (SISG)—a group formed by ICAO after perts from ICAO, several air carriers, airframe and engine manu- the 1999 Accident Investigation and Prevention Divisional Meet- facturers, pilot associations, regulatory authorities, transporta- ing (AIG 99). Since 2001, SISG has met annually to exchange, tion safety boards, and members from North America and Eu- review, and jointly classify accident and incident data to produce rope, and indirectly from more countries. CICTT is co-chaired consistent safety statistics. Figure 2 illustrates the downward trend of controlled flight into terrain (CFIT) accidents. This example shows a “common taxonomy benefit” for CFIT prevention since a common understanding of this issue was needed before tackling it. The efforts undertaken these past years to prevent CFIT accidents (the acronym CFIT was less known 20 years ago) introduced new safety nets to successfully address this accident category. The common categorization of a problem and its coding greatly helped in better identifying it and monitoring its trend. Above all, it contributed to gathering a global consensus. The different stakeholders (industry and government ) could thus “talk” about the same issue and consequently act in a coordinate manner.

Example of ASIAS in the United States The FAA promotes the open exchange of safety information to Figure 1. Boeing statistics based on CICTT Occurrence continuously improve aviation safety. To further this basic objec- Categories. tive, the FAA established the ASIAS center.

ISASI 2007 Proceedings • 69

Proceedings 2007.pmd 69 1/14/2008, 9:43 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 70 relation with theAircraft Make/Model/Series mentioned inthe directivesto verifypendingissuesinthe airworthiness systemin ing onagivenoccurrence, aninvestigatorshouldeasilybeable enhance continuedoperational safety. For example, whilework- This newcompatibledatabaseshouldfacilitateinvestigations and Model/Series standard directive initsnewairworthiness database. ECCAIRS, directly Aircraft implementedtheCICTT Make/ ous organizations involved. a migrationhastobeplannedandcoordinated among thevari- generally requires changingthestructure ofexisting systems.Such standard initsnext release. Taxonomy changestake timeasit Aircraftin 2004andwilladopttheCICTT Make/Model/Series out theyears.ADREPimplementedOccurrence Categories be basedonlarger datasets. necessarily from theEuropean Union).Safetyanalysescanthen integration amongorganizations from different countries(not 2004). Thiscommontoolfacilitateselectronic exchanges and data (Accident/Incident DataReporting) 2000taxonomy (Menzel, compatible repositories. ECCAIRSisbasedontheICAOADREP for usersacross Europe toencodeaccidentsandincidentsinto objectives. TheEuropean Commissionprovides acommontool Centre forAviation IncidentReporting Systems(ECCAIRS)share “portal”approach andtheEuropeanThe ASIAS Co-ordination Example ofECCAIRSinEurope Boeing 737-800anditsassociatedresults. Model/Series standard. Figure 4depictsasinglequeryfor Aircrafting auniqueaircraft Make/ modelthankstotheCICTT able toquerymultiplesystemsinasinglequery. web-basedportal(seeFigureThrough theASIAS 3),usersare and establishinteroperability amongmultiplesource systems. isabletolinkdatabases try names,andoperatorASIAS the aircraft make andmodel,airportnames,,tate names,coun- taxonomies. CICTT cal capabilitiesbyestablishinginternaldatastandards andusing hasmadesignificantprogressgies. ASIAS indevelopinganalyti- common taxonomies anddefinitions,analyticalmethodolo- isfocusingitseffortsonthedevelopmentandadoptionof ASIAS Having developedanddeployedadata-managementframework, ize data-managementpracticesandaddress dataqualityissues. effective integrationofdatafrom multiplesources. ing anoperationalenvironment thatsupportstherapidandcost- to enhancetheanalyticalvalueofexisting datasources bycreat- Architecture (ADA).Theprincipalobjectiveofthestrategywas ing adata-managementstrategyknownastheAdvancedData addressed theseproblemspiece atatime.ASIAS byimplement- lysts are facedwithamosaicofdatathatcanonlybeviewedone base structures thathavelittleincommon.Asaresult, safetyana- make/model codes).Inaddition,thesystemsstore dataindata- values thatdonotconformtoanycommonstandard (aircraft are notgovernedbycontrolled vocabulariesandcontaindata ous organizations. Thesystemstypicallyfeature text blocksthat nature ofthedatasystemsthathavebeendevelopedbyvari- The European Aviation SafetyAgency, whichoperates productsThe ADREPtaxonomy hasadoptedCICTT through- The globalquerysearch canmineseveraldatabasesbyenter- By focusingonstandardizing key dataelementsinitially, like hasallowedtheFAAThe developmentofASIAS tostandard- istheheterogeneousA fundamentalproblem facedbyASIAS • ISASI 2007 ISASI Proceedings 70 a highdegree ofconfidencebecausethecommonstandard. Figure 3.Access toglobalquerysearch—by aircraft. The majorityofthesepredefined listsofincidents(ortaxono- always more totheaccidentthanjustasingleevent(Wood, 2006). initiating eventorevenakey factor inanaccident,butthere is them are precursors of accidentsbythemselves.Theymaybean added thatifweconsultthecurrent listsofincidents, noneof erly defined,shouldbeaprecursor ofafuture accident.”He also 2006,DickWoodDuring ISASI stressed that“anincident,prop- Development oftoolsforincidentanalyses are neededmore thanever. increase ofelectronic data.“Intelligent” classificationschemes dents. Thechallengeistoavoidbeingburiedbytheexponential ing numberofdatasystemsfortheirsearches ofsimilarinci- to havethesamemeaninginrespective systems. another (ortobecross-visible) andsafety data tems totalkone The effortsundertaken enablesafetyinformationsys- byCICTT combining informationtechnologiesandcommontaxonomies. connecting, forexample, U.S.andEuropean safetysystems,by like Studieshavedemonstratedthe feasibilityofinter- ASIAS. national orinternationallevels)bymakingtheminteroperable can bedonebyinterconnecting safetyinformationsystems(at collection andconsolidationoffactsduringaninvestigation.This Common taxonomies are enablingtoolsthatcan acceleratethe Interconnecting safetyinformationsystems Figure 4.Globalqueryandresults forBoeing737-800. notification. Thisverificationwouldbedoneelectronically Investigators soonwillhaveeasierandfasteraccesstoagrow- 1/14/2008, 9:43 AM 2 with 2 mies) deal with “visible” incidents. This means we already know what they are, their causal factors, and their solutions. Because they are generally isolated events caught by the redundant safety nets, they thankfully do not degenerate into accidents. There is a tendency to ignore them. The “real” precursor is a situation that is not “single error safe.” Consequently, it becomes crucial to better understand the safety nets of the system and their effectiveness in preventing accidents.

“Hard” and “soft” safety nets ECCAIRS allows investigators to record technical safety nets3 as well as to keep track of the failure of the expected function of these “hard” barriers. On the other hand, when analyzing incidents and human defenses, it is not yet possible to keep track of those factors that saved the day, such as a successful third-party Figure 5. Examples of “concept banks” applied to various text- intervention or the application of the relevant procedure. These based data sources. successful human interventions that prevented an incident from turning into an accident or minimized accident outcomes are This shifting from a reactive to a proactive focus is not new. For not currently uniformly recorded in databases, probably because example, it had been suggested in the following situations (Benner taxonomies illustrate the recent efforts in enhancing safety & Rimson, 1995): through the addition of technical safety nets like those available • To redirect data acquisition concentration from accidents (which SESSION 3—Moderator Alan Stray in the ADREP taxonomy. This is more in line with a reactive para- identify causes or operational failures) to incidents (which iden- digm where a safety net (a new system or regulation) is added tify both operational failures and successful recoveries). because of an accident, whereas the successful human interven- • To try to find answers to the question “What went right to tions have not yet been recorded in a standardized way through a prevent it?” instead of “What went wrong to cause it?” common positive taxonomy. • To acknowledge both the ubiquity of human error and the The aviation system has indeed achieved an impressive safety human capability to recover from errors. Redirect resources to- level across time by creating redundant systems and adding safety ward successful intervention processes that thwart accident pro- layers for prevention and mitigation. The “single error safe” sys- gression, thereby focusing on adaptation to error rather than tem started with the airplane itself. Much of the airplane design error perpetuation. criteria are meant to provide a redundancy wherein the failure of • To expand the focus of investigations to include positive factors. any system or part of a system does not lead to an accident (Wood, The positive factors mentioned more than 10 years ago are 2006). This concept has been extended to the other components included in the Terms of Reference of the “Positive Taxonomy” of the aeronautical system. The Airborne Collision Avoidance sub-team. System (ACAS), Minimum Safe Altitude Warning System (MSAW), Terrain Awareness and Warning System (TAWS), standard oper- New CICTT “concept banks” sub-team ating procedures (SOPs), and training are examples of “hard” Another major challenge faced by aviation safety analysts is the and “soft” safety nets that prevent accidents. However, the effec- extensive use of free text to capture important information re- tiveness of these safety measures is difficult to assess. Our safety lated to accidents and incidents. Simple facts, such as date, time, statistics are presently only using negative indicators, such as ac- operator, altitude, and location, are easily collected using struc- cident or fatality numbers. tured data fields. Acquiring a thorough understanding of what We need to develop an easy-to-use target taxonomy that would happened, how, and why, however, requires a subject matter ex- enable “rough” trend analyses of some key safety nets (both “soft” pert to interpret the narrative component of the report if there and “hard”) of the aviation system. Having better indications of are no structured data fields. Accident narratives can be lengthy the coverage of these safety nets should facilitate their monitor- and complex. Depending on the nature of an analysis, subject ing and should contribute to reinforcing the resilience of the aero- matter experts may be required to read thousands of reports. As nautical system. a result, a safety analysis can be a very time-consuming and expensive undertaking. New CICTT “Positive Taxonomy” sub-team One approach to addressing the free-text issue is to develop CICTT has chartered a sub-team to develop a “Positive Tax- text-mining concepts. A concept, simply stated, is a collection of onomy” that aims at better identifying the safety nets and assess- words that have been related to a subject. Concepts can be coming their effectiveness, with emphasis on the successful human bined to form complex concepts that include word strings and interventions. Human factors have generally been considered in use text-mining techniques, such as stemming and word proxim- relation to accident causes or as performance limitations. The ity rules, to assess the strengths of relationships among words. sub-team will— In a recent study using the concepts for automation and con- • consider the human factor as a safety factor, fusion, analysts were quickly able to search 5.4 million records to • record successful human interventions in databases, and identify 800 reports for further analysis. Figure 5 illustrates some • capitalize on positive taxonomy to increase the resilience of concept banks in relation with another study on Boeing 737 pres- the aeronautical system (Boudou et al, 2006). surization events.

ISASI 2007 Proceedings • 71

Proceedings 2007.pmd 71 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 72 vented anaccidentfrom occurring? 2. Was there equipment,adecision,and/orprocedure thatpre- 1. Whydidthisincidentnotturn intoanaccident? (Boudou etal,2006)couldalso beuseful: dent precursors. Thefollowing shortchecklistofquestions and couldhelpinaddressing thechallengeoffindingnewacci- tors shouldchangethewayoccurrences are beingconsidered tors (andsolutions)are alsoknown.Considering“positive”fac- Most incidentlistsdescribeknownoutcomeswhosecausal fac- by puttingmore emphasisoncauses ratherthanonconsequences. vestigators inclassifyingincidentsandAnnex 13seriousincidents The introduction ofa“Positive Taxonomy” couldhelpsafetyin- and impactAnnex 13 How taxonomies helpsafetyinvestigators should highlightthegapsandweaknessesofsystem. becoming accidentsbecauseofluck.Theseseriousincidents would bewellspenttoidentifyseriousincidentsthatavoided consistency totheinterpretation ofaseriousincident.Resources kind ofinvestigation(Reuss, 2006). is nearlyimpossibletospendasmuchtimeandeffortonthis tion ofanaccidentwithafataloutcome.Itisequallyclearthatit incident cancontributeasmuchtoflightsafetytheinvestiga- gated. Itiscleartoanyonethattheinvestigationofaserious incidents thatshouldbedefinedasseriousare investi- vestigate incidentsandseriousincidents.Nevertheless,notall thority. Eventheflightsafetydepartmentsofmanyairlinesin- ous incidentsare treated like accidentsbytheinvestigationau- reality beassessed15yearsafterAIG92?Insomecountries,seri- paved thewayforinvestigationofseriousincidents.Howcan circumstances indicatingthatanaccidentnearlyoccurred.” This was includedinAnnex 13anddefinedas“anincidentinvolving Divisional Meeting1992(AIG 92), theterm“seriousincident” be theoutcomeofthissiftingprocess. porting rules.Thisbringsupthe“seriousincidents”thatshould gate everythingthatmightbereported underthecurrent re- tion organizations donothavethetimeorresources toinvesti- (Del Gandio,2006).Thesetoolsare neededbecauseinvestiga- needle inahaystackthatmightreally beworth understanding....” creasing numberofreported occurrences inorder to“findthat incidents thatcometoourattention.”(DelGandio,2006). investigative andanalyticalskillstounderstandvisible,high-risk Chain”): “To dothisright,wewillneedtosharpentraditional 2006(“IncidentstoAccidents—Breakinging speechofISASI the address thechallengepresented president byISASI’s inhisopen- These sub-teamsare partofawidereffortthathasbeentryingto Better definingofa“seriousincident” proved trend analyses. merging theconceptbankswithinnewstructured fieldsforim- not operateacommonsafetylanguageyet.Anext stepcouldbe banks greatly helpsinexploiting thecurrent databasesthatdo trieval bytheaviationcommunity. Thedevelopment ofconcept and structure themwithinataxonomy thatwillfacilitateeasyre- is todevelopashareable collectionofconcepts(conceptbanks) Investigation authoritieshavestressed theneedtobringmore As aresult oftheICAOAccidentInvestigationandPrevention Braking thechainrequires havingtoolstosiftthrough thein- The objective of the CICTT Text-MiningThe objectiveoftheCICTT ConceptsTaxonomy • ISASI 2007 ISASI Proceedings 72 or another:Eitherbyentering dataorbyqueryingitforinvesti- Safety investigatorsare theend-usersofdatasystemsinoneway Roles ofsafetyinvestigators of theaviationsystem. consistent datatogivedecision-makers amore completepicture to haveaglobalandcommonapproach toultimatelyproducing which prevented accidents.Ifwegeneralizethisexample, weneed nets (thatis,positivefactors),suchastheuseofanotherlanguage, erations, thereporting systemsmustflagandrecord thesafety situation. To haveamore completepicture ofthereality ofop- standing onanon-nativespeaker from turningintoahazardous times whentheuseoflocallanguageprevented amisunder- fic. Insuchcases,ariskanalysisshouldalsotake intoaccountthe dio communicationsinareas withsignificantinternationaltraf- implementing thesystematicuseofEnglishlanguageforra- control, authoritiesinsomecountriesmayhavetodecideabout sion. For example, regarding thelanguageissueforairtraffic sion-makers inbetterassessingthepros andconsofasafetydeci- factors versusthe“usual”negativeones.Thisshouldhelpdeci- with a“safetybalance”thatwouldleveragethe“new”positive programs. Thepositivetaxonomy aimsatcompletingthistool goals iscommonlyusedbySafetyManagementSystem(SMS) The imageofabalanceleveragingproduction goalsversus safety Weighing theprosandcons ing focusfrom consequencestocauses gated indepth.Commontaxonomies are toolsthathelpinshift- injury thankstoluck,thentheoccurrence shouldbeinvesti- not highlightasafetynet,thatis,there wasnodamagenor nets. Ifforexample thefirstelementsofaninvestigationcan- would helpinassessingtheresilience oftheexisting safety ter assesstheresilience oftheoverallsystem. forthemedium/longterm,commonfieldsindatabasestobet- • questions. fortheshortterm,guidancematerialsuchasachecklistof • in September2008Montreal). Someproposals couldinclude— Prevention DivisionalMeeting(AIG 2008 tentativelyscheduled be discussedduringthenext ICAO Accident Investigationand would meananalterationtotheoverallframeworkthatshould tors classify, consider, investigate,andanalyzeoccurrences. It tions previously mentioned,wouldhelpanalystsandinvestiga- cult toobservethaneffects. tigated indepth.Itcouldhelpidentifycausesthatare more diffi- the occurrence couldbeconsidered aseriousincidentandinves- meaning thatnohumanpositiveinterventionwasidentified,then consequences appeartobemerely amatterofcircumstances, sifying anoccurrence asaseriousincident.Inotherwords, ifthe ousness oftheaccident/incident? 6. Was there anyhuman(positive)factorthatreduced theseri- 5. Are theresults ofthisoccurrence onlyamatterofcircumstances? survival? ing thathisenvironment (seat,seatbelt,etc.)contributedtohis ous? For example, ifapassengerisinjured, isitworthconsider- 4. Whatprevented theaccident/incidentfrom beingmore seri- 3. Inthecaseofanaccident,couldithavebeenmore serious? If wewanttobemore proactive, weshouldcollectdatathat The introduction ofsuchataxonomy, aswellthesixques- The answertothelastquestionshouldbeveryhelpfulinclas- 1/14/2008, 9:44 AM . gation or analytical purposes. They are instrumental as they col- and give new meaning to the expression information overload. lect and provide the facts on which the safety data is based. The technology to enable these capabilities is on the horizon. When the Annex 13 tools and resources are applied on serious However, if it is difficult to manage aircraft accident/incident re- incidents, safety investigations can explore more in-depth the ports, how will the information systems adapt to the new tech- causal factors with clear cause and effects relationships, especially nologies and their potential impact? How will value be derived from a human factors standpoint, because all actors survived and from the new data? How will analyses be conducted and new can recollect the circumstances of the hazardous buildup. More safety hazards identified? investigations on serious incidents shared through the existing The CICTT is addressing standardization issues by develop- ADREP framework could provide quality data, ideally data also ing an industrywide consensus as to what business rules and nam- recording the strengths and weaknesses of the system. ing conventions should be applied for key aviation descriptors The next step could be to combine incident, serious incident, and data elements. The long-term goal of this effort is the devel- and accident data to establish enhanced “reading grids” to better opment of a core universal aviation language that will maximize diagnose the risks. This can currently be done in hindsight. Fore- the industry’s capability to analyze and share aviation safety data sight capabilities are on the horizon if we all apply the same ap- and information. The CICTT is nearing the completion of the proach on serious incidents. Safety investigators could thus mine first phase of the effort and will be moving on to subsequent more similar incidents (precursors?) and build up complete and phases. ◆ convincing safety cases powered by more and better data. With more and more documents in electronic format and numerous References reporting systems, there is a great potential for enhanced tools Benner, L., Rimson, I.J. (1995). Paradigm Shifts Toward Exploiting Success- ful Human Factors Intervention Strategies to Prevent Aircraft Accidents. (based on common taxonomies) having foresight capabilities. In Proceedings of the Workshop on Flight Crew Accident and Incident Human The safety investigators who provide the facts and data that

Factors, June 21-23, 1995, McLean, VA. Office of System Safety. Washing- SESSION 3—Moderator Alan Stray will ultimately feed these analytical tools should be involved in ton, D.C.: U.S. Federal Aviation Administration. Boeing Commercial Airplanes (2006). Statistical Summary of Commercial Jet these expanding new activities. Participation in the newly founded Airplane Accidents—Worldwide Operations 1959-2005. Seattle, WA. international working groups is more than welcome from both Boudou, B., Pouliquen, Y., Ferrante, O. (2006). Towards a Human Factor industry and government representatives. The challenge consists “Positive” Taxonomy for Occurrence Analysis. In, Proceedings of the Interna- tional Conference on Human-Computer Interaction in Aeronautics, HCI-AERO, of jointly developing a universal set of simple tools, accepted and pp. 48-55, September 20-22, 2006, Seattle, WA. Toulouse, France: Editions used by all for data-driven prevention. CICTT could ultimately Cépaduès. have an impact on the investigation framework if supported by Del Gandio, F. (2006). Welcome to ISASI and Cancun. ISASI Forum. Vol. 39, No. 4, p. 3, October 2006. the various stakeholders, especially by ISASI and its members. International Civil Aviation Organization. (2001). Annex 13 to the Convention on International Civil Aviation—Aircraft Accident and Incident Investigation (9th Conclusions Ed.). Montreal, Quebec, Canada: Author. Menzel, R. (2004). ICAO safety database strengthened by introduction of Taxonomies have evolved in line with the scope of investigations new software. ICAO journal, Vol. 59, No. 3, pp. 19-26, May 2004. (technical failures in the 1950s/1960s, human failures in the 1970s/ Reuss, J. (2006). Incident Investigation: A Diversion of a Boeing B-747 Re- 1980s, and organizational failures in the 1990s). Failures are tied sulting In a Serious Low-Fuel Situation. In, Proceedings of the 37th Annual International Seminar “Incidents to Accidents-Breaking the Chain,” pp. 66-69, to accidents. As we are moving toward incident investigations, Cancun, Mexico. Sterling, VA: ISASI. why not have successes tied to incidents? Wood, R. (2006). Defining and Investigating Incidents. ISASI Forum. Vol. The rise of the Internet and powerful databases like Google 39, No. 4, pp. 14-17, October 2006. have been under exploited for accident and incident investigations. The resources offer promising safety prospects if every- Related websites body shares the same safety language and if taxonomies are tran- ASIAS: http://www.asias.faa.gov scribed into user friendly tools. The efforts already undertaken CAST: http://www.cast-safety.org by CICTT enable safety information systems to talk to one an- CICTT: http://www.intlaviationstandards.org other and safety data to have the same meaning in respective ECCAIRS: http://eccairs-www.jrc.it systems. This common taxonomy is an indispensable tool to define common safety issues and complementary ways to globally Endnotes 1 Throughout this document, “taxonomy” is defined as a classification scheme enhance aviation safety. of keywords and definitions. It can also be considered the “safety language” Looking into the future, emerging information technologies of information systems. will greatly improve our ability to collect data but, at the same 2 See the minutes of the Ninth ECCAIRS Steering Committee meeting (Pettenasco, Italy, October 19-20, 2006). http://eccairs-www.jrc.it/ time, make it even more difficult to conduct safety analyses. SteeringCommittee/1920October2006/Default.htm This is because the data management environment is simply 3 Dedicated fields are available in the ADREP 2000 taxonomy for the not equipped to handle an exponential growth of data. For ex- following: —GPWS/TAWS (CFIT section in ECCAIRS): Ground Proximity Warning ample, low-cost, sensor-equipped processors are starting to be System/Terrain Awareness and Warning System deployed on everything from aircraft parts to produce in the —STCA (ATM Unit section, attribute 380): Short Term Conflict Alert grocery stores. These sensors can measure and regularly report —MSAW (ATM Unit section, attribute 370): Minimum Safe Altitude Warn- ing System various attributes such as locations, performance factors, or —APWI (ATM Unit section, attribute 364): Area Proximity Warning Infor- environmental conditions that are of interest to us over wireless mation networks. A single airliner equipped with thousands of these —A-SMGCS (ATM Unit section, attribute 367): Aerodrome Surface Move- ment Guidance Control System low-cost sensors could report various parameters every second. —ACAS/TCAS alerts (Separation section, attribute 563): Airborne Collision A fleet of these aircraft could generate terabytes of data per day Avoidance System / Traffic alert and Collision Avoidance System

ISASI 2007 Proceedings • 73

Proceedings 2007.pmd 73 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 74 aircraft wreckage was discovered inadensejunglearea. tion search forthe GOL,andbytheendofsecondday and rescue systemwasputintoaction.There wasa communica- Legacy aircraft were notinjured. Base. Thetwocrewmembers andfivepassengersonboard the lizer andperformedanemergency landingatCachimboAirForce experienced damagetotheleftwingandhorizontalstabi- forces; all154occupantswere fatallyinjured. TheLegacyN600XL miles southeastofCachimboAirForce BaseinBrazil. collided inflightovertheAmazonrainforest approximately 100 by Excelaire ofLongIsland,N.Y., initsdeliveryflighttotheU.S., Embraer Legacy600businessjet,N600XL,ownedandoperated 737-800, PR-GTD, operatedbyGOLAirlinesofBrazil,andan On Sept.29,2006,at19:56.54UTC,arecently purchased Boeing History air accidentthatoccurred inBrazilonSept.29,2006. Stoss liminary findingsandrecommendations, duringthemajormid- zil, theUnitedStatesofAmerica,andCanada,includingitspre- Pellegrino This paperpresents thehistoryofcooperationbetween Bra- Introduction Ferreira Nick Stoss. William English. [email protected] Carlos EduardoMagalhãesdaSilveiraPellegrino. [email protected] José MounirBezerraRahman. e-mail: [email protected] Brazilian Aeronautical Accident InvestigationCommission(CENIPA). Col. Rufino AntoniodaSilvaFerreira BRA; CarlosEduardo MagalhãesdaSilveiraPellegrino (Col,Ret.), CENIPA-BRA; William English(Accredited By RufinoAntoniodaSilvaFerreira (Col.),CENIPA-BRA; Rahman(Col,Ret.), JoséMounirBezerra CENIPA- In accordance with internationalrulesandBrazilianproce- theBrazilianAirForceJust aftertheaccidentoccurred, search The Boeing737wasdestroyed byinflightbreakup andimpact • ISASI 2007 ISASI Middle AirCollisionOverBrazilian e-mail:[email protected] Skies—A Lesson toBeLearned Skies—A Lesson Representative), U.S.NTSB; andNickStoss(Director ofAirInvestigations),CanadianTSB Proceedings e-mail:[email protected] 74 e-mail: isthepresident ofthe e-mail: sued toinvolvedparties. in July 2007.Sincethattime,recommendations havebeenis- investigation. Thenext meetingoftheCommissionwilltake place Commission metonlyoncein2006todefinethemaincourseof Traffic Control SystemCommandCenterlocatedinVirginia. The gators were invitedtovisittheFAA NewYork ARTCC andtheAir the accident.Insameway,contributing factorsto theinvesti- still remains. Theywerethat theremany exposed were tothefact facilities, Embraer, andCachimboAirForce Base,where N600XL found it. BythemiddleofNovemberthey very lastpieceoftheCVR. of BrazilianArmyminesearchers wentintoactiontofindthe find theCVRandDFDRofPR-GTD wasmade.Theteam at theTSBlaboratory. Duringthefollowingdays,aneffortto N600XL CVRandDFDRwere thefirstboxes sentforreadout with theCanadianTransportation Safety Board (TSB).The Rio deJaneiro onOctober2ledbyWilliam English. National Transportation SafetyBoard at (NTSB)teamarrived as stateofmanufacture andstateofregistry wasmade,andthe dance withAnnex 13,thefirstcontactwithAmericanauthorities, Ferreira wasappointedastheinvestigator-in-charge. Inaccor- same dayoftheaccident,andCol.RufinoAntoniodaSilva dure, theAccidentInvestigationCommissionwascreated onthe ing asafetymentalityinmind, theBraziliansafetysystemisnow offices tosupportFAR 135companiesandFAR 91owners.Hav- the FAR 121companysupervisorforsafety. Ithassevenregional where standards, instructions,andthetrainingare directed. It is vention (CENIPA) isthesystem’s centraldecision-makingbody safety recommendations. place blameintoanefforttoward accidentprevention through evolved, thefocusofinvestigationsevolvedfrom anattemptto main goaltostriveforsafetyandaccidentprevention. Asit 11, 1965,whenthestructure wasmodifiedinorder tochange the sibilities. Itwasimproved bydocument Number57055from Oct. tem thatwasbasedinInquires toappointculpabilityandrespon- ian laws. rences inaccordance with ICAOAnnex 13andsupported Brazil- responsible formanagingbothcivilandmilitaryaviationoccur- and InvestigationofAeronautical AccidentsSystem),anditis Investigação ePrevenção deAcidentesAeronáuticos (Prevention The BrazilianSafetySystemiscalledSIPAER—Sistema de Brazilian structureofinvestigationprocess The investigatorsoftheCommissionwere abletovisitallATC The coordination ofCVRandDFDRreadout wasarranged The CenterofAeronautical AccidentInvestigationandPre- It wascreated in1951 order toreplace theoldmilitarysys- 1/14/2008, 9:44 AM looking for contributing factors instead of causes. The search is sible for the investigation of all aviation occurrences in Canada, called factors and it’s divided into three main areas: operational for representing Canadian safety interests in foreign factor, material factor, and human factor. The last one is also investigations involving Canadian-certified aviation operators and divided into human factor physiological aspects and human fac- products, and for providing investigation support to foreign in- tor psychological aspects. vestigations when requested to do so. Specific to this investigation, We consider that all accidents and incidents are not caused by the TSB provided advice on major investigation management and one main cause but by many situations linked together, so that investigation methodology, TSB Engineering support in the areas one by one these links will contribute to an irreversible point of of CVR and FDR readout and analysis, as well as flight operations the occurrence. There is no measure or comparison between the and air traffic services operational and investigation expertise. In contributing factors. All factors should be fully covered with a accordance with ICAO Annex 13, Section 5.23, the TSB appointed deep evaluation in order to find solutions to reduce or remove an accredited representative and assigned another 11 technical the level of risk, preparing defenses for expected and unexpected advisors (investigators) to this investigation. human errors and to identify and correct potential or latent organizational problems and material failures. The accident history From another angle, the use of contributing factors reports Events related to the accident started to build up some days prior. makes more difficult the use if applied to other purposes rather The Excelaire crew arrived at São José dos Campos on Septem- than safety since there is no appointed main problem. The crimi- ber 25 to perform the acceptance flights on the brand-new nal process normally looks for a main cause or reason that will Embraer Legacy. The crew flew three flights, and a number enable the authorities to find one person or a group to blame. of items had to be corrected by Embraer. By the end of Thurs- day, Sept. 28, 2006, Embraer had corrected all discrepancies, NTSB structure to support the commission and Excelaire agreed to accept the airplane. SESSION 3—Moderator Alan Stray The National Transportation Safety Board is an independent fed- September 29 started with a celebration at the Embraer plant— eral agency charged by the U.S. Congress with investigating ev- it was the formal delivery party. The flight to the United States ery civil aviation accident in the United States (and significant was to depart just after the event. Because the flight from Brazil accidents in other modes of transportation), issuing safety rec- to the United States required one, enroute stop, the crew decided ommendations aimed at preventing future accidents, and dis- to stop at Manaus. One Embraer employee was flying with them charging the accident investigation responsibilities of the United to be the tour guide. To expedite the process, Excelaire asked States in accordance with ICAO Annex 13 for accidents that oc- Embraer for support to file and send the flight plan from SBSJ cur outside U.S. territory. As the U.S. is the state of manufacture (São José dos Campos) to SBEG (Eduardo Gomes, Manaus). This of the Boeing aircraft and Honeywell/ACSS avionics equipment, flight was performed under RBHA 91 (very close to FAR Part and the state of registry of the Legacy, the NTSB named 91). The proposed flight plan called for a route from Poços de an accredited representative and technical advisors. The accred- Caldas, FL370, until Brasilia VOR, then a flight level change to ited representative, per normal NTSB procedure, is an investiga- 360 until Teres interception, then a flight level change to 380 tor-in-charge from the Major Investigations Division, and coinci- until SBEG. This was because the airway from Brasilia VOR, UZ6, dentally had extensive ATC experience, including serving as a is bi-directional. technical advisor on the Ueberlingen, Germany, midair collision At the same time, at SBEG, the GOL 1907 crew was preparing in 2002. Advisors from the NTSB who traveled to Brazil initially the flight to Brasilia. By the filed company flight plan, the crew included investigators specializing in operational factors (airman was supposed to fly at Flight Level 410. During the preflight activity, training, and certification) and airworthiness (aircraft checks, the second-in-command (SIC) contacted Manaus Clear- systems). ance Delivery and asked to fly at 370. It was accepted. This flight Technical advisors from other parties—the Federal Aviation was performed under RBHA 121 (very close to FAR Part 121). Administration (FAA, regulatory authority) and Boeing—also ac- The N600XL crew initiated the refueling of the aircraft and companied the accredited representative. Additional technical performed initial checks but no flight plan was provided to them. advisors assisted the accredited representative on subsequent meet- At the very last minute, it arrived just in time for the SIC to insert ings in Brazil and during activities in the U.S. NTSB investigators the data into the FMS. in human factors, air traffic control, CVR, FDR, and aircraft per- At 1751Z, the N600XL took off from SBSJ to SBEG. The ATC formance assisted the accredited representative and appropriate clearance presented to the crew was understood as FL370 direct CENIPA group chairmen. Additionally, advisors from Honeywell to Eduardo Gomes (SBEG), without following ATC rules in pro- (manufacturer of transponder, radios, and associated control equip- viding clearance limits. They performed the Oren SID with sev- ment), ACSS (manufacturer of TCAS), and Excelaire (aircraft op- eral intermediate restricted flight levels. At 1833Z, the N600XL erator) participated. Further assistance was provided by the FAA reached FL370, which was maintained until the collision, pro- Air Traffic Organization, providing familiarization briefings and ceeding north-northwest along airway UZ6. visits at U.S. ATC facilities for the CENIPA investigators. At Eduardo Gomes, the 1907 took off at 1835Z and reached Flight Level 370 at 1858Z, proceeding south-southeast also TSB structure to support the commission on the UZ6 airway. Inside the Brasilia area control center (ACC- The Transportation Safety Board of Canada (TSB) is an indepen- BS, also known as CINDACTA1), sectors 7, 8, and 9, on the dent agency created to advance transportation safety through the north of the FIR were grouped together at ATCO console Num- investigation of occurrences in marine, pipeline, rail, and air modes ber 8 because there was little traffic at that period of the day. of transportation. The Air Branch of the TSB, in part, is respon- There was only one controller at the console, and the number

ISASI 2007 Proceedings • 75

Proceedings 2007.pmd 75 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 76 the eventofanaccident:one forcriminalpurposesandanother knowledge tofindtherightanswers. have different missionsbutwiththesameobligation tousetheir correct answer. Sothere are twodifferent groups ofexperts that lated tothetragicevent,butallofthemhavearightexpect a is responsible? mediately comeforward. First, whatwasthe cause? Second,who Each timethatanaeronautic accidentoccurs,twoquestionsim- Management ofjudicialprocessrequests Cachimbo AirForce base. code changedto7700at2002Z.N600XLlandedsafely at transponder transmissionontheoriginallyassignedcode. The the lackofradiocommunicationwasprovided. control information ontheN600XLtraffic.Noinformationabout times tocontactBrasiliaACCwithoutsuccess. understand completely. that,N600XLtriedseven After more to contacttheAmazonicCenteratsomefrequency hecouldnot the BrasiliaACCcallinblind.Thecontroller askedthe crew calls ontwofrequencies; however, noresponse wasbroadcast. quency listed.TheATC recorder captured the pilot’stentative Following theJeppesen chart,thecrew triedtwiceforeachfre- ler madesevencalls,butnoreplies were recorded. the airplanewasabout220milesnorthofBrasilia.Thecontrol- route. ATCO changethecleared flightleveltoreflect thatfortheentire label. SincetheATCO describedtheN600XLasFL360,new plan altitudethatchangesautomaticallyattherightsideof a feature, anautomaticlabelchange.Itistherequested flight flight levelofN600XLtoFL360.TheATC software provides, as bined sector7,8,and9.ThenewATCO changedtheassigned did nottake anyaction. altitude, butinsteadshowedtheRadar3Daltitude.TheATCO screen associatedwithN600XLnolongerdisplayedamodeC played normaltransponderreturns. Theaircraft labelonthe area ofmanyradarsites,andallotheraircraft inthearea dis- ATC radar, althoughtheairplanewaswellwithincoverage ceiver sitewaslocatednearBrasilia. N600XL wastheonenormallyusedforsector9,andtrans- had onlyfiveaircraft tocontrol. Theradiofrequency assignedto to N600XL. of BrasiliaVOR. Nofurtherinstructionsfrom ATC were issued they were underradarcontact.Theaircraftsouth 4 minutes was crewmembers were cleared tomaintain FL370andadvisedthat and theBrazilianACCwasestablishedat1851Z.The more thanone. of ATCOs availableinthefacility atthattimedidnotsupport In Brazilian law, two processes are simultaneously openedin All peopleinvolvedhavedifferent relations andinterests re- At 1959ZtheAmazonicCenterstartedtoreceive theN600XL At 1956:54Ztheaccidentoccurred. The BrasiliaATCO contactedtheAmazonicATCO topass Three minutes priortotheaccidentcrew ofN600XLheard attempted tocallBrasiliaACC. At 1948z,thepilotofN600XL The relieving ATCO startedtocallN600XLat1926z,when At 1915Z,achangeofATCO occurred, stillworkingthecom- At 1902Z,theN600XLtransponderwasnolongerreceived by As N600XLpassedBrasilia,theATCO onconsoleNumber8 The lastbi-directional radiocontactbetweentheN600XLcrew • ISASI 2007 ISASI Proceedings 76 the linebetweentwoefforts andconfusesthepublic the accidentinvestigationbutused forlegaldefensepurposesblurs in theU.S.onthiscasebecause ofthethreat ofprosecution. answer forthis.We foundagreat dealofdifficultywhenworking least willtainttheirinformation.Unfortunately, there isnoeasy accident from cooperatingwithasafetyauthorityoratthevery that thecriminalthreat willprevent somepeopleinvolved inthe acknowledge thechallengethatwehaveencountered firsthand nal liability. lel withorganizations responsible fordeterminingpotentialcrimi- accident investigatorswillbeworkingtoward ourgoals inparal- Ueberlingen collision,letsusknow, innouncertainterms,that world, suchastherecent trialsinEurope stemmingfrom the unbiased safetyinvestigation. ecution directly influencetheabilitytoconductathorough and ity; wehaveseenthechillingeffectofthreatened criminalpros- investigation asyouhavealready seenisafact. and trainingrecords, madepublicinthecourseofcriminal by theaccidentinvestigators,suchasradardata,CVRtranscripts, avoid takingontheriskofthreat ofprosecution. involved refuse tocooperatewithasafetyauthorityinorder to how tochangeinthemiddleofreality where thepilotsandATCOs of ourpractices.Butthechallengethatwehaveencountered is gation havelongconsidered thatwemightneedtochangesome analysis were notdisclosed. Annex 13, 5.12,inthatpartsoftherecords notrelevant tothe Brazilian AccidentInvestigationCommissionstrictlyfollowed The onlythingtodowasaccomplishtherequest. Howeverthe the CVR(cockpitvoicerecorder) andFDR(flightdatarecorder). liminary reports from bothorganizations, transcriptionsfrom both DECEA (BrazilianATC Department)materialincustody, pre- police inquiryallmaterialunderguard ofCENIPA, including accident investigationcommissionrelease tothepresident ofthe a federal judge.Thejudgerequired that,within48hours,the OF/GABJU number240/2006from November13signedby to refuse thejudicialdeterminationspecifiedbydocument able situationastheydon’t haveanykindofprotection orright number ofcountriesaround theworld. termine specificcriminalliabilitycouldbethesameinalarge unique toBrazil.Thegreat socialandpoliticalpressures tode- sure oftherecords. Itisimportanttonotethisnotnecessarily state conductingtheinvestigationanddeterminingdisclo- the appropriate authorityfortheadministrationofjustice lives are affectedforever. when 154 direct lossesare involvedandhundreds ofpeople’s be affected bythecriminalprocess. Thisisparticularlydifficult stand howimportantitisforairsafetyinvestigationsnot to tect therecords from theinvestigationprocess. been successfullydealingwithjudicialauthoritiesinorder topro- one forsafetyprevention. In mostcases,the investigators have Additionally, theappearance ofdocumentsmadebypartiesto We mayneed tochangesomeofourpractices,andwemust The eventsoverthepastyearinBrazil,andothersaround the This accidenthasbrought allthetheoretical discussiontoreal- The release ofagreat dealofinformationnormallycontrolled The Brazilianauthoritieswithabackground insafetyinvesti- Brazilian accidentinvestigatorshavenotbeeninacomfort- Section 5.12ofICAOAnnex 13coversthereal possibilityof All personnelinvolvedintheaviationsafetybusinessunder- 1/14/2008, 9:44 AM aviation industry. Such documents or other information releases aircraft were continually in flight over the jungle to discover any that may bear a resemblance to accident files, findings, or reports, sign of life. and include some technical information typically associated with By the middle of the following week, the full impact of the disas- air safety investigations may in reality only include those facts sup- ter came over the nation. It was hard to measure the sadness. portive of a particular side in a legal case, or be grossly misunder- The airline and the civil aviation authority put the family sup- stood and misinterpreted by non-technical persons. port plan into action. A hotel at Brasilia was selected to be the Criminalization directly affected the information gathering ef- headquarters of the support. Health, psychological, and religious forts of the investigators. For example, the flight crew of the Legacy support were given to the families. had not been interviewed by trained aviation accident investiga- At the crash site, an Air Force command and control center tors since the early days after the accident. As the team developed was created. Several aircraft were used to support the operation. more information, it was important to have a thorough discussion It took a month to find the CVR and the DFDR of the 1907. with the crew and the operator. Both the pilots and the operator In the mean time, there was the election of the president of expressed a great desire to cooperate with safety investigators yet Brazil. The media used the accident history to change the poll at the same time had a very realistic fear that their words would be output. It tried to show the budget reduction on the ATC was used against them in court. Because the accident occurred outside due to restrictions of the current president. the U.S., the NTSB had no authority to issue subpoenas and com- The families of the accident victims were flown to the crash pel the crew and company to cooperate. Months after the acci- site. For them it was the last goodbye. dent, after the crew had returned to the U.S., NTSB investigators For the recently created civil aviation authority (ANAC), the and legal staff spent many long hours working with Excelaire and accident was the worst-case scenario. There was a great deal of its legal representatives to come to a workable solution to have miscommunication with the media. thorough crew interviews, and an examination of the operators Currently the ANAC has a plan to be activated on these SESSION 3—Moderator Alan Stray facility, records, and practices. In this case, the Excelaire legal team events. It is based on ICAO Annex 17 and covers all aspects of decided that the risks of having Brazilian government personnel an accident. involved firsthand were too great and asked that only U.S. govern- The pressure of the nation wide commotion drove both the ment personnel conduct the interviews. criminal and safety investigation. This, of course, made it difficult for the Brazilian Investiga- tors, as questions prepared in writing are never as desirable as a U.S.-Brazil cooperation firsthand discussion. In a similar vein, proposed interviews and Immediately after learning of the accident in Brazil, the NTSB data gathering activity at the main training vendor, Flight Safety realized that we would be involved via our Annex 13 responsibili- International, were also prevented due to fear of prosecution. At ties in a very complex manner. NTSB investigators participate first, FSI was open to the investigative activities, but later refused very often as representatives of the state of manufacture, particu- to cooperate with either Brazilian or U.S. investigators to pro- larly with Boeing aircraft, and the large U.S. engine manufactur- vide interviews with relevant instructors, or documentation of the ers. However, this accident investigation would quickly prove a Legacy crew’s training. It is an interesting aside that the requested more unique situation as it was the first time in many years that a flight crew training documents did turn up in court papers filed major accident occurred outside the U.S. involving a U.S. opera- later on. tor. At the first word that the accident might have been a midair We also must understand that our attitude about what is impor- collision, and that the airplanes were both very new and techni- tant for safety may be different from what a prosecutor may be cally advanced, we realized that there might be a question about looking for. In May of 2007, the NTSB released a recommenda- collision avoidance equipment, so the U.S. was now also the state tion about cockpit warnings for loss of TCAS or transponder func- of manufacture of a major component of interest, namely the tion. To readers with an air safety mindset, we reason that a mes- transponder and TCAS. sage that is not easily seen or responded to is an avenue for a safety An investigation team was formed and traveled to Brazil dur- improvement. Prior to this accident, the loss of TCAS functional- ing the next days. Three NTSB investigators, and representa- ity was not considered a flight-critical item; but with the knowl- tives from the FAA and Boeing traveled immediately and repre- edge gained in the investigation, we recommend that the operat- sentatives from Excelaire, Honeywell, and ACSS provided sup- ing status is important enough to warrant a more robust warning. port from home. The U.S. and Brazil have a long history of However, the very same information from a point of view that re- working together in accident investigation, as of course both na- quires finding a responsible party could imply that the responsible tions are home to major airframe manufacturers. However, quite person was not diligent or missed something he shouldn’t have. early on it was recognized that this accident was going to be very We are seeing the same types of differing opinions on how ATC different. By the time the U.S. team had arrived in Brazil, the issues are involved in the accident. At the time of this writing, the criminal inquiry had opened, and the U.S. pilots had been pre- criminal and congressional inquiries in Brazil are pointing toward vented from leaving the country. ATC lapses and focusing also on identifying a responsible person As previously mentioned, it was difficult to conduct a safety or persons, rather than evaluating safety issues. investigation during an ongoing criminal investigation, and the effects began to be noted right away. National commotion during hard transition times The first complication was with access to the flight crew of the The accident was a nationwide event. A total of 154 lives were Legacy. As U.S.-certificated airmen, it was imperative that the lost in the middle of the Brazilian rain forest. The first days started U.S. team gather all possible information on the crew, including with the hope that survivors could be found. The Brazilian SAR background experience, training, and operational knowledge of

ISASI 2007 Proceedings • 77

Proceedings 2007.pmd 77 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 78 forcing assumptionsaboutwhat thecrew oftheLegacy wassup- information mayhavehadthe unintendedconsequenceofrein- lost, methodsofhandingoff data blocksandcoordinating ATC play ofsearch radar3-D feature whentranspondermodeCis controller assumptionsabouttheflight. together withjustthewrong timingtoreinforce someerroneous example, numerous features oftheATC software mayhavecome revealing manysafetyissuesthatare stillbeingexamined. For tem. Brazilian,U.S.,andCanadianATC experts cooperatedin 4 furtherclarifiedtheeventsthatoccurred withintheATC sys- ATC information,andfurtherteamvisitstoCINDACTAs 1and gation process, theinvestigativeteamwasabletoreview some understanding howthisaccidenttookplace.Earlyintheinvesti- time withnocommunicationisalsoanindicator.] checks. [Note—Thelackofawareness oftheextreme lengthof plan duetoaninefficientsharingoftasksduringthepreflight ICAO rulesastheyneverdiscussedpreviously togethertheflight they demonstratedmore thanoncealackoffamiliarizationwith by theN600XLcrew duringtheflight.According totheCVRdata, important tonotethelowlevelofsituationalawareness displayed issue isuncovered itcanbequicklyactedupon. cleared upinthemindsofindustry, orconversely, ifasafety ing factsoftheaccidentintheirproper context, questionscanbe clear example ofonerole ofthesafetyinvestigation—by expos- of whatisexpected ofthemselvesandtheotherside.Thisisa that bothsidesofthemicrophone havethesameunderstanding cepts mustbequicklyunderstoodbyflightcrews. Itisimperative differences from ICAOguidance)basicATC clearances andcon- 11, andintheICAO4444,(BrazilianATC procedures havefewer procedures intheU.S.,andthosedescribedICAOAnnexes 2, confusion. While there are numerous differences betweenATC the aircanbeeasilymisinterpreted bylaymenandcreates how thecomplex interrelations ofATC procedures andrules of struction. Thisisofcoursenotthecase,butitclearlyillustrates mal conditions,changecruisingaltituderegardless ofATC in- change ofaltitudeintheICAOflightplan. expectation ofcrew actionswhentheyhadfiledforanenroute they shouldbeaware of.Onespecificexample hadtodowiththe procedure orofexpectation intheATC systemofBrazilthat the media,begantowonderifthere were somedifferences of ments, andknowingnothingotherthanwhatwasreported in thority andwere widelyreported inthemedia. and flightprocedures were made bypeopleinpositionsofau- the judicialinvestigation,manystatementsthatdealtwithATC flight crew relates toATC procedures. Early on inthecourseof the operatingenvironment, mainlyATC, andthewaythat had already intervenedandpotentiallyinfluencedthecrew. must betimelyanddetailed,butinthiscase,thejudicialactivities they were inBrazil.Effectiveinterviewsofsurvivingcrewmembers would beinadvisablefortheteamtointerviewcrew while governments, andthepilots’legaldefenseteam,decidedthatit and controversy from thejudicialproceedings, officialsfrom both international flying.However, duetothehigh levelofattention Automatic updatingofcleared altitudeinthedatablocks,dis- Clearly, ATC issuesare oneimportantandrelevant pointto As wehaveseen,noaspectofanaccidentexists alone—itisalso Initial statementsimpliedthatflightcrews should,undernor- Pilots intheU.S.andelsewhere were confusedbymanystate- An additionalcomplication,andonestillpersisting,involves • ISASI 2007 ISASI Proceedings 78 extensive inputtoensure thetestplanswere ascompleteand the FAA, Embraer, Excelaire, andtheavionicscompaniesallhad an integratedbenchtest.Investigators from CENIPA, theNTSB, workedHoneywell andACSS togetherformonthstoconstruct to notehowdeeplythetestplanswere designedandexecuted— vertent entriesmightleadtotheobservedresults. Itisimportant and FDRdata,todeterminewhatscenariosforpossible inad- tenance logsrecorded withintheunits,andcorrelated withCVR cation recordings, and internalevidence,suchasfaultmain- the outsideevidence,suchasATC radarrecords andcommuni- tion wasasdesigned.Separateplanswere developed,basedon tery ofteststoconfirmtheactualelectronic andmechanicalfunc- tion—first, theavionicscomponentswere runthrough afullbat- haustive testplanswere developedtoexamine twolevelsoffunc- more detailed benchtestinglateron.Further detailedandex- at Cachimbo,andthepertinentcomponentswere removed for investigators were usedfortesting“onwing”intheairplanewhile oped amongEmbraer, andCENIPA Honeywell,ACSS, andNTSB werement units),andTCAS extensively tested.Test plansdevel- transponder units,control heads(calledRMU,orradiomanage- critical avionicsequipmentfrom theLegacyairplane.Radioand and U.S.investigativeteamsregarded theexamination ofthe than 12draftrecommendations regarding ATC. ATC investigatorsworkingonthisissuehavecollaboratedmore cedures betweenATC sectors.Atthetimeofwritingthisdraft, of transponderorradarcontact,andhandoffcoordination pro- occurred intheCINDACTAs—lost communicationprocedures, loss Center, andatFAA headquarterswithaneyetoward theissuesthat York AirRoute Traffic Control Center, theATC SystemCommand ine real-time operations,andobtaindetailedbriefingsattheNew FAA, Brazilian,U.S.,andCanadianinvestigatorswere abletoexam- dent, theteamalsoexamined U.S.ATC facilities.Thankstothe technology, training,andprocedures were applicabletotheacci- diture; theyonlyrequire arobust setofprocedures andtraining. outlets. Noneoftheseconceptsrequires great outlaysinexpen- as crossing restrictions downstream oruseofrelays through other of transceiversites,issuanceclearancesincludingsuchitems cation coveragecanbeaccountedforbyappropriate allocation mates, andsuspensionofRVSM.Gapsindirect radiocommuni- dures, suchasobtainingpositionandaltitudereports, timeesti- radar return issimplydealtwithbyuseofnon-radarATC proce- tations inthetechnology. For example, lossofatransponderor system mustuseestablishedconceptsfordealingwithknownlimi- perfect coverageofradio-basedequipmentisunrealistic—but the dures andtrainingusedbyATC. To imaginethatthere shouldbe gation, andlaterradarhavebeenpartparcel oftheproce- traffic control began,limitationsinradiocommunications,navi- This isagreat misunderstandingofhowATC operates.Sinceair speculation aboutso-called“blackholes”intheBrazilianairspace. not theonlypartofATC storyeither. There hasbeenmuch anomalies robust, clear, andwidelyunderstood?Technology is the technologywillreact? Are theprocedures fordealingwith sponder, dotheusers—thatis,ATCOs—truly understandhow stand howwelltheusersunderstandit. stand thetechnologybehindasafetyissue,butalsotounder- posed todo.Itisimperativethatinvestigatorsnotonlyunder- Further coordination andcooperationbetweentheBrazilian In supportingtheefforttodeterminejustwhatfeatures ofATC When ananomalyoccurs,suchasthelossofLegacy’stran- 1/14/2008, 9:44 AM accurate as humanly possible. In order to develop meaningful ment with this investigation came to the TSB as a rumor through and relevant safety information, test plans for such complicated the media. TSB’s initial reactions were to confirm the rumor by systems as modern “glass cockpit” avionics must include all of contacting the DIPAA directly and through the NTSB, and to the available evidence—it is not sufficient to simply get in a cock- determine whether TSB had the required technical equipment pit and push buttons! False results leading to inappropriate re- to read out the recorders on board both aircraft, and if we had sponses could lead to dangerous, unintended consequences. In the capacity to take on the addition workload. our case, the results of months of planning and testing found no TSB planning also considered the fact that if the TSB was re- mechanical, electrical, or software problems with the avionics quested to read out the recorders, Canada, under the provisions of components. An NTSB cockpit voice recorder group created an Annex 13 Section 5.23, would be entitled to accredited representa- English language content transcript of the Legacy CVR, then tive status in this Brazilian investigation. Of greatest importance careful correlation of the CVR and ATC background audio re- was the fact that the TSB would be able to properly protect all vealed no failures or inadvertent entries in the VHF communica- investigation information to which it was given access, in particu- tion systems. By comparing the ATC-pilot communications with lar the CVR, DFDR, air traffic recordings, and witness testimony. a chart of the radio frequency coverage in the area, it was clear Also, the most important principle for the TSB was that this that the Legacy pilots did not change frequency inadvertently was an investigation being conducted by the DIPAA, that all our and stayed on the last assigned frequency until they had flown work would be conducted under the direction of the DIPAA IIC, beyond the range of the transceiver site. All equipment was work- of course respecting Canadian laws, as well as TSB legislation, ing properly—within its expected limitations. Thorough testing policies, and investigation principles. of entries into the RMU and other inputs revealed no undesired results from entry combinations—no “bugs” or undocumented TSB reaction to CENIPA request for support “features.” After that, we were left with nothing but the possibil- This preplanning was very valuable because, when the TSB re- SESSION 3—Moderator Alan Stray ity of an inadvertent, physical selection of an undesired mode ceived the official request for support from DIPAA (the investiga- that was not seen by the crew until after the collision. tion commission), it was able to quickly ascertain that DIPAA was Early on in the investigation, based on cues in the CVR, inves- requesting support in the readout and preliminary analysis of tigators began to look at how the audible alerts (master caution the CVRs and DFDRs from both aircraft, and able to confirm etc.) worked in the Legacy. Initial auditions of the CVR revealed that the TSB could do the investigative work requested in a timely a tone, similar to a MCAU, just a few minutes before the colli- manner. Also, when DIPAA granted accredited representative sta- sion. The pilots revealed that a passenger had opened a rear tus to the TSB, this action facilitated our involvement in the in- door of the cabin to access a baggage compartment, which acti- vestigation and our ability to conduct our work under ICAO An- vates the MCAU due to breaking the fire protection. nex 13 standards and recommended practices, including the pro- On the ground in Cachimbo, investigators confirmed this was tection of investigation information. true and contrasted this with the fact that switching the transpon- To support the DIPAA investigation, the TSB appointed an der to “Stand by,” which causes the returns to vanish from ATC accredited representative and technical advisors in the areas of and other aircraft TCAS displays, and disables the own-aircraft flight operations, flight recorder readout and analysis, air traffic TCAS, makes no audible alert, and causes only a status indicator services, and investigation management. The TSB also provided of “STBY” on the RMU display and “TCAS Off ” on PFD/MFD the IIC with advice and support on media relations while he was displays (depending on configuration). These status messages are in Canada. During our preliminary discussions with the IIC, we static, in non-warning colors (green and white, respectively), do were also able to determine who would be participating in the not correlate with any audible message, and do not require investigation work being done in Canada. In essence, in addition acknowledgement by the crew. This hypothesis was thoroughly to the TSB accredited representative and seven TSB investiga- examined during our test protocols; and while these features were tors, and the DIPAA and two investigators, the investigation team completely within certification standards, and very common in any in Canada would include representatives from CENIPA, Embraer, avionics suite, the circumstances of the accident led investigators GOL Airlines, the NTSB, and Boeing. to conclude that this was not desirable in today’s environment. TSB’s next action was to contact the Canadian Department of Therefore, this past spring, the NTSB issued Safety Recommen- Foreign Affairs and the Canadian Air Transport Security Agency dations A-07-035 through –37, which urged “that the airborne loss to establish procedures necessary to ensure that problems would of collision avoidance system functionality, for any reason, provide not interfere with the transportation of the DIPAA investigators an enhanced aural and visual warning requiring pilot and recorders while they were in Canada. acknowledgment.” While not concluding that the loss of transponder was causal to the accident, the safety issue is an important Readout and preliminary analysis of recorder information result of our international cooperation, and potential improve- The flight data recorder and cockpit voice recorder from the ments in safety even prior to the conclusion of the accident Legacy aircraft were hand carried to the TSB on the afternoon of investigation. Oct. 10, 2006. Because the Legacy recorders were undamaged, the downloading of these recorders commenced immediately on Canada-Brazil cooperation receipt. The next morning a CVR audition group listened to the entire 2 hour CVR recording. Subsequently, it was decided that TSB investigation support planning only a partial transcript would be required. In parallel, the FDR From the perspective of the Transportation Safety Board of data analysis was started. Canada (TSB), the first indication about our possible involve- The Boeing FDR and CVR were hand carried to the Engi-

ISASI 2007 Proceedings • 79

Proceedings 2007.pmd 79 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 80 controllers directly. Thegroup thendepartedforManaus fora portunity toproceed totheoperations floorortointeractwith a replay ofATC radarandvoicerecordings. There wasnoop- erations, thegroup viewedtheoperationsarea andthenviewed area control center(CINDACTA abriefingontheop- I).After tor departedforBrasilia. investigators, theNTSBrepresentatives, andtheTSBinvestiga- zilian military. the investigationteamwascoordinated andprovided bytheBra- on dutyandrest times,and fatiguefactors.In-countrytravelfor tion andradarinformation/displayproblems, controller workload, contents andformats,procedures forthe eventsofcommunica- nication/radar coverage,radarholes,blindspots,display sector handoverprocedures, training,useofchecklists,commu- handoff procedures oftheACCtoACC,controller tocontroller ing, inter-unitlettersofagreement/procedures, coordination/ collection planincluded,inpart,allvoiceandradardatarecord- fic ServicesGroup, wastheproduct ofthismeeting.Thedata low-on investigationplan,inparticulartheworkofAirTraf- significant eventsandcurrent statusoftheinvestigation.Thefol- well asthesequenceofeventsknowntodate,includingsafety- during themeetingwere theflight’sbackground information,as NTSB representatives, andtheTSBinvestigator. Areas covered ing washeld,whichincludedtheBrazilianinvestigationteam, afternoon, Nov. 6,2006.Thenext day, onTuesday, ateambrief- gator airtrafficservicespecialisttoBrazilforaperiodof5days. In response to thisrequest, theTSBsentoneof itsseniorinvesti- investigationsupport Air trafficservices air trafficcontrol investigationexpertise fortheinvestigation. It wasduringthisprocess thattheIICmadeaspecificrequest for potential safetyissues,andotherareas ofinvestigationinterest. advice oninvestigationplanning,methodologies, While inCanada,theIICrequested andwasprovided withTSB Investigation managementsupport the membersofinvestigation. the flightanimationcontinued,andallresults were shared with the flightanimation.Therefinement ofFDRdataanalysisand data plots,FDRfiles,CVRaudiotranscripts,and comment. the DIPAA and otheraccredited membersfortheirreview and sis ofthedata.Thepreliminary flightanimationwasprovided to preliminary flightanimationwasproduced toassistintheanaly- dio clipswere selectedforinclusioninaflightdataanimation.A addition, theBoeingCVRdatawere timesynchronized andau- dated andtimesynchronized basedonthetimeofimpact.In unit andsuccessfullydownloaded. load thedata.Inbothcases,memorywasinstalledonabench due totheirdamage,required theuseofbenchunitstodown- 30 fordownload.Bothflightrecorders from theBoeingaircraft, later foundandbrought totheEngineeringBranchonOctober wasmissingfrom theCVRchassis.Itwas memory unit(CSMU) neering BranchonOct.11,2006.However, thecrashsurvivable The next morning,November8,thegroup visitedtheBrasilia That evening,asmallteam,includingtheIIC,fiveBrazilian inRiodeJaneiroThe TSBinvestigatorarrived late Monday Prior todepartingCanada,theIICwasprovided withtheFDR The FDRdatafortheBoeingandLegacyaircraft were vali- • ISASI 2007 ISASI Proceedings 80 course, suchthingshavegone onthroughout thehistoryofavia- contradictory andconfusing toairmenaround theworld.Of pronouncements bydifferent entities involvedwithATC were teraction withtheATCO duetothecriminalprocess, thepublic though thesafetyinvestigationhasbeenblocked from muchin- gathered inthetesting. put forthincourt,whichusedselectedportionsofinformation in theLegacyairplaneatCachimbo,andvarioustheories were questions aboutwhatnon-safety-related peoplemayhavedone ticipated intheavionicstestingU.S.,there were lingering of distrustaboutmotives.For example, althoughallpartiespar- areas ofinvestigation,causingthedifferent parties varyinglevels investigation wasalwaysovershadowinganyoftheseinterface systems). Duringthecourseofthisinvestigation,criminal circle backto theirowninterfacewiththeATC radar andradio tant asunderstandingthetechnicalstatusofsystems(which pectations. Theflightcrew interfacewiththeavionicsisasimpor- ingless withoutunderstandingtheflightcrew reactions andex- piecemeal atindividualsubjectareas. ATC procedures are mean- but theyare ofthehumannature. of thetechnicalnature; thosewere easilyenoughbroken down, should helpprevent arecurrence. Sothelessonswelearnare not solutions—recommendations already made,andsoontocome, narios—the “probable” causeconcept.More than that,wehave transponder wentoffintheLegacy, butwehaveplausiblesce- tain actionswere nottaken intheACC.We neverknowwhythe investigation thatneededtobedonefindouranswers. can beunderstood;there wasnoreal ground-breaking technical collision avoidancetechnologycancollide.Butallthosesubjects technology, determininghowtwoairplaneswithstate-of-the-art tions areas, understandingofthetypicallyarcane ATC rulesand tight linksandinterrelations betweentheATC andflightopera- On thesurface,thisaccidentappearsverycomplex—there are The lessonstaughtbythistragicaccidentare notfinishedyet. learned Lessons and AirTraffic ServicesGroup. tion adviceandparticipationintheinvestigationRecorders Group ing toDIPAA requests foradditionaldataanalysisandinvestiga- The TSBhascontinuedtosupporttheinvestigationbyrespond- TSB continuingsupport of theIICandhisteam. tial safetyissuesandfurtherareas ofinvestigationforthebenefit currence oftheNTSBrepresentatives, provided alistofpoten- the lastfewdays. meeting andprovided anupdateontheactivitiesundertaken in for Friday. Theentire investigationteamwaspresent forthat and spentsometimepreparing foraclosingmeetingplanned staff waspossible. Although timewasshort,someinteractionwiththedutycontrol replay ofradarinformationfolloweddirectly afterourarrival. again viaBrazilianmilitaryconveyance.Atourofthefacilityand visit oftheManausATC area control center(CINDACTA IV), Similar conceptshavebeenseenintheATC area aswell.Al- It isnotpossibletoproperly investigateanaccidentbylooking Some oftheworkwasnoteasy. We mayneverknowwhycer- Prior todepartingBrazil,theTSBinvestigator, withthecon- The group returned toRiodeJaneiro thenext day, Thursday, 1/14/2008, 9:44 AM tion accident investigation, but in this case, the overwhelming of transponder mode “C” in the ATC software in use, in order to presence of the criminal case has drowned out the voice of the increase the ATCO situational awareness. ◆ safety investigation. On January of this year, the commission released eight pre- Conclusion liminary safety recommendations: The midair collision accident of GOL 1907 and the Legacy a. Review the Brazilian AIP, in order to update it, with emphasis N600XL was a nationwide event. It created a need to find not on the inclusion of rules and procedures of the Brazilian Air Traffic only new defenses for the aviation systems but also a criminal Control. responsibility. b. Train the ATCO in the correct procedure accomplishment in the These parallel needs created difficulty for the safety investiga- Air traffic control clearances, as defined in items 8.4.8, 8.4.9 and tion in both Brazil and the U.S.. People do not want to be inter- 8.4.10 of ICA 100-12 Air Rules and Air Traffic Control Services. viewed; and if they agree, their information is colored by the fear c. Assure the level of English proficiency for all ATCO of the that their words will be handed to the police by court request. Brazilian Air Traffic Control System, as well as provide the neces- To avoid part of this problem the cooperation among Brazil, sary means to fulfill the ICAO Annex I SARP and Doc. 9835. the U.S., and Canada created an excellent atmosphere of work d. Ensure the adherence of all ATCO to follow all the handover sharing—with their findings always toward the idea of prevention. procedures for sectors or adjacent centers. e. Ensure that written procedures for lost communication are References completely followed by all ATC units. ICAO. Annex 13 to the Convention on the International Civil Aviation Con- vention—Aircraft Accident and Incident Investigation—Ninth Edition. f. Ensure that all ATCO attend specific ATC rules and procedure Canada. training classes, considering the recommendations on letters b), Brazil. Air Force Command. CENIPA. NSCA 3-6 Investigação de acidente c), d), and e) of this document. aeronáutico, incidente aeronáutico e ocorrência de solo. Brasília. 2003. SESSION 3—Moderator Alan Stray g. Standardize and operationalize the use of the OFF SET fea- Endnote ture in the lack of communication and or radar coverage regions. 1Brazil. Air Force Command. CENIPA. NSCA 3-6. Investigação de acidente h. Implement a new presentation (effective alert system) of loss aeronáutico, incidente aeronáutico e ocorrência de solo. Brasília. 2003.

ISASI 2007 Proceedings • 81

Proceedings 2007.pmd 81 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS fixed-wing and rotary-wing instructor.fixed-wing androtary-wing ATPL airplaneandCPLhelicopterlicenseswasanA-category TAIC in1998andhasledmore than30investigations.Heholds Force safetyofficeandallaircrew trainingandstandards. Hejoined senior staffcollege,heassumedresponsibility formanagingtheAir formation aerobatic teamforthree years. On graduatingfrom the responsible forRNZAFinstructortrainingandstandards andledthe 82 organizations tohelpprovide thoseadditionalpiecesofthejigsaw. smaller agencieslike ourselves,where werely heavilyonourfellow ciple canbeappliedtoanyinvestigation,itisespeciallycrucialfor and determinetheprobable causeoftheaccident.Whilethisprin- organizations were weabletoidentifyallthecontributory factors and demonstratethatonlybyworkinginconjunctionwithother after, andat2305Iwasappointedtheinvestigator-in-charge. port AccidentInvestigationCommission(TAIC) wasnotifiedsoon aircraft anditstwopilotswascommencedimmediately. TheTrans- tempts tocontacttheaircraft were unsuccessful.Asearch forthe ter aleftturnanddisappear. Noradiocallswere made,andat- Wellington) indescent,theaircraft wasobservedonradartoen- 2126 hours,shortlyafterpassingParaparaumu (northof uled freight flight from Christchurch toPalmerston North.At On Friday, Oct.3,2003,Convair580ZK-KFU wasonasched- Introduction I willshortlyreview themajormilestonesininvestigation, • ISASI 2007 ISASI Convair 580Accident Investigation: officer ofthecentralflyingschool,McClellandwas Europe andNorthAmerica.Asthecommanding extensively around thePacific, andtoalesserextent tica, SoutheastAsia,andtheMiddleEast,flew transport aircraft. HecompletedpostingsinAntarc- Zealand AirForce flyingbothhelicoptersandheavy Ian McClelland Proceedings By IanMcClelland,Transport Accident InvestigationCommission(NewZealand) 82 spent 22yearswiththeRoyal New A StudyinSynergy ZK-KFU determine thecauseofsudden departure from controlled flight. New Zealand,itwasimportant thatwerecover theaircraft and more than80still inservicearound the world,including10in Some 170ofthesewere laterconvertedto580status; and with 20,000 hourstotalexperience. Bothwere ingoodhealth. was lessexperienced ontypewith194hours,buthadmore than nearly 17,000hours,including3,300hoursontype.Thecopilot shore, butnosurvivors. licopter usingnightvisiondeviceslocatedfurtherwreckage off- washed upalongtheshoreline. Anaerialsearch byAirForce he- hour later, debrisidentifiedascomingfrom theaircraft wasfound a tighteningleftturnanddisappearfrom thescreen. Aboutan tion oftheQNH,butthere wasnoresponse. omitted theamendedQNH.Thecontroller asked forconfirma- North. Thecopilotcorrectly repeated backthe clearancebut the ATIS informationandjoininginstructingforPalmerston to Ohakea Control. descent clearance,ZK-KFU wasinstructed tochangefrequency aircraft todescendinitially13,000ft.At2125,afterafurther uneventfully northatFlightLevel210.At2113,ATC cleared the kg. Theaircraft departedChristchurch at2032andproceeded turboprop enginesandhadamaximumall-upweightof26450 and courierpacks.Theaircraft waspowered bytwoAllison501 ZK-KFU wasadedicatedfreighter mail thatprimarilycarried Convair 580ZK-KFU in anaccidentandthereby prevent areoccurrence. aim ofidentifyingasmanythecontributingfactorspossible safety. Onlythrough thisprocess canwehopetoachieveourjoint communication betweenourorganizations topromote aviation orientated world,andcontinuetofostercontactsgoodlinesof keep pacewiththoseomnipresent developmentsinouraviation- That iswhyeventslike thisseminarare essentialinensuringwe More than1,000Convairsinarange ofvariantswere produced. This wasanexperienced crew, withthecaptainhavingflown Shortly after, thecontroller observedZK-KFU onradarenter Ohakea cleared ZK-KFU todescend7,000ftandpassed on 1/14/2008, 9:44 AM SESSION 4—Moderator Richard Breuhaus

The investigation The first challenge was to locate and recover the aircraft. A marine salvage company and the Navy were given the task, and using side-scanning sonar located a possible wreckage field in 110 ft of water about 4 km offshore. The area was subject to strong tides with divers often working in visibility of less than a meter. However, after 12 days both pilots were located and the recovery of wreckage commenced. A plot of the wreckage identified that the aircraft had likely broken up in flight, but the close proximity of the engines, pro- pellers, and undercarriage raised questions about the height of the break-up. To add to the conundrum, light paper articles lit- tered the beach areas, and four pieces of aircraft paneling were found spread in a line up to 3 km in land. With the assistance of the NTSB, the characteristics of the paneling, location found, and known wind were analyzed and a possible trajectory determined. This was combined with the radar track and mode C information to identify a break-up point. In all, about 70% of the aircraft by weight and 15% of the cargo was recovered for examination. No dangerous goods were reported being carried or found. The Commission received assistance from Rolls-Royce (Allison), who sent out an investigator to review the inspection of the two engines. Both engines were found to producing power at the time of impacting the water. The propeller hubs were sent to Pac Prop in the States and under NTSB supervision were examined. They were found to be operating normally at time of impact. With the assistance of TSB Canada, aircraft and performance information was sourced from the type certificate holder Kelowna Flightcraft, Transport Canada, and the National Research Council. The FAA also provided valuable supporting information. Across the ditch, the Australian Transport Safety Bureau (ATSB) worked on the DFDR and CVR. Unfortunately the CVR, although

ISASI 2007 Proceedings • 83

Proceedings 2007.pmd 83 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 84 while theIPs were kept informedofinvestigation progress, I facilitate direct accesstothesepeople.Thiswasimportant,for data collectedbytheNRC, nationalpointofcontactwould ATSB, orfrom anexternal agency, for example icingresearch investigative organization, forexample theDFDRanalysisin were alldancingtothesametune. this documentcannotbeunderstated.For asthesayinggoes, we gation asinterested partiesunderICAOAnnex 13.Theutilityof TSB) provided acentralpointofcontactandjoinedtheinvesti- relevant independentinvestigationagency(theATSB, NTSB,and including 9overseasorganizations. Ineachofthesecases,the In all,19agenciesprovided direct support fortheinvestigation, Coordination about 7,000ft. spiral diveandtheaircraft broke upasitdescendedthrough short time.Thecrew wasunabletorecover from theensuing through anarea ofsevere icingandstalledafterflyinglevelfora The investigationdeterminedthatZK-KFU haddescended Finding ing controlled flight. leveled andslowedinthisbandoficingbefore suddenlydepart- icing. For unknownreasons, possiblyturbulence,theaircraft was front. Theconditions were conducivetoturbulenceandsevere ZK-KFU descendedthrough thetrailingedgeofaveryactive ing oftheflight,meteorologists were abletodeterminethat information surrounding theevent. Giventhetimingandrout- craft wasdoing392ktsandpullingabout3.25G. increasing to-86°approaching 6,800ft—atwhichstagetheair- 60° to70°nose-downattitude,withadescentangleofabout-70° mine thatafterlevelingat14,400ft,theaircraft rapidlywenttoa over land.TheATSB andNTSBwere togetherabletodeter- ft. Thismatchedthetrajectoryofthosepiecespanelingfound record ofthefullflightuntildescendingrapidlythrough 6,800 the lasttransmissionbothengineswere operatingnormally. we were abletoextract engine noise,indicatingthatatthetimeof no cockpitvoice.Thiswasahugesetbacktotheinvestigation,but testing satisfactorily, onlyrecorded VHFradiotransmissionsand Where expert advicewasrequired, eitherfrom withinanother Back inNewZealand,theMetServiceprovided theweather Fortunately theDFDRprovided goodqualitydataandhelda • ISASI 2007 ISASI Proceedings 84 would beafforded thesamelevelofprotection asunderNew eration. Italsoprovided comfortknowingthattheCVRandDFDR For theATSB, thepriorsettingup ofanMoUensured fullcoop- Memorandums ofunderstanding contact detailsandsmoothingthepath. all cases,thistooktheformofanexchange ofe-mailsproviding focused. Thiswayenergy andresources were notwasted.Innearly got therequired informationandthattheinvestigationremained needed tobeabletalkdirectly totheexperts toensure thatI 1/14/2008, 9:44 AM the staff available. We had only just recruited a new investigator

when this accident occurred. A very steep learning curve en- SESSION 4—Moderator Richard Breuhaus sued. However, the retiring investigator was at the opposite end of the scale, with nearly 25 years in the job, including investigating a previous Convair 580 accident in July 1989. Neverthe-

Zealand legislation. On the national front, an MoU with the police ensured a smooth transition from police control of the initial search, where we supported, to taking over after the recovery of the two pilots. A similar agreement with the CAA allowed a CAA safety investigator to be seconded to the investigation, providing a valuable interface and good training. A participants’ agreement ensured that sensitive information remained confidential and avoided any potential conflicts of interest.

Organizational structure Flexibility is a requirement for any organization. TAIC policy is for the IIC to manage the investigation through to and including the public release of the report. This allows for continuity of command and communications. However, with only three air investigators and the need to manage other investigations, we also need to be flexible in releasing staff during a protracted investigation. For ZK-KFU, the report was released to the public within 11 months—an easily manageable timeframe. Another challenge for a small organization is the expertise of

ISASI 2007 Proceedings • 85

Proceedings 2007.pmd 85 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 86 by aviationstandards, didposesomesignificantchallenges—pri- The accidentandsubsequentinvestigation,althoughnotlarge Conclusion our domain. ity, interviewsandthehandlingofrecorders remained solely the durationofinvestigation.However, toensure credibil- neering andlarge aircraft experience attachedtotheteamfor ship captains.We alsohadaCAAsafetyinvestigatorwithengi- recovery vessels—atummy-rumbling experience forthesebig example, themarineinvestigatorswere usedonthesearch and investigators where suitable—especiallyintheearlydays.For numbers count.”Sowepressed intoserviceourmarine andrail less, asGenghisKhanoncesaid,“There comesatimewhen • ISASI 2007 ISASI Proceedings 86 Information word.” aviation safety. fortheopportunityto“spread AlsotoISASI, the in thisreport fortheirunendingsupportinthefurtheranceof The Commissionagainwishestothankthoseagenciesidentified Acknowledgements Kapiti Coast,NZ,Oct.3,2003 Kapiti Convair 580,ZK-KFU, lossofcontrol andinflightbreak-up Report 03-006 For more information:www.taic.org.nz establishedworkingrelationships andagreements (e.g.,MoUs). • gional workshops),and networking,bothbefore andafteraccident(e.g.,seminars,re- • goodteamwork, • flexibility, • direct andunhindered communications, • anestablishedinvestigationframework(ICAOAnnex 13), • unchallenged report were madepossibleby accept withoutfurtherinquiries.Inshort,theinvestigationand accident—a findingthattheinvestigatingcoroner wasableto presentation were weabletodeterminetheprobable causeofthe only through thecooperationofagenciesmentionedinthis community, tousethewealthofexpertise available.For ZK-KFU, gations. We mustalsobeabletohaveaccessthewidersafety sources, dictatesthatweare adaptableandardent inourinvesti- TAIC’s smallsize,withitslimitedmanpowerandmaterialre- for theinvestigation—whatcausedaccidentandwhatdidn’t. of CVRinformation.Thisleadtoatypicaltwo-pronged approach marily wreckage locationandrecovery, combinedwiththelack ◆ 1/14/2008, 9:44 AM Tenerife to Today: What Have We Done in Thirty Years To Prevent Recurrence? By Ladislav Mika, Ministry of Transport, Czech Republic, and John Guselli (MO3675), JCG Aviation Services Australia Ladislav Mika is the head of the Flight and Operations Division in the Ministry of Transport of the Czech Republic.

John Guselli is a director of JCG Aviation Services, an Australian company that specializes in the development of transport safety systems, safety management, investigative analysis and the delivery of specialist aviation training. Licensed as an air traffic controller in 1974, he has served in a wide variety of senior operational and strategic safety management roles at the national level. He has completed an Aircraft Accident Investigation Course at Cranfield University (U.K.) and has managed and assisted in civilian and military system evaluations, safety audits, incident investigations, and international airline liaison

in Australia, New Zealand, Indonesia, China, and the U.K. He holds SESSION 4—Moderator Richard Breuhaus audit qualifications and diplomas in adult education and aviation. He has facilitated international safety management and investigation training in conjunction with operational management for the Singapore Aviation Academy, Eurocontrol, Airservices Australia, the Australian Transport Safety Bureau, the Southern California Safety Institute, Airways New Zealand, and the Civil Aviation Safety Authority of Australia. John is chairman of the ISASI Air Traffic Services Working Group. Tel: +61 2 9872 3722. Fax: +61 2 9872 9565. E-mail: [email protected].

1.0 Introduction The aviation industry is a composite of many diverse but interde- pendent systems. As the global privatization process marches ever onward there Air safety investigators quickly learn that no matter how many is the increasing expectation of a return on investment by share- ways they attempt to collate the contributory factors of an occur- holders. This return will often be influenced by accommodating rence they usually come up with key issues related to (or stimulating) an increased demand for runway capacity. • people, Airport real estate for operational activity is usually finite. • equipment, This means that as the volume of traffic increases, capacity • procedures, enhancement measures are developed. These measures will • environment, and often involve an increase in procedural complexity or physical • organization. redevelopment of airport layouts. Some would argue that this Runway safety is one issue that has maintained a critical posi- is simply a logical evolution within the aviation industry, but tion at the top of the safety watch list. they neglect the significance of people and their organizational Safety risk is a product of likelihood and consequence. Most structures. runway collisions will continue to have a catastrophic consequence Air safety investigators appreciate the significance of the hu- to the well-being of aircrew and their passengers as it is unlikely man factor as it typically provides up to 80% of the causal factors that we will ever, cost effectively, produce airframes capable of associated with air safety occurrences. surviving high-energy impact. People are associated with planning, documentation, training, It follows then that the most effective focus of our safety pre- and an assurance of the effectiveness of these measures. They are vention effort lies within a reduction or removal of the likelihood represented in the process by air traffic controllers, pilots, and of these events. At this point, a simple and logical equation be- plant vehicle operators. gins to run out of steam. It does so because of incompatible goals Organizations are associated with the provision of the people as generated by the obligation to balance safety with expedition. well as the resources for them to deliver the service.

ISASI 2007 Proceedings • 87

Proceedings 2007.pmd 87 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 88 ICAO definesarunwayincursion 2.0 Whatisarunwayincursion? a particulartypeofaircraft. events are notconfinedtoanyspecificgeographiclocation orto experience the phenomenonoftherunwayincursion.These deliver thetragicoutcome.Thirty yearslater, westillregularly violation. • resource management, and • awareness, • training, • assumption, • phraseology, • complacency, • communication, • organization. • environment, and • procedures, • equipment, • people, • tributory factorsrelated to followed byPan American.Tragically, thissimplestrategyfailed. old. ThisATC strategywouldpermittheKLMaircraft todepart, the samerunwaywitharequirement tovacateitpriorthethresh- into LosRodeos. ture threshold. Thecrew quicklynotedathickening fogrolling KLM aircraft commencedtotaxialongtherunwaydepar- extremely offivelarge taxed bythearrival aircraft. Rodeos onTenerife. Thisregional airport,thoughcapable,was sequently, were divertedtothesmallerairportofLos arrivals complex hazards associatedwithrunwaysafety. awareness intheaviationindustrytodiversityofsimpleand 583 people.Thissingletragicoccurrence polarizedagrowing two Boeing747aircraft, onafoggyrunway, ledtothedeathsof own though. the essenceofproblem. Itdoesnotprevent anythingonits tected area ofasurfacedesignatedforthelandingandtakeoffaircraft.” involving theincorrect presence ofanaircraft, vehicle,orpersononthepro- In isolationandincombination,eachoftheseconspired to Principal deficient elementsamongthesefactorswere The investigationultimatelyrevealed acombinationofcon- At thesametime,aPan Americanaircraft wastaxiingalong ground-basedAfter delaysandsignificantrefueling activity, a Terrorist activityhadclosedtheLasPalmas Airportand,sub- In theCanaryIslands,onMarch 27,1977,acollisionbetween Consider thetragedyatTenerife. This simpleenoughstatementiseasilyabsorbedandcaptures • ISASI 2007 ISASI Proceedings 88 1 as“ Any occurrence atanaerodrome tion intheriskofrunwayincursions. promoting runwaysafetyandwithaprimaryfocusonthereduc- craft andvehiclesinthevicinityofrunway, withtheaimof safety-related informationpertainingtothemovementofair- ists from stakeholder organizations. the Transportation SafetyBoard ofCanada,ortechnicalspecial- as theTransport CanadaAerodrome andAirNavigationBranch, panel andobserverswithadirect interest inrunwaysafety, such (ATAC), aswellotheraviationstakeholders identifiedbythe of Canada(ATSAC), theAirTransportation AssociationofCanada trol Association(CATCA), the AirTraffic SpecialistsAssociation Air LinePilots Association(ALPA), theCanadianAirTraffic Con- (CAC), theCanadianOwnersandPilot’s Association (COPA), the resentative from NAV CANADA,theCanadianAirportsCouncil but isnormallycomposedofoneprimaryandback-uprep- mation ofRSIPP(RunwaySafetyandIncursionPrevention Panel). way incursion-prevention activitiesandthisresulted inthefor- NAV CANADA identifiedaneedtocontinueoversightofrun- decided nottoextend IPAT beyonditsApril2005expiry date. lowing thesuccessfuladoptionoftheserecommendations, itwas produced bybothTransport CanadaandNAV CANADA.Fol- recommendations containedinreports onrunwayincursions Team) co-chaired byTransport CanadaandNAV CANADA. previous group knownasIPAT (IncursionPrevention Action activities inCanada.Thiswasasaresult ofthedissolutiona pendent workinggroup tooverseerunwayincursionprevention In 2005,NAV CANADAinvitedstakeholders toformaninde- 4.1 Canada from withintheirorganizations. the basisthatmostlastingandeffectivesolutionsmaycome around theworld.Theworkoftheseproviders ishighlightedon providers indicatesthecontinuingfocusonthisphenomenon in isolation)toward areduction inrunway incursions. Subsequent toTenerife, manystateshaveworked together(and 4.0 Whathavetheybeendoing? made. through IFALPA andIFATCA, thatmeasurableprogress canbe aviationregulators. • aircraft manufacturers, and • airportoperators, • airoperators, • ANSproviders, • ing groupings (astheywillusuallybearaccountabilitysomehow): little difficulty. Thefrontline strategieswillcomefrom thefollow- At acursorylevel,thedeterminationofstakeholders presents 3.0 Whoarethestakeholders? cursions are CategoryA. taneous actionrequired toavoidacollision.Very fewrunway in- the risk.CategoryAeventsare onesofextreme riskwithinstan- Canadian runwayincursions are classified as totheseverityof Canadian runwayincursionstatistics The Panel’s mandateistoprovide aforumfortheexchange of Membership inthismultidisciplinarygroup willremain open IPAT inthecourseofitslifewastasked withimplementing The followingsummaryofrecent initiativesbyANSservice It isonlywhenpeakindustrybodies,representing individuals 1/14/2008, 9:44 AM Phraseology has been changed for aircraft and vehicles entering the runway. A significant amount of data is collected post incursion through the use of pilot and controller feedback forms. This feedback has enabled NATS to understand how and why errors occur and continues to steer its runway safety strategy. NATS participates in both the U.K. and European runway safety steering groups. Statistics compiled by NATS and displayed below so far reveal three significant target areas for safety enhancement. They indicate that 1. an aircraft has entered a runway without clearance. 2. a correct pilot readback can be followed by an incorrect pilot action. 3. failures in following ATC instructions.

4.3 Europe Chart 1 European runway incursion analyses received a fillip following a serious runway incursion occurrence on Dec. 10, 1998, at Schiphol, Amsterdam Airport2. After an investigation lasting more than 2 years the following conclusions were published: a. Low visibility and a low cloud base at the airport made visual control from the control tower impossible. Low visibility procedures were effective for air and ground traffic. b. There are no indications that prior coordination of the tow movement between apron control and tower, as required under

low visibility conditions, took place. SESSION 4—Moderator Richard Breuhaus c. Exit 2 of Runway 06/24 was not equipped with traffic lights. d. The crossing clearance request was inadequate as it did not mention position and intended movement. e. No further information was asked by the assistant controller to clarify the runway crossing request. This caused a misinterpretation Chart 2 resulting in a false hypothesis with regard to the position of the tow. f. As a consequence, the wrong position of the tow was passed to Factors such as weather, speed of the involved aircraft, and the tower controller, which eventually led him to misinterpret time to take action are considered in a matrix in order to deter- the ground radar picture. mine the risk. Chart 1 shows runway incursions in terms of the g. The working position of the assistant controller was not severity of the risk. equipped with a radar screen. She was, therefore, not able to positively monitor the tow movement. 4.2 United Kingdom h. The tower controller based his decision to clear Delta Air Lines The National Air Traffic Services provides air traffic control ser- Flight 039 for takeoff on his interpretation of the ground radar vices at 15 of the U.K.’s biggest airports and “enroute” air traffic picture and the indication of the stop bar control panel. He did services for aircraft flying through U.K. airspace. This year it ex- not verify with the assistant controller to positively confirm that pects to handle more than two million flights carrying more than the tow was clear of the runway. 220 million passengers. i. The alertness of the cockpit crew of Delta Air Lines Flight 39 For more than 2 years now, the Runway Safety Focal Group prevented the occurrence of a catastrophic accident. has been in action supporting NATS runway safety activities. Rep- j. Design and position of the control panels for stop bars and resentatives from the 15 U.K. airports meet on a regular basis. traffic lights are not unambiguous and, therefore, prone to hu- This group’s activities have supported a significant amount of man error. progress. k. The non-use of checklists during the change over from in- All airports now have a Local Runway Safety Team that is ac- bound- to outbound mode resulted in an initially wrong set up tively managing runway safety issues at the airports. Airports have for the stop bar control panel in relation to the controller duties. identified their key runway safety risks and are in action to re- This reinforced their doubt about the correct functioning of the solve or mitigate the issues. system instead of realizing their misunderstanding in the posi- Aerodrome Resource Management Training (effectively TRM tion and movement of the tow. in the airport environment) has been delivered at U.K. and Eu- l. The supervisor/coach failed to adequately supervise the tower ropean airports with positive results. operations in general and did not timely intervene to prevent The use of conditional clearances has been challenged, and the incident. trials continue to enable NATS to understand how it might use m. The staff on duty was not working as a team. them in the future. The conclusions to this investigation revealed different fac-

ISASI 2007 Proceedings • 89

Proceedings 2007.pmd 89 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 90 Authorities, JointAirworthiness • SafetyRegulation Commission, • Eurocontrol, • duced byajointworkinggroup comprising visibility ofactualincidents. essarily indicatealowersafetyperformance,butpossiblyimproved increased by11%in2005compared to2004.Thisdoesnotnec- was aseriousincursionevery14days. way incursionswere reported. Further analysisrevealed thatthere tion. Inaddition,aglobaltaxonomy nowassiststheanalysts. European definitionshavebeensupersededbytheICAOdefini- with thesubmissionofoccurrence reports. In2007,14different thedifficultytounderstandcausalandcontributoryfactors. • lyzing runwayincursions. theabsenceofaharmonizedandconsistentapproach forana- • information. thepotentiallackofdataandreluctance toshare safety • sions across theregion. Theywere issues hindered Europe inreducing therateof runway incur- ciples inChart3. dations fortheprevention ofrunwayincursionswassupported. ational awareness. Actiontoformalizetheresulting recommen- including communications,humanfactors,procedures, andsitu- pants todebatemanydifferent issuesassociatedwithrunwaysafety, tions. Theworkshopoffered auniqueopportunityforpartici- shop where actionwastaken toconsolidatepastrecommenda- ets ofcontributoryelements. Chart 3 The European ActionPlanandsupportingmaterialsare pro- By comparison,thenumberofreported runwayincursions A snapshotofthe2005data(seeabove)revealed that600run- It hasactionedplanstoreduce thesedifficultiesasassociated To itscredit, in2005Eurocontrol concededthatthree main The workshopconcludedwithagreement onthe generalprin- In 2002,theEurocontrol agencyhostedaninternational work- • ISASI 2007 ISASI —2005 Data —2005 Proceedings 90 commenced in2005forthis program, isdisplayedbelow. runway safetyissuesfrom apilotsperspective. production detailing ofavideo,inconjunctionwithCASA, • all pilots. developmentof arunwaysafetybrochure to bedistributedto • developmentof runwaysafetyposters. • ERSA. coordination of hot-potaerodrome diagramsforinclusionin • centers andataero clubsandotherorganizations. developmentofhot-spotpostersfordisplay inairlinebriefing • derstandable andthatnoambiguityexists. drivingontheairfieldregularly toensure thatsignageisun- • aircrew. complex, whichmayhavethepotentialtoconfusedriversor may beutilized,somemessagesfrom ATC maybeoverlongor gested. For example, althoughstandard ICAOphraseology drivers are satisfactory, orifanyimprovements couldbesug- confirmingthatcommunicationsbetweenATC andaircrew/ • necessary. local hot-spotmapsorotherguidancematerialasconsidered cuses onlocalissues,forexample byproducing anddistributing runningalocalRunwaySafetyAwareness Campaignthatfo- • tions forimprovement thatare considered necessary. identifying anylocalproblem areas andmakinganysugges- • signed tothelocalteamsinRunwaySafetyDocument. the implementationofrecommendations thathavebeen as- coordinating withtheorganizations orteamstheyrepresent, • for improvement. ing difficultiesofthoseworkinginotherareas andsuggestitems workingasacombinedteamtobetterunderstandtheoperat- • problem areas attheaerodrome. reviewing investigation reports toestablishlocalhot-spot or • assists inenhancingrunwaysafetyby Safety Teams staff involvedinarunwayincursion. factors-based surveythatisissuedtopilotsandairsideground cident data,thegroup hasimplementedaconfidentialhuman- ence provided bytheAirservices SafetyPanel. and airtrafficcontrol, anditoperatesunderthetermsofrefer- (RIG) iscomprisedofrepresentatives from safetymanagement tors andendusers.TheAirservicesRunwayIncursionGroup way incursionsandtofacilitategreater awareness amongopera- to mitigatetheriskofrunwayincursions. Airservices Australiawasanearlyadopterinactivitiesdesigned 4.4 Australia ICAO. • IAOPA, and • IFALPA, • IFATCA, • •IATA, Air NavigationServiceProviders, • Airlines, • Group ofAerodrome SafetyRegulators (GASR), • The ongoingtimelineofjoint civilandmilitaryinitiatives, Other activitiesbeingundertaken bytheRIGinclude Another importantactivityhasbeenthepromotion of Besides maintainingaconstantreview ofrunwayincursionin- A group wasestablishedtotake anationalperspectiveonrun- atcontrolled airports.ThelocalRunwaySafetyTeam 1/14/2008, 9:44 AM Runway growth is challenging runway and infrastructure expansion. Avia- tion in the United States is a mass transportation system with thousands of unique components. There are more than 480 towered airports (and thousands of non-towered airports), over 15,000 air traffic controllers, in excess of 650,000 pilots, and greater than 240,000 aircraft, all conducting millions of operations around the clock. Improvements that standardize operations and reduce risk on the airport surface will be essential to foster improved performance and safe growth. 4. Collision-avoidance safeguards need to be developed for the high-energy segment of runways. Fatalities are most likely to occur in the first two-thirds of the runway (typically called the high- 4.5 United States energy segment) where aircraft are accelerating for takeoff or The FAA 2002–2004 Blueprint for Runway Safety3 stated that its decelerating after landing. Approximately 65 million takeoffs and purpose was to landings, plus millions of crossings, occur annually in this seg- 1. define and prioritize many of the coordinated efforts between ment of the runway. Improvements to airport geometry, airport the FAA and the aviation community to reduce runway incur- and aircraft technology, operating procedures, and airport us- sions, and age patterns that address incursion risk on this runway segment 2. to create engagement and alignment between FAA headquar- will be required to reduce collision risk in the future. ters/regional staffs and the aviation community, which is essen- 5. Human factors are the common denominator in every runway tial to achieve success. incursion. A systematic attack on this aspect of the problem will In doing so, it identified a number of elements critical to the require detailed analyses of the causes of these errors and the success of the program. It stated: design of approaches to mitigate them. Recognition of the following key points is fundamental to formu- These five conclusions, drawn from the ongoing analyses of run- lating and implementing solutions to improve runway safety for way incursion reports, will direct our systematic search for solu-

the nation: tions. Given the constraints of time and resources, however, it is SESSION 4—Moderator Richard Breuhaus 1. Operational performance in the airport movement area must necessary to assign priorities. The guidance is to first invest our be further improved to reduce runway incursions. The NAS in- assets to resolve the problem of collision avoidance on the high- volves enormously complex interactions among air traffic con- energy areas of runways—potentially the most lethal of the risks. trollers in the tower and people who operate on the airport sur- The effectiveness of this blueprint can be quantified by the face, including pilots, mechanics, maintenance technicians, and following comparison of U.S. runway incursions (1999 to 2006)4. airport employees. Improved awareness efforts and compliance It is clear that despite significant recent traffic growth, the rate of are required to reduce runway incursions. A frequent reason run- incursions is reducing. way incursions occur is loss of situational awareness. The major breakdowns in operational performance that result in runway incursions at towered airports are

Pilots who a) enter a runway or cross the hold short line after acknowledging hold short instructions, b) take off without a clearance after acknowledging “taxi into position and hold” instructions.

Air traffic controllers who a) lose required arrival/departure separation on the same or in- This relative success has not emerged without differing opinions. tersecting runways, NATCA testified in March 2007 at the NTSB Runway Safety b) make runway crossing separation errors. Forum5. The main points, brought forward on behalf of their control tower perspective by NATCA, were— Vehicles drivers and pedestrians who a) cross a runway without any communication or authorization, Technology b) enter a runway after acknowledging “hold short” instructions. Equipment needs to work in inclement weather. ASDE/AMASS operates in the limited mode with any kind of precipitation present 2. Runway incursions are systemic, recurring events that are un- (rain/snow). While operating in limited mode, the “safety logic” intentional by-products of NAS operations. Runway incursions is not functioning, and, therefore, cannot warn of impending are systemic because they are related to existing aviation proce- conflicts. ASDE-X is much better with the potential for dures, airport geometry, training, operations, communications, multilateration support. and NAS infrastructure components. Improvements to the NAS will be required to reduce risk and improve safety performance. Procedures 3. Operations must be standardized to reduce risk at a time when FAR 91.129 (i) is in need of review. Additionally, an insistence on

ISASI 2007 Proceedings • 91

Proceedings 2007.pmd 91 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 92 runway incursioninformationis recommended asanessentialstep to- proach willleadtoeffectiveglobal solutions.Specifically, standardized collision riskassociatedwithrunway incursions.Aninternationalap- been higher. Integral toadvancingsafetyperformanceisthereduction of aviation toperformatincreasing levels ofsafetyexcellencehasnever This paperelegantlysummarizedtheissue.Itstated: address theissueofrunwayincursionsfrom aglobalperspective. working paperwaspresented bytheUnitedStatesthatsoughtto personnel, were killedinthecollision. total of118persons,includingground-based baggagehandling takeoff inreduced visibilitywithaCessnaCitationbusinessjet.A ground safetyingeneral. global aviationindustryperspectiveofrunwayincursions and A tragicrunwaycollisioninMilanonOct.8,2001,polarizedthe 5.0 Developinginitiatives FAROS • runwaystatuslights, • ASDE-X, • movingmaps, • way incursionsliewithin ture; noneare foolproof.” to prevent runwayincursion.” Association (ATA), whichconcludedthatthere was“ gated withtrainingandprocedural interventions. fective on-the-jobtrainingbeingconducted.Theseerrors couldbemiti- ler teamwork,improper scanning,poorprioritizationofduties,andinef- These errors stemfrom lapses,alackofcontrol- itemsincludingmemory runway incursionshavebeenattributedtocontroller operationalerrors. at Objective3.2whenitstated: in runwaysafetyevents. and decision-making. When controllers are fatigued,itaffectsreaction time,judgment, and harder thantheyeverhavebefore. Thisiscausingfatigue. Based onthestaffingdynamic,controllers are workinglonger Fatigue workload increase. on thefrequencies (tocatchmissedread-backs), andanoverall less eyesontherunways(tocatchpilottransgressions), lessears to workingshorthandedandcombiningpositions.Thisleads years togetacontroller fullycertified.Thisstaffingshortageleads is nothiringreplacements fastenoughtokeep up,plusittakes 3 The FAA islosingthree controllers adaytoretirement. TheFAA Staffing this position. requires amendmentiftheFAR ischanged.IFATCA agrees with many runwayincursions.Also,the an individualclearancetocross anyrunwayisneeded. “low-cost” surfacesurveillancetechnology. • perimetertaxiways,and • During theEleventhAirNavigationConference collidedon Scandinavian AirlinesFlightSK686,anMD-87, ATA stressed thefactthat“ The sameForum alsonoted thepositionofAirTransport The FAA partlyacknowledgedthisissuewithintheBlueprint The NTSBhascitedcontroller fatigueasacontributingfactor The current “taxito” runwayassignmentclearancehascaused • ISASI 2007 ISASI 6 , Proceedings 92 It believesthemeasures toprevent run- many ofthetechnologiesare notma- More thanathird ofthemostserious Aeronautical InformationManual no silverbullet Demand for 7 (2003)a issue; thiswascausedbyagoodcontroller withalotof experience making for us,”saidFAA spokesmanIanGregor. wasn’taprocedural “This News— FAA statement shortlyaftertheevent,andreported byAero- it tobethemostseriousincidentofitskindinatleastadecade. was categorizedasCategoryAbytheFAA. MediaNewsreported runway. AnearcollisionatarunwayintersectionSanFrancisco craft avoidingacollisionwithSkyWest Airlinesaircraft onthe San Francisco inanoccurrence involvingaRepublic Airlinesair- problem.” the vehiclesthatcrowd commercial airportsisasignificantpartofthe greatest threat inaviation,and thepotentialforaplanetostrikeoneof Safety Board (NTSB)saystherisksofacrashonground represent the lead report onthisissuestatingthat “We’ve beenlivingonluckfortoolong.” Rosenker. Rosenker wasquotedattheNTSBForum asstating, been galvanizedbythestatementofNTSBChairmanMark need ofresolution. Governmentagenciesaround theworldhave cable afteraspecificoccurrence hastaken place. assessment shouldbeconductedassoonreasonably practi- hood andconsequenceforrecurrence. objective wastoassesseachincursionwithrespect toitslikeli- ment wascontainedintheseverityclassification.Theprimary simple classificationacross theindustryinameaningfulway. neuvering areas. Itprovided thebasisofstandardization and the interfaceofaircraft, airtrafficcontrol andvehiclesonma- was toaddress thetopicofrunwayincursionsgeneratedthrough Runway Incursions try fragmentation,ICAOproduced the ized setofdata. c. developacommonrunwayincursiondatabasewithstandard- sions. sion severity, error typeand/orfactorsthatcontributetoincur- b. developacommoncategorizationtaxonomy ofrunwayincur- a. developacommondefinitionofrunwayincursion. runway incursions. ward achievingglobalriskreduction andimproving riskmanagementof The investigativeperspectivebecomescomplex followingan This unfortunateprediction wasnearlyfulfilledonMay25in In addition, Despite subsequentpositiveprogress, manyissuesare stillin The followingseverityclassificationschemewasprovided: As inanyfundamentalinvestigation,itwasstressed thatany With regard toanalysisofgloballygathered data,thekey ele- As aconsequenceoftheworkingpaperandanoverallindus- It produced therecommendation “Every category Aisaseriousevent,andit is aseriousconcern category “Every 1/14/2008, 9:44 AM USA Today in 2006.Theexpress purposeofthisManual 9 provided thetravelingpublicwitha 8 “The NationalTransportation“The thatICAO Manual forPreventing a mistake.” The controller, with about 20 years of experience, was re- phony standards during recurrent training was introduced. quired to be recertified for his job, Gregor said. Most U.K. airports have now developed local runway safety teams (in line with a Eurocontrol initiative) to assess the safety risks, mark- ing particular physical areas of concern as ‘hot spots’ and then take action to eliminate the risk. Recent statistics show that incidents appear to be on the rise at regional airports while they are reducing at the major international airports. They have, therefore, devised specific publicity aimed at general aviation pilots. All work and findings have been shared with Eurocontrol to help feedback into the bigger picture. Work continues on a number of areas including a study into continuous 24-hour operation of runway stop bars and a pilot’s organization proposal that aircraft switch on high-intensity lights when approaching or entering a runway. Ultimately, as with all safety-related activities involving human 6.0 Regulatory activity beings, there will never be a total eradication of runway incur- Regulatory agencies have responded substantially to the hazards sions. UKCAA continues to strive for the lowest level of incidents of runway incursions, and in particular, since the publication of possible and targets the trends or observed serious incidents that ICAO Doc. 9870. Typical of many responses has been the provi- pose the greatest risk to safety. sion of a watching brief and a formal oversight of organizational The steering group demonstrated a model example of how an safety management system elements that defend against the like- effective regulator and the aviation sector can work together. This lihood and consequence of runway incursion. level of partnership is also vital on an international scale if it Transport Canada cites the following key results in its over- seeks to introduce common effective technological solutions and sight program, which has been active since 2000: best-practice protocols and safety measures. • Mitigation monitoring. Much of the success associated with the UKCAA publicity re-

• Reduction of “extreme” occurrences reported. lated to an easily identifiable logo. This symbol focused the in- SESSION 4—Moderator Richard Breuhaus • Awareness training resulted in a “leveling off ” or stabilization dustry through regular association and has reinforced the project of reported incursions. objectives. • A shift from “awareness training” to more of a monitoring role. • Incursion database maintenance. • Analysis of contributing factors. • Development of —Awareness training. —Safety presentations (all operations). —Safety posters. —Safety videos. Similarly, the United Kingdom Civil Aviation Authority This logo, in turn, became a focal point for a number of success- (UKCAA) has actively demonstrated an effective oversight of ful posters that presented a simplified message to aircrew of all mitigation strategies for the runway incursion hazard. levels. The following poster, in particular, highlighted the human Its first success was publicizing the issue with industry. A series performance limitations associated with routine airport operations. of posters, leaflets, and other publicity material—all featuring specially designed runway incursion branding—made those involved much more aware of the issue and they then set about tackling these issues, as the increase in reporting showed. They also know that the educational impact of the material has helped as it specifically targeted certain sectors of the industry (i.e., airside drivers, pilots, and air traffic controllers). The new reporting levels, of course, meant extra work for the data group; as well as collecting the data, they created a more precise picture on the more frequent causes of incidents, which could then be tackled more effectively (e.g., by identifying developing trends that were addressed by proactive measures before they became genuine risks to safety). Moreover, this analysis of data showed that many incidents resulted from those involved failing to follow standard proce- 7.0 The manufacturers dures. The group therefore targeted drivers, pilots, and air traf- Robert Sumwalt of the NTSB believes that cockpit-based systems fic controllers outlining the importance of following procedures will eventually have the capacity to overlay an aircraft’s “real time” accurately, emphasizing specifics such as best practice while taxiing; position onto electronic airport maps, therefore, reducing the and a CAA requirement for aircrew to be assessed on radio tele- likelihood of runway incursions.

ISASI 2007 Proceedings • 93

Proceedings 2007.pmd 93 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS runway incursions,couldsoonprovide solutionstotheproblem on electronic flightbags(EFBs)andagroundswell ofconcernabout product developmenteffortsinindustry, spawnedpartlybynewguidance uct thatwecansay, ‘Put thisontheaircraft,’” saysSumwalt.Butnew 94 Stakeholders shouldactivelyapply thestandardized process col- Standardization ofcategorizationand contributoryfactors • the minimumnecessarytosupportsafeoperations. way crossings (underpower ortow)are prevented orreduced to Stakeholders needtovalidatepractices whereby unnecessaryrun- Airfielddesign • the valuesofclearandunambiguousphraseology. All stakeholders needtounderstand,practice,anddemonstrate • operational effort: eas present thegreatest safetybenefitfortheleastexpenditure of the utilizationofallavailableresources. Thefollowing broad ar- the shortterm. cedure thatcancurrently inoculateusfrom theconsequencesin to trafficgrowth inourindustry. There isnoonepractice or pro- The hazards associatedwithrunwayincursionsare proportional 8.0 Thewayahead some timethisyear.” product mightbeavailable,butplantodemonstratethepackage whether thesystemwillincludeamoving-mapdisplayorwhen compute potentialconflicts.Thecompaniesare notsaying an aircraft’s positioninrelation torunways,make itpossibleto the facility. transponder returns, andamultilaterationsystemsetuparound for towercontrollers through acombinationofradar, onboard system pinpointsthelocationofaircraft nearorontheairport airports andslatedbytheFAA toberolled outto27others. The formation joinedwithSensis’ground infrastructure. using Honeywell’sonboard collisionavoidanceandairportin- cockpit andsimultaneouslytoairtrafficcontrollers inthetower send automatedadvisoriesofpotentialcollisionsdirectly tothe ‘real-time runwayincursioncockpitadvisorycapability’thatwill competing solution.Thetwocompaniesare collaboratingona tional (July9,2007): may deliverevengreater progress asreported inFlightInterna- tion equipment. ity willholdthekey tofurtheradvancesinairbornebaseddetec- tial outlayare complex certificationprocesses andmaintenance. the significantunitcostprecludes widedistribution.Alliedtoini- around theworld.Thisisagoodstarttoward asolutionhowever EFB with“ownship”positionandmovingmapsfor200airports It hasbecomeincreasingly apparent thatthesolutionlieswithin To FlightInternational,hestatedthat “That data,combinedwithHoneywellproducts“That thatdetermine “Sensis buildstheASDE-X systemnowinstalledateightU.S. “Honeywell andSensiscouldcomeupwithamore generic Collaboration betweencompetitorsandindustrystakeholders It isanticipatedthataprogressive rollout ofADS-B functional- Currently, Boeingoffersanapproved ClassIIIfullyintegrated Communications • ISASI 2007 ISASI Proceedings 94 “I can’tyetpointtoaprod- 10 .” Mitch Serber—ALPA Jim Burin—FlightSafetyFoundation David Carbaugh—Boeing Joe Beaudoin—U.S. Mike Doiron—Transport Canada Mike Edwards—NATS David Harvey—AirservicesAustralia Ben Alcott—U.K.CAA Bert Ruitenberg—IFATCA Darren Gaines—NATCA Monica Mullane—NAV CANADA Ladislav Mika—MoTCzechRepublic ing inorder toenhancesafetywithintheirindustry. safety professionals withaglobalperspectiveoninformationshar- Traffic ServicesWorking Group. This documenthasbeenprepared asaproduct Air oftheISASI Acknowledgements 10 9 8 7 6 5 4 3 2 1 Endnotes tive airportoperations. be reduced totheminimumextent necessaryforsafeandeffec- The capacityofairsidevehiclestoaccessmaneuveringareas must • of runwaysafetyandtrafficexpedition. Tower operatingprocedures mustbalancethecompetingneeds • lighted insitespecificairportbriefingmaterials. tion toensure thatidentifiedprecursors toincursionsare high- Procedural operationsontheflightdeckrequire harmoniza- • dustry awareness. mulgation ofderiveddataandcontributoryfactorswillraisein- to theformulationofrunwayincursionmitigationstrategies.Pro- Occurrence reporting andsubsequentinvestigationsare critical Occurrence reporting, investigation, andsafetypromotion • phenomenon. lated anddistributedbyICAOtofurtheraidanalysisofthe http://www.usatoday.com/news/nation/2007-04-05-runway-safety_N.htm. Recommendation 2:Developmentofglobalrunwayincursionriskman- EleventhAirNavigationConference, Montreal, September 22toOctober Final Approach RunwayOccupancySignal. RunwayIncursionForum: Promoting RunwaySafety, Arlington, Virginia: FlightInternational,June2007. http://www.faa.gov/runwaysafety/pdf/blueprint1.pdf. FINALREPORT 98-85/S-14N193DN,Boeing767Dec.10,1998, Procedures for AirNavigationServices—AirTraffic Management(PANS- aid-runway-incursion-problem.html. agement information. 3, 2003,Doc.9870.2006. March 27,2007. Amsterdam Airport. ATM, Doc4444). http://www.flightglobal.com/articles/2007/07/09/215421/cockpit-techs-to- The followingcontributorsare gratefullyacknowledged: It represents contributionsmadebyadedicatedgroup ofair Airside vehiclemanagement Control towerprocedures Flightdeck procedures 1/14/2008, 9:44 AM ◆ Flight Data—What Every Investigator Should Know By Michael R. Poole, Managing Partner, Flightscape and Simon Lie, Associate Technical Fellow, Boeing Air Safety Investigation

Mike Poole is a professional engineer with a current pilot’s license. He represented Canada as the national expert panel member to the International Civil Aviation Organization’s Flight Recorder Panel. He’s worked for more than 20 years with the Transportation Safety Board of Canada where he was the head of the Flight Recorder and Performance Laboratory and the Flight Recorder Group chairman on all major accidents, the most recent being Swissair 111. Mike is now one of the principals at Flightscape, a flight sciences company specializing in flight data analysis software.

Simon Lie is an associate technical fellow and air safety investigator at Boeing Commercial Airplanes. He has an academic background in composite Figure 1. Recovery of the Boeing S-307 that ditched in Elliott

structures and aeroelasticity, and spent 10 years of his Bay near Seattle, Wash., on March 28, 2002. The image below SESSION 4—Moderator Richard Breuhaus career at Boeing troubleshooting predelivery issues on has been compressed to 1% of the file size of the original image the B-747, -767, and -777 aircraft. Simon led above. The challenge of correctly interpreting the scene on the Boeing support of the numerous accident investiga- right is analogous to the challenge of interpreting recorded flight tions including Singapore Airlines B-747 Taipei 2000, China Airlines data, which are usually much less than 1% of the data available B-747 Taiwan 2002, Flash Air B-737 Egypt 2004, and Mandala on board the aircraft. Airlines B-737 Indonesia 2005.

Abstract This paper summarizes issues that every investigator or airline Flight Operations Quality Assurance (FOQA) analyst should know about flight data and, in particular, how the information can be misleading if not fully understood. The process from recovery to final report is presented from a high-level perspective, citing actual examples from major international investigations where the data were initially misleading. The correct interpretation of flight data and/or audio data requires a full understanding of the entire signal path from measurement to recorder to investigator. Understanding the underlying principles of the process is para- mount to successful interpretation. While not all investigators can have this level of expertise, it is important that they are aware ingly being used for investigation and airline safety programs. of the types of problems that have been seen in the past but are Modern aircraft record a huge amount of data compared to just generally little known outside of the flight recorder laboratory. a few years ago, but even in the most advanced aircraft recording Major international investigations generate significant pres- systems, significantly less than 1% of the available data are actu- sure to disseminate information both within the team and exter- ally recorded. The challenge of analyzing flight data is to recre- nally. Counteracting this pressure is the need to properly vali- ate an accurate understanding of an event from that small per- date and understand the flight data. Balancing how much vali- centage of the available data. To illustrate this challenge, the two dation is sufficient before disseminating flight data is an important photos shown in Figure 1 depict the same scene. The image on issue for the investigation team. This paper will also demonstrate the right has been compressed to retain only 1% of the data. an example of two flight animations of the same data with differ- It is not difficult to imagine that important details might be ing results and explain why. overlooked or misinterpreted if the image on the right is the only data available. However, given detailed a priori knowledge Introduction of the dimensions, weights, and capabilities of the airplane, crane, Flight data are becoming more readily accessible and are increas- barge, and related operating procedures, the right-hand image

ISASI 2007 Proceedings • 95

Proceedings 2007.pmd 95 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS it wasprocessed. requires afullunderstandingoftheoriginflightdataandhow trol panel.Asthesetwoexamples demonstrate,scientificrigor heading chosenbytheflightcrew viatheautoflightmodecon- the flightcrew. Inthelatter, “Selected”meansthe target valueof to bethemostaccurateandthushasbeenselectedfordisplay ent sensorsare availableandthisparticularvaluehasbeenjudged “Selected” indicatesthatmultiplefuelflowreadings from differ- ployed bythereplay ground station. understanding oftheprovenance includingthemethodsem- the correct interpretation ofanFDRrecording requires afull increases thepotentialtomislead.There are manyexamples where that are becomingprogressively more automated,whichinturn conclusions. There isaproliferation offlightdataanalysistools enance” oftheflightdata,especiallywhendrawingsubstantive investigators andairlineFOQAanalystsappreciate the“prov- ties considerflightdataanalysisasaspecialty. Itisimportantthat misinterpretation, whichiswhymostmajorinvestigativeauthori- analysis ofFDRdatarequires careful attentiontodetailavoid can provide anaccuratepicture ofwhathappened.Similarly, the 96 According tothe Provenance craft: two different parametersthatare recorded air- oncertainB-737 even thenamingofparameterscanleadtoconfusion.Consider derstanding theoriginandhistory. Asparametersproliferate, clusions whenreviewing recorded flightdatawithoutfullyun- authors haveseenprofessional investigatorsreach mistaken con- The sameprincipleappliestorecorded flightdata.Bothofthe gin andhistoryofthedatahasbeenreviewed andunderstood. table scientificjournalpublishesresearch results unlesstheori- the originofdataandhowwere processed. Norepu- The scientificevaluationofdatarequires anunderstanding of The scienceofflightdata utilized duringaninvestigation. through anumberofdistincttransformationsbefore being The dataoriginateinthemodecontrol panelandpasses selected heading Figure 2.Agraphicaldepictionoftheprovenance ofthe this valuetotheflightcontrol computer (FCC). TheFCCuses (MCP) tochooseaheadingthey wishtofly. TheMCPtransmits flight crew usesthe headingwindowonthemodecontrol panel gation.” Considerthe“Selected Heading”example above. The various systemcomponentsuntilitisinterpreted foraninvesti- system stateandthechangestothatrecord asitpassesthrough the definitionbecomes“arecord ofaphysicalmeasurement or various owners.”Adaptedforthecontext ofrecorded flightdata, of theultimatederivationandpassageanitemthrough its • ISASI 2007 ISASI Selected Fuel Flow Proceedings Oxford EnglishDictionary parameterrecorded onaB-737-300FDR. 96 and Selected Heading , provenance . Intheformer, the is“arecord not completedbefore theairplanedescendedintoRedSea. reached 110°rightbank.Arecovery attemptwasmadebut rolled outoftheleftturnandintoarightbankthateventually the investigation.Theairplanebeganleftturnbutthen depth ofmore than1,000metersandprovided datausedduring the page.TheFDRandCVRwere subsequentlyrecovered from a result inorresult from arightturntendtoward thebottomof values) isintentional.Byconvention,parametervaluesthat heading andselectedscales(from highervaluestolower at thisphaseofflight.Theunorthodoxarrangementthe as avalueequaltotherunwayheading(220°)wouldbeexpected recorded everysecond.Thevalueattime123secondsisunusual recorded onceevery64seconds.Theotherthree parametersare parameters duringtheaccidentflight.Selectedheadingis Figure 3.Altitude,airspeed,heading,andselectedheading SU-ZCF, crashedintotheRed Seashortlyaftertakeoff from Sharm Airlines FlightFSH604,aBoeing 737-300,Egyptianregistration On Jan.3,2004,about02:45:06 UTC,04:45:06localtime,Flash example B-737-700 changes canaffecttheresults. must befullyunderstoodasbothintendedandunintended is thepotentialforachangetosignal.Therefore, eachstep the samechain—butnotalways.Ateachstepofchain, there In practice,parametersthathavethesamesource oftenshare pictorial format. dent orincidentinvestigator. Figure 2showsthesignalchainin format. Finally, thedatarepresentation isinterpreted bytheacci- is represented asaplot,table,animation,orpossiblyanother back intoengineeringunits(i.e.,degrees). Theconvertedvalue subsequently extracted andconvertedfrom rawbinaryformat solid-state memoryasasequenceofonesandzeros. Thedataare FDR writesthevaluetoeithermagnetictapeor(wecanhope) from The theFCCuntilitisscheduledtobewrittenFDR. signal chain,wefindthattheDFDAU stores thevaluesitreceives flight dataacquisitionunit(DFDAU). Continuingtofollowthe behavior. Inaddition,theFCCtransmitsvaluetodigital the valueforcomputingcorrect flightdirector andautopilot In theory, eachparametermayhaveitsownuniquesignal chain. 1/14/2008, 9:44 AM to intercept the 306 radial from Sharm el-Sheikh VOR station located just north of Runway 22R.1 The FDR and CVR were subsequently recovered from a depth of more than 1,000 meters and provided data used during the investigation. The airplane began the left turn but then rolled out of the left turn and into a right bank that eventually reached 110° right bank. A recovery attempt was made but was not completed before the airplane descended into the Red Sea. The FDR recorded that the departure was flown with the use of the captain’s and first officer’s flight directors in heading select mode. In this mode, the flight director provides roll guidance to turn the airplane toward and hold a “selected heading” set by the flight crew on the mode control panel. Accordingly, investigative attention turned to the recorded values of selected heading on the FDR. Figure 3 depicts the airplane heading, selected heading, altitude, and airspeed during the accident flight. Heading, computed airspeed, and altitude are recorded each second. Selected heading is recorded once every 64 seconds. Stan- dard practice calls for setting the selected heading equal to run- Figure 4. Altitude, airspeed, heading, and selected heading way heading during take off. At time 59 seconds, before the air- parameters during an earlier flight. Although selected heading plane turns onto the runway, the recorded value of selected head- generally follows actual heading as would be expected, there are ing2 was 220° (runway heading) as expected. At time 123 seconds, repeated instances where unexpected values of 360° are just prior to rotation, the recorded value was 360°. Later during recorded. the flight, the recorded values were to the left of the airplane heading, as would be expected during a left turn. The 360° value

was unusual as the expected value would still be runway heading SESSION 4—Moderator Richard Breuhaus at this point of the takeoff roll. The recorded selected heading data could have indicated an unusual procedure by the flight crew, a malfunction of the mode control panel or flight control computer, or something else. Thus, one focus of the investigation was to understand the actual reason for the unusual reading. When examining unexpected FDR data, a common practice is to use the entire 25-hour record to determine if the unusual behavior has been present on previous flights. Figure 4 depicts the same four parameters from an earlier flight recorded on the FDR. The recorded values of selected heading generally followed the actual heading (as expected), but there were repeated instances where the two differed and the selected heading was recorded as 360°. During some of the times that the 360° values were recorded, the airplane was flying on a heading of approximately 315° with the autopilot engaged in heading select mode. With the selected heading 45° to the right of the actual heading the airplane would have been expected to begin a right turn toward 360°. However, Figure 5. A portion of the same flight depicted in Figure 4 (note no such behavior was observed in the recorded data. Figure 5 change in time scale). The unexpected 360° values of selected depicts a portion of the same flight as shown in Figure 4 at a heading alternate with values coincident with the actual different time scale. The unexpected 360° degree values can be airplane heading (expected values). seen to alternate with values coincident with the actual airplane heading. el-Sheikh International Airport (SSH) in South Sinai, Egypt. The A common practice among DFDAU manufacturers is to use flight was a passenger charter flight to Charles de Gaulle Airport alternating patterns to indicate errors in the FDR data. For ex- (CDG), France, with a stopover in Cairo International Airport ample, “stale data” occur when a source stops transmitting data (CAI) for refueling. Flight 604 departed from Sharm el-Sheikh to the DFDAU or the transmitted data are not received by the airport with two pilots (captain and first officer), one observer, DFDAU. Consultation with the manufacturer of the DFDAU con- four cabin crew, six off-duty crew members, and 135 passengers firmed that the alternating pattern observed in the FDR data on board. The airplane was destroyed due to impact forces with from the accident flight was an error code indicating “stale data,” the Red Sea with no survivors. which originated in the DFDAU. The stale data error code is an The airplane had departed from Sharm el-Sheikh Runway 22R alternating sequence of 409510 counts (i.e., 1111111111112) and and was airborne at 02:42:33 UTC, approximately 2½ minutes the last value received3. For selected heading, 409510 counts con- prior to the crash, and had been cleared for a climbing left turn verts to 360°, therefore the stale data error code consists of re-

ISASI 2007 Proceedings • 97

Proceedings 2007.pmd 97 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS rameter same behaviorwasalsodiscovered intheselectedcourse#1pa- between anexpected valueand360°.AsshowninFigure 6,the the samebehavior—selectedheadingoccasionallyalternated data from thesistership.Anexamination ofthatdataconfirmed accident airplane,theEgyptianMCAprovided 25hoursofFDR be incorrect. heading transmissiontotheDFDAU. Suchaconclusionwould had malfunctionedasevidencedbytheapparent lackofselected the inquiryhadendedhere, onemightconcludethat theFCC corded valuesof360°alternatingwiththelastvaluereceived. If 98 selected headingand course#1were transmitted to the data valuechange. writing thestaledataerror codeuntileitherthecountervalueor three consecutivestalesamples,theDFDAUis stale.After begins and thedatavalueare thesame,DFDAU concludesthevalue DFDAU concludesthedataare fresh. Ifboththecountervalue Ifeitherthecountervalueor datavalueisdifferent, the • time asamplewassenttotheFDR. pares thevalueof countertothevalueoflast theDFDAU When scheduledtowriteavaluetheFDR, com- • samples ithasreceived from thesource (inthiscasetheFCC). TheDFDAU usesan8-bitcountertotrackthenumberofdata • detected asfollows: stale data.According totheDFDAU manufacturer, staledataare plain theanomaly. cessed compared totheselectedcourse#2datathatwouldex- selected headingandcourse#1parameterswere pro- observed data.Perhaps there wassomedifference intheway that somesortofdesigncharacteristicwasresponsible forthe either airplane.Basedonthesediscoveries,thepossibilityarose heading andselectedcourse#1. ship exhibitedthesameunexpectedvaluesinselected every 64seconds.FDRdatafrom theaccidentsairplane’ssister in selectedcourse#2.Allthree parametersare recorded once were alsoobservedintheselectedcourse#1parameterbutnot Figure 6.Similartoselectedheading,unexpectedvaluesof360° In additiontothe25hoursofFDRdataavailablefrom the Consulting withtheFCCmanufacturer, itwasdetermined that Accordingly, theinquiryfocusedonhowDFDAU detected • ISASI 2007 ISASI 4 onbothairplanesbutnotintheselectedcourse#2 Proceedings 98 #2. Thecapacityofan8-bitcounteris256 transmit intervalis640to1asthecaseforselectedcourse Figure 7.Behaviorofan8-bitcounterwhenthereceive-to- for theanalysisportionofinvestigation. processed the selectedheadingdata.Thesewere thedataused account fortheanomalydiscovered inthewayDFDAU Figure 9.Thesamedataasdepicted inFigure 1corrected to result thattheDFDAU correctly detectsthatthedataare fresh. previous value)whenthenextsampleistransmittedwith different value(thatdiffersbyapproximately 128from the counter whenasampleistransmitted,thewillbeat times) betweeneachtransmission.Regardless ofthevalue operation, thecounterwill“roll over”twice(orpossiblythree The capacityofan8-bitcounter is0-255or256distinctvalues. lized forselectedcourse#2(receive totransmitratio of640to1). rate of10Hzforaratio640 to1. was transmittedbytheFCC(andreceived bytheDFDAU) ata seconds—a ratioof1,280to1.Incontrast,selectedcourse #2 heading dataonceevery50msandtransmittedit 64 DFDAU atarateof20Hz.Thus,theDFDAU received selected operation. incorrectly detectsthatthedataare staleduringnormal times betweeneachtransmission.Theresult isthatthe DFDAU and selectedcourse#1.Thecounterwillroll overexactlyfive transmit intervalis1,280to1asthecaseforselectedheading Figure 8.Behaviorofan8-bitcounterwhenthereceive-to- Figure 7depicts thebehaviorof8-bitcounterwhenuti- 1/14/2008, 9:44 AM 5 . Duringnormal tion capability of the DFDAU was responsible for the unexpected value of selected heading recorded on the FDR and that the actual value of selected heading at this time was 220°. The corrected value shown in Figure 9 depicts the data used for the analysis portion of the investigation. As often occurs, this investigation uncovered a finding not related to the accident itself—that the DFDAU did not correctly process data when the receive interval-to-transmit interval ratio was a multiple of 2567. A full understanding of the provenance of the FDR data allowed for the correct interpretation of that data for subsequent use in the analysis of the accident.

Flight data processing As shown in Figure 10, flight data can be processed and used in Figure 10. Flight data must be converted from raw binary two fundamentally different ways. One way is to convert the bi- format to engineering units for use in plotting and animations. nary ones and zeros into engineering units data and produce The most common method is to perform the conversion one time CSV (comma separated variables) files, which are similar to what and store the results as engineering units, often in CSV files. The you would see in an Excel spreadsheet. The other, which is rare, conversion process itself can affect the relative timing and is to interactively work with the binary data on a demand basis. precision of data. Unfortunately, the conversion details are The first method (CSV) is the most frequently used in the airline almost never provided—thus a portion of the provenance of the FOQA industry because the CSV format can be interchanged data is lost. A better method is to work interactively with the raw with nearly any computer system and software package. The sec- data performing explicit conversions only when needed. ond method (binary) requires software applications that have a built-in engineering unit conversion process that allows interac- During normal operation, the 8-bit counter will reach its maxi- tion with the actual raw flight data. The CSV method can intro-

mum value and “roll over” back to zero at least twice and possibly duce several problems that can, in some cases, make it unaccept- SESSION 4—Moderator Richard Breuhaus three times as the 640 samples are received by the DFDAU be- able for an accident investigation owing to the inability to trace tween each sample transmitted to the FDR. Regardless of the the provenance of the data and high potential to produce mis- value of the counter when a sample is transmitted, the counter leading results. will be at a different value (that differs by approximately 128 By way of example, Figure 11 depicts three CSV files gener- from the previous value) when the next sample is transmitted. ated with different options from the same source binary file. Each The result is that the DFDAU can correctly determine if the data table lists the parameters across the top against time for each line are fresh or stale. of data. The table on the left discretizes time based on the high- Applying the same analysis to selected heading and selected est sample rate of the data in the table (in this case the 8 Hz course #1 yields a different result. Figure 8 depicts the situation vertical acceleration parameter). This is the most compact and when the ratio of receive-to-transmit interval is 1,280 to 1. In this most frequently used method to convert flight data. It is also the case, the counter rolls over exactly five times between each trans- most commonly used method to transmit converted data. The mittal to the FDR. Normal operation will result in the counter center table shows an expanded time base that includes the ac- value being the same when successive samples are transmitted to tual sample time for each entry in the table. This method makes the FDR. If the parameter value has not changed, the DFDAU the table larger in length but shows the relative timing between will incorrectly detect that the data are stale, even though the the parameters selected. The table on the right demonstrates correct number of samples (1,280) has been received. what happens when the same principle is used to generate a table The anomalies in the selected heading and selected course #1 that includes parameters from each of the 64 words recorded parameters occurred frequently but not in every instance during each second8. which the above conditions are met. The last step in the inquiry From Figure 11 (next page), it can be seen that the length of determined that the exact receive-to-transmission ratio depended the table is growing in size from the left to right. A first-genera- upon the relative timing between the FCC internal clock and the tion FDR recording at 64 wps will record 5,760,000 words over DFDAU internal clock, known as jitter6. Occasionally, the DFDAU 25 hours. The equivalent to the table on the right side of Figure would detect 1,279 or 1,281 samples instead of 1,280, in which 11 would, therefore, require 5,760,000 lines. To display the en- case the data would be treated as fresh. tire data set in Microsoft Excel would require 180 spreadsheets Once the behavior of the stale data detection algorithm was due to the 32,000 line limit in Excel, assuming you have enough understood, it was a simple matter to correct the FDR data to columns to list all the parameters, which is not usually possible. A accurately reflect the selected heading values transmitted by the 512 wps QAR recording for 25 hours would require 1,440 Excel FCC. The DFDAU will only detect stale data if the parameter spreadsheets. Some QAR have up to a 400-hour capacity. Thus it value itself is unchanged. Therefore, it was possible to conclude is impractical to replicate the original binary file in a CSV forthat the selected heading transmitted by the FCC that resulted in mat. As a result, most data processed and transmitted in the CSV the 360° value recorded on the FDR must have been the same as format often compress the data such that each line of the file the previously recorded value—220, the runway heading. The represents one second and includes only a subset of the actual investigation concluded that the anomaly in the stale data detec- recorded parameters.

ISASI 2007 Proceedings • 99

Proceedings 2007.pmd 99 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 100 cise sampletimes(d data(line)andtheoriginalbinary dataattheirpre-inputs asCSV event.) Figure 12 showstheflightdataforfourHzside-stick the control algorithm.Neitherpriority buttonwasusedinthis the prioritybuttontoeliminateotherside-stickposition from craft. (Thealgebraic-sumalgorithmisusedunlessonepilotpresses performs analgebraicsumofthetwoinputstocommand airside stickssimultaneously. Whenoperatedsimultaneously, theA320 A320 tailstrike, itwasdeterminedthatbothpilots operatedthe interactively withthebinarydata.Duringinvestigation ofan using aprocessed fileinsteadofworking engineeringunitsCSV The followingexample highlightstheproblems withacceptingand A320 example 1—CSVversusbinary sample timesare added. the lengthcanexpandasmore parameter The tableontherightdemonstrateshow observation ofthefourparameterslisted. table liststheactualsampletimeforeach different parametersislost.Thecenter format, buttherelative timingbetweenthe acceleration). Itisthemostcompact displayed data(inthiscase8Hzvertical on thehighestsampleratedatain table ontheleftlistsdiscrete timesbased same flightdataintabularformat.The Figure 11.Three methodsofdisplayingthe requires theoriginalrawbinarydata. airlines requesting anevaluationofevent.Instead,Boeing verified. For thesereasons, datafrom BoeingdoesnotacceptCSV it doesnotallowtheprovenance ofthedatatobechecked and filedoesnotincludetheconversionalgorithmsthemselves, CSV file.Further,solely onthedatainoriginalCSV becausethe realize thatadditionalparameterswere recorded andinsteadrely ing inasignificantdelay).Atworst,theinvestigatorsmaynot they begintheirworkandfocusonaparticulararea (oftenresult- investigators are forced torequest additionalparametersonce ated bytheinvestigatorsandwhichare tobeignored. Atbest,the filemustdecidewhichparametersareator ofaCSV tobeevalu- ence betweenthetwoprocessing methodsmayseem veryminor— 1 Hzdata,thetimeshiftwould bemore pronounced. Thediffer- to thenearest quartersecond.Hadthisexample beendonewith file is truncated to theleftbyafractionofsecond sincetheCSV The CSV methodrequiresThe CSV anumberofcompromises. Thecre- • ISASI 2007 ISASI Proceedings iamonds). As e 100 xpected, thelineisshiftedslightly tible tomechanicalvibrations suchasthosethatoccurduringtur- frequent withmagnetictape-basedrecordings, which are suscep- binary datatorecover whatisknownasdata“dropouts.” Theseare The secondA320example highlightstheneedtoworkwith A320 example 2—recoveringdata“dropouts” conclusions. datacouldresultevent basedsolelyontheCSV inerroneous the processing. Itisnotdifficulttoimaginethatananalysisofthe which haveallthoseissuesaswellthetimeshiftresulting from data, enance issues,theyare considerablybetterthantheCSV have issuesregarding resolution, accuracy, latency, andotherprov- pitch inputs,isconsiderablydifferent. Whilethebinarydatastill the behaviorofsidesticks,andinparticularfirstofficer’s and binarybecomesdramatic.Atkey pointsintheanimation, shows thealgebraicsum.InFigure 13,theerror betweenCSV When bothare operatedtogether, thewhitehollowdiamond captain’s inputandthegraydiamondisfirstofficer’sinput. lower-right quadrantofeachimage.Thewhitediamondisthe dataarein thelower-leftquadrantandCSV showninthe tion. Thefirstofficeristhepilotflying.binarydataare shown corded side-stick position atvariouspointsduringtheanima- of thetimeshift.Figure 13containsscreenshots showingthere- and thebinarysource dataside-by-side todemonstratetheeffect file. time shiftintheCSV ough analysisoftheeventreveals theproblems introduced bythe surely nothingseriousthatwouldaffecttheanalysis. Amore-thor- A flight animation was developed using both the CSV data A flightanimationwasdevelopedusingboththeCSV 1/14/2008, 9:44 AM the position that some analysis of the data was necessary in order to ensure that the data produced was correct. As discussed in this paper, the processing of flight data is fraught with the potential for error as well as choices in the manner in which it will be produced. The best way to ensure the data have been processed correctly is to examine and analyze the data. If the data appear unusual or unexpected, start by ensuring that the signal chain or provenance of the data is fully understood. It is important to understand that readouts using different systems or different settings on the same system can produce different results. As noted above, different results are possible depending on the options selected (for example, timing options on the generation of a CSV file). The aircraft crashed short of the runway in daylight VFR conditions. At the moment of first impact, the initial playback “lost” one second of data due to vibration or jarring of the magnetic tape-based digital FDR. The initial investigation from the field concluded that a mild initial touchdown on the golf course was followed by a bounce and a second devastating impact. During the bounce, one engine spooled up and the other spooled down Figure 12. Comparison of A320 side-stick position data recorded at in response to the TOGA (take-off go-around) command. Early 4 Hz. The original binary data points are shown as diamonds. The beliefs were that if both engines had spooled up, it may have same data processed by the CSV method is shown as lines. Note the been possible to avoid the accident. In fact, some newspapers time shift as the CSV method positions the 4 Hz data to the nearest reported that Canadian experts believed that the engine failed ¼ second rather than at the actual time recorded. to respond and likely caused the accident (apparently because

bulence or a crash sequence. Data dropouts can also occur within the readout had occurred in Canada). SESSION 4—Moderator Richard Breuhaus solid-state recordings, primarily due to power interruptions. The software system originally developed at the TSB is unique On Feb. 14, 1990, an A320 crashed in Bangalore, India, with in that not only can it interactively work with binary data, but it the loss of 92 lives. The investigation was conducted by the High also has an extensive “wave-bit editor”—which enables investiga- Court of Karnataka, in accordance with Indian laws and regula- tors to study the waveform recorded on the magnetic tape, which tions. The Court initially decided to have the recorders replayed represents the digital ones and zeroes. Figure 14 is a sample at a local operator’s readout facility, but the operator did not screenshot9 that shows how the bits are interpreted from the raw have A320s in its fleet at the time and it was unable to playback waveform recorded on the magnetic tape. The bits are recorded at the FDR. The Court eventually decided to go to the Transpor- a constant rate in bit cells of constant length. A zero is encoded as tation Safety Board of Canada (TSB), where a request was made 180° of a sine wave within the allocated time while a one is en- for a “readout” of the data only with no analysis. The TSB took coded as 360° in the same interval. As shown on the third line of

Figure 13. LEFT: Still frames taken from portion of each screen depicts the motion is an artifact of the time shift of the CSV an animation of an A320 tail strike event of the captain’s controller, the gray data and the frequency of the first during which both pilots operated their diamond the first officer’s, and the white officer’s inputs. side-stick controllers simultaneously. The hollow diamond the algebraic sum. The RIGHT: At the time of the tail strike, lower portion of each screen depicts the first image is taken approximately 6 differences can be seen in the first officer’s location of the side-stick controllers. seconds prior to the tail strike. pitch input and in the algebraic sum. A Position based on the binary data are CENTER: Approximately 3 seconds later, performance evaluation of the airplane’s shown in the left quarter, and position the first officer’s pitch input appears to be response based on the CSV data will not based on CSV data are shown the in right opposite directions in the binary and CSV yield the same results as one based on the quarter. The white diamond in the lower data. In actuality, the apparent reversal binary data.

ISASI 2007 Proceedings • 101

Proceedings 2007.pmd 101 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 102 leading toerroneous conclusions data atthetimeoffirstimpactwouldnothavebeenrecovered the provenance ofthedata,itislikely thespecificonesecondof limited tothereadout withoutthenecessaryanalysis toconfirm operator forthereadout orhadthecontributionof TSBbeen the datafrom theBangalore accident.HadtheCourtgonetoan the waveformandcorrect errors suchastheonesthataffected maintenance purposestypicallydonothaveanyabilityto view focus oftheinvestigation. version from waveformtobinarybitstream, redirected theentire provenance ofthedata,specificallyreevaluation ofthecon- down duetodamagetheelectronic controls. Attentiontothe tact wassohard itwasthe“crash”andcausedengineto spool dent tothefirstcontact the initialconclusionthatenginemayhave over 6G,themaximumrangeofrecording. Thischanged corrected data revealed thattheverticalaccelerationpeaked at correct the“lost”onesecondofdata.However, once done,the first impact.Manualreview andcorrection required afulldayto similar problem areas inthewaveformaround thetimeof cialists andcanbemanuallyeditedusingtheanalysissoftware. single longone.Theerror isreadily detectablebythe FDR spe- Figure 13,aonefollowedbyzero was incorrectly interpreted asa worth ofdataislostasallthesubsequentbitsare shifted. followed byazero. Whensucherrors occur, anentire second been incorrectly interpreted asasingleonebitratherthan “cursor.” Onthethird lineoftheFigure, thelarge grayblockhas respectively. Thegrayhighlightlineindicatesthepositionof the background asblackorgrayrepresenting zero andonebits boxes around deducedlocationofeachbitcellandcolor-coded cal devices.For easeofanalysis,thereadout systemhasdrawn playback andotherinconvenientrealities inherent inmechani- stretch, variationsintapespeedduringeitherrecording, or variation inbitcelllengthevidentaboveistheresult oftape deduced from thewaveformbyreadout software. The cell. Theactuallocationofthecellsisnotknownandmustbe 360° or180°ofsinewave,respectively, withinafixed-lengthbit of asinusoidalwaveform.Aoneorzero isencodedaseither Figure 14.DigitalFDRdatarecorded onmagnetictapeconsists It shouldbenotedthatreadout facilitiesusedforFOQAor The FDRdatafrom theBangalore accidentcontainedseveral • ISASI 2007 ISASI Proceedings 102 being theaccident.Infact,firstcon- 11 . caused theacci- 10 preting flightdata. cesses withintheanalysissoftware isanecessarystepintheinter- each parameterandunderstandingthecapabilitiesreplay pro- recovery andconversionprocesses. Determiningtheprovenance of duced onboard theaccidentaircraft andduringthesubsequent 11 Inpartasaresult ofthisaccident,ICAO updatedAnnex 13,whichnow 10 Eachsecond,apredefined synchronization codeiswrittentotheFDR. 9 Theexample dataare notfrom theBangalore accidentwhichwasanNRZ 8 First generationdigitalrecorders usearecording rateof64twelve-bitwords 7 Asaresult ofthisfinding,theDFDAU manufacturer wasnotifiedofthe 6 Anotherinstanceofjitterisoftenseenintherecording ofUTCseconds. 5 Theactualvaluesan8-bitcountercanencodeare 0through 255,atotalof 4 SelectedcourseistheVOR radialselectedbytheflightcrew onthemode 3 Thesubscriptnotationusedinthisarticleindicatestheradixorbaseof 2 Inthisarticle,reported valuesofselectedheading are rounded tothe 1 FlashAirlinesFlight604Final Report, EgyptianMinistryofCivilAviation Endnotes be abletoworkwithandinteractivelyeditFDRsource dataat the bitlevel. difference betweenan“airline”and“investigation” facilityandtheneedto to includeguidelinesforstateswithoutreadout facilitiesthathighlightsthe ited representative totheinvestigation.Annex 13,AppendixD,wasupdated technical support(suchasFDRreadout) bepermittedtoappointanaccred- provides thatstatesconductsubstantialanalysisorprovide substantial extraneous) bitsinthedatastream. beginning ofeachseconddatathuslimitingtheeffectmissing (or The readout systemsearches forandusesthese“synccodes”toidentifythe format recording. grow accordingly. recording rates.ThelengthofthetableonleftsideFigure 3would per second(wps).Laterrecorders use128,256,512,andeven1024wps anomaly sothatnecessarycorrective actionscouldbetaken. 10 value willappeartobeoffbyonesecondresulting inapatternsuchas3,7, successive samplesmaybe3,7,11,15,19…).Occasionally, arecorded UTC secondsare typicallyrecorded atanintervaloffourseconds(e.g., counting atoneratherthanzero. This choicewasmadeforthebenefitofthatportionsocietywhichstarts because thevaluesportrayedforcounterare 1-256ratherthan0-255. 256 distinctvalues.Software engineersmayfindfaultwithfigures 7and8 enance ofthedataiswellunderstood. data ontheFDR—demonstratingyetanotherreason toensure theprov- A different parameterontheFDRindicateswhichFCCissource ofthe can receive datafrom bothFCC,butonlyrecords datafrom asingleFCC. data originatingfrom therightFCC,twoare swapped.TheDFDAU the captain’s courseandselected#2isthefirstofficer’scourse.In control panel.Indataoriginatingfrom theleftFCC,selectedcourse#1is have thesubscript10.Byconvention,radixitselfisexpressed inbase10. number. Thusbinarynumbershavethesubscript2anddecimal control panel. this parameteris0.088°,onlywholedegrees are selectableonthemode nearest wholedegree. Althoughtheresolution oftherecording systemfor 2006, page2. , 15,19…. 1/14/2008, 9:44 AM above demonstrateunintendedchangesintro- the potentialforerror. Theexamples discussed tion canintroduce unintendedchangesandthus decoding, conversion,andthefinalrepresenta- from measurement totransmission,recording, enance ofthedata.Eachstepinsignalchain data requires afullunderstandingoftheprov- should knowthatthecorrect interpretation offlight Every investigatororanalystwhousesflightdata Summary ◆ Sound Identification and Speaker Recognition for Aircraft Cockpit Voice Recorder By Yang Lin (AO5012), Center of Aviation Safety Technology (CAST) of CAAC, and Wu Anshan and Liu Enxiang, General Administration of Civil Aviation of China (CAAC), Air Safety Office

Yang Lin ([email protected]) has more than and classification of speech and non-speech CVR signals. 12 years of experience in the field of aviation safety The CVR records audio information on four channels. Non- and is a member of the International Society of Air speech information from the cockpit area microphone (CAM) is Safety Investigators (ISASI). Currently she is an air recorded on channel 1. CAM records thumps, clicks, and other safety investigator and senior engineer at the Civil sounds occurring in the cockpit other than speech. Channel 2 Aviation Safety Technical Center (CASTC) of Civil and 3 of the CVR record speech audio information from the cap- Aviation of China (CAAC), where she has been tain and first officer’s audio selector panels. Channel 4 records working since 1994. While at CASTC, she analyzes and presents the audio information from the jump seat/observer’s radio panel. recorded data in support of accident/incident investigations and also conducts flight data recorder readouts on behalf of government authori- Background of cockpit sound identification ties and airlines in China and other countries. She has helped to develop It may be hard to believe that non-speech sounds are highly im-

and apply CAAC regulatory policies for aviation recorders, FOQA, and portant to the investigation of aircraft damage because the back- SESSION 4—Moderator Richard Breuhaus other areas. Since 2005, she also worked for China Postal Airlines in ground cockpit sounds can reveal problem areas of the aircraft Beijing. Her duties include incident investigation, flight crew safety during the time leading up to the accident. Non-speech data awareness briefings, and flight data analysis program management. from the CAM can be analyzed with sound spectrum analysis to detect whirl flutter, as well as possibly distinguish the sound of a Wu Anshan ([email protected]) is a senior air safety investigator bomb explosion from the sound of cabin decompression. Spec- with CAAC, and has been at the CAAC since 1970. His primary role trum analysis can also be used to confirm that the clicks and has been to investigate the air traffic control and organizational aspects thumps recorded by the CAM are simply generated by cockpit of aviation accidents and incidents. He has substantially contributed to controls and the sound of the aircraft moving through the air. more than 20 significant investigations and has been actively involved Analysis background information recorded in aircraft CVRs in developing investigation methodology at the CAAC. has been proposed as a complement to the analysis of onboard FDRs in civil aircraft investigations. One reported case provides Liu Enxiang ([email protected]) is the deputy director at the CAAC’s a good example of the analysis of CVR data playing a key part in Office of Aviation Safety. He has been with the CAAC for more than 18 an aircraft accident investigation. In 1992, a 19-seater commuter years. Liu has participated in several national aircraft accident investi- aircraft crashed during an evening training mission. At that time, gations as an investigator-in-charge (IIC), as an expert in investigation the U.S. Federal Aviation Agency (FAA) did not require the in- of avionic equipment. He graduated from Nanjing University of Aero- stallation of FDR on board all small commercial aircrafts, and nautics and Astronautics with a degree in aeronautical engineering and the CVR on board the small jet that crashed was the only flight has commercial aviation aircraft maintenance experience. record available to provide clues to the causes of the accident. Fortunately, in this case, the CVR recording not only included s air transportation systems have expanded around the the voice communication, but also structural acoustics as well as world in recent decades, aviation safety and accident/inci- other sounds and noise sources. This allowed the accident inves- Adent prevention have assumed greater importance to gov- tigation to focus on the non-speech sounds taken from the CVR ernments and airlines. Aircraft accident investigation has a key tape. A close inspection of the time series from the CVR track role to play when an aircraft has an accident or unexpected revealed a periodic set of transient components occurring at a incident during flight operations. Traditionally the flight data frequency of 0.86 Hz. Comparing this frequency with an inde- recorder (FDR) has played the major role in establishing the pendent dynamic analysis of the engine mount damage, the 0.86 causes of most accidents or incidents. However, information Hz transient data were demonstrated by independent structural contained in the cockpit voice recorder (CVR) is also very use- and flutter analyses to be quite close to the frequency experi- ful during such investigations by providing a better understand- enced from a damaged engine mount. Moreover, there was a ing of the real situation. The CVR can act effectively as a latent sudden, loud sound at the end of the tape. This 25-millisecond- signal transducer for both speech and non-speech audio informa- long event was much louder than the sound in the cabin. Al- tion. Some typical techniques, such as sound identification, and though this short length of the sound did not provide adequate voice recognition, appear to offer significant clues in the analysis audio listening time, there was enough signal time and ampli-

ISASI 2007 Proceedings • 103

Proceedings 2007.pmd 103 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS mpeg-7 Low-Level Description” Identification ofAudioMaterialUsing nificant energy ordered listofindexes ofbandswith sig- of bandrepresentative vectorsthatisan rameters. Papaodysseus takes thechoice spectral flatnessmeasure asfeature pa- dio,” ing forSongDetectioninBroadcast Au- audio features in“Robust SoundModel- Cepstral Coefficients(MFCC)are usedas to extract audiofeatures. MelFrequency easy toimplement. Simplicity: inexpensive tocomputeand • storage. Compactness: smallenoughforeasy • modest noise. Robustness: stableenoughtovariouscodes,channels,and • audios. Discriminability: sensitiveenoughtodistinguishthedifferent • block offeatures from abigsegmentof by frame.Someapproaches compute a and asetoffeatures are extracted frame audio signalissegmentedinto framesfirst 104 the aircraft pitcheddown,rolled totherightandcrashed tion oftherightwingpaneloutboard oftheengine.Asaresult, horizontal surfaces.Thelossoftheenginealsoledtosepara- fallen enginestruckthetailofaircraft, damagingmostofthe starboard wingseparatedduringtheflight.Subsequently, the clusion drawnaftertheinvestigationwasthatengineon tude toperformwaveletandvoicerecognition analysis.Thecon- Figure 1. Identification System. Background CockpitSound Audio Information.” Storage, Retrieval, andSegmentationof Manufacture forContent-Based Analysis, following guidelines audio features. Generally, audiofeature designshouldobeythe print inacoustics.Anaudiofingerprintiscomposedofaseries nels, noise,andsoon.AnaudioIDisidentifiedbyfinger- frequency domainjustbecauseofdifferent codecs,bitrates,chan- that are from thesamesource andmaybedifferent intimeand cockpit sounddatabase.Theidenticalaudiosrefer totheaudios to findtheaudiosidenticalgivenaudioinbackground craft accidentinvestigations. plore theanalysisofaircraft CVRsoundsources foruseinair- Scotland, in1989duetoabombexplosion, motivatedustoex- that ofPan AmFlight103,whichdisintegratedoverLockerbie, There are manyapproaches available In oursystem,background cockpitsoundidentificationisused The results oftheaccidentinvestigationdescribedabove,and • 5 andin“MethodArticleof ISASI 2007 ISASI

Framework of 8 . Intheapproaches above, Proceedings 4 . 6 104 “Content-Based 7 takes extraction flowchart. Figure 2.Feature 1,2,3 . long as410millisecondsischosen. Frame shiftisonly12.8milli- each frame. equal logarithminterval.A32-bit audiofeature iscomputedfor tained. Atotalof33overlappedfrequency bandsare usedatan rier transformationisperformed,andspectrumpower is ob- mented intoframesandweightedbyahammingwindow. Fou- signals are downsampledto5,000Hzfirst.Thensignals are seg- encoded atverylowbitrates.Accordingly, inthis Systemaudio low 2,000Hz,high-frequency partsloseheavilywhenaudiosare Because humanhearingismostsensitivetothefrequencies be- Figure 2shows theaudiofeature extraction flowchartadopted. 2. Audiofeatureextraction approach tures ofpossibleidenticalaudiosandoutputsthebestcandidates. puted inadvance.Theaudiosearch modulecompares thefea- 2 below. Theaudiofeature databasestores theaudiofeatures com- computes theaudiofeatures usingalgorithmdescribed inSection ing, suchasdownsampling,andlowbandpassfiltering.Thenit result ofthematchprocess. audio database.Audiocandidatesare generatedaccording tothe dio features first.Audiofeatures are compared tothefeatures in base. Whenaudiosignalsare fedintotheSystem,itextracts au- three modules: feature extraction, audiosearch, andaudiodata- Figure 1 showstheframeworkofsystem.Itiscomposed Sound IdentificationSystem 1. Framework ofBackgroundCockpit in badquality. ods, anditslowsdowntheprocess dramaticallywhenaudiosare four timesormore spacetosavedatacompared toothermeth- Content Identification.” proposed inthispaperisbasedon“Robust AudioHashingfor cal audiosbyahashtable quickly andeffectively. System willbeabletosearch identicalaudiosinthedatabase features are ready, theBackground CockpitSoundIdentification hances therobustness ofaudiofeature significantly. Whenaudio proach carefully, weproposed animproved approach, whichen- is veryrobust tomanykindsofprocessing. Byanalyzingthisap- spectral bandenergy difference (bothintimeandfrequency axis) seconds. audio. Etantrumgetsa512-bitaudiofeature from aslong30 is achieved. cess. Thesearch spaceisreduced dramaticallyandhighefficiency of unpromising pathsare prunedawayduringthesearch pro- scores are higherthanthebeamwidthfrom thebestscore. Plenty based search approach cutsoffbrancheswhosecumulativematch instead offramebyframe,itcansearch audiosquickly. Thebeam- the distributioncomparisonisprocessed byablockofframes distribution willcontinuetogoinforthenext finematch.Since is regarded asthefirstrough search. Theaudioswithsimilar tion isthencompared tothatofagivenaudio.Thiscomparison tribution ofvectorcodewithinaperiodaudio.Thisdistribu- the vectorcodebookofaudiofeatures firstandobtainedthedis- In order tomake theaudiofeature stable,aframelengthas The feature extraction moduledoessomepreliminary process- Kimura adoptedatwo-passsearch strategy. The background cockpitsoundfeature extraction approach Haitsma presented amethodthatlocatesthepotentialidenti- 9 1/14/2008, 9:44 AM 4 4 Ittakes intoaccountthatthesignof . Itisquiteefficient.Butitneedsabout 10 Hegenerated seconds. As a result, the frame boundaries of audio queries in the worst case are 6.4 milliseconds off from the boundaries used in the database that are precomputed.

3. Audio search approach 3.1 Audio feature similarity measurement Each frame has one 32-bit audio feature. The similarity of two features is measured by the Hanning distance, which is the number of different bits. The smaller the Hanning distance, the more similar the two features are, vice versa. Bit error rate (BER) defines the similarity of two audio feature serials with the same length. Let X, Y are two audio feature serials, X={x1, x2,…, xN}, Y={y1, y2,…, yN}. Where N is the frame Figure 3. Feature robustness comparison under various number of the features. The BER between X and Y is conditions.

Where, H(.) is the Hanning distance between X and Y. Obvi- ously, 0d”BERd”1, the lower the BER is, the more similar the two feature serials are.

3.2 Beam-based search approach When searching audio candidates in the audio database, it will be of very low efficiency if a whole match comparison is pro-

cessed at every possible starting frame. A beam-based search strat- SESSION 4—Moderator Richard Breuhaus egy is presented in this System to avoid low efficiency. The main idea of this approach is that it takes the current best score as the base and prunes away all branches whose scores are higher than Figure 4. System performances under various conditions. the base plus the empirical threshold (beam width). 4.2 Audio search performance test 4. Experimental results Nearly 20-hour-long speech data are in the audio database. Five First, we used the Chinese National Project Speech Database as hundred 3-second audio segments are used as queries to be iden- test data. All silent parts at the beginning and the end of the tified. Precision rate and recall rate are used as the performance speech files are cut off. Speech files are merged into 5-minute- indicator. Precision rate is the ratio of the number of correct can- long files. Totally 20 hours of speech are used as the audio data- didates to the number of all candidates the system outputs. Re- base. Five hundred 3-second audio files are randomly picked out call rate is the ratio of the number of correct candidates to the from the database. These 3-second audios are used as the audios number of all queries to be identified. to be identified. All these speech data are originally in PCM 16K Figure 4 shows the performance of the system under different sample rate format. They are encoded by various codecs at dif- codecs and bit rates. AudioDB refers to the encoding and decod- ferent bit rate and then decoded to the PCM 8K sample rate ing method for the background cockpit sound database. Query wave files that are used in our experiments. refers to that for query audios. ORI refers to the original data not processed by any codecs. RTF refers to the real-time factor, which 4.1 Audio feature robustness test is the ratio of the average recognition time for one query to the The audio feature robustness test checks the degree of consis- total amount (time) of the audio database. tency between the features of original audios and the processed Figure 4 shows that the system works quite well for various ones by various codecs. The robustness of audio features can cases, and the search speed is reasonably fast. be measured by a BER of features. Fifty-minute-long data are tested in our experiments. We compared the performance of 4.3 Real CVR audio search performance test our approach and that of Haitsma’s approach. Figure 3 shows We performed two types of audio search tests in this study. First, the test results. Where MP3@32K means MP3 encoded and the following three types of sounds generated in the cockpit were decoded at 32K bit rate. BER1 are obtained by Haitsma’s ap- recorded as sound samples: proach, and BER2 are from our approach. It shows that our • Warning and alert signals such as GPWS, TCAS, engine fire, approach enhances the robustness of the audio feature consis- autopilot disengage, etc. tently at various codecs and bit rates. It reduces BER by 20.4% • Sounds generated by switches on central panel P2, glare shield on average. Additionally, we tested the robustness for the non- P7, and forward overhead panel P5. speech audio data. The results show there is no difference be- • Sounds generated by levers such as landing gear lever, thrust tween speech data and non-speech data for robustness in terms lever, speed-brake lever, and flap lever as well as stall warning of statistics. signals generated by the levers.

ISASI 2007 Proceedings • 105

Proceedings 2007.pmd 105 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 106 ture Models(GMM). of speechandmodelspectralinformationusingGaussian Mix- recognition usefeatures extracted from veryshort-timesegments text beingspoken (Figure 6). recognition trials,whereas thelatterdoesnotrely onaspecific words orsentenceshavingthesametext forbothtrainingand pendent methods.Theformerrequires thespeaker tosaykey methods canalsobedividedintotext-dependent andtext-inde- or rejecting theidentityclaimofaspeaker. Speaker recognition given utterance.Speaker verificationistheprocess ofaccepting the process of determiningwhichregistered speaker provides a his orhervoiceintheCVRrecording. Speaker identificationis identification andverification,identifiesaspeaker basedon tion transmittedinthespeechsignal,whichcanbeclassifiedinto the appropriate person. with spectrumanalysisinorder tomatchtherecorded voicesto The speechinformationrecorded bytheCVRcan beanalyzed Automatic speaker recognition Figure 5. variation andintra-speaker variationbynormalizationtechniques noise. Somemethodsare proposed tocompensateforchannel significant performancedegradation inthepresence of ambient proach, whilesuccessfulinmatchedacousticconditions, suffers ation ofspeaker verificationtechnologysince1995.Thisap- tion Evaluation(SRE). Institute ofStandards &Technology (NIST)Speaker Recogni- performance inevaluationcampaignssuchastheU.S.National (UBM)/GMM-based systemisnowcompulsorytoobtain good vers havethelowestscore. sounds havehigherscores; thesoundsgeneratedbyvariousle- ond typeofaudiosearch test,warning,andalertsignalsswitch recorded assoundsampleshavethehigherscore. Whileinsec- search teststhree typesofsoundsgeneratedinthecockpitwere lar thetwofeature seriesare. tests isshowninFigure 5.Thehigher thescore is,themore simi- with are thesameasinfirsttypeoftest.Theresult ofthese Thesoundsamplestosearchon tapeCVRandsolid-stateCVR. pit soundsamplesinthesamedatabase. samples werecorded earliertotestagainstallprerecorded cock- queries tobeidentified. Fifty audiosegmentsthatare lessthan3secondslongare usedas Current state-of-the-artsystemsfortext-independent speaker Automatic speaker recognition automaticallyextracts informa- From thetestresults, wecanseethatinthefirsttypeofaudio The secondtypeofaudiosearch testusesreal soundrecorded The firsttypeofaudiosearch testusesthecockpitsound Nearly 20hoursofaudiodataare savedintheaudiodatabase. • ISASI 2007 ISASI

Example ofsearching result. Proceedings 11 12,13 106 UsingaUniversalBackground Model NISThasconductedanannualevalu- which coversaspectssuchasthescalingoflikelihood scores. approaches tospeaker recognition isthatofscore normalization, chines (SVMs) the useofothermodelingtechniqueslike SupportVector Ma- tral informationbyGMMcanbeimproved orcomplementedby space. Figure 7.Framework ofAutomatic SpeakerRecognitionSystem. System. Figure 6. length andoralcavitystructure, sotheshort-time spectralisdiffer- ologic structure isdifferent foreachindividual,suchasthe track weighted processing. the highfrequency, everyframeofthespeechsignalusespre- half lengthofoneframe.To compensate fortheattenuationof ing thespeechsegmentby10ms-30ms.Theshiftlength isthe speech signal,theusualframeconceptisintroduced byshorten- The speechsignalissmoothedinshorttime.For analyzingthe 2. Speaker featureextraction approach els, whichcomposethespeaker modeldatabase. SVM modelingapproach isusedtotrainthetarget speaker mod- put front-end features characterizethespeaker. TheGMMor by robust techniques.Duringthespeaker modelingprocess, in- thermore, theinfluenceofchannelandenvironment isrestrained speaker features are drawnfrom theinputspeechsegments.Fur- recognition. Whenaudiosignalsare fed intotheSystem, three modules:feature extraction, speaker modeling,andspeaker Figure 7 showstheframeworkofSystem.Itiscomposed 1. Framework ofAutomaticSpeaker Recognition System feature mapping tional system. provide significantcomplementaryinformationtotheconven- been shownthatsystemsbasedonlonger-rangestylisticfeatures as lexical, rhythmic, andintonationalpatterns.Recently, ithas longer-range stylisticaspectsofaperson’s speakingbehavior, such such astheCepstralMeanSubtraction(CMS),feature warping There are twomainaspectsofspeaker features. First, thephysi- 20 However, short-term cepstralmodelingfailstocapture

Speaker IdentificationandVerification 21,22,23 1/14/2008, 9:44 AM 17,18,19 15 , andjointfactoranalysis. Anotherimportantissueinthestatistical , orbytransformationsofthecepstral 16 Modelingofspec- 23,24 14 , ground GMM using a Maximum a Posteriori (MAP) algorithm adaptation of the means of the Gaussian components. The resulting scores are T-normed.

3.2 Cepstral SVM system The cepstral SVM system is based on the cepstral sequence ker- Figure 8. Flow of nel proposed by “The Contribution of Cepstral and Stylistic Fea- speaker recognition. tures to SRI’s 2005 NIST Speaker Recognition Evaluation Sys- tem.”23 All of them use basic features, which are similar to the cepstral GMM system. The only difference is that MFCC features are appended with only delta and double delta features. This results in a 39-dimensional feature vector. This vector undergoes feature-transformation and mean-variance normalization using the same procedure as explained in the cepstral GMM system. Each normalized feature vector (39 dim) is concatenated with its second (39x39) and third (39x39x39) order polynomial coefficients. Mean and standard deviation of this vector are computed over the conversation side.

4. Speaker recognition approaches As mentioned above, the speaker recognition includes speaker verification and speaker identification. The speaker verification is determined by whether the test speech segment is uttered from Figure 9. Matrix of training and test segment conditions. the given target speaker or not. The result of recognition is “YES” or “NO,” and the comparison happens between one segment and

ent. Second, the uttered habits are different, such as an accent. It can one fixed speaker. The speaker identification is that given the test SESSION 4—Moderator Richard Breuhaus be described as prosody features. In the field of speech signal pro- speech segment. The system needs to choose the true speaker from cessing, the former is embodied on the structure of frequency. The the speaker models database. The key function is calculating the classical features include cepstral and pitch. And the latter is em- log likelihood of the input test speech features and one target bodied on the variability of the speech based on the spectral struc- speaker model. Its calculated method is denoted as follows: ture. The classical features include the delta cepstral and delta pitch. SX()=−log pX() |λλ log pX() | In speaker recognition, the cepstral is used mostly and could hyp UBM λ achieve a good performance. Besides, it can be extracted more Where SX() is the final output score, pX()| hyp is the prob- easily than other features. At present, the Mel Frequency Cepstral ability of the speech segment based on the hypothesis model; ()λ Coefficients are used successfully in speaker recognition, which is pX| UBM is the probability of the speech segment based proven in applications. In feature extractors of speaker systems, on UBM. The final output score SX() is according as the final all of the feature vectors are processed by CMS and the feature answer “YES” or “NO” by comparing with the system threshold. warping method. The flow of speaker recognition is shown in Figure 8. Using the delta cepstral information based on a time domain proves that the performance of speaker recognition is enhanced 5. Evaluation and experimental results mostly. In our system, speech data are parameterized every 25 5.1 NIST evaluation ms with 15 ms overlap between contiguous frames. For each frame, We used NIST 06 SRE tasks and data as training and test data. a feature vector with 52 dimensions is calculated: 13 Mel Fre- The NIST speaker evaluation method is introduced in this sec- quency Perceptual Linear Predictive (MFPLP) coefficients, 13 delta tion. The evaluation includes 15 different speaker detection tests cepstral, 13 double delta cepstral, and 13 triple cepstral. defined by the duration and type of the training and test data. Each of these tests involves one of five training conditions and one 3. Two of the speaker models of four test conditions. One of these tests (Figure 9) is designated 3.1 Cepstral GMM system as the core test. The task is to determine whether a specified speaker The GMM system uses a 100-3800 Hz bandwidth front end con- is speaking during a given segment of conversational speech. sisting of 24 MEL filters to compute 13 cepstral coefficients (C1- The task of speaker detection includes single speaker verifica- C13) with cepstral mean subtraction, and their delta, double delta, tion and conversational speaker verification based on a telephone and triple-delta coefficients, producing a 52-dimensional feature database. In the single speaker verification task, a training or vector. The feature vectors are modeled by a 2,048-component testing speech segment is uttered from one speaker. Thus, the GMM. The background GMM is trained using data from the task determines whether a specified speaker is speaking during a NIST 1999 and 2001 speaker recognition evaluation. The fea- given segment of conversational speech. Moreover, in the con- tures are mean and variance normalized over the utterance. For versational speaker verification task, there is at least one conver- channel normalization, the feature mapping is applied using sational speech segment in the training database and testing da- gender- and handset-dependent models that are adapted from tabase. The conversational speech segments are uttered from two the background model. Target GMMs are adapted from the back- speakers. In speaker verification task, the test data are segmented

ISASI 2007 Proceedings • 107

Proceedings 2007.pmd 107 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS mance forallspeaker detectiontests, used astheprimaryevaluationofspeaker recognition perfor- 108 In thistest,thecorrect rateis10outof12,which83.3%. of testutterances. C =numberofcorrectly recognized testutterances/totalnumber The correct rateCisdefinedasfollows: data available,wealsoseesomemistakes. speaker recognition wascorrect. Becausewehavelimitedpilot the speechsegmentandspeaker donot match.Inmostcases, are blank,whichmeansanunusuallylowscore, indicatingthat scores were obtainedagainstdifferent speakers. Some ofthefields fifth columnsshowthatforthesametestingsegment,different whether speaker recognition wascorrect. Thethird, fourth,and umn isthedifferent testingsegment.Thesecond columnshows identified. Ourtestingresults are showninTable 5.Thefirstcol- the three speakers, andthespeaker withthehighestscore was test; foreachtestingsegment,ascore wascalculatedforeachof speaker modelingusedabout60secondsofdata. OBS speaker modelingusedabout30secondsofdata,andFO CAP, FO, andOBS.Due to limiteddataavailability, CAPand as smallwavfiles,whichwere usedtotrainspeaker modelsfor 30-minute tapeCVR(Figure 10).Thesegmentswere thensaved (OBS) speechsegmentsmanuallyfrom fouraudiofilesfrom a First, wecreated captain(CAP),firstofficer(FO),andobserver 5.3 RealCVRspeakerrecognition performancetest other systems. is nomore than10%.Itissimilartothebestlevelcompared with Theperformanceofthespeaker verification system.TheEER • the numberofcandidateis5. speaker numberofthecloseddatabaseisnomore than50and correct detectionrateismore than92%,inacasewhichthe The performanceofthespeaker identificationsystem.The • recognition evaluationdatabase. The experiments are assignedbasedonthe 2006 NISTspeaker 5.2 Experimentsandresults tection errors, The parametersofthiscostfunctionare therelative costsofde- alarm error probabilities: tion costfunctionisdefinedasaweightedsumofmissandfalse and thecorrectness ofthesedecisionswillbetallied.Thisdetec- or “false”(themodelspeaker doesnotspeakinthetestsegment), judged as“true”(themodelspeaker speaksinthetestsegment) sequence oftrialsprovided. Eachtrialmustbeindependently For eachtest,adetectioncostfunctionwill becomputedoverthe tection performancetobeusedforallspeaker detectiontests. by speakers firstandthenprocessed byconventionalverification. miss rateisequaltothefalsealarmrate, the performance.EERisdenotedaspointvaluewhen the specifiedtarget speaker, P E P P EER Target The correct rateisusuallyusedtoevaluatetheeffectiveness. The correct Next, foreachspeaker werandomlychosefoursegmentsto There isasingle,basiccostmodelformeasuringspeaker de- • =0.01. Besides,theequalerror rate(EER)alsodescribes ISASI 2007 ISASI == |)( ) (| ) (| isTre as Non Target False Target Miss C Proceedings Miss and 108 C FalseAlarm P Target , andthe . Theparametervaluesare .

C Miss a priori =10, probability of C FalseAlarm

◆ =1, for speakerrecognition. Figure 10. 14 13 12 11 10 9 8 7 6 5 4 3 2 1 References Etantrum.[Online].Available: http://www.freshmeat.net/projects/songprint. C.Papaodysseus, G.Roussopoulos, D.Fragoulis, T. Panagopoulos, andC. E.Allamanche,J.Herre, O.Helmuth,B.Fröba, T. andM.Cremer, Kasten, T. Blum,D.Keislar, J.Wheaton,andE.Wold, “MethodandArticleof P. Cano,E.Batlle,H.Mayer, andH.Neuschmied,“Robust SoundModel- J.Haitsma,T. Kalker, “Robust AudioHashingforContentIdentification,” Schulze,G.H.,Rohre, Stearman,R.O., S.M.,andBuschow, M.C.,“Aircraft Schulze, G.H.,andRohre, Stearman,R.O., S.M.,“Aircraft DamageDetec- Vogt, C.,Coughlin,S.,Lauber, J.K.,Hart,C.A.,andHammerSchmidt,J., Verification. Proc. Speaker Odyssey. Crete, Greece, 2001. www.nist.gov/speech/tests/spk/index.htm. Results, Perspective,” SpeechCommunication, Vol. 31,pp.225-254,2000. NIST Speaker Recognition Evaluation—Overview, Methodology, Systems, Mixture Models,”DigitalSignalProcessing, vol.10,pp.181-202(2000). plications, SaltLake City, Utah,May2001. in Proc. ofInt.Conf.onComputationalIntelligenceandMultimediaAp- Searching: Introducing GlobalPruningtotheTime-Series ActiveSearch,” cordings,” J.AudioEng.Soc.,Vol. 49,No.1/2,pp.23–35,2001. Alexiou, “A NewApproach totheAutomaticRecognition ofMusicalRe- Indiana, U.S.A.,October2002. Description” inProc. oftheInt.Symp.OfMusicInformationRetrieval, “Content-Based IdentificationofAudioMaterialUsingmpeg-7Low-Level tation ofAudioInformation,”U.S.Patent 5,918,223,June1999. Manufacture forContent-Based Analysis,Storage,Retrieval, AndSegmen- Munich, Germany, May2002. ing forSongDetectioninBroadcast Audio,”in Proc. AES112thInt.Conv., tember 2001. in Proc. oftheContent-BasedMultimediaIndexing, Firenze, Italy, Sep- corder,” 133rd MeetingLayLanguage,AcousticalSocietyofAmerica,1997. Damage Detectionfrom AcousticSignalsFound byaCockpitVoice Re- Recorder.” Conference InstituteofNoiseControl Engineering,1997. tion from AcousticandNoiseImpressed SignalsFound byaCockpitVoice tional Transportation SafetyBoard, Washington, D.C.,April1993. Island, RhodeIsland.”Aircraft Accident/IncidentSummaryReport, Na- “Loss ofControl BusinessExpress-Beechcraft 1900CN811BENearBlock JasonPelecanos andSridhaSridharan.Feature Warping for Robust Speaker D.Reynolds, T. Dunn,“Speaker Quatieri, andR. Verification UsingAdapted G.R. Doddington,M.A.Przybocki, G.R. A.F. Martin,andD.A.Reynolds, “The T. A.Kimura,K.Kashino, Kurozumi, andH.Murase,“Very QuickAudio [Online]TheNISTSpeaker Recognition EvaluationHome:http://

Example oftrainingandtestsegmentresults 1/14/2008, 9:44 AM C

+ C Det FalseAlar = C m 15 D. Reynolds, “Channel Robust Speaker Verification Via Channel Map- “MLLR Transforms as Features in Speaker Recognition,” Proc. Eurospeech, ping,” Proc ICASSP, Hong Kong, pp. 53-56. 2003. Lisbon, pp. 2425-2428, 2005. 16 C. Vair, D. Colibro, F. Castaldo, E. Dalmasso, P. Laface, Channel Factors 21 W. Campbell, J. Campbell, D. Reynolds, D. Jones, and T. Leek, “High- Compensation in Model and Feature Domain for Speaker Recognition, Level Speaker Verification with Support Vector Machines,” Proc. IEEE Odyssey 2006 Workshop on Speaker and Language Recognition. ICASSP, Montreal, 2004. 17 W. Campbell, J. Campbell, D. Reynolds, D. Jones, and T. Leek, “High- 22 E. Shriberg, L. Ferrer, S. Kajarekar, A. Venkataraman, and A. Stolcke, Level Speaker Verification with Support Vector Machines,” Proc. IEEE “Modeling Prosodic Feature Sequences for Speaker Recognition,” Speech ICASSP, Montreal, 2004. Communication, Vol. 46, pp. 455-472, 2005. 18 S. Kajarekar, “Four Weightings and a Fusion: A Cepstral SVM System for 23 L. Ferrer, E. Shriberg, S. Kajarekar, A. Stolcke, K. Sonmez, A. Venkataraman, Speaker Recognition,” Proc. IEEE ASRU Workshop, Cancun, 2005. and H. Bratt, “The Contribution of Cepstral and Stylistic Features to SRI’s 19 W.M. Campbell, J.P. Campbell, D.A. Reynolds, E. Singer, P.A. Torres- 2005 NIST Speaker Recognition Evaluation System,” Proc. ICASSP, Carrasquillo, “Support Vector Machines for Speaker and Language Rec- Toulouse, pp. 101-104, 2006. ognition,” Computer Speech and Language, Vol. 20, pp. 210–229, 2006. 24 Reynolds, D., Comparison of Background Normalization Methods for Text- 20 A. Stolcke, L. Ferrer, S. Kajarekar, E. Shriberg, and A. Venkataraman, Independent Speaker Verification. Proc. Eurospeech, Rhodes, pp. 963–966, 1997. SESSION 4—Moderator Richard Breuhaus

ISASI 2007 Proceedings • 109

Proceedings 2007.pmd 109 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS Human Factors andAerospace Safety Verlag). Heisalsoco-editorinchief(withHelenMuir)ofthejournal Studies (FAA) andCognition,Technology, andWork (Springer- on theeditorialboards oftheInternationalJournalAppliedAviation factors) oncalltotheBritishArmyDivisionofAviation. Hesits He wasanaircraft accidentinvestigator(specializinginhuman Safety Group intheHuman Factors Department,CranfieldUniversity. Dr. DonHarris Factors Group chairman. Taiwan University. chairman oftheDepartmentMechanicalEngineering,National Training Program bytheCivilAviation anddeputy Authority (CAA) coordinator oftheNationalTaiwan UniversityCommercial Pilot Yuan, Aviation SafetyCouncil,RepublicofChina. Hewasthe Dr. Hong-Tsu Young e-mail: [email protected]. 110 is necessarytodevelopabetter understandingofthedifferences terns ofhumanerrors basedon culturaldifferences. Asaresult, it cultural dimensionsdrawaclear picture oftheattributablepat- tem (Wiegmann andShappell,2003).Hofstede’s(19912001) application oftheHumanFactors AnalysisandClassificationSys- of causalfactorsintheUeberlingenaccidentreport through the from different culturalbackgrounds andinvestigatedattribution This research involvedaround 45aviationaccidentinvestigators tion safetyhadbeensuggestedbyHelmreich (1998). andMerritt The ideathatnationalculturalcharacteristicsplayapartin avia- Abstract • ISASI 2007 ISASI International Cooperationand isthedirector oftheFlightDeckDesignandAviation member oftheErgonomics Society(MErgS). Contact Association ofAviation Psychology andaregistered aviation humanfactorsspecialistintheEuropean Cranfield University, UnitedKingdom.Heisan Visiting Fellow intheDepartmentofHumanFactors, National DefenseUniversity, RepublicofChina,and Dr. Wen-ChinLi Airline SQ006accidentinvestigationHuman CI611 accidentinvestigationandwastheSingapore was theinvestigator-in-charge oftheChinaAirlines ASC asanaviationsafetyinvestigatorin2000.He former ChinaAirlinesAirbusA300pilot.Hejoined Safety Division,Aviation SafetyCouncil.Heisa Thomas Wang By Dr. Wen-Chin Li,NationalDefenseUniversity; Dr. Hong-Tsu Young, Taiwan, ASC; Proceedings isthemanagingdirector oftheExecutive Challenges: Understanding 110 Thomas Wang, andDr. ASC; CranfieldUniversity DonHarris, Cross-Cultural Issues Cross-Cultural iscurrently thedirector oftheFlight isassistantprofessor inthe (published byAshgate). and context are andMaurino,2004). really inseparable(Merritt in response tochangesinthatenvironment; therefore, culture Peng, 2001).Aculture isformedbyitsenvironment andevolves comes aconstituentcomponent ofthatculture (Jing,Lu, and people inasocietyhavethesamewayofdoingthings, itbe- ideas andespeciallytheirattachedvalues.”Ifthemajority of in artifacts;theessentialcore ofculture consistoftraditional achievements ofhumangroups, includingtheirembodiments and transmittedmainlybysymbolsconstitutingthedistinctive in patternedwaysofthinking,feeling,andreacting, acquired posed onewell-knowndefinitionforculture—“culture consists equipped withGeneralElectric’senginescrashesinJapan. example, where anAirbus aircraft, operatedbyaChineseairline, pact upontheaccidentinvestigationprocess. Take ahypothetical requires alittleimaginationtodemonstratehowculture mayim- a result ofthemanycultures ofteninvolvedinanaccident.Itonly tion hasalwaysbeenagreat challengeforaccidentinvestigationas multicountry, multiculturalundertaking.Internationalcoopera- tered. Asaresult, byitsverynature, accidentinvestigationisa state oftheoperator, andthestateinwhichaircraft wasregis- aircraft’s designandmanufacture, thestateofoccurrence, the gation teamshouldincluderepresentatives from thestateof Furthermore, according toICAOAnnex 13,theaccidentinvesti- porting passengersaround theworld,butalsoinmulticulturalcrews. In theaviationindustry, pilotsnotonlyflyinforeign airspacetrans- man factorsissuesbasedupondifferent culturalpreconceptions. different cultures mayproduce different interpretations forhu- cident investigationissupposedtobeanobjectiveexercise, but which peoplecommunicateanddevelopattitudestoward life.Ac- 2004). Culture isattheroot ofaction;itunderliesthemanner by and Aaro, andMaurino,2004;Patankar, 2004;Merritt 2003;Rose, Helmreich 1998;Jing,Lu, andMerritt, andPeng, 2001;Lund between nationalculture andaviationsafety(e.g.,Braithwaite,2001; There hasbeenagreat dealofresearch regarding therelationship Introduction work intheaccidentinvestigationprocess itself. ent.” Thisprocess startswithunderstandingtheculturalfactorsat different cultures. Remedial actionsmustbe“culturallycongru- tions itneedstobenotedthatthesameremedy maynotworkin suggesting safetyenhancementsresulting from accidentinvestiga- eration foraccidentinvestigationtobeachieved.Furthermore, when cultures topromote bothaviationsafetyandinternationalcoop- in attributionofaccidentcausesandcontributoryfactorsacross There are manydefinitionsofculture. Kluckhohm(1951)pro- 1/14/2008, 9:44 AM • Power distance (PDI) focuses on the degree of equality, or in- equality, between people in the country’s society. In countries with a large power distance, subordinates are subordinate to their superiors. A relatively small power distance between superior and subordinate results in informal relationships and a great deal of information and discussion. If necessary, the subordinate will contradict his superior. • Uncertainty avoidance (UAI) is the extent to which the members of a society perceive a threat in uncertain or unfamiliar situations, and the extent to which they subsequently try to avoid these situations by means of regulations and bureaucratic sanc- tions, among others actions. Uncertainty avoidance concerns the situations of unclearness events, preferred more predictable, and which risks are more clearly defined events. • Individualism (IDV) focuses on the degree that society rein- forces individual or collective achievement and interpersonal relationships. In a highly individualistic society, rights are para- mount. Individuals in these societies may tend to form a larger Figure 1. Layers of influence and categories comprising the number of moderately distant relationships. A society with low Ripple Model of safety culture (Morley and Harris, 2006). individualism is typical of a society of a collectivist nature with close ties between individuals. SESSION 5—Moderator Danny Ho Cultures can be divided into different levels: families, organiza- • Masculinity (MAS) exemplifies the traditional masculine work tions, professions, regions, and countries. The power of culture role model of male achievement, control, and power. Expressions often goes unrecognized since it represents “the way we do things of this are an orientation toward competition and performance here.” It is the natural and unquestioned mode of viewing the world and the desire for recognition of one’s performance. A highly mas- as national cultural characteristics play a significant part in avia- culine social order is one in which males dominate a significant tion safety (Helmreich and Merritt, 1998). Johnston (1993) sug- portion of the power structure, with females being controlled by gested that regional differences have a major impact on CRM imple- male domination. A low masculinity ranking indicates the country mentation and crew performance. There is a marked difference in has a low level of differentiation and discrimination between gen- how crew resource management (CRM) training is perceived out- ders. Women are treated equally to men in all aspects. side the United States. In the United States, CRM is normally seen More individualist cultures show a lower probability of total- as the primary vehicle through which to address human factors loss accidents; collectivist cultures exhibit a greater chance of ac- issues. Other countries, notably those in Europe, see human fac- cidents. A high level of uncertainty avoidance in a national cul- tors and CRM as overlapping, viewing them as close but distinct ture has also been found to be associated with a greater chance of relatives. Orasanu and Connolly (1993) have suggested that a great accidents (Soeters and Boer, 2000). As aircraft have become in- deal of decision-making occurs within an organizational context, creasingly more reliable, human performance has played a pro- and that the organization influences decisions directly (e.g., by stipu- portionately increasing role in the causation of accidents. Recently, lating standard operating procedures) and indirectly through the research comparing the underlying patterns of causal factors in organization’s norms and culture. Culture fashions a complex accidents comparing Eastern and Western cultures has suggested framework of national, organizational, and professional attitudes underlying differences attributable to culture. Using the Human and values within which groups and individuals function. Factors Analysis and Classification System (HFACS), it was ob- To a certain degree, aviation human factors has been dominated served that issues concerning inadequate supervision at higher by research into psychological and psycho-physiological attributes managerial levels and a suboptimal organizational process were such as motor skills, visual perception, spatial abilities, and deci- more likely to be implicated in accidents involving aircraft from sion-making (Hawkins, 1993). This may crudely be classified as Eastern cultures (Li, Harris, and Chen, 2007). It was suggested the “hardware” of human factors. However, for operating hard- that small-power-distance cultures with a high degree of indi- ware, codes and instructions are required that may be referred to vidualism seemed to be superior to collective, high-power-disas the “software of the mind.” This software of the mind may be tance cultures for promoting aviation safety, especially in terms considered to be an indication of culture because culture provides of the processes and procedures at the higher organizational lev- “a toolkit” of habits, skills, and styles from which people construct els. Such an analysis may provide additional explanatory power “strategies of action” (Hofstede, 1984). National cultures provide to elucidate why national differences in accident rates occur. a functional blueprint for a group member’s behavior, social roles, Morley and Harris (2006) developed an open system model of and cognitive process. Culture provides rules about safety, the ba- safety culture—the Ripple Model (see Figure 1). This Model has sis for verbal and nonverbal communication, and guidelines for been used to interpret the wider influences underlying several acceptable social behavior. Culture also provided cognitive tools major accidents (e.g., the China Airlines 747 accident—Li and for making sense out of the world. National culture was rooted in Harris, 2005; Dyrden Fokker F28 accident at Dryden—Harris, the physical and social ecology of the national groups (Klein, 2004). 2006). This Model identified three threads running throughout Hofstede (1984, 1991, and 2001) proposed four dimensions the personnel within (and without) an organization, irrespective of national culture: of their level and role. These were labelled “Concerns,” “Influ-

ISASI 2007 Proceedings • 111

Proceedings 2007.pmd 111 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 112 In thefirstphaseofinvestigation, theinvestigationteamworked vestigation through theiraccredited representatives and advisers. tion, Switzerland,andtheUnited Stateswere involvedinthein- bility oftheBFU.TheKingdom ofBahrain,theRussianFedera- Annex 13andtheGermaninvestigationlawunderresponsi- national standards andrecommended practicescontainedinICAO sis oftheaccidentisasfollows(BFU:AX001-1-2/02). dent reports atUeberlingonJuly1,2002.Thesynop- occurring The datawere derivedfrom descriptionsofacci- thenarrative Stimulus material traffic controllers, airlinessafetyofficers,andmaintenancestaff. staff and16Britishaccidentinvestigatorsconsistingofpilots, air air trafficcontrollers, airlinessafetymanagers,andmaintenance There were 29Chineseaccidentinvestigatorsincludingpilots, Participants Method culture) codeasingleaccident. ent cultures—a high-power-distanceandalow-power-distance to evaluatereliability. Inthiscase,manyraters(from twodiffer- tiple accidents.Inthisstudy, adifferent approach isundertaken cases reliability wasestablishedbetweentworaterscodingmul- Gaur, 2005and 2006).However, 2005;LiandHarris, inallthese ment andCohen’s (e.g.,Wiegmann andShappell,2001; Kappa to bequitegoodbothbyusingasimplepercentage rateofagree- Tu-154 were investigatedusing theHFACS analyticalframework. ing causesoftheUeberlingenmidaircrashaBoeing757and tance versuslowpowerdistance)cultures attributedtheunderly- dent investigatorsfrom EasternandWestern (highpowerdis- as welltheircausation.To thisend,themannerinwhichacci- effect ontheinterpretation oftheunderlyingcausesaccidents investigation process. Itneedstobeestablishedifculture hasan considered as partofthemultinational,multiculturalaccident alluded toearlier, theeffectsofnationalculture haveyettobe impact uponaviationsafetyandaccidentcausation;however, as these entitiesfrom nationalculture isalmostimpossible. organizational culture are difficultenough,tryingtofullyseparate ture ofnationalculture. Ifattemptstoseparatesafetyculture from itself asubculture ofthe industryculture, whichinturnisasubcul- that safetyculture isasubculture oforganizational culture, whichis and Helmreich (1995) andGlendonStanton(2000)propose tion ofsafetyculture istobedeveloped.AuthorssuchasMerritt beyond theorganization ifacomprehensive modeloftheevolu- aries fortheconceptualizationofsafetyculture mustbeextended ganization haveaprofound effectonsafetyculture. Thebound- either apositiveornegativemanner. Actions • by whichsafetyneedscouldbeaccomplished. Influences • and worriesaboutmeetingtherequirements placed onthembyothers. Concerns • ernment, andsocietyasawhole. management, seniortheindustryregulator, gov- ences,” The investigation was carried outinaccordanceThe investigationwascarried withtheinter- The inter-raterreliability ofHFACS hasbeendemonstrated Culture hasalready beendemonstratedtohaveaconsiderable In thisModel,theauthorsargued thatelementsoutsideanor- • and“ ISASI 2007 ISASI

described thebehaviorsthatdirectly impacteduponsafety, in were associatedwiththreats totheneedsofindividual Actions”

were concerned Proceedings andwere evidentinlinepersonnel,middle 112

with thefactorsthatdictatedmethods downward level,proposed byWiegmann andShappell(2003). Figure 2.TheHFACS framework—eachupperlevelwouldaffect cording toIFR the cityofUeberlingen(Lake ofConstance).Bothaircraft flewac- 757-200, onaflightfrom Bergamo toBrussels,occurred northof which wasonaflightfrom MoscowtoBarcelona, andaBoeingB- 2002, at21:35:32hours,acollisionbetweenTupolev Tu-154M, city ofUeberlingen,andattheBFUinBraunschweig.OnJuly1, ACC Zurich,atthedifferent accidentsitesinthearea around the simultaneously inaheadquarterattheairportFriedrichshafen, at (3) Managementandqualityassurance oftheairnavigationservice night allopenworkstationswere continuously staffedbycontrollers. the airnavigationservicecompany didnotensure thatduringthe partially contradictory. (2)Managementandqualityassurance of the operatorswere notstandardized, were incomplete,andwere tions, andprocedural manufacturer instructionsofthe TCAS and as aresult theregulations ofnationalaviationauthorities,opera- publishedbyICAOand The regulations concerningACAS/TCAS and didnotcorrespond inallpointswiththesystemphilosophy. IIintotheaviationsystemwasinsufficient gration ofACAS/TCAS RA. to thegeneratedTCAS advised themtoclimb.Thismaneuverwasperformedcontrary instruction todescendandcontinueddosoevenafter TCAS be ensured anymore; (2)TheTu-154M crew followedtheATC couldnot time whentheprescribed separationtotheB-757-200 time. TheinstructionfortheTu-154M todescendwasgivenata imminent separationinfringementwasnotnoticedbyATC in the twoairplanes,andnonesurvivedcrash. north ofUeberlingen.There were atotalof71peopleonboard thecollision,both aircraftACC Zurich.After crashedintoanarea The followingsystemiccauseshavebeenidentified:(1)inte- The followingimmediatecauseshavebeenidentified:(1) 1/14/2008, 9:44 AM ( instrument flightrules)andwere undercontrol of company tolerated for years that during times of low traffic flow at on accidents in the United States. On the other hand, in Taiwan, night only one controller worked and the other one retired to rest. a high-power-distance collectivist culture, it has been found in this research that supervisory and organizational influences have Classification framework a greater influence in accidents. The U.K., from which the com- The Human Factors Analysis and Classification System is based parison data in this study were derived, is also a low-power-dis- upon Reason’s (1990) model of human error in which active fail- tance culture (according to Hofstede’s classification system). ures are associated with the performance of front-line operators The results in Table 1 show that at HFACS Levels 3 and 4 (the in complex systems and latent failures are characterized as inad- higher organizational levels) there were significant difference be- equacies or mis-specifications that might lie dormant within a tween the Taiwanese and U.K. sample in two categories: “Orga- system for a long time and are only triggered when combined nizational Climate” and “Planned Inadequate Operations.” In with other factors to breach the system’s defenses. HFACS was both cases, participants in the U.K. sample were more likely to developed as an analytical framework for the investigation of the attribute shortcomings at the organizational level than were their role of human factors in aviation accidents. This study used the Taiwanese counterparts. This may reflect the differences on version of the HFACS framework described in Wiegmann and Hofstede’s power-distance dimension, where, as a result of being Shappell (2003). The presence (coded 1) or the absence (coded a low-power distance culture, U.K. participants were more likely 0) of each HFACS category was assessed in each category of to be critical of higher level management than the Taiwanese HFACS. To avoid over-representation from any single accident, participants who are more likely to defer to superiors. each HFACS category was counted a maximum of only once per According to Hofstede’s classification, the Taiwanese culture is accident. The count acted simply as an indicator of presence or predisposed toward organizations with tall, centralized decision absence of each of the 18 categories in the Ueberlingen accident. structures and that have a large proportion of supervisory person- The first (operational) level of HFACS classifies events under nel. In these cultures, subordinates expect to be told what to do. SESSION 5—Moderator Danny Ho the general heading of “unsafe acts of operators.” The second However, members of these high-power-distance cultures frequently level of HFACS concerns “preconditions for unsafe acts.” The experience role ambiguity and overload. Group decisions are pre- third level is “unsafe supervision,” and the fourth (and highest) ferred, but information is constrained and controlled by the hier- organizational level of HFACS is “organizational influences.” This archy and there is resistance to change. Members of society in high- is described diagrammatically in Figure 2. power-distance countries are also unlikely to speak out when their opinions may contradict those of their superiors. Confrontation is Procedure generally avoided. Low power distance and high individualism All participants were trained for 2 hours by an aviation human promote greater autonomy of action at the lower levels of an orga- factors specialist in the use of the Human Factors Analysis and nization. The Taiwanese culture, on the other hand, which is less Classification System. This was followed by a debriefing and a sum- reactive as a result of its preferred organizational structures that mary of the events in the Ueberlingen midair crash. Finally, all discourage autonomy, is also resistant to change. participants received a blank form for coding their HFACS data U.K. participants were also more likely to attribute “adverse before watching the film of Ueberling midair crash accident inves- mental state” as a psychological precursor to the accident, whereas tigation to code the contributing factors underlying this accident. the Taiwanese participants were predisposed to attributing the accident to a perceptual error (see Table 1). This may reflect some Results and discussions reluctance on the part of Eastern participants to utilize the cat- The frequency of participants indicating that a particular HFACS egory of “adverse mental state,” which may have a certain degree category was a factor in contributing to the Ueberlingen accident of stigma attached to it. Instead, they opted to use the (perhaps) is given in Table 1. less blameworthy category of “perceptual error.” According to Wiegmann and Shappell (2001) and Li and Har- In all previous studies, the reliability of HFACS has been demon- ris (2006), factors at the level of “unsafe acts of operators” were strated using just two raters coding multiple accidents. Inter-rater involved in 63.4% of accidents in U.S. sample and 41.1% in Tai- reliability, calculated either by simple percentage agreement or wan; factors at the level of “preconditions for unsafe acts” were Cohen’s Kappa, has demonstrated the categorization system to be involved in 26.8% of accidents in United States and 31.3% in Tai- moderately highly reliable. The method for demonstrating reliabil- wan; at the level of “unsafe supervision,” 4.5% of causal factors ity in this study, however, suggests that reliability estimated using were associated with accidents in United States and 12.5% in Tai- multiple raters and a single accident is somewhat lower. Looking at wan; at the level of “organizational influences,” 5.3% of causal fac- the third column in Table 1, it can be seen that the overall percent- tors were associated with accidents in United States and 15% in age use of each category differs across the categories. However, some Taiwan. However, it is difficult to suggest with any certainty if the care should be taken when interpreting this table. true explanation for the differences in the data were attributable For example, in instances where the overall count for a cat- to the U.S. data being taken from civil aviation or if it was a na- egory was low (e.g., “Adverse Physiological States”), this was in- tional, cultural difference between the United States and Taiwan. dicative of agreement across the raters that a particular category As Hofstede (1991) pointed out, the culture of the United States was not a factor (i.e., high rater reliability). Nevertheless, reliabil- is characterized as small-power-distance and individualist. Sub- ity calculated this way is significantly lower than that calculated ordinates acknowledge the authority of their superiors but do the more conventional manner. However, this could be a product not bow to it, and emphasis is firmly placed on individual initia- of either the degree of training received on the HFACS frame- tive (and reward). This supports the findings of Wiegmann and work or the clarity of the factors in the stimulus material or HFACS Shappell (2001) that individual operators have greater bearing itself. Further research is required to clarify this issue.

ISASI 2007 Proceedings • 113

Proceedings 2007.pmd 113 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 114 gruent withthenationalculture oftheoperators. also whensuggestingremedial actionstoensure thattheyare con- not onlywheninterpreting theevents leadingtoanaccidentbut gators needtounderstandthis when workinginmulticulturalteams, tions (asdescribedinFigure 1)surrounding anaccident.Investi- evident intheinterpretation oftheinfluencesandsubsequentac- the eventsleadingtoanaccident.Theseculturaldifferences are such thingasanobjectivetruthwhenanalyzingandinterpreting despite thebesteffortsofallconcerned,there issometimesno cially wheninterpreting humanactions. Thisdemonstratesthat quite differently byrepresentatives from different cultures, espe- tures needtobeaware ofasthesameeventswill beinterpreted accident. Thisissomethingthatinvestigatorsfrom different cul- interpret thesamefactorsinasequenceofeventsleadingtoan ences inthemannerwhichparticipantsfrom different cultures There seemstobesomeevidencethat there are culturaldiffer- Conclusion less thanfive,Yates’s correction wasapplied(designatedby*). instances where theexpectedcellcountforone(ormore) cellswas Ueberlingen accident,broken downbycountryandoverall.In an HFACS categorywasafactorincontributingorcausingthe Table 1.Number(andpercentage) ofparticipantswhoindicated HFACS Level 4 HFACS Level 3 HFACS Level 2 HFACS Level 1 • aldt orc 2 03 c c 35 p=0.145 p=0.030 (77.8%) (53.3%) 24 10 c (62.5%) (75.0%) (86.2%) (41.4%) Supervisory 12 37 25 Known Problem p=0.670 (75.6%) Failed toCorrecta c (68.8%) 12 12 c Operations (79.3%) Planned Inadequate 20 Supervision c 43 Inadequate 25 Environment p=1.000 5 (95.6%) 27 p=1.000 15 (93.8%) (60.0%) (96.6%) (62.5%) 15 10 (58.6%) 28 Personal Readiness Management 17 Crew Resource Limitation (31.0%) Mental/Physical Physiological State raiainl2 54 c c p=1.000 42 (93.3%) (93.8%) p=0.030 24 (93.1%) (53.3%) 15 c (75.0%) (41.4%) 12 27 35 Process 12 Organizational 13 Climate Organizational 22 Resource Management c c 34 16 c 11 5 11 Technological 23 11 2 Physical Environment c 9 30 c c c 29 15 31 c Adverse 38 15 5 13 44 Adverse MentalState 14 24 Violation 20 15 Chi-Square 24 Perceptual Error Overall 29 Skill-Based Error U.K. Decision Error Taiwan HFACS Categories ISASI 2007 ISASI Voain 81 0c 30 12 18 Violation Proceedings 114 8.% 8.% 8.% p=0.593 (82.2%) (86.2%) (86.2%) 5.% 3.% 4.% p=0.186 (44.4%) (31.3%) (51.7%) p=0.001 (64.4%) (31.3%) p=1.000 (82.8%) (84.4%) (87.5%) p=0.760 (97.8%) (82.8%) (93.8%) (100%) 7.% 8.% 7.% p=0.967 (77.8%) (81.3%) p=0.378 (75.9%) (66.7%) (75.0%) (62.1%) p=0.654 (35.6%) (31.3%) (37.9%) p=0.004 (66.7%) (98.3%) p=0.320 (51.7%) (68.9%) (81.3%) (62.1%) (df=1) (n=45) (n=16) (n=29) 1.% 2.% p=0.307 (24.4%) (18.2%) ◆ 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 =0.201; =8.195; =0.988; =2.121*; =4.683; =0.285*; =0.182*; =1.751; =0.000*; =0.000; =1.046*; =11.939; =0.000*; =0.093*; =0.000*; =4.683; =0.002*; =0.776; Wiegmann, D.A.,andShappell,S.A.(2003), AHumanError Approach to Wiegmann, D.A.,andShappell,S.A.(2001),HumanError AnalysisofCom- Soeters, J.L.,andBoer, P.C. (2000),Culture andFlightSafetyinMilitary Rose, K.(2004),TheDevelopmentofCulture-Oriented Human Machine Reason, J.(1990),HumanError, Cambridge University, NewYork. Patankar, M.S.(2003),AStudyofSafety Culture atanAviation Organiza- Orasanu, J.,andConnolly, T. (1993),TheReinvention ofDecision-Makingin Morley, F.J., D.(2006),RipplesinaPond: andHarris, AnOpenSystem A.,andMaurino,D.(2004),Cross-culturalMerritt, Factors inAviation Safety. A.,andHelmreich, (1995),CreatingMerritt, R.L. andSustainingaSafety Lund, J.,andAaro, L.E.(2004),Accident Prevention. Presentation ofaModel Li, W-C., D.,andChen,S-Y. Harris, (2007),EasternMindsinWestern Cock- Li, W-C., D.(2006),Breaking andHarris, theChain:AnEmpiricalAnalysis Li, W-C., D.(2005),Where andHarris, SafetyCulture MeetsNationalCul- Li, W-C., D.(2005),HFACS andHarris, AnalysisofROCAirForce Aviation Kluckhohm, C.(1951),TheStudyofCulture. LernerD,LasswellHD,Edi- Klein, H.A.(2004),CognitioninNaturalSettings:TheCulturalLensModel, Johnston, N.(1993),Regional andCross-Cultural AspectsofCRM,inHay- Jing, H.S.,Lu, C.J.,andPeng, S.J.(2001),Culture, Authoritarianism,andCom- Hofstede, G.(1991),Cultures andOrganizations: Software oftheMind. Hofstede, G.(1984),Culture’s Consequences:InternationalDifferences in Hofstede, G.(2001),Culture’s Consequences:ComparingValues, Behaviors, Helmreich, A.C.(1998),Culture andMerritt, atWork R.L., inAviation and Hawkins, F.H. (1993),HumanFactors inFlight,Ashgate,Aldershot,England. D.(2006),KeynoteHarris, Address: AnOpenSystemsApproach toSafety Gaur, D.(2005),HumanFactors AnalysisandClassificationSystemApplied Glendon, A.I.,andStanton,N.A.(2000),Perspectives onSafetyCulture. Safety Braithwaite, G.(2001),AttitudeorLatitude:AustralianAviation Safety. References tion System,Ashgate,Aldershot,England. Aviation AccidentAnalysis:TheHumanFactors Analysis andClassifica- 72, No.11,pp.1006-1016. Classification System,Aviation, Space, and Environmental Medicine,Vol. mercial Aviation Accidents: ApplicationoftheHumanFactors Analysisand Aviation. International JournalofAviation Psychology, 10,111-133. (pp. 61-103). Variables. (Ed),CulturalErgonomics. InM.Kaplan SanDiego,CA;Elsevier Systems: Specification,Analysis,andIntegrationofRelevant Intercultural tion. InternationalJournalofAviation Studies,3,243-258. pp. 3-20. sion-Making inAction:ModelsandMethods,Ablex, NewJersey, Norwood, andZsambok,C.E.(Editor),Deci- R., Klein, G.A.,Orasanu,J.,Calderwood, pational SafetyandErgonomics, 12,3-15. Model oftheEvaluationSafetyCulture. InternationalJournalofOccu- neering Research. SanDiego,CA;ElsevierScience(pp.147-181). (Ed)AdvancesinHumanPerformanceIn M.Kaplan andCognitiveEngi- tralian AssociationofAviation Psychologists. Aviation SafetySymposium;1995November20-24SydneyAustralia.Aus- Culture: SomePractical Suggestions.Proceedings oftheThird Australian ence, 42,271-324. Placing EmphasisonHuman,Structural,andCulturalFactors. SafetySci- Aviation, Space,andEnvironmental Medicine,78(4),420-425. pits: Meta-AnalysisofHumanFactors inMishapsfrom Three Nations. Cancun, Mexico. Investigators Conference: IncidentstoAccidents,Breaking theChain, System (HFACS), inStewart,J.(Editor),InternationalSocietyofAirSafety of AccidentCausalFactors byHumanFactors AnalysisandClassification Factors andAerospace Safety5(4),345-353. ture: TheHowandWhy oftheChinaAirlinesCI-611Accident.Human tional JournalofAppliedAviation Studies,Vol. 5,No.1,pp.65-81. Accidents: Reliability AnalysisandCross-Cultural Comparison,Interna- 86-101. tor. ThePolicy Sciences.Stanford, CA:Standford UniversityPress, 1951: M.(Editor),CulturalErgonomics,Kaplan, Elsevier, SanDiego,pp.249-280. posium, Sydney. ward, (Editor),AustralianAviation B.J.,andLowe,A.R. Psychology Sym- mercial Aircraft Accidents.HumanFactors andAerospace Safety, 1,341-359. London: McGraw-Hill BookCompany. Work-Related Values. BeverlyHills:SagePublications. Institutions, andOrganizations Across Nations.California:SagePublications. U.K.; Ashgate. Medicine: National,Organizational andProfessional Influence.Aldershot, 2006. Sydney, Australia,November9-12. ogy Association(AAvPA) InternationalConference—Evolving SystemSafety Culture: Actions,Influences,andConcerns.AustralianAviation Psychol- to CivilAircraft AccidentsinIndia.Aviat Space Environ Med;76:501-5. Science, 34,193-214. Aldershot, U.K.;Ashgate. 1/14/2008, 9:44 AM Very Light Jets: Implications for Safety And Accident Investigation By Robert Matthews, Ph.D., Senior Safety Analyst, Office of Accident Investigation, U.S. Federal Aviation Administration

Dr. Robert Matthews is a senior analyst with FAA’s followed quickly by the single-engine Diamond DJet and eventu- Office of Accident Investigation. He has worked 9 ally by a single-engine Cirrus Jet. years in national transport legislation with the U.S. VLJ manufacturers already have undergone some shakeout, DOT and several years as an aviation analyst for the as several companies that were active early have failed to sustain Office of the Secretary at the U.S. DOT. He has also their financing or have abandoned the field for other reasons. worked with the Organization for Economic Coopera- The Eclipse 500 and the Adam 700 are the best known survivors tion and Development as a consultant. Dr. Matthews of the early hopefuls. They have been followed by better-known earned his Ph.D. at Virginia Tech’s Center for Public Administration names, including Cessna with its CJ3-Mustang, Diamond with its and Policy Analysis and is an assistant professor, adjunct, at the DJet, Embraer with its Phenom, and HondaJet, while Cirrus and University of Maryland. Piper are preparing to enter the field. SESSION 5—Moderator Danny Ho If manufacturers’ estimates are even close to being accurate, Abstract up to 5,000 VLJs could enter service within just the next several The next revolution in aviation markets and aviation safety is un- years. The aviation community has no experience with a new der way. Its source is a new class of “very light jets” (VLJs), which class of aircraft entering the fleet at such a pace. For example, 5 are relatively low-cost small jets designed for single-pilot opera- years after air transport jets entered the U.S. airline fleet in De- tions. VLJs have recently begun to enter the fleet in modest num- cember 1958, just 550 were in service. Five years after first-gen- bers, with the Cessna Mustang and the first deliveries of the Eclipse eration business jets entered the fleet just, 440 were in service in 500, but VLJs soon will enter the fleet in very large numbers. the U.S. civil fleet. VLJs are poised to overwhelm the scale at This paper addresses three basic issues regarding VLJs. Part which these once-revolutionary aircraft entered the fleet. one examines the characteristics of VLJs and their market. Part The recent growth of “technologically advanced aircraft” (TAA) Two assesses the effects that VLJs likely will have on aviation safety. may be the experience closest to what can be anticipated with This is based in part on a detailed review of a large body of fatal VLJs. Figure 1 uses the Cirrus SR20/22 and the Diamond DA-40 accidents involving air taxi operators, corporate operators, and to illustrate how quickly glass cockpits have penetrated the small- business operators1 and cross-country personal operators in the aircraft fleet in the U.S. As of June 2007, just several years after United States in the past 5 fiscal or financial years (FY). Part Three first entering the U.S. fleet, Cirrus had nearly 3,000 active air- assesses new challenges that VLJs may present for accident in- craft on the FAA registry, with several hundred registrations pend- vestigators and investigative authorities. ing and more aircraft entering the fleet every month. The DA- 40, albeit at more modest levels, also is expanding rapidly in the Part One: Characteristics and Markets U.S., particularly since late 2004. VLJs likely will surpass the ex- Very light jets sometimes are called micro-jets, mini-jets, or per- perience of the Cirrus and DA-40 both in the pace of fleet ex- sonal jets. Whatever we call them, VLJs are about to revolution- ize the air taxi industry and business aviation, and they likely will affect the market for high-performance personal aircraft. Though the term “VLJ” remains a term of art, generally it denotes relatively inexpensive turbofan airplanes that weigh less than 10,000 pounds (most under 7,500 pounds) and sell for prices that range from US$1.5 million to US$4 million. VLJs typically will have four to six seats, including crew, with service ceilings up to 41,000 feet, and a range of up to 2,000 miles. They will offer the increased reliability of jet engines and will be highly automated, with flight management systems, multifunction displays, real-time weather displays, integrated electronic flight bags, and state-of-the-art avionics and navigation, complete with moving maps, terrain maps, terrain warning and traffic alerting, plus the traditional altimeter, airspeed, heading, vertical speed and horizon—and all this will be integrated with an autopilot and will be Figure 1. Cirrus SR20/22 and Diamond DA-40 with FAA displayed more simply on high-definition flat screens. The first airworthiness and registry certificates, June 2000 to June 2007 VLJs to reach the market will be twin-engine jets, but they will be (end-of-month data).

ISASI 2007 Proceedings • 115

Proceedings 2007.pmd 115 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 116 three broad scenarios. ure 2illustratesthepaceof entrythatmightbeexpected under substantial share offlighthoursinthenot-too-distant future. Fig- unit thancurrent fleetsproduce. Inshort,VLJswillaccount fora will reach bignumbersandwillproduce more flighthoursper highest estimates,thebottomlineisclear:VLJfleetquickly be purchased tobeflown. Despitesomeskepticism aboutthe sit ontheground fordays orweeksatatime.Theseairplaneswill with US$1.5to$4millioninvested,theseaircraft are notlikely to operators. Again,someobserversbelievethisistoohigh, but ing 1,500oreven2,000hoursperyearVLJamongair taxi $2 million,demandshouldbeverysubstantial. lion andsomesingle-engineturboprops sellfor$1.5millionto pable twin-enginebusinessaircraft currently sellforUS$3 mil- such numbersare high.However, sincesomeofthemore ca- after theirintroduction, thoughsomeorganizations believethat to 1,500VLJswillenterthefleetannuallywithinseveralyears many as15,000unitsby2020.Typical estimatesalsosuggest1,000 VLJ market. Mostestimatesrangefrom 5,000unitsby2020toas of Switzerland,has100Eclipsesonorder. Switzerland has112firmorders fortheEclipse,andJetBird, also tion ofLuxembourg has181orders fortheEclipse,Aviace of erators inEurope alsohavelarge orders inplace:ETIRCAvia- Embraer Phenomsand100Adam700s.Three prospective op- prospective U.S.operator, MagnumJet,hasfirmorders for100 with long-termplanstooperateasmany1,000VLJs.Another tor intheU.S.,withmore than300firmorders fortheEclipse, being discussed.Dayjetispositionedtobethefirstlarge operations. Thisisthefieldinwhichentirely newbusinessmodelsare will soonfollowsuitinlarge numbers. America andWestern Europe, butoperatorsinotherregions likely mates. About90percent oftheorders currently comefrom North for VLJs.Less-demandingdefinitionsproduce muchhigheresti- conservatively, identifiednearly1,500orders from 19countries estimates anentrypriceofjust$1.38million. Embraer Phenom.Thesingle-engineDiamondDJetcurrently million fortheCessnaMustang,andabout$2.85 pected tostartaround $2.25millionfortheAdam700,$2.55 Prices nowstartatUS$1.53 millionfortheEclipseandare expansion andinthefundamentalchangestheybringtoaviation. Figure 2.Three conceptualgrowth rates,verylightjets. If weassumethemiddlecurve onFigure 2,some8,000VLJs Common estimatesalsosuggestaverageratesofuseapproach- Yet theaviationcommunitycontinuestodebatesizeof The paceofchangewillbemostapparent inairtaxiopera- As ofmid-June 2007,Airclaims, whichdefines“orders” rather The real revolution withVLJsliesinpriceandoperatingcosts. • ISASI 2007 ISASI Proceedings 116 aviation, andpersonaloperations. possibility ofnewrisksbeingintroduced intoairtaxis,business pace ofchangeisthesource ofsubstantialconcernaboutthe in businessmodelsasVLJspromise todeliver. Thisunprecedented Aviation hasneverexperienced asrapidachangeinthefleetor backgrounds. Insum,thecentralpointhere isasenseofscale. jet segmentsintheindustry, butmanywillcomefrom non-jet ics. Someofthesepilotsandmechanicswillcomefrom existing real pressure ontheavailabilityofqualifiedpilotsandmechan- these numbersmayprove tobelow. Thistypeoffleetwillplace flight hours(ormore) peryearin10yearsjusttheU.S.,and year, fleetwide. will averagesomethingontheorder of750to1,000hoursper of VLJswilloperateasairtaxisorinbusinessaviation,likely would beoperatingby2020.Ifwealsoassumethatthemajority and Cessna500series. Figure 4.Estimatedcumulativeaccidentrates,Lear 23 Figure 3.Typical accidentexperience,airtransportaircraft. prepared forthemore-demanding environment ofjetoperations. will upgradeintosingle-pilot operations before theyare properly sands ofsingle-pilotjetoperations, andfearsthattoomanypilots pace atwhichVLJswillenter the fleet,dailyprospect ofthou- cantly improves safety. Themostcommonconcernsincludethe at leastduringalearningperiod,eveniftheaircraft latersignifi- tive, butanynewclassofaircraft hasalwaysaddedsomenewrisk— on theircharacteristics,theneteffectofVLJsshouldbevery posi- VLJs willhavebothnegativeandpositiveeffectsonsafety. Based Characteristics ofVLJs Part Two: NewRisksVersus Positive If thesenumbersare close,theysuggest6millionto8 1/14/2008, 9:44 AM lized more quickly than did rates for the earlier generation of aircraft illustrated here. The FAA anticipates similar accident curves for VLJs. Like other new aircraft of earlier eras, VLJs are likely to confront a learning curve with relatively high accident rates at first, but at lower starting points than experienced by earlier generation aircraft. The early high rates are simple to explain. By definition, since it is a new-generation aircraft, all pilots, mechanics, and commercial operators have little or no experience with the aircraft. However, as experience builds and as any residual design issues are resolved, the initially high rate is followed by sharp and sustained improvements, followed by yet lower and stabilized rates that are lower than earlier generation aircraft. However, the pace at which VLJs are expected to enter the fleet will produce a paradox for air taxis. The sheer size of the Figure 5. Fatal Cirrus accidents per 100,000 hours; U.S. VLJ fleet in air taxi operations and their more-intensive use could June 2001–May 2007 quickly double total air taxi exposure. Consequently, the total number of accidents and fatal accidents may increase among air New risks taxi operators even while overall rates decrease. The paradox, Rapid changes in aircraft fleets have been persistent sources therefore, will be a “safer” system, as measured by rates, but one both of new short-term risk and substantial long-term improve- that may generate an increase in fatal accidents due to sharp SESSION 5—Moderator Danny Ho ments in aviation safety. Whether we speak of air carrier air- increases in volume. This paradox will not be so apparent in per- craft, business-corporate aircraft, or more broadly based gen- sonal flight, where a much larger scale of activity will minimize eral aviation fleets, each new generation of aircraft has produced the effects of VLJs on overall rates. accident rates that resemble “elbow” curves, in which rates start out high, fall sharply, and then stabilize at lower levels. Equally Single-pilot operations important, each new generation of aircraft enters the fleet with The core concerns about single-pilot operations can be stated a lower initial accident rate than did the preceding generation, rather simply. Things happen faster in jets, and pilots must stay and each new generation has a shorter learning curve, with rates further ahead of an airplane traveling at 350 knots than when stabilizing more quickly and at lower levels than the preceding traveling at 150 knots. Global Aerospace, the insurance under- generation. Large jets operated by major airlines provide the writer, estimates that accident rates for single pilots in turbine- most familiar illustration of this point. Figure 3 shows data from powered aircraft (including turboprops) are 50% greater than Airbus to illustrate the point, and Boeing regularly publishes for twin-pilot operations. Global adds that the single-pilot issue comparable data. generally is more important among private pilots rather than Though documentation is not as well established for lighter among air taxi operators, as private pilots have much higher aircraft, their experience appears to be comparable to the expe- accident rates in general. A brief review at the FAA of accidents rience of air transport aircraft. Figure 4 illustrates cumulative involving the Cessna 500/501, the Cessna 525, and the Raytheon accident rates for the Lear 23, which was one of the earliest cor- Premier supports these observations from Global Aerospace and porate-type jets to enter the fleet in appreciable numbers, and may even suggest that the ratio is slightly higher. The Cessna for the more numerous Cessna 500 series. Both fleets clearly ex- 500 series and the Premier are used here because they are certifi- hibit the “elbow” curve in their cumulative accident rates. cated for single-pilot operations, and the Cessna series is well The Lear 23 was a revolutionary aircraft in its own right, with established in the fleet with about 2,800 currently in service in swept wings, turbojet engines, and high-altitude and high-speed the United States. flight. The Lear 23 was a very different aircraft from anything The NTSB accident database includes 71 accidents involving that most of its early pilots had ever experienced, and its early those aircraft; just 18 had two-pilot crews. All but 1 of the 53 accident rate reflected this. However, after a steep learning curve, single-pilot accidents involved personal flights or business flights the Lear 23 established a stable and much-reduced accident rate. with non-professional pilots. If we add selected twin-engine tur- The Cessna 500s entered service just 7 years after the Lear 23, boprops from 1983 (the Metro, Embraer Bandeirante, and the but lessons had been learned and the Cessna 500s entered ser- MU-2), the number of accidents reaches 371, of which 207 had vice with an initial accident rate that was lower than the early single pilots. No data on flight hours for single-pilot operations Lear 23 rate. The Cessna 500 accident rate then fell quickly and versus twin-pilot operations are available in the U.S. However, stabilized at a lower cumulative level than the earlier Lear. given the accident numbers cited above, in order for single-pilot The early accident experience with technologically advanced operations to have an accident rate that is 50% greater than the reciprocating aircraft (TAA) in business and general aviation ap- two-pilot rate, two-pilot operations would have to account for pears to follow a similar path. Figure 6 estimates cumulative acci- just 55% of total hours in the selected fleet. In fact two-pilot dent and fatal accident rates for the Cirrus SR20 and SR22. The crews probably account for more than 55% of this fleet’s hours, lines follow the same general shape as those experienced by each suggesting that the accident rate for single pilots in turbine-pow- generation of air carrier jets, as well as the Lear 23 and the Cessna ered aircraft may exceed the rate for two-pilot crews by more 500 series. Rates were high very early then, fell sharply and stabi- than 50% .

ISASI 2007 Proceedings • 117

Proceedings 2007.pmd 117 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 118 risks, andadequateskillsfor recovery from low-speed orhigh- performance capabilities,full understandingof“coffincorner” tude operations,withasound understandingoftheaircraft’s Pilots mustbeadequatelyprepared forhigh-speed,high-alti- • pilot andoperator, aswelltheprovision ofAirTraffic Services. relate invaryingdegrees tothe experience andknowledgeofthe synopsis ofkey itemsintheNBAAlist.Notethatallthese issues operators, andregulators mustbeprepared. Thelistbelowisa a shortlistofthemostimportantsafetyissuesforwhich pilots, best technologycannotalwayssavepilotsfrom decisions. terrible operational history. Thebottomlinehere isobvious:eventhe will happentosomedegree withVLJs,particularlyintheirearly frequently thanevolvingfolklore would suggest.Nevertheless,it aircraft clearly indicatesthatthishappens,butithappensless history inso-calledtechnologicallyadvancedgeneralaviation tools toexpand theirenvelopesofrisktaking.Theearlyaccident and theimproved weatherinformation,ormaysimplyusethose manufacturers are planning,asdiscussedlaterin this paper. duced bytheflightmonitoringanddispatchprograms some more intenseforsingle-pilotoperations.Thisriskcouldbe re- for everyrunway. Thepossibleincrease inworkloadcouldbe NOTAMS, andapilotoperatingHandbookwithspecifications In contrast,adispatchfunctionwouldincludeweathersupport, fications forlandingdistance,fuelburn,weightandbalance,etc. weather informationanddeterminetheirownperformancespeci- function increases pilotworkloadaspilotsmustsecure theirown that donothavedispatchfunctions.Theabsenceofa pared tooperatejets? train thisnewworkforce, andare thosecompanies properly pre- larly, willairtaxicompaniesbeproperly equippedtohire and airspace, anddosowithoutanotherpilotintherightseat?Simi- jets athighspeeds,sometimesneartheupperlimitsofcivilian ciency andknowledgeare adequatetooperatehighlyautomated positions intheairtaxiindustrybefilledbypilotswhoseprofi- ics withadequatejetexperience? Will thethousandsofnewpilot interest. Canairtaxioperatorsfindenoughpilotsandmechan- of seatstothegeneralpublicsubstantiallyincreases government concern isespeciallyacuteinairtaxioperations,where thesale lead tothousandsofpilotssuddenlyupgradingintoVLJs.The plex aircraft generallyare notinexperienced. than firstofficers.Thebottomlineisthatsinglepilotsincom- single pilots,butpilotsagainhavemuchmore experience model: commandersthenhaveabout25%more experience than ture changesonlymodestlywhenweexamine hoursinmake- manders”), andfarmore flighthoursthanfirstofficers.Thepic- more totalflighthoursthandidpilots-in-command(or“com- In theselectedfleetidentifiedabove,singlepilotsaveraged25% tions appearstobethenumberofpilotsonboard. tor inexplaining ahigheraccidentrateforsingle-pilotopera- programs, pilottraining,etc.However, themostsignificantfac- tent ofdispatchsupport,thepresence ofstructured maintenance ferent ratesofIFRflightversusVFRflight,thepresence orex- erations mayincludedifferences inthemixofairportsused,dif- The NationalBusinessAircraft Association(NBAA)hasproduced Finally, somepilotsmayplacetoomuchfaithintheavionics An additionalriskcouldbeintroduced forairtaxioperators However, thesheernumberofVLJscomingintofleetwill Pilot experience doesnotappeartobeamongthosefactors. Factors thatexplain higheraccidentratesforsingle-pilotop- • ISASI 2007 ISASI Proceedings 118 ronment? Finally, willnewoperatorsfacecompetitive pressure recently upgraded portionofVLJpilotsbeready for thisenvi- this inviteexcessive head-downtimeforasinglepilot?Will the at them,andwiththeneedto changeflightpathsabruptly?Will high workloadsinbusyairspace,withATC barkinginstructions experience injetsorwithFMSadequatelyhandlepotentially or from satelliteairports. Will pilotswithlimitedornoprevious will involvebusyurbanairspace,evenwhenflightsoperate to way excursions. proach andlanding,lossofcontrol inflight,andhigh-speed run- several categoriesoftypicallysevere accidents,suchasCFIT, ap- frequency ofunstableapproaches, whichare acommonfactorin and, therefore, nocoupledapproaches. Thiscouldincrease the ways, VLJswilloperateintomanyshortfieldsthathaveno ILS Though VLJswillbedesignedtolandandtake offonshortrun- airports withshorterrunwaysandlesssupportinginfrastructure. proach fixes, ortomaintainhighspeedinterminalareas. risk, aswithrequests from ATC tomaintainhighspeedap- recognize whenATC instructionsmightplacethemathigher ing duringtaxiingoperations.Pilot trainingcanhelppilotsto posing VLJstojetblastontheground, andensure proper spac- vide proper spacingbehindheavyjets,avoidunintentionallyex- Finally, ATC mustbeeducated toensure thatcontrollers pro- • lot resource training. nario-based training.Single-pilotoperatorsmustaddsingle-pi- groomed forpositionsascaptains,completewithCRM andsce- mand. With two-pilotoperations,thisrequires thatpilots be Pilots-in-command mustbefully prepared toexercise com- • pilots andoperators. for dispatchfunctionsandgeneralexperience injets bothfor on weather, fuelburn, range,etc.Again,thissuggeststheneed Similarly, pilotsmustchooseappropriate cruiseprofiles, based • erators. tions andforgeneralexperience injetsbothforpilotsand op- These requirements, inturn,suggesttheneedfordispatchfunc- plete withalternateairportsandenroute flightpaths. etc. Theseissueswillrequire appropriate preflight planning,com- lence, wake vorticesataltitude(andintrafficpatterns),windshear, and ofwinteroperations,includingwindsaloft,clearairturbu- Pilots musthaveadequateknowledgeofhigh-altitudeweather • basic pilotingskillsare maintainedinfull. and autopilots.Similarly, pilotsandoperatorsmustensure that avoid becomingreluctant eithertouseorabandonautoflight capabilities andlimitationsofautopilotsFMS.Pilots must Pilots andoperatorsmusthaveadequateknowledgeofthe • the relative simplicityofVLJcockpits. to checklistsandmustavoidbeinglulledintocomplacencyfrom Pilots, especiallythoseflyingassinglepilots,mustadhere strictly • or inotherhigh-performanceaircraft. large share ofthepilot workforce haslimitedexperience injets today, theycanbeespeciallyimportanttoVLJoperationsifa scribed flightpaths.Whiletheseissuesapplytosomeaircraft . and approaches toavoidovershootingaltitudes,fixes, orpre- Pilots mustadequatelyprepare forhigh-speedclimbs,descents, • edge ofjetoperations. perience, buttheyalsorelate tooperators’experience andknowl- speed stalls.Theseissuesclearlyrelate topilottrainingandex- Similarly, mostairtaxi,business,andpersonalflightsinVLJs To thelistabove,wemightaddriskoflandingatsmaller 1/14/2008, 9:44 AM 2 to dispatch an aircraft into marginal environments? ticipated learning curve. In addition, much of the learning curve The good news is that most of these risks are well recognized will spend itself fairly quickly as VLJs become more established by manufacturers, governments, and the organizations that will in the fleet. operate the first generation of VLJs. Manufacturers and air taxi More importantly, several common characteristics of VLJs companies have developed training programs, and the comple- should produce major improvements in safety that more than tion of those training programs will be a requirement under the offset any new risks. In the end, VLJs should provide a signifi- manufacturer’s warranty in many cases. Training programs will cant net improvement in safety for air taxis, small business op- include Level-D simulators and human resource training for erators, and cross-country personal flights. single pilots. Similarly, in the U.S. and elsewhere, most pro- The most important safety characteristics of VLJs include the spective air taxi operators have explicitly identified the need following. for extensive training programs and have already begun devel- High-altitude capability means that VLJs will fly above the terrain oping such programs, along with required maintenance pro- and above much of the weather, at least in cruise flight. Conse- grams and operational procedures as those companies prepare quently, VLJs will be much less vulnerable to CFIT accidents and for certification. Governments also will require jet ratings, with loss of control in flight, which are the biggest killers in air taxi IFR ratings, for all VLJ pilots, plus commercial ratings for VLJ operations, personal flights, and small business flights. pilots in air taxi operations. The “J” in VLJ means a turbofan engine. The obvious fact that In the air taxi industry, the risks associated with single pilots VLJs will employ jet engines should substantially reduce the fre- will be reduced further by customers who will insist on two-pilot quency of accidents related to power loss and will improve the operations. Similarly, insurance policies will require two-pilot crews capacity of multiengine aircraft to maintain altitude if one en- of most air taxi operators and of many corporate operators. Cur- gine fails. rently all the companies planning to use VLJs in air taxi service Flight Information System (FIS) weather should reduce the frequency SESSION 5—Moderator Danny Ho in the U.S. are planning to use two-pilot crews. of accidents related to unanticipated weather encounters. Some risks noted above for personal and small business op- Other avionics and equipment typically will include an Electronic erators, such as the absence of support structures, will be at least Flight Information System (EFIS), MultiFunction Display, Mov- partly addressed by the marketplace. For example, Eclipse plans ing Map with terrain depiction and terrain awareness and depic- to provide dispatch services to operators, complete with flight tion, terrain and obstacle warning systems, and autopilots with following, flight planning, NWS-certified weather briefers, pilot coupled approaches. All this will be accompanied by improved operating handbooks, etc. Eclipse is working with the FAA to and simpler displays. These characteristics should reduce establish operating procedures for this service. Similarly, a num- workload in most environments and will substantially improve ber of companies currently offering aircraft management ser- pilots’ information and situational awareness. vices likely will fill some of the remaining voids. To quantify the positive effects that VLJs should have on safety, Price will be the primary factor that limits the penetration of each of the above characteristics has been tested against recent these services among aircraft owners and operators, as these fatal accidents in the U.S. involving flight activities that will be market-based services will not be free. If price theory has any major parts of the VLJ market. Those activities include the fol- validity, these services will confront some degree of resistance at lowing airplane operations: cross-country personal flights; air taxi any price, regardless of their quality or their net benefits to safety operations, small commuters, corporate aviation, and business and risk. Nevertheless, all these efforts, plus the aircraft charac- aviation. These activities accounted for 850 fatal accidents or 45 teristics, will combine to reduce risk among private operators percent of all non-airline fatal accidents in the U.S. for FY 2002 and they should help to shorten the anticipated learning curve. through FY 2006, and 55% of all fatalities. The scoring excluded Finally, many of the small businesses and private pilots who fatal accidents involving helicopters, recreational flying, banner purchase VLJs are likely to depend on aircraft management towing, aerobatics, most public-use flights, heavy lift operations, companies to maintain their aircraft or will join fractional owner- aerial application, instruction, and other activities. ship programs. This will reduce still further some of the risk as- If a characteristic would have had no effect on an accident, the sociated with new-generation fleets. characteristic was assigned a score of zero. Conversely, if a single All these factors will reduce the severity of the learning curve, characteristic would have eliminated the risk of a particular acci- but they are unlikely to eliminate it, particularly with single-pilot dent, that characteristic would receive a score of 100. Based on private operators. The bottom line is that the introduction of at the premise that no technological characteristic can ever elimi- least some new risk is inevitable. New risks will be especially high nate all risk, no characteristic received a score of 100 against any for small business users and for pilots who buy VLJs for their accident. In addition, a simple algorithm was used to ensure that personal use. On average, they will be the least experienced over- no single accident received a combined score of more than 100, all, the least experienced in jets, and on average they will have as each characteristic was assessed for its capacity to eliminate limited support structures. the risk that remained in each accident. For example, assume we are assessing the VLJ against a CFIT accident that occurred in Positive effects of VLJs cruise flight. The capacity for high-altitude flight might be scored The risks identified above will be real and will produce some very high against this accident, say 90%, while the avionics pack- accidents that otherwise may not have occurred, particularly in age might also be scored rather high, say at 75%. The two scores the early period of VLJ operations. However, likely practices and can not simply be added because no single accident can be avoided policies among manufacturers, operating companies, insurers, 1.65 times. Instead, the combined score would be 97.5%, as the governments, and some customer demands will shorten the an- avionics would be scored only against the portion of risk that

ISASI 2007 Proceedings • 119

Proceedings 2007.pmd 119 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 120 the cockpitsofmostVLJshad astand-aloneeffectthatwasnearly accident set. performance wouldbringthe totalriskreduction to44.7%ofthe When combinedwiththetwocharacteristicsalready assessed,jet by avionicsandaltitude,the10.7%wasalmostentirely additive. by jetperformancehadverylittleoverlapwithaccidentsaddressed 10.7% ofriskintheaccidentset.Sinceaccidentsaddressed itself, theuseofjetengineswouldhaveeliminatedanestimated dents ontakeoff inwhichenginerun-upswere inadequate.By with oneengineout.Turbine poweralsoinfluencedsomeacci- a twin-enginejet’scapacitytosustainaltitudeor1%climb rate of thefourcharacteristics,basedlargely ongreater reliability and ties intheaccidentset. comes, theywouldhaveavoidedanestimated39%ofallfatali- addressed theaccidentsthattypicallyhavemore severe out- risk intheaccidentset.However, becausethesecharacteristics teristics combinedwouldhaveeliminated“only”34.3%ofthe often addressed thesamerisks.Consequently, thetwocharac- dent set.However, avionics(at22.8%)andaltitude17.1% would haveeliminatedanestimated17.1%ofriskintheacci- neuvering wouldhavebeeneliminated.Higheraltitudealone and someloss-of-control accidents inwhichtheneedforma- been particularlyeffectiveagainstenroute CFIT, enroute icing, most effectivecharacteristic.Like avionics,altitudewouldhave dent set. of theriskinaccidentsetand28%fatalitiesacci- avionics packagesalonewouldhaveavertedanestimated22.8% which betternavigationalawareness wouldhavehelped.The proach-and-landing accidents,andgenerallyagainstcasesin tion alsoproved effectiveagainstlossofcontrol inflight,ap- reduced risksignificantly. However, theavionicsandautoma- display oralertingsystemwouldhave dents inwhichaterrain against theaccidentset.ThiswasespeciallytrueforCFITacci- avionics packagesproved tobethemosteffectivecharacteristic have beenavertedifthoseflightshadtaken placeinVLJs.The 53% ofthefatalitiesamongtargeted flightactivities would ence orlimitedinfluence. several othercharacteristicswouldhavehadeithernoinflu- several oftheimportantVLJcharacteristicsandaddition or minimalscores alsoinvolvedaircraft thatwere equippedwith or knowinglyflyingwithapoorlyperformingengine.Somezero accepting highrisks,suchasknowinglyflyingintosevere weather haustion, systemorcomponentfailures, andpilotsknowingly irrelevant ornearlyirrelevant. Thesecasesincludedfuelex- accidents inwhichaircraft characteristicsandperformancewere other 5%oftheaccidentset.Thosecaseswere dominatedby 28% ofthecasesandreceived onlyminimalscores againstan- pilots becamelostinflight.ConverselyVLJsscored zero against in thecockpitwouldhavereduced risk,andaccidentsinwhich above weather, accidentsinwhichbetterweatherinformation other lossofcontrol inflightwhere aircraft couldnotclimb accidentsrelatedterrain, toenginefailures, enroute icingor follows: (1-90%)+[(1-90%)x75%]=90%7.5%97.5%. remained afterapplyingthebenefitsofhigh-altitudeflight,as Finally, thebetter weatherinformationthatwillbeavailablein The presence ofaturbine enginewasthethird-most effective The capacitytooperateathigheraltitudeswasthesecond- The review concludedthat49%ofthefatalaccidentsand VLJ characteristicsscored bestagainstcontrolled flightinto • ISASI 2007 ISASI Proceedings 120 flight activity, andselectedaccidenttypes. Figure 6.Positive effectsofVLJcharacteristicstotal,selected in airtaxisandbusinessaviation toalevelwhere, despitelower be thatthesheersizeofVLJ fleetmightincrease totalactivity rently experienced bythetargeted market. Theparadoxcould fatal accidentratethatisatleast 60%lowerthantheratescur- operating practices,etc.,theneteffectshouldbetoproduce a Given thepositivecharacteristicsofVLJs,plusanticipated ticularly aftertheanticipatedlearningcurvehasbeenovercome. effects shouldprovide amajor, netimprovement insafety, par- perience withthenewfleet.However, onbalance,thepositive erally, errors willbemadeastheaviationcommunitybuildsex- the technologytoexpand theirenvelopeofrisktaking,and,gen- not really ready toflyajetbythemselves.Somepilotswillrely on operational historyofVLJs.Somesinglepilotswillfindthey are tion pilots. in theIFRsystematamuchhigherratethanmostgeneralavia- 18,000 feet.Finally, VLJflightsalsowillbenefitfrom operating operations, andbytheIFRratingsrequired tooperateabove ing programs, bythepresence oftwopilotsinalarge share of They alsowillbeenhancedbyoperators’andmanufacturers’ train- better maintenancethanmuchofthecurrent fleetexperiences. geted VLJmarkets. Thepositiveeffectsshouldbeenhancedby the riskexperienced inthepast5yearsU.S.by tar- In sum,thebasiccharacteristicsofVLJsshouldeliminatehalf of VLJcharacteristics Summary ofnewriskandpositiveeffects effects onthevariousaccidenttypes. activity shown,buteachcharacteristichadsignificantlydifferent tics hadcomparableeffectsoneachofthethree typesofflight acteristics againstselectedaccidenttypes.Thefourcharacteris- accident set.TheFigure alsoshowstheeffectivenessofVLJchar- types ofactivitiesthataccountforallbutasmallshare ofthe against theaccidentsetandshowseffectivenessthree to “only”49.1%. accidents, theneteffectincreased totalriskreduction from 44.7% However, becauseothercharacteristicsoftenaddressed thesame identical tothatofjetperformance,at10.6%theaccidentset. Yet, sometradeoffswillbeintroduced, particularlyearlyinthe Figure 6summarizestheeffectivenessofVLJcharacteristics 1/14/2008, 9:44 AM accident rates, total accidents could increase. The result may be a any investigation that involves data recorders, investigators must safer system that produces more accidents. determine the point on the recording at which the data becomes relevant to the accident. With up to 300 hours of data available, Part Three: How VLJs Will Affect Accident Investigation that basic task will become more time-consuming. Parts 1 and 2 have established that large numbers of VLJs will be Similarly, the need or the desire to download and interpret entering the fleet soon, with significantly lower accident rates more recorders after accidents could severely tax the capacity of than the targeted markets currently have, but not before a learn- some investigative authorities to conduct this work. While the ing curve is overcome. The remaining issue for this paper is how use of data recorders is routine in air transport accidents and in the inevitable VLJ accidents will affect accident investigation and some business jets, the use of recorders in the investigation of investigators. The short answer is that the core process of acci- general aviation and business accidents will increase substantially. dent investigation will not change in fundamental ways. Never- The bottom line will be more reliance on recorded data and more theless, some changes will occur in the details of investigations demand placed upon those professionals who interpret and dis- and those changes will be most challenging in countries where play the data. VLJs enter the private aviation market in large numbers. Similarly, because VLJs are complex aircraft and are real jets, Whether an accident involves a VLJ or any other aircraft, the the mixture of specialists involved and the distribution of workload core purpose of any investigation will remain unchanged. The will change somewhat. Investigators on the scene will continue to purpose is well stated by the United Kingdom’s AAIB: “to deter- look for evidence that an engine was or was not producing power mine the circumstances and causes of an accident” in order to at impact. However, since investigators will be working with jet prevent future accidents and thereby preserve life. Similarly, ba- engines, in most cases on-scene engine work will be limited to sic procedures will remain in place, regardless of whether an air- checking fuel and oil filters, evidence of over-temping, scoring, craft is a VLJ or not. Investigators on scene will continue to docu- or obvious signs of blade or turbine separation. However, as with SESSION 5—Moderator Danny Ho ment ground scars, wreckage paths, the position of switches and other jet engines, if engine tear-down is required, investigators control systems, evidence of fuel, evidence of airframe icing, run- will need to rely more and more on other professionals who per- way conditions, the presence of hazardous materials, visible signs form the work off site. of corrosion or fatigue, weather conditions, etc. Investigators also Though fatal accident rates may be fairly low for VLJs, when will continue to research air traffic communications and service, accidents occur they likely will include a higher share of high-en- crew history, the history of the airplane, the condition of the air- ergy impacts in which the ability to obtain extensive understand- plane on the accident flight, statements from surviving crew and ing on scene will be limited. Again, we will find ourselves depend- passengers or other witnesses, and so on. ing more on the readout and interpretation of data recorders. However, some important elements will change. The most Finally, despite lower fatal accident rates, when accidents oc- obvious change may simply be the number of cases involving cur we are far more likely to confront composite materials at the complex airplanes as VLJs expand in the fleet. Other changes scene. That increases the likelihood of a shattered airframe once will include more common involvement with composite materi- the composites are compromised. In the case of fires, composites als on relatively small aircraft, more involvement with jet engines will reduce the survival of evidence with which to determine the and, perhaps, more high-energy impacts. point of origin and whether the fire ignited in flight or after im- Basic workload and the necessary skill mixes may be among pact. This, again, will make us more dependent upon the read- the most apparent changes for investigative agencies in coun- out of data recorders. tries with significant VLJ fleets. Particularly early in VLJs’ operat- Yet, none of these changes suggest any fundamental change in ing history, any VLJ accident is likely to generate broadly based the structure of accident investigations. We will continue to gather interest among governments, manufacturers, operating compa- evidence, continue to interpret that evidence, and continue try- nies, pilot unions, mechanics’ unions, and others. ing to understand an accident thoroughly enough to help us pre- Generally, as aircraft complexity increases, investigations ulti- vent future accidents. Instead, the anticipated changes will affect mately rely more and more on data recorders in order to under- issues like workload, the distribution of workload among various stand the accident thoroughly. The typical VLJ will enter service professionals, and much greater reliance on data recorders in with a capable quick access recorder (QAR). Early QARs evolved the investigation of accidents involving small business and perfor use in large air transports as a less costly alternative to remov- sonal flights. ing flight data recorders (FDR) in order to gain access to operational data and to system faults. Depending on design, contem- Conclusions porary QARs can transmit data at the end of every flight (upon Aviation has never experienced as rapid a change in the fleet or opening an aircraft door), or data can be stored onboard until in air taxi business models as the VLJ promises to deliver. Their the QAR’s disc or card is removed and downloaded. Finally, QARs relatively low prices, their design for single-pilot operations, their can transmit real-time data in flight to a server via satellite com- speeds, and other characteristics will impose new risks. The most munication systems or based on cell phone technology. obvious new risks will address the qualifications of single pilots Some VLJ manufacturers expect to rely eventually on routine, who upgrade from other types of airplanes, plus questions about in-flight transmission of QAR data, while others plan to use on- commercial companies that may be new to jets, and the typical board storage of up to 300 hours, with data being downloaded learning curve that is associated with any new category of air- whenever an aircraft enters a maintenance facility. Either type of planes. approach presents a new opportunity and a new challenge for However, these new risks will be more than offset by the posi- investigative authorities. For example, as a practical matter, in tive characteristics of VLJs. They will offer the increased reliabil-

ISASI 2007 Proceedings • 121

Proceedings 2007.pmd 121 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 122 the end,VLJsshouldproduce afatalaccidentratethat isatleast sure insomesegmentstominimizesingle-pilotoperations.In mercial operators.Finally, insurers andpassengerswilladdpres- plus maintenanceprograms and operatingrequirements forcom- will playtheirpart,withrequirements forjetratings,IFR the benefitsofade-factodispatchfunction.Governmentsalso erators currently experience, andmanypilotswillhavesomeof more professionalized thanmanysmallbusinessandprivateop- ther reduce theremaining risk.Maintenanceprograms willbe aircraft managementcompaniesbyprivateoperators,willfur- commercial operators,plusfractionaloperationsandtheuseof risks associatedwithrecent accidents. The characteristicsofVLJsalonewilloffsethalftheknown bility andavionicswillbeespeciallyeffectiveinreducing risk. try personalflightscurrently produce. Thehigh-altitudecapa- fatal accidentratesthansmallbusinessoperatorsandcross-coun- definition flatscreens. Thesecharacteristicswillproduce farlower with anautopilotandwillbedisplayedmore simplyonhigh- warningandtrafficalerting—andallthiswillbeintegrated terrain maps, onics andnavigation,completewithmovingmaps,terrain plays, integratedelectronic flightbags,andstate-of-the-artavi- agement systems,multifunctiondisplays,real-time weatherdis- ity ofjetenginesandwillbehighlyautomated,withflightman- In addition,newtrainingprograms from manufacturers and • ISASI 2007 ISASI Proceedings 122 2 See several studies by CAST andtheFlightSafetyFoundation2 SeeseveralstudiesbyCAST andthe 1 TheU.S.distinguishesbetween“business”and“corporate”aviation.Cor- Endnotes pening again. pened, whyithappened,andhowtoreduce theriskofitshap- reliance ondatarecorders aswetrytounderstandwhathap- bution ofworkamongvariousprofessional disciplines,andthe relatively low. Anysuchincrease willaffectworkload,thedistri- substantially inthegeneralaviationcommunity, evenifratesare bine-powered aircraft likely willincrease, andperhaps increase will notchange,thevolumeofaccidentsinvolvingcomplex, tur- mental process ofaccidentinvestigationanditscore objectives investigative authoritieswillhavetorespond. Thoughthefunda- volume ofVLJswillproduce accidentstowhichinvestigatorsand geted markets. 60 percent lowerthantheratescurrently experienced bythetar- Commercial Aviation SafetyTeam (CAST). use ofprofessional pilotsincorporate/executive aviation. each provides not-for-hire transportationandthecentraldifference isthe required bythebusinessinwhichindividualisengaged.”Inshort, aircraft (notforcompensationorhire) byanindividualfortransportation pilots of transportingitsemployeesand/orproperty, pany, orotherorganization (notforcompensationorhire) forthepurpose porate/executive aviationis“anyuseofanaircraft byacorporation,com- Nevertheless, theanticipatedlearningcurveandsheer fortheoperationofaircraft.” Businessaviationis“anyuseofan 1/14/2008, 9:44 AM ◆ and employingprofessional Enhanced Airborne Flight Recorder (EAFR)—The New Black Box By Jim Elliott, G.E. Aviation

Jim Elliott is a systems applications engineer with Systems. ED-112 was prepared by Working Group 50, an inter- G.E. Aviation in the Data Acquisition and Recording national committee with a broad membership comprised of regu- Systems (DARS) product area. He joined G.E. latory agencies, aircraft manufacturers, avionics manufacturers, Aviation in 1981 and has performed various systems recorder manufacturers, military representatives and safety cen- engineering roles in the DARS product areas for the ters, airlines representatives, pilots unions, and many accident past 22 years. Elliot was a member of the EUROCAE investigators. ED-112 supersedes ED-55 “Minimum Operational Working Group 50 during the development of ED- Performance Specification for Flight Data Recorder Systems” and 112. Before joining G.E. Aviation, he served in the U.S. Navy where ED-56A “Minimum Operational Performance Specification for he performed repairs and maintenance on data systems and supervised Cockpit Voice Recorder Systems,” two previously published the data systems technicians aboard the USS Elliot. EUROCAE documents. One of the important objectives identified during the drafting of ED-112 was harmonization. ED-112 SESSION 5—Moderator Danny Ho Introduction harmonizes the requirements of the earlier CVR and FDR MOPS, For many years, aircraft accident investigators have been recom- including the survivability requirements, the environmental test mending essential improvements to crash-protected airborne requirements, the recording start/stop criteria, and provides for flight recorders and their installation requirements. These rec- harmonization of the FDR recording requirement with ICAO ommended improvements are based on the lack of important Annex 6. ED-112 also introduces completely new recorder func- and valuable information during the investigation of several air- tionality including Communications, Navigation and Surveillance/ craft accidents where the airborne recorders yielded less-than- Air Traffic Management (CNS/ATM) data link recording, image complete information during the mishap event. In the United recording, elaborates on the concept of combined recorders (which States, these recommended improvements are identified in the inherently provide harmonization), and establishes the Recorder National Transportation Safety Board (NTSB) Most Wanted Independent Power Supply (RIPS) requirements. ED-112 addi- Transportation Safety Improvements list for Aviation—“Improve tionally prohibits recording audio data at a reduced quality using Audio and Data Recorders/Require Video Recorders,” dated merged crew channels for data older than 30 minutes and pro- November 2006. GE Aviation’s Enhanced Airborne Flight Re- hibits the use of magnetic tape, wire, and photographic methods corder (EAFR) is the next generation of solid-state digital Crash of recording in Crash Protected Airborne Recorder Systems. By Protected Airborne Recorder Systems, and it incorporates many prohibiting these items, some of the obstacles that have ham- lessons learned during previous recorder developments. The pered previous accident investigations due to the lack or survival EAFR also addresses and resolves the improvements identified of information or poor quality information have been removed. in the NTSB “Most Wanted” aviation list. The EAFR meets the ED-112 recorder requirements for the A summary of the NTSB Most Wanted aviation list includes Cockpit Voice Recorder System, Flight Data Recorder System and the following objectives: the CNS/ATM Data Link Recorder System. The EAFR has the • Require cockpit voice recorders to retain at least 2 hours of necessary crash-protected memory capacity and a dedicated high-quality audio. Ethernet interface for image recording to support the ED-112 • Require back-up power sources so cockpit voice recorders can Image Recorder Systems requirements. Should rulemaking re- record an extra 10 minutes of data when an aircraft’s main power quire image recording, the EAFR is capable of acquiring and fails. storing this additional information. • Install cockpit image recorders in cockpits to give investigators more information to solve complex accidents. What is the EAFR and what does it do? • Install dual combination recorders. As described in ARINC Characteristic 767, an EAFR is capable of • Expanded parameters recorded on Boeing 737 airplanes. providing combi- The EAFR system meets or has the growth capability to meet all nations of any or of these improvement objectives. The Boeing 737 airplane specific all of the following objective is being addressed under a supplemental notice of pro- functions in a posed rulemaking (SNPRM), and the EAFR is very capable of re- single line replace- cording the expanded parameters when they are made available. able unit (LRU); A significant number of lessons learned and the recorder im- the digital flight provements desired by accident investigators are also specified data recorder in ED-112, the EUROCAE Minimum Operational Performance (DFDR) function, Specification (MOPS) for Crash Protected Airborne Recorder the cockpit voice

ISASI 2007 Proceedings • 123

Proceedings 2007.pmd 123 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 124 tions, andtheEAFRcrash-protected memory capacityhasthe tion. Theimagerecording durationwillbegovernedbyregula- stores thisdatainthecrash-protected memoryinaseparateparti- capable ofreceiving adigitaldatastream ofcockpitimagesand tures, andenginesasrequired. Theimagerecorder functionis images oftheflightdeckinstruments,flightdeck,aircraft struc- The imagerecorder growth function aircraft usingahigh-speedEthernetinterface. like thecrew audio, canbedownloadedrapidlyonboard the dio channelsmemorypartition,thedatalinkinformation, un- Even thoughthedatalinkinformationisstored inthecrew au- link informationinthecrew audiochannelsmemorypartition. same astheaudiorecording duration.TheEAFRstores thisdata tion inthecrash-protected memoryfora2-hourduration,the veillance functions.TheEAFRprocesses andstores thisinforma- the aircraft’s communicationmanagementandintegratedsur- munication isused.Thesedatalinkmessagesare provided by to ground communicationsystemwhendigitalairtoground com- recorder functionreceives digitalmessagesfrom theaircraft air data linkmessagesprovided toandfrom thecrew. Thedatalink The datalinkrecorder function downloaded whentheEAFRisoffaircraft. CVR recording durationis2 hours.Recorded audiocanonlybe crophone audioandoneforthecrew The channels,perED-112. tected memoryinseparatepartitions,oneforthearea mi- The EAFRprocesses andstores thisinformationinthecrash-pro- nels are alsorecorded inboththeforward- andaft-installedEAFRs. the aft-installedEAFRrecorders. Thethree digitalaudiocrew chan- pit area audioisprovided toandrecorded inboththeforward- and Theanalogcock- for 10minutesintheeventofpowerinterruptions. areEAFR, connectedtotheRIPS,providing aback-uppowersource microphone andpreamplifier, alongwiththeforward-installed the cockpitarea microphone andpreamplifier. Thecockpitarea the FlightDeckAudioSystemandoneanalogaudiochannelfrom receives audiofrom three digitalaudiocrew channelsprovided by acoustical soundenvironment oftheflightdeck.TheCVRfunction munications betweencrew membersandalsocaptures thegeneral The cockpitvoicerecorder function the aircraft usingahigh-speedEthernetinterface. DFDR flightdatainformationcanbedownloadedrapidlyonboard recorded duringatleastthelast25hoursofitsoperation.The systems are required tobecapableofretaining 88dataparameters data before theoldestdata.Current FDRrecording overwriting flight dataparametersandrecords approximately 50hoursofflight plication iscurrently configured forrecording approximately 2,000 partition separatefrom theotherdatatypes.ThefirstEAFRap- stored inthecrash-protected memoryinasegregated memory craft fiberopticaircraft datanetworkinterface.Theflightis the aircraft andtheavailabilityofdataparametersonair- inside theEAFRandmadepossiblebydigitalarchitecture of plex switchedEthernetdatastream. Thisfunctionalityishosted the specifiedratesfrom theaircraft’s fiber opticavionicsfulldu- and tion. TheFlightDataAcquisitionfunctionresides intheEAFR sensors andsystemsprovided bytheFlightDataAcquisitionfunc- The DFDRfunction paragraphs. recording function.These functionsare describedinthefollowing recorder function,thedatalinkrecording function,andanimage

• acquires themandatoryflightdatarecording parametersat ISASI 2007 ISASI Proceedings records parametricflightdatafrom aircraft 124 isusedtorecord thedigital records theflightdeckcom- isusedtorecord visual EAFRloadablesoftware airplanepart(LSAP). • CAM outputtoboththeforward-installed andaft-installedEAFRs. Onecockpitarea microphone andpreamplifier thatprovides • stalled EAFR. Onerecorder independentpowersupplyfortheforward-in- • Two EnhancedAirborneFlightRecorders. • FDR andCVRrecorder systems. provide airlineoperatorsoperatingcostsavingsovertheolder power. Thisreduced size,weight,andpowerconsumptionwill weighs only9.0pounds,andconsumes12wattsof+28VDC sures 5.07incheswidex8.41long5.90high, and CVRrecorders. TheEAFRhasasmallformfactorthatmea- grated ground toolsformaintenanceandground support. required forsupportoftheEAFRsince itincludesbuilt-ininte- flight dataacquisitionunitLRU.Nospecialtoolsorsoftware are digital flightdataacquisitionfunctioneliminatingtheneedfora installed ontheaircraft. TheEAFRalsoincludesanintegrated currentFDR andaCVR, regulations require thattwoEAFRsare require it.AlthoughoneEAFRhasthecapabilitiesofbothan has thecapabilitytosupportimagerecording ifregulations should recorder thatalsorecords CNS/ATM datalinkinformationand recorder systemswithasingle, small,low-weight LRUcombined The EAFRreplaces boththeFDRandCVRLRUsofprevious Size matters—theEAFRweighsin recorders collectanextra 10minutesofdata whenanaircraft’s hours ofaudio,provide aback-uppowersource socockpitvoice NTSB’s MostWanted listobjectives fortheCVRtorecord at least2 aircraft accidentorincidentinvestigation.The EAFR meetsthe tial forretaining thisinformationneededduringthecourse ofan the quantityofrecorded informationandincreases thepoten- The EAFRprovides significantimprovements tothequalityand The EAFRmeetsinvestigatorsneeds test interfaceandtheintegratedflightdataacquisitionfunction. EAFR incorporates,includingahigh-speeddigitalmanufacturer downloaded whentheEAFRisoffaircraft. image recording crash-protected memorypartitioncanonlybe storage capacityfor2hoursofimagedatarecording. Datainthe A typicalEAFRsysteminstallationincludes: The EAFRismuchsmallerandlighterthanprevious FDR ARINC 767alsoidentifiesoptionalenhancedfeatures thatthe 1/14/2008, 9:44 AM main power fails, provide the growth capability to install image The EAFR also includes integrated electronic documentation recorders in cockpits to give investigators more information to solve of the flight data parameters using the Flight Recorder Electronic complex accidents, and meets the objective to install dual combi- Documentation (FRED) compliant with ARINC specification 647A. nation recorders. An important benefit of the dual combined re- FRED is an international standard that defines the content and corder installation is that there are now two complete copies of all the format of electronic files that document Flight Data Recording of the recorded information available to the investigators. The Systems. FRED provides the complete configuration description enhanced flight data capacity of 2,000 parameters for 50 hours is of the flight recorder data frame and is stored inside the crash- a huge increase over previous recorder systems. protected memory, a significant improvement in flight data recovery techniques. FRED provides accident investigators with a con- Implementation sistent, accessible, complete, and accurate interpretation of the flight For its first application, two identical EAFR combination recorders data documentation required for the timely recovery and analysis are installed in forward and aft aircraft locations, providing dual of the FDR accident data. This is especially important with the combined recorder capabilities. The forward recorder installation increased number of flight data parameters being recorded. includes a RIPS, which provides continuation of the flightdeck audio Due to the extent of the increased EAFR capabilities, many recording for 10 minutes during electrical power interruptions to ARINC standards are supported to ensure interoperability with this EAFR. The forward EAFR monitors the status of the RIPS and the various systems and capabilities that comprise the system ar- reports this information to the health management function. chitecture. The EAFR design supports numerous ARINC stan- To ensure proper operation and reliable cockpit audio record- dards including ARINC 767 Enhanced Airborne Flight Recorder ing, the EAFR performs an audio self-test of the system. The (EAFR), ARINC 777 Recorder Independent Power Supply (RIPS), flightdeck EAFR audio test is very robust and includes an active ARINC 647A—Flight Recorder Electronic Documentation test of the cockpit area microphone and the flightdeck aural envi- (FRED) for ARINC 767 Recorders, ARINC 664 Avionics Full SESSION 5—Moderator Danny Ho ronment. This test is automatic during the Aural Warning System Duplex Switched Ethernet, ARINC 615A Software Data Loader (AWS) power up or it can be manually initiated via a panel TEST Using Ethernet Interface, ARINC 619 ACARS Protocols For Avi- button. Crew or maintenance action initiates the test and the AWS onic End Systems, and ARINC 624 Design Guidance For Onboard notifies the recorders to expect the test tone. The AWS emits a 1 Maintenance System, to name a few. kHz test tone for 3 seconds, and the recorders search for the tone This extended capability also involves more technical standard and absence of the tone in the area microphone audio signal. This order (TSO) authorizations than the past recorder systems. The test verifies the functionality of the cockpit area microphone, the EAFR system will include authorizations to FAA TSO C-123b for preamplifier, the interface wiring, and the EAFR audio input cir- Cockpit Voice Recorder Systems, TSO C-124b for Flight Data cuitry. A successful test or failure is reported to flightdeck displays Recorder Systems, and TSO-C177 for Data Link Recorder Sys- and to the health management function. tems. Additionally, TSO C-155 will be applied to the recorder The EAFR supports ARINC 615A data loading and uses two independent power supply, and TSO C-121 applied to the un- different loadable derwater locating devices. software airline parts (LSAP). The Concluding remarks first LSAP contains These EAFR features provide the investigator with much more the operational information and additional types of information than previous software which in- recorder designs and make it quickly available in an efficient and cludes the func- easily accessible manner. These significant improvements in air- tions for flight data borne crash-protected recorders provide accident investigators recording, audio worldwide the extended capability to share their lessons learned recording, CNS/ from accident investigation data collection. Sharing the lessons ATM data link re- learned and the information gained in airline safety is a core cording, flight data acquisition, network and system input/output value of the International Society of Air Safety Investigators (Ethernet and avionics full duplex switched Ethernet), and built-in (ISASI). This recorder addresses the specific need of accident test and health management. The other LSAP contains the air- investigators of achieving timely safety recommendations that may craft specific configuration information and includes the end sys- help prevent a recurrence of an accident. tem configuration, recording configuration database, and the flight The EAFR is being developed to EUROCAE ED-112 and cer- recorder electronic documentation. This LSAP is created by the tified for a new, high-efficiency, long-range, mid-sizes commer- airplane manufacturer using the recorder configuration tool (RCT). cial airplane. The EAFR is a modern airborne crash-protected For ground and maintenance operations, the EAFR includes in- recorder system with huge improvements over previous record- tegrated ground tools for downloading, installation checks and an- ers, capitalizing on the latest technology, conforming to new stan- nual check verification. The built-in ground tools are web page based dards and requirements, providing increased capability, reliabil- tools that are accessed with a personal computer using an Ethernet ity, performance, capacity and growth. The EAFR contains a sig- Internet web browser and provide capabilities for configuration, read- nificant number of industry firsts and provides an abundance of out, replay, and flight test support. These ground tools include the various types of crash-protected data for investigators in a smaller operational ground program (OGP) web pages for data download- and lighter package. The EAFR is a new generation of airborne ing and the direct parameter display (DPD) web pages that allows crash-protected recorders that is small on the outside but huge the display of operator selected data parameters in real time. on the inside! ◆

ISASI 2007 Proceedings • 125

Proceedings 2007.pmd 125 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 126 to investigateincident.They are 5. Mishap investigationinRSAF independent ofanyotherboard ofinquiry. lish primarycausalfactorsaswellcontributory and is and nottoapportionblame.Thesafetyinvestigationwill estab- 4. Only thencanintelligent,corrective actionsbetaken. must bedeterminedandtheirproper interrelationship established. certain causalfactors.Allfactors,bothmechanicalandhuman, able evidencethat,ifcorrectly identifiedand assessed,willprovide which eventuallyformapattern.Thewreckage itselfcontainsvalu- mishap isamethodicalaccumulationofsmallbitsinformation, 3. efit thatcouldbederivedfrom acostlymishap. erroneous conclusionsnullifiescompletelytheonly possibleben- factors bedetermined.Anincompleteinvestigationresulting in fore, toprevent future occurrences, itisimperativethatallcausal tion ofanyonewhichcouldhaveprevented themishap.There- cause. Very commonly, asequenceofeventsoccurs;theelimina- to yieldthegreatest benefits.Few mishapsresult from asingle 2. report tohighermanagement. and recommendations oftheinvestigatorswillbesubmittedina equipment, suitabilityofprocedures, etc.Theanalysis,comments, factors, e.g.,humantrainingofoperators,adequacy tors mustanalyzeeachincidenttodetermineallpossiblecausal ments canbemadetoprevent asimilaroccurrence. Investiga- incidents are essentialtodeterminethecausesothatimprove- tious, andimpartialinvestigationanalysisofaircraft orground agement systeminanyflyingorganization. Detailed,conscien- 1. Introduction in theRSAF Part 1:IncidentInvestigation b. theUnitSafetyInvestigation (USI) a. theSafetyInvestigation(SI) The purposeofaninvestigationshouldbeclearlyunderstood In theRSAF, there are twodifferent bodiesthatmay besetup The investigationofthecircumstances surrounding anaircraft Investigation isanimportantelementofarobust safetyman- The purposeofasafetyinvestigationistoprevent mishaps • ISASI 2007 ISASI RSAF AnalysisandInvestigation; Bio notavailable Proceedings 126 By LTC Suresh Navaratnam,Republic ofSingapore AirForce (RSAF) Tool andTechniques weeks 10. investigation canbedividedintosixdifferent phases: 9. Phasesofasafetyinvestigation. human factoraspectforincidentsinvolvingerrors. a doctorfrom themedicalservicesmaybeco-optedtolookinto the co-opted intotheteamtolookrespective areas. For instance, accident/incident. Specialistofficersintherelevant agenciesmaybe the accident.Theteamshallinvestigateallrelevant detailsofthe 8. are gathered inconfidenceandanon-attributive manner. or asabasisforanydisciplinaryactions.Theviewsandevidence not meanttodiscriminateorassessanindividual’sperformances vening aSITissolelyforthepurposeofaccidentprevention. Itis for corrective andpreventive actions.Hence,thepurposeofcon- establish thecause(s)ofnear-accidentsandlatentfactors up totheincidentthrough evidenceandwitnessinterviews be toinvestigateandmake anassessmentoftheeventsleading near accidents)isobserved.ThebasisforconveningaSITshould trend ofhighaccident-potentialincidents(i.e.,near-missesor serious consequences.Itcouldalsobeactivatedifanincreasing violation ofairspace,orrulesandregulations thatmayhave accidents like anairproximity occurrence, orincasesinvolving ment. TheSIteamissetuptostudyorinvestigateanynear- recurrence ofsimilarevents.Theteamreports toRSAFmanage- make recommendations toaddress anyweaknessestoprevent of theincident,bothactivefailure andlatentprecondition, and The primaryobjectiveoftheSIistodeterminecausalfactors aninvestigation. high mishappotentialincidentthatwarrants finding bodyconvenedwheneverthere isamishap/incidentor 7. Safety investigation(SIT) to prevent recurrence ofeventsasimilarnature. gate allpossiblecausalfactorsandpropose immediatemeasures The purposeoftheAFIinvestigationistoindependentlyinvesti- as soonpossibleandthenafullreport expeditiously thereafter. ducted. TheAFIsafetyinvestigationwillfurnishaninitialreport being influencedbyanyboard ofinquiryconcurrently beingcon- outexpeditiouslygation istobecarried withoutinfluencingor In theeventthatsuchaninvestigationisinitiated,AFIinvesti- investigation intoanincidentorhighmishappotentialoccurrence. 6. The compositionoftheSITwillvarydependentonnature of f. Follow-up e. Reporting d. Investigationandwriting c. Arrival b. Notification a. Preparation The SafetyInvestigationTeam (SIT)isanindependentfact- The AirForce Inspectorate(AFI)mayinvestigateororder an The SITshouldalsoaimtocomplete itsinvestigation withthepreliminary update report withinfirst48hrs.If 1/14/2008, 9:44 AM The conductofthesafety within 2 further extension is required, the chairperson will seek approval mon safety precautions. In all field activities, especially when from the convening authority. motivation to continue is high, fatigue is to be expected. Tem- 11. The SIT report format should capture the following: per the need to continue site investigation without interruption a. A factual account of the near-accident or incident(s). with the observed fatigue levels of the investigating party. A b. Findings and opinions of the team as to the cause(s) and tragic mishap involving a team member will lose the investiga- latent factors. tion time, resources, and insight. Care must be given to hazards c. Recommendations and proposals. described below during the initial briefing and throughout the whole investigation. It is hence the responsibility of the SIT Unit safety investigation (USI) leader to brief and highlight any potential hazards that may 12. Incidents with a “HIGH” mishap potential will automatically endanger his members. qualify for a USI. Its aim is to determine the active and latent 19. The hazards are classified into six main categories: failures and make necessary recommendations for the purpose of a. Munitions preventing the next similar occurrence. An USI can also be convened b. Pressure vessels at the discretion of the Formation or Unit CO. c. Flammables and toxins 13. The USI is to be led by an officer of minimum CPT rank. He d. Environment and climate will be assisted by two-three other members, who may be from e. Composite materials the different vocations, to provide the depth and breadth in the investigation. Preserving the evidence 14. Like the SIT, the USI should aim to complete its investigation 20. In the event of an aircraft mishaps/incident, the incident com- within 2 weeks, and similarly, if further extension is required, the mander and the salvage team will be the first party to arrive on convening authority’s approval will be sought. The format of the scene. The incident commander will be the on scene commander. SESSION 5—Moderator Danny Ho USI report will be similar to that mentioned earlier of the SI report. With the assistance of the salvage team, medical team and the field defense squadron (FDS) personnel, their duties include safe Responsibilities security of the site and offering medical assistance to the injured. 15. Management at all levels will be responsible for ensuring that They are also to ensure the “preservation of evidence.” The inci- the investigation is completed in accordance with the guidelines dent commander or FSO will at the earliest opportunity brief of this paper. and assist the SIT upon its arrival. 16. Safety personnel at each level must be capable and readily 21. Soon after the impact and the arrival of officials and bystand- available to assist in the investigation, and maybe to conduct as- ers, the impact site deteriorates rapidly. All efforts to preserve signed investigations. the evidence should be understood and controlled. A deliberate 17. Investigators, management, and safety personnel at all lev- plan to examine the site and its story must be formulated before els must ensure that the following essential requirements are the first attempt to draw conclusion. accomplished: 22. All physical evidence must be protected from further dam- a. Each incident must be thoroughly investigated and all causes age. Edges of broken surfaces should be covered and kept away identified. Often in investigations, certain causes may be obvi- from contaminants such as oil, fuel, or other pieces. Do not rush ous; however, the investigations should not be terminated until to wash, clean, or brush off parts when examining wreckage, and all possible causal factors have been examined. do not mate together broken pieces, as this may destroy evidence b. The findings of investigations have little value until the in- of their failure mode. formation is disseminated so that the appropriate corrective ac- 23. A thorough check of the cockpit area should be made and tions can be taken. Although timeliness is important, premature include all controls, selectors, switches, and handles. Note the reporting of inaccurate or unsubstantiated information can be undisturbed reading on all instruments and indicators. Obvi- damaging to prevention efforts. Findings must be accurately ously, do not change settings of controls, dials, switches, or other stated, fully substantiated, and directly related to the investiga- components which may give a clue to control settings, engine tion. Recommendations, where appropriate, must provide posi- power, flight control movement, or aircraft configuration and tive corrective or preventive actions where possible. The impor- aircrew action before the crash. Photograph these items if at all tance of accuracy cannot be overemphasized, as recommenda- possible. tions are often the basis for expensive and far-reaching actions. c. Investigations and reports remain virtually valueless in acci- Critical time evidence dent prevention until action is taken on the findings and/or rec- 24. Recover and protect any evidence likely to disappear or change ommendations. The part played by investigations and reports in with time. Photograph the evidence before disturbing its posi- the accident prevention effort is realized only at this step in the tion. Wreckage and grounds should not be disturbed until all process. Therefore, follow-up procedures must ensure that ap- necessary evidence has been gathered; however, the wreckage propriate actions are taken and are effective. should not be left longer than necessary on runways, public high- ways, or congested parts of a city or town. The following evi- Crash site management dence is likely to be lost over time: Initial briefing and safety at the site a. Samples. As investigators make their walk-through, they 18. An area of vital importance in investigation is the safety of should be alert to substances that should be collected as samples the investigating team. Investigators, in their eagerness to seek for laboratory analysis. These samples could be fluids (fuel, lu- out the causes, often ignore safe investigation practices and com- brication oil, hydraulic fluid), gases (oxygen, fire-extinguishing

ISASI 2007 Proceedings • 127

Proceedings 2007.pmd 127 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS lighted. importance ofinterviewingwitnesses andphotographybehigh- It is,therefore, importantthatduringtheinitialbriefing, the leastunderstoodskillsin the process ofmanyinvestigations. task ofpreservation. Unfortunately, thesetwoareas are among and causethemtobelost. is discovered. Personnel mayinadvertentlysteponthebulbslater Each shouldbetaggedorlocatedforlaterrecovery assoonit bulb assembliesmaybenoticedduringtheinitialwalk-through. illuminated atthetimeofcrash.Numerous smallbulbsor nation andifadditionalhelpisneeded. Instead, itissimplytodeterminewhatareas needfurtherexami- here isnottoprove inflightfire existed andidentifyitssource. deposits ofmoltenmetaltypicaltoinflightfires. Theobjective located outsidethearea ofground fire, unusualsootpatterns,or looking forobviousclues—piecesofburnedwreckage thatare team shouldberooting around inthewreckage. ITshouldbe tern andanyindicationsofinflightfire. Thisdoesnotmeanthe its initialwalk-through, itshouldbenotingtheground fire pat- moisture, precipitation, orwinds.Whiletheteamisconducting soot patternsanddiscolorationmaybealtered duetoovernight containers andcanadviseonsamplingtechniques. 128 ing witnesses recorded andretrieved forfurtheranalysis.Basically, 27. Recording information be discounted. duringremovalcurring mustbedocumentedsothatitlater may to prevent furtherdamageorlossofevidence.Anyoc- be obliterated.Inmovingthewreckage, everyeffortmustbemade documents, withasmuchdetailnecessaryforareas thatmay tographic record. Allaspectsofthescenemust beportrayedin an accuratewreckage distributiondiagram,alongwithafullpho- tional documentationmustbeensured. Thisincludespreparing way, etc.)before adetailedinvestigationcanbeconducted, addi- 26. Removing wreckage Task Group shalladvisetheteamleaderoncourseofaction. also examined bythemedicalofficer. Insuchcases,theMedical bodies shouldnotbemovedbefore beingphotographedand 25. Handling death NOTE: ring ittoalatertime. the teamisconsciousofimmediatelytakingasampleordefer- the teamhasinformationtomake. Thepointistomake sure and preserving it. identified, there willbeatrade-offbetweendisturbingevidence idea oftheseactions.Whenaneedfortakingsamplehasbeen of theteamparticipatinginwalk-through shouldhavean agent), orsolids(soot,fire residue, broken metal).Eachmember c. b. These trade-offsmayinvolvesomedifficultdecisionsthatonly When thewreckage mustberemoved (tocleararunway, high- When occupantsoftheaircraft are obviouslydeceased,the Having theevidencepreserved, thisinformation mustbe • Light bulbs Fire pattern. ISASI 2007 ISASI

The localPOLauthorityhassamplingequipmentand and Proceedings . Lightbulbsmaysurviveinitialimpactsifnot Manyfire patternswillnotchange;however, photography 128 caneffectivelyaccomplishthis interview- vent similaroccurrences. so thatexpeditious control measures canbeprevented topre- essary toestablishthecauseofmishap/incidentornearmishap tigation isformishapprevention andshallbeconvenedasnec- and operationalcapability. Thesolepurposeofthesafetyinves- 29. Allincidentsandmishapsare costlyintermsofdollarvalue Conclusion cise databaseintheSIS. thodically, thusatthesametimegeneratingaconcrete andcon- tools allowtheRSAFtoclosethesecasesconclusivelyandme- ing latentissuesthatwere notorinadequatelyaddressed. These database (inexcess of5years)toassistinvestigatorsindiscover- currence.” Finally, thedataminingprogram usestheextensive Elimination Process, whichconcludeswiththe“probability ofre- Technical-related casesare dealtwithbytheStandard Technical incident reporting forthesharingoflessonsacross theRSAF. porating thenewlydevelopedanddigitizedHFACs tocapture agement. AnothertoolistheSafetyInformationSystem,incor- causation factor, beitman,machine,medium,mission,orman- model, whichallowstheinvestigationprocess todrilldownthe causation. IntheRSAF, fivesuchtoolsexist, theyare the5M able toassistintheinvestigationeffortdeterminemishap 28. Inanyinvestigation,everyavailabletoolshouldbemadeavail- Tools formishapinvestigation 3. Objectives could havebeennotonlylatentbutcontributory. the SIStoalsoinvestigateotheraspectsofcurrent incidents that tected, henceresulting intheincident.Investigatorscanrely on to provide possiblecluestoemerging trends thatwere notde- 2. more functionalityandefficiency. II wasdevelopedandputinplaceOctober2003toprovide rent fast-pacedgrowth ofIT, ithasbecomeobsolete.Hence,SIS based onthetechnologyavailablethen(early90s).With thecur- be derivedforsafetymeasures tobetaken. However, theSISwas and statisticaldataforanalysis.Anyundesirablesafetytrends can safety information(bypostingFAIRs/GAIRs viatheOAsystem) since July96,providing managementandworkinglevelswith 1. Introduction RSAF SafetyInformationSystem(SIS) Chapter 1 Part 2:Investigation Tools hierarchy. f. provide seamlessinterfacewithOAand otherMISapplications. e. provide bettervalue-addtotheincidents beingreported. d. bemore userfriendlyandinteractive. c. automatethesafetyinformationflowthrough thecommand b. reach outtoawideruserbase. a. provide timelyalert ofsafetyincidents. The RSAFdependsgreatly ontheSafetyInformationSystem The objectivesoftheRSAFSISIIare to The RSAFSafetyInformationSystem(SIS)hasbeeninplace 1/14/2008, 9:44 AM Concept of SIS II 4. SIS II is a web-centric application for easy maintenance and accessibility. This is also in line with MINDEF’s direction to tap the latest Intranet technology for faster data retrieval/ sharing. Users will receive only an e-mail containing a hyperlink for access to the SIS II application. This will allow easy maintenance and ease of changing business logic. The users will use a web browser to navigate and obtain information from the Intranet and database servers. With this set up, users will be able to access SIS II, as well as OA and other MIS applications seamlessly, through their workstations.

Modules Safety report submission and routing Figure 1. Parallel routing of FAIR/GAIR. 5. This is the main module in the RSAF SIS for the creation, editing, amendment, and printing of the following reports: tions taken in the FAIR/GAIR. All comments on this report will a. FAIRs Under this, the three categories/types of FAIRs avail- be captured and archived in the SIS II. able to be reported on are aircraft, C2, and UAV FAIRs. 9. This module also allows parallel routing of FAIRs/GAIRs for b. GAIRs The types of GAIRs to be reported can be classified soliciting specialist inputs (e.g., ALD, DSTA, ARMC). After each according to incidents that are either member of the usual command chain/hierarchy for FAIR/GAIR (1) Work-related. Under this category will be aircraft and non- routing has input his part, he can select through a “drop down” SESSION 5—Moderator Danny Ho aircraft related incidents/accidents. The latter will include mili- e-mail address list who he wants to route the report to in parallel tary transport (MT) cases. while the report is being routed to the next party in the standard (2) Non-work-related. This will be for incidents such as sports routing process. The aim is to provide the flexibility for units to injuries, bee stings, and private-owned vehicles (POV) accidents. solicit the expertise from other agencies for the various types of c. Hazards. This is for raising concern on safety-related issues FAIRs/GAIRs/Hazards. See Figure 1 for the FAIR/GAIR workflow that if not timely accorded due consideration could lead to an for parallel routing. accident/incident. 10. To further improve the quality of information, this module Under the FAIRs / GAIRs where the causal factor group is caters to the events to be captured and described as best as pos- “Man,” the HFACS1 option must be provided for the analysis of sible through various input formats. To draw and share maxi- the human factor contribution. mum lessons, the findings (can be a combination of texts and 6. This module has a user friendly MMI (man-machine inter- graphics) can be attached to the FAIR/GAIR and made available face) to provide better navigation and usage of the application. on line to allow better appreciation of the particular incident The screens are designed to simplify data entries. Pop-up win- reported. dows are available where needed to explain the expected input. Pre-defined selections are put in place, except for the descrip- Tracking management tion of the occurrence, to eliminate spelling errors that hamper 11. At each stage of the FAIR/GAIR workflow, SIS II is able to analysis. “Help” is featured widely to provide definition of terms show the current status and the action party where the particular and explanations of choice of selections, caution signs, etc., and report is residing. Reports that are outstanding and the respon- a troubleshooting guide. Guidelines are available on the types sible parties are easy to identify. of events that should be classified as FAIRs/GAIRs, in their true 12. A time line for the action party to respond is also designed context. into the SIS II. A reminder is autogenerated to the particular 7. Besides describing the event itself in detail in one section, the action party if the action is not duly attended to. At the same originator is also able to relate and share personal experiences, time, the sender is auto-notified that the mail he sent was not reactions, and considerations during the course of the event in replied to / actioned accordingly. This will ensure that all FAIRs/ another section. The RSAF safety community can also give it value- GAIRs are timely and completely closed. add by sharing comments on the findings and lessons learned. Other personnel who have experienced similar cases can also Safety audit inspection share on their experiences. 13. The module allows the capturing of audit findings in squad- 8. After the initial assessment by the CO, the broadcast of the rons after the completion of a safety audit inspection. In addi- FAIR/GAIR is sent in the form of an e-mail through the OA to all tion, SIS II allows the compilation of inspections/audits reports SIS II users. The e-mail contains an executive summary of the for trend analysis of safety performance. FAIR/GAIR and a link to the SIS II. This link allows the user to launch the SIS II application through the Intranet, to access to Triggering details of the particular FAIR or GAIR. This way, the broadcast is 14. For trend alerts, there is a trigger mechanism (via e-mail not delayed as the amount of data transferred is reduced. The alert) built into the SIS II to trigger RSAF management of any broadcast also indicates to the receiver whether it is for his/her predetermined undesirable trends. In addition, SIS II allows a action or information only. Upon clicking on the link, the SIS II criteria-based search or selection of parameters by any user and is launched for the receiver/action party to enter comments/ac- alerts them to any trend that has exceeded a pre-set value. The

ISASI 2007 Proceedings • 129

Proceedings 2007.pmd 129 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 130 24. Contingencies duringSISsystem failures personnel. Farm andsupportedbySISIIHelpdesk,whichismannedDSTA 23. System supportrequirements transmit viatheSISII. to theparent bases/unitsforthelattertokey inthedataand ments willstillstandintheinterim,i.e.,faxingoverFAIRs/GAIRs foroverseasdetach- Intranet network.Thecurrent arrangement where thesystemwillbeweb-based andrideonthecurrent RSAF 22. Accessibility byoverseas other applications. tion eliminatedviasingle-source inputsanddatasharing with system interface,dataerror shouldbereduced anddataduplica- 21. SIS IIinterfacewithotherRSAFinformationsystems for specificpresentations oranalysispurposes. the user’sselectioncriteriawithinSISIIdataqueryscreens 20. for theUSOs/BSOs/FSOstheirusualsafetyreports. better dataanalysisandpresentations forallSISusers;especially 19. Reports about AFI,events,manuals,publications,etc. service level,safetyarticles,alertmessages,generalinformation lected FAIR/GAIR casesthathavesomevalueinsharingonatri- accessed bypersonnelwithIntranetaccount.Examplesare se- ing ofgeneralnon-sensitiveRSAFsafetyinformationthatcanbe 18. E-Bulletin board sonnel involvedforaspecificperiod,location,orevenaircraft type. various occurrence types(logsoropsevents)evengroup ofper- analysis. For instance,analysiscanbebasedonCausalFactors orthe user friendlyandinteractivetoenableamore robust anddetailed 17. Analysis tion viewingandaccess. tions/fields andselectioncriteriaavailableforselectiveinforma- when compared totheearlierSIS.InSISII,there are manyop- 16. Search engine e-mail. an actionitemthatrequires hisattentionwhenhelogsontothe FAIRs/GAIRs. E-mailprompts willinformauserthatthere is 15. a predefined numberforeachmonth. him whenthenumberofbirdstrikes inTAB exceeded more than by theuser. For instance,BSOTAB cansetthetriggeringtoalert trigger mechanismcanbedefinedatthesystemlevelbyAFIor IntheSISIIimplementation,onlylocalsiteswillbeaddressed IntheeventthatSISisdown orinaccessibleforanyreason, SISIIislinked tothevarioussystems.Hence,through such Complementing withaneasyandefficientdatasearch, SISIIis A virtualbulletinboard isbuiltintotheSISIIforpublish- The implementationofSISIIridesontheEnterpriseServer Triggering isalsoincorporatedtoprompt actionpartiesfor Besides this,customizedreports canbegeneratedbasedon Data search isalsomadelesslaboriousandafasterprocess Preformatted reports are readily availableondemandfor • ISASI 2007 ISASI Proceedings 130 (adapted from Prof. JamesReason,1990). Figure 1. the broadcast (topreclude repeat broadcasts). into thedatabase.SIShelpdeskshouldbenotifiedto“by-pass” tually possible),theSIScanbeaccessedtokey theinformation Broadcast amessageforthisnewreport. Subsequently(wheneven- broadcast forFAIR/GAIR andattachedtheFAIR/GAIR document. FAIR/GAIR. Usethe“Reply All”modewithanyprevious SIS ready done). cast (topreclude repeat broadcasts sincethebroadcast wasal- database. SIShelpdeskshouldbenotifiedto“by-pass” thebroad- sible), theSIScanbeaccessedtokey theinformationinto message foranewreport. Subsequently(wheneventuallypos- for FAIR/GAIR andkey intherespective fieldsinthebroadcast to address theimmediateissue: ways used.To dothis,oneofthefollowingmodescouldbeused the “manual”meansofsafetyinformationdisseminationcanal- (HFACS) Human Factors AnalysisandClassificationSystem Chapter 2 Part 2:InvestigationTools cluding theconditionsofoperatorsandorganizational fail- 2. across boththeoperationsandlogisticsfields. ensures overallconsistencyandeaseofpresentation ofstatistics Factors AnalysisandClassificationSystem(HFACS). Themerge and GAIRs)are alignedunderauniversaltoolcalledtheHuman 1. Introduction The analysisandclassificationofhuman-inducedcases(FAIRs B. Key intherespective fieldsinthesoftcopyversionof A. Usethe“Reply All”modewithanyprevious SISbroadcast The HFACS encompassesallaspectsofhumanerror, in-

The “SwissCheese”Modelof human error causation 2 1/14/2008, 9:44 AM Figure 2 Figure 4 SESSION 5—Moderator Danny Ho

ure. The framework is also employed to develop improved methods and techniques for investigating human factor issues during mishap investigations. The HFACS framework is use- Figure 3 ful as a tool for guiding future mishap/incident investigations and developing a more structured database, both of which would improve the overall quality and usefulness of human factors data. 3. The HFACS is based on upon Reason’s model of latent and active failures (commonly known as the “Swiss Cheese” Model), encompassing all aspects of human error, including the conditions of operators and organizational failure. Specifically, HFACS describes four broad levels of failure (see Figure 1). a. Unsafe acts. The unsafe acts of aircrew/maintainers can be loosely classified into 2 subcategories, i.e., Errors and Violations. Errors are classified into three basic types, i.e., Decision, Skill-Based, and Perceptual Errors. Violations (both Routine and Exceptional) are more serious as they represent a willful disregard for the rules and regulations that govern the safety of flight. b. Preconditions for unsafe acts. Simply focusing on Un- safe Acts is not enough. We also need to understand why the unsafe acts took place. Hence, two major subdivisions of unsafe conditions are Substandard Conditions of Operators/ Maintainers and Substandard Practices of Operators/ Maintainers. The former addresses adverse mental and physiological states, and physical/mental limitations while the latter covers CRM and personal readiness. c. Unsafe supervision. Professor James Reason also traced the causal chain of events back up the supervisory chain of command. As such, four categories of Unsafe Supervision have been identified, i.e., Inadequate Supervision, Planned Inappropriate Op- erations, Failure to Correct a Known Problem, and Supervisory Violations. d. Organizational influences. Fallible decisions of upper-level

ISASI 2007 Proceedings • 131

Proceedings 2007.pmd 131 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 132 investigation. Note:Thisisnot acompletelisting. 8. Organizational influences consider inaninvestigation.Note:Thisisnotacompletelisting. 7. Unsafe supervision an investigation.Note:Thisisnotacompletelisting. 6. Preconditions forunsafeacts plete listing. safe actstoconsiderinaninvestigation.Note:thisisnota com- must beevaluatedforlatentconditions.Figure 2isalistofun- man performanceweaknesses,eachleveloftheHFACS model 5. Unsafe acts HFACS checklistforoperationalfactors subcategories ofeachthefourlevelsfailure isappended 4. and operationalprocesses. issues related toresource management,organizational climate, recognized thatthemostelusiveoflatentfailures revolve around conditions andactionsoftheoperators.Generally, ithasbeen management directly affectsupervisorypracticesaswellthe Figure 5 Figure 5isalistoforganizational influencestoconsiderinan Figure 4isalistofpreconditions forunsafesupervisionto Figure 3isalistofpreconditions forUnsafeActstoconsiderin Figure 3isanillustrationandsummaryofthecategories When conductinganinvestigationtodeterminepossiblehu- • ISASI 2007 ISASI Proceedings 132 3 : rather thanhard technicalfacts. opposed toearliertechniquesthatwere basedonassumptions and surgical methodofassessingtheprobability ofrecurrence as dations. TheSTEPhasallowedinvestigatorsamore prescriptive 2. ThePORassistsinvestigatorsinframingtechnicalrecommen- would alsobenefitandimprove closure toTechnical FAIRs. vention strategiesthusprecluding recurrence. Similarprocesses drills intothevariouscausalfactorsandallowsclaritypre- similar identification-cum-eliminationprocess isthuswarranted. prehensiveness asseenintheHFACS isadmittedlyabsent.A measures forprevention. However fortechnicalFAIRs, thecom- for immediaterecourse andtheprescription ofnecessarycontrol both activeandlatentshortcomings.Thisallowsdirected efforts ing failures at theoperatorandmanagementlevels,inclusiveof and ClassificationSystemhasproven tobeeffectiveinidentify- 4. Presently forman-related FAIRs, theHumanFactors Analysis occurrence. management levelswouldpreclude arepeat oftheundesired identification ofactiveandlatentfailures attheindividualand duced failures, targeted effortstowardroot causesthrough the of themanufacturingprocess iseffected.Similarlyforman-in- potentially existent unlesscorrective re-design ofmodification design orsuboptimalmanufacturingstandards, arecurrence is complications. Itisobviousthatshouldafailure stem from poor causal categoriesthatstemfrom inherent flawsorman-induced cally, Technical failures canbecategorizedintoseveralmain of recurrence basedonspecificcausalfactorsisnecessary. Typi- ity ofeitherendthisscale,aprocess toquantifythefrequency incident willrepeat itself.Howevertodeterminetheapplicabil- 3. Probability ofrecurrence determinesthelikelihood thatan Probability ofrecurrence(POR) actions. For human-factors-related FAIRS, theHFACS into thecausalfactorsaccompaniedbyappropriate follow-up HIGH. Additionalcommentsprovided bytheunitallowinsight termined tohaveanmishappotentialofLOW, MEDIUM,or LOGS) andthrough assessmentintheoccurrence summary, de- 1. Presently, incidentsare classifiedbythetypeofoccurrence (OPS/ Introduction Probability ofrecurrence(POR) Chapter 3 Part 2:InvestigationTools probability ofthisshortcomingindesigntoberead across other again, undersimilarcircumstances. For consideration,isalsothe ciency indesign,theproblem canbeexpected topresent itself lowing asprimaryfactors: elimination processes isproposed. Thisshouldcomprisethefol- mine theprobability ofrecurrence intechnicalcases, astandard 5. Standard Technical EliminationProcess (STEP) a. Standard Technical EliminationProcess—In order todeter- Design flaw— 1/14/2008, 9:44 AM As thefailure/unserviceability isduetoadefi- 4 further systems within the same platform. There may be cases where the e. Sporadic defects—Such cases are intermittent mainly due defect or fault is known, hence preventive measures have already to contact problems or wiring connectivity issues. These defects been implemented resulting in a less frequent occurrence. cannot be fully confirmed and, hence, the source and causal fac- b. Manufacturing defect—This would be due to an error in tor may not be definitive. manufacture, assembly, production quality etc. It may be possible to isolate this anomaly to a particular batch with a common Conclusion cause—be it the same factory, produced at same time, assembled 5. With the incorporation and implementation of the STEP and by the same worker, etc. Additional considerations should include POR in investigations, with the aid of the SIS II tool, the investi- fleetwide impact—be it an impact on a large scale or an isolated gation process for technical cases should benefit from insight into one, i.e., one aircraft only. the causal factors (human factors and Non-human factors) and c. Misuse—Such situations would be the result of usage beyond providing clarity for the appropriate follow-up actions and pre- original design, or employment in conditions outside the original vention strategies with the intent of preventing recurrence. ◆ design parameters. Additionally for this category, there exists the risk in exceeding the designed safety and reliability parameters. Endnotes d. Abnormal wear/aging—There would be cases where the wear 1 HFACS—Human Factors Analysis and Classification System. rate is unusual high or abnormal. Hence, maintenance and engi- 2 This model is based on the concept by Wiegmann-Shappell. 3 Extracted from the document disseminated under the sponsorship of the neering should look again at the maintenance program and evalu- U.S. Department of Transportation (Federal Aviation Administration). ate if additional maintenance program is required. 4 Human Factor Analysis and Classification System. SESSION 5—Moderator Danny Ho

ISASI 2007 Proceedings • 133

Proceedings 2007.pmd 133 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS SilkAir inSingapore in1994. landing procedure whileoperatingascheduledpassengerflightwith flight withIndianAirlinesinNovember1987and2)Partial gear-up commendations: 1)Partial gear-up landingonascheduledpassenger carrier, SpiceJetofIndia.Duringhisairlinecareer, hehasreceived two ness onthesecondnightflight versus 6.15hours)andexperienced asignificantdeclineinalert- and-a-half hourslessduringtheirdaytimelayovers(8.66 hours consecutive nightswith24hoursbetweenflightssleptabout two- across multipledays.Gundel(1995)foundthatpilotsflyingtwo sions couldbeduetothistypeofdisorientation awareness. orexcur- ManyCFITaccidentsorrunwayoverruns some obstacleabovetheground becauseofalacksituational perception illusionwhenthepilotdescendsintoground or sulting inafatalaircraft mishap. lem—fails torecognize orcorrect thedisorientation,usuallyre- dangerous rated byhisothersenses.“Type I”disorientationisthe anything iswrong. Whathesees—orthinkssees—iscorrobo- cation ofspatialdisorientation.Inotherwords, hedoesnot think disorientation. Adisorientedaviatordoesnotperceive anyindi- and themostpertinentoneforaviationiswhatcalled“Type I” weather conditions. could havedisastrous consequenceswhileoperatinginadverse tive influenceonvision.This,alongwithspatialdisorientation, andoxygendeficiency,positive G-forces isknowntohaveanega- phe duetolapsesisenormous. Anaircraft going250ktsona sleep onset sodes ofsleeplasting0.5to10 seconds)butcanalsooccurwithout ation) increase. Lapsesmay beassociatedwithmicrosleeps (epi- duced abilitytofunction.Lapses(thefailure torespond toasitu- Summer 2002)hasfoundthatsleepinessandfatiguecause re- Virgil D.Wooten (theFederal AirSurgeon’s Medical Bulletin— 134 F Performance canalsobeaffectedbycumulativefatiguebuildup An example ofthistypeSDwouldbetheheight-/depth- Spatial disorientationhasbeenidentifiedinthree categories, To quote Dr. Wooten potentialforcatastro- inhisarticle,“The In thearticle“Fatigue andDesynchronosis inAirCrews,” Dr. Wet Runway Accidents—The Role of • ISASI 2007 ISASI decreased concentration,fatigue,withthecombinationof ported incidentsandaccidentsincivilaviation.Apartfrom atigue hasbeencitedasafactorinmore than20%ofre- typeofdisorientation.Thepilot—unaware ofaprob- operations studyandisemployedbyanewlow-cost pilots inIndia.Heisaspecialistonwetrunway Kit,” whichisthestandard trainingaidforallairline compiled an“Adverse Weather OperationsTraining Indiaproject forthelast6yearsand the ALAR captain, with20,000hours.Hehasbeenworkingon Capt. A.Ranganathan Proceedings Fatigue andCoerciveHabits 134 1 . isaB-737NGtraining By Capt.A.Ranganathan most celerate therateofinformation processing, thereby decreasing lenge short-termmemory. This isbecausework-pacedtasksac- newly acquired skills, andnewinformationretention tendtochal- tasks thatinvolvesustainedvigilance andattention,theuseof brief, highlymotivating,andfeedbackisgiven.Ontheother hand, and errors of omission. Decreased performancevariability results from increased lapses critical errors anduncertaintyaboutthestatusofsituation. tions repeatedly butcannotretain theinformation, leadingto loss. Thesleepyandtired crewmember reads orhearsinstruc- problem. solutions andrepeatedly tries thesameapproach toasituational fective problem solving.Thememberislessabletothinkofnew further reduces situationalawareness.” other eventandoverattentiononindividualsignalsorproblems aware ofhavingmissedsignals.Theresulting anticipationofan- may take especiallywhen actionwhennoiswarranted, tions are necessary. False responding alsoincreases, i.e.,thepilot may bemarkedly slowed,whichcanbecriticalwhenrapidreac- ing landingapproaches incommercial carriers. Reaction times ond lapse.Microsleeps havebeenshowntooccurinaircrew dur- glidepath, forexample, cantravelover400feetduringa1-sec- Fatigue effectstendtobeminimalwhentasksare self-paced, Memory deficitsprogressively worsenwithfatigueandsleep Fatigue increases calculationerrors, logicalerrors, and inef- 1/14/2008, 9:44 AM Figure 1 Figure 2 tralia, which has been quoted and used by the ATSB report on Figure 3 fatigue, a group of trainee doctors were divided into two teams. One had sufficient rest and the other had to be awake for long periods. What was interesting about the results were the findings on the team without sufficient rest. All of them took decisions based on “probabilistic” factors where they had encountered similar cases earlier. These studies may explain the reasons why experienced pilots who have carried out their assigned tasks safely for several years, but have failed to recognize the effect of fatigue and sleep on the one occasion when their alertness was required. The AF A340 accident in Toronto is an example of this. The period of “time since awake” of the captain might be a pointer to the reason for Figure 4 the accident.

Coercive habits Pilots tend to develop habits during their career. It takes just one hard landing to get them into a habit of doing “power-on touch- downs” or “extended floats.” The subconscious mind takes over at the time of flare, especially when you are tired. Habits developed on one type of aircraft may carry over on another type, even though SESSION 5—Moderator Danny Ho that technique may not be required for the new type of aircraft. In Figure 1, the spoilers deploy immediately on touchdown, and in Figure 2 the aircraft design results in the spoilers deploy- the reserve capacity of brain function. NASA studies have estab- ing at a much later stage. This may result in complacency in the lished that there is a tremendous increase in heart rate during all belief that spoilers and reversers are available immediately on approaches and landings. In adverse weather conditions, the touchdown. When you look at several wet runway overruns, the combination of increased heart rate, accelerated adrenal gland delayed deployment of reversers has been a prime factor. Simi- functions, and effects of fatigue can prove dangerous. larly, a look at the following two figures brings out another in- In an article based on the joint study2 by Duke University and duced habit. NUS Graduate Medical School, Singapore, a few important as- The pilot had developed a habit of retracting the landing lights pects that may be relevant to aviation accidents emerge. The study as soon as the aircraft touches down! Strangely, even while landing found that sleep deprivation was associated with increased action a wet runway and in rain, the habit seems to have overtaken vation in the brain for risky decisions, indicating a possible shift better judgment that positive control on the runway is more im- toward risk-taking behavior. In addition to altering risk prefer- portant. The captain, apparently, was on duty for the third night ences, sleep deprivation may also diminish the ability to learn in a row, even though he had the “required” rest between duties. from the negative consequences of risky behavior. Lack of ad- With increased use of automation, complacency has become equate sleep impairs vigilance, flexible thinking, working memory, more dominant. Habits developed on one type of aircraft are not and executive functioning. This cognitive change may impair the going to be forgotten in a hurry. A conscious effort is required to ability to make correct decisions under conditions of risk. overcome habits. Approach and landing in heavy rain puts a lot The findings of cognitive neuroscientist Michael Chee, M.D., of additional stress on the pilot’s mind. An insufficient or incor- published online in the journal Proceedings of the National Academy rect runway condition report adds to the errors. What the tired of Sciences shows that sleep deprivation leads to short-term memory mind perceives in limited time that is available during the land- loss. It had been believed that it was the result of the brain not ing run is not easy to fathom. being able to assemble and “file away” the information it received When accidents on wet runways are considered based on the in its proper place. To quote Dr. Chee, “We generally think of above studies, it is apparent that fatigue plays a large part in memory decline as a result of faulty storage of information. When strange decisions that the crewmembers have taken. During the people are sleep deprived, they may not be seeing what they briefing after the AF A340 accident in Toronto, the chief investi- think they should be seeing, and it appears that this is what con- gator, Real Levasseur, said, “Humans are humans and they are tributes to memory declines following sleep deprivation.” not machines. Unfortunately, in the present world of commercial A few years back, a study3 of surgeons in a virtual-reality simu- aviation, the human side is forgotten and pilots are considered as lator illustrated the effect of lack of sleep on performance. The machines.” ◆ surgeons were allowed 8 hours of sleep for one trial and had to stay up all night for the other. In each case, they then had to References 1 Battelle Memorial Institute JIL Information Systems. perform a surgery simulation the next day. The results indicated 2 Sleep Deprivation Elevates Expectation of Gains and Attenuates Response that, without sleep, errors increased 20% and the procedures were to Losses Following Risky Decisions. Vinod Venkatraman, Meng 1, 3; Y.M. carried out at a rate that was 14% slower than with 8 hours of Lisa Chuah, Ph.D. 1; Scott A. Huettel, Ph.D. 2, 3; Michael W.L. Chee, MBBS, MRCP (UK) 1, 2. sleep. These are significant drops in performance. 3 Tools for Managing Fatigue in Transit October 26-27, 2000 ALERTNESS In another study by Dr. Drew Dawson of University of S. Aus- 2000—Mark Rosekind President/Chief Scientist.

ISASI 2007 Proceedings • 135

Proceedings 2007.pmd 135 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS address humanperformanceanderror incomplex,high-risksystems. Pittsburgh. Heistheauthorofmore than80papers,mostofwhich his M.S.andPh.D.incognitivepsychologyfrom theUniversityof technical fellowwiththeAviation SafetyGroup inBoeing.Hereceived Dr. RandyMumaw Human Performance CommitteeattheAirLinePilots Association. accidents duringhiscareer withDelta.Hehelpedcreate thefirst 136 significant contributorstoan event 60-70%ofthetime.To “break trollers, airplanesystemdesigners,andothersare identifiedas reliable. Flightcrews, maintenancetechnicians, airtrafficcon- decreased overtheyearsasthoseelements havebecomemore humans. Accidentsattributedtofailures inairplane systemshave mercial aviationre-emphasizes thesignificanceofrole of Each neworrevised summaryofaccidentsandincidentsincom- Why aworkinggrouponhumanperformance? during thepastyear. with detailsthathavealready beenpublished inthe of thehumanfactorsworkinggroup. Idon’t wanttobotheryou like toshare brieflysomeoftheimportantelementswork factors fieldbycontactwithanindustryworkinggroup. Iwould committee mance. Atthatsametime,Ihelpeddevelopthepilotperformance the investigationtodealwithcriticalissueofhumanperfor- 10 yearslater, the NTSBformedhumanperformancegroups within issues suchasselection,training,aging,fatigue,andhealth.Some sues hadnotbeendesigned.Humanfactorsatthattimedealtwith at thattimeaformalmethodofanalyzingpilotperformanceis- that meeting,wespoke aboutmanypilotperformance issues,but public health,whichwasrequired ofallmilitaryflightsurgeons. At tors inAirTransportation Professor McFarland (authorofthe1953text entitled Ross McFarland tospeakhisclassofflightsurgeons atHarvard. ject ofhumanfactorshappenedwhenIwasinvitedbyProfessor tigation group inthe1960s.Oneofmyfirstcontactswithsub- in1972.Ibecamepartofthepilots’accidentinves- Lines Delta Air joined NortheastAirlinesinBoston1957,whichmerged with As someofyouknow, IlearnedtoflyintheU.S.AirForce and Introduction ISASI InternationalWorking Groupon It wasnotuntillastyearthatIdrawnbackintothehuman • ISASI 2007 ISASI Human Factors: AProgress Report for thefor Air L acted asanaccidentinvestigatorinmanyimportant retired in1992andisaFellow ofISASI.Capt.Stone years’ experienceasapilotforDeltaAirLines,Stone tional Working Group onHumanFactors. After 35 Council. HeisthechairmanofISASIInterna- astheexecutiveadvisortoInternational serves Capt. Stone Proceedings isahumanfactorsspecialistandassociate ) directed acourseleadingtomaster’sof 136 ine Pilots Association. By Capt.Richard B.Stone(WO0837)andDr. RandyMumaw, Boeing istheformerpresident ofISASIand ISASI Forum Human Fac- Dr. Mike Walker—Australian Transport SafetyBureau, Senior Dr. RandyMumaw—BoeingCommercial Airplanes,Human Capt. DickStone—ISASI Steering Committee Dr. Claire Pelegrin—Airbus, Director HumanFactors, Product Capt. DanielMaurino—Director, FlightSafetyandHuman Dr. Rob Lee(retired)—Director, HumanFactors, Systems Dr. CurtGraeber—SeniorTechnical Fellow, HumanFactors James Danaher(retired)—Chief, OperationalFactors Division, IIWGHF Advisory Board Thomas Wang—Aviation SafetyCouncil,Taiwan, Aviation Yann Pouliquen—Bureau d’Enquêtesetd’Analyses(BEA), Dr. Claire Pelegrin—Airbus, Director Human Factors, Product Dr. Ames/SanJoseStateUniversity Loukia Loukopoulos—NASA Dr. Ames/SanJoseStateUniversity, AlanHobbs—NASA Senior Dr. LeoDonati—Transportation SafetyBoard Canada,Acting Dr. EvanByrne—U.S.NationalTransportation SafetyBoard, Dr. GrahamBraithwaite—CranfieldUniversity, Director ofthe HP ModuleDevelopmentTeam Members (IIWGHF) Committeeconsistsof training, andorganizational policiesandpractices. chain mayhavelinkstosystemdesign,operationalprocedures, humans intheaccidentchain.Thisinfluenceon plex socio-technical systems alsoreveal theimportantrole of only trueincommercial aviation;mishapsinotherhighlycom- mance contributedtodegradedsystemperformance.Thisisnot edy, accidentinvestigationshaverevealed thathumanperfor- where there are failures inairplanesystemsthatprecede atrag- addressing issuesinhumanperformance.Infact,evencases the chain,”weneedtobecomeevenbetteratunderstandingand Transport SafetyInvestigator Factors SpecialistAviation Safety Safety Factors Program, InternationalCivilAviation Organization Safety, andCommunications,ATSB Aviation Safety, BoeingCommercial Airplane Office ofAviation Safety, NTSB Safety Investigator Safety Analysis,France Safety (currently inAthens,Greece), HumanFactors Researcher Research Associate Manager, HumanPerformance Chief HumanPerformance DivisionOfficeofAviation Safety Safety andAccidentInvestigationCenter The ISASI InternationalWorkingThe ISASI Group onHumanFactors 1/14/2008, 9:44 AM Ron Schleede (retired)—Deputy Director, Office of Aviation illusions (spatial disorientation). In this 10-page document, first Safety (NTSB) and Director for Air Investigations, you are indoctrinated into the language used by human perfor- Transportation Safety Board of Canada mance scientists. As you review this, you are struck by the fact Capt. Richard Stone (retired)—Delta Air Lines that the language becomes a checklist of what can happen during spatial disorientation—a great value to any accident investi- The IIWGHF Vision provides gator. Next the authors describe what kind of conditions can cause • that all agencies involved in accident investigation around the disorientation. Closing this section is a list of recognized experts world endorse the belief that the investigation of human perfor- in this field. The final section is an analysis of a number of acci- mance proceed without the presumption of human error or neg- dents. The factual data are presented and then an analysis of ligence. An investigative process that seeks to ascertain what oc- human performance issues is presented. From the accident curred rather than who was at fault will yield more vital and accu- investigator’s standpoint, you have what you need to gather the rate information. pertinent data in an accident, get human performance expert • that appropriate human factors expertise is brought to bear help, and prepare a report that is complete. on all investigations of human performance issues. My next example is from the module dealing with fatigue. • that standardized and coordinated guidance modules be dis- Here again the investigator is given a basic understanding of tributed to accident investigators around the world. The mod- how sleep and fatigue are intertwined and the special language ules will be distributed in phases that is used in this field. Sleep requirements are discussed in —Phase 1: Initial set of guidance modules detail and so are the consequences of sleep deprivation. —Phase 2: Revised/updated set of guidance modules Microsleep, a condition where the individual is asleep with eyes • that accident and incident databases worldwide share a com- open but no mental processing occurs, is described. Such a spe- mon taxonomy for identifying and listing human performance cific condition can be invaluable to the investigator who has issues so that the databases can be used to track trends over time. little knowledge of this condition. Next, the module discusses SESSION 6—Moderator David King Here are the IIWGHF investigation modules subjects that we what to look for in an investigation. As in all modules, a list of propose to develop. recognized experts in the field is presented. A small number of Guidance module topics have been put in four categories accidents are reviewed as few accidents have carefully exam- 1. Human performance issues—which are used to provide back- ined this important causal factor. ground on fundamental aspects of human performance. The third module I would like to discuss is the module on • fatigue events sequence representation. I am sure many of us have been • visual and vestibular illusions (spatial disorientation) involved in charting the time sequence of events during an acci- • stress, situational awareness dent. It is a necessary task if you are to arrive at a reasonable • decision-making limitations description of the events preceding an accident. This module is • effects of drugs being developed by a number of acknowledged experts in this 2. Human performance investigation techniques—which are used to field, so I think it will add a new dimension to your investigation focus on techniques that can be used for analysis. toolkit. The module deals with the broad range of data required • fatigue-modeling tools to describe an accident factually. It also warns of the trap of por- • workload traying data in a subjective instead of objective fashion. I think • barrier analysis this is critical because all of us seem to want to rush to find the • speech analysis cause of the accident as quickly as possible and therein lies a • target detectability analysis huge trap. I was reminded, while reading this paper, of an article 3. Human factors investigation fundamentals—which are broader I read in Scientific American some years back. The article dealt treatments of human factors topics that are central to accident with research into problem solving. When subjects were quick to investigation. choose how to solve a problem and found their method did not • general human factors issues (orientation to human factors) work, they were literally stymied and were unable to alter their • organizational factors thinking and start all over again in solving the problem. Sounds • use of data vs. the need for speculation in investigating human like some people I have worked with who think they have found performance the cause of an accident and will do anything to prove they have • tests of existence vs. tests of influence the answer. One final point about this module, the authors are • event sequence representation human performance scientists and they have a keen eye for de- • checklists—checklist for data collection in the first few days scribing how to dig out the human performance issues in the after an accident events sequence. The last module I would like to introduce is the workload mod- A look at some of the things contained in the modules ule. It is a very important corollary of the events sequence repre- So let’s take a look at how the modules could help investigators sentation as it deals in-depth with actions and decisions of the in the field. Some nine modules are in the final stage of comple- operator. While it provides basic information about techniques tion. Wider distribution of these modules will occur after further to evaluate recorder data, it also describes how to construct and reviews and revisions within the team. But I can share my own evaluate simulation data. As in all the modules, the reader gains impressions of how they can help the investigators who are not a grasp of the science and language of workload assessment. This human performance experts. can be invaluable as the investigator deals with consulting ex- My first example is from the module on visual and vestibular perts in the process of accident analysis.

ISASI 2007 Proceedings • 137

Proceedings 2007.pmd 137 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 138 it willhelpinthedistributionofproduct oftheworking group. has hadaverygoodrelationship withICAO, andweare hopeful ROMs maymake itpossibletodothisatminimumcost.ISASI print thedocuments,althoughitseemsInternetandCD- We hopethatwecanfindsomeindustryinterest inhelpingus Module distribution Moduleswillbedistributed toallinvestigativeentities. • Moduleswillbecirculated tostakeholders. • IIWGHF AdvisoryBoard. review A ofcompletedmoduleswillbebythe • gators. Themoduleswillbeeditedbyexperienced accidentinvesti- • What’s next intheworkscheduleofworkinggroup? • ISASI 2007 ISASI Proceedings 138 facts. the investigationprocess andleadstocoveringupimportant some investigationauthorities,webelievethisobjectivecorrupts investigations. Whilefindingfaultseemstobestillthepointof modules willmake thecaseforobjective,unbiased,andpatient nal prosecution. perts, limitedfinancialresources, andcompetinginterests ofcrimi- inconsistent becauseoftheunavailabilityspecialsubjectex- investigations. enable investigatorstoraisethestandard ofhumanperformance The hopeisthatthedevelopmentoftheseconcisemoduleswill Conclusion Much oftheintroductory materialthatwillaccompany the Right nowthelevelofhumanperformanceinvestigationsis ◆ 1/14/2008, 9:44 AM International Cooperation During Recent Major Aircraft Accident Investigations in Nigeria By Dennis Jones, Senior Air Safety Investigator, U.S. NTSB

Dennis L. Jones, senior air safety investigator, has The AIPB at the time was a department under the Federal been with the NTSB for 28 years and has been in Ministry of Aviation. The AIPB would be later reestablished as charge of more than 500 aircraft accident investiga- the accident investigation board with the passage of the Nigeria tions during his career. He is currently an investiga- Civil Aviation Act of 2006, and after the investigation of the acci- tor in the NTSB Major Accident Investigation dents were initiated. The AIPB was staffed with investigators, Division based in Washington, D.C. He has been trained and experienced in aircraft accident investigation, and appointed as U.S. accredited representative, heading supported by administrative personnel. The department was di- several U.S. teams, for major accident investigations in Africa over the vided into airworthiness and operation units. The National Trans- past 10 years. portation Safety Board is the U.S. government agency respon- SESSION 6—Moderator David King sible, in part, for the investigation of aircraft accident investiga- Introduction tion. The AIPB and NTSB had developed a working relationship During a 1-year period between 2005 and 2006, there were three over many years, achieved from involvement with investigations major aircraft accidents in the country of Nigeria. The accidents and participation in training initiatives. involved three domestic airlines, and the crashes resulted in the Bellview Airlines, Sosoliso Airlines, and Aviation Development deaths of 321 persons. The investigations of these occurrences Company/ADC Airlines were the operators of the airplanes in- brought together government and industry air safety investiga- volved in the accidents. Bellview was formed in 1991 and began tors from Nigeria and the United States of America. This paper scheduled service in 1993. At the time of the accident, the airline will focus primarily on the interactions and activities during the was operating a fleet of seven aircraft. Sosoliso and ADC were investigation to provide a description of the cooperative spirit domestic airlines founded in 1984 and 1994, respectively, and that occurred within the international team. Also, the findings of both companies had an operating fleet size of less than five air- the one completed investigation will be described. planes. Sosoliso and Bellview did not have any previous accidents. ADC had four previous accidents, including an occurrence in Overview 1996 resulting in 134 fatalities. Nigeria, located in West Africa, is the most populous country in The AIPB conducted the investigations in compliance with the Africa, with a population of about 140 million. According to the standards and recommended practices under the provisions of Nigerian Civil Aviation Authority (NCAA), the aviation market Annex 13, and accordingly, an investigator-in-charge (IIC) was in the country, in part, consists of 17 domestic and 20 foreign designated for each of the investigations. The IIC was given full airlines that operate in the country, as well as 5 Nigerian carriers responsibility for the conduct of the investigations. In addition that operate international routes. Nigeria is also served by 21 domestic and 5 international airports. The annual international airline passenger traffic is 2.8 million and domestically, 2.6 million. NCAA records indicate there are 544 pilots, 490 air traffic controllers, and 913 aircraft maintenance engineers. The NCAA reported that between 1996 and 2006, Nigeria ranked fourth behind the Democratic Republic of Congo, Angola, and Sudan in the number of fatal accidents that occurred in the region. The single crash in the country in 2006 was the deadliest accident on the African continent for the year. The Nigeria Accident Investigation and Prevention Board1 (AIPB), the aircraft accident/incident investigative authority, was responsible for the conduct of the investigations. The U.S. Na- tional Transportation Safety Board participated as the representative of the state of manufacturer/design. An NTSB investigator was appointed as the U.S. accredited representative (USAR) and he was assisted by technical advisors from the U.S. Federal Aviation Administration, Boeing airplane, and Pratt & Whitney engines. Scene of Belllview Flight 210.

ISASI 2007 Proceedings • 139

Proceedings 2007.pmd 139 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 140 layout wasdonetoanoutline inthedimensionsofmodel age wastransportedtoahangar attheLagosAirportwhere the out ofwreckage, review ofaircraft andpilotrecords. Thewreck- dynamics, interviews,wreckage recovery, a two-dimensionallay- examination oftheaircraft wreckage, determinationofcrashsite heavy rainthatoftenprevented workatthecrashsite. activities continuedforabout10days,hampered frequently by scattered around thegeneralarea ofthecrash.Thecrashsite of thewreckage wasimbedded inthecrater, with otherdebris with theground atahighspeedinsteepdescent.Themajority ter more than35feetdeep,indicativeofthe airplanecolliding their participation. the U.S.teamandtoexpress hisgratitudeandappreciation for of Nigeria MinisterofAviation wouldlaterwelcomethearrival tion abouttheflightcrew, aircraft, andhistoryoftheflight.The and BellviewAirlineswere inattendanceandprovided informa- the situationataccidentsite.Representatives from theNCAA of thefactualinformationthathadbeendevelopedtodateand team joinedtheinvestigation.Themeetingincludedabriefing corders were notrecovered. further evaluations.Despiteanexhaustive search, theflightre- interviewed eyewitnesses,andbegancollectingdocumentsfor AIPB surveyedthecrashsite,searched fortheflightrecorders, required equipment,andtechnicalmaterialtobecarried. information assistedwithdeterminingtheteamcomposition, The briefingswere especiallybeneficialtotheU.S.team,and date briefingstotheUSARwithbestavailableinformation. some ofwhichismisleading.However, theAIPBprovided up- and/or incompleteinformationisreported byavarietyofsources, hours. rived inLagos,andsubsequentlyreached thecrashsiteby1200 was found,manyoftheNigerianinvestigatorshadalready ar- about 14milesnorthoftheairport.Bytimewreckage following morning.Thecrashsitewaslocatedinawoodedarea, the airplanewasbeingconducted. and continuedtoprovide periodicalupdateswhilethesearch for missing andasearch wasinprogress. TheynotifiedtheNTSB nization retreat whentheywere notifiedthatFlight1145was attempts byairtrafficcontrol toreestablish radiocontact. were nofurthertransmissionsfrom theflight,despiterepeated and heacknowledgedinstructionstoreport passingFL130.There Soon afterwards, thepilotreported climbingthrough 1,600ft, 18L, turnright,andproceed northboundoncourseatFL210. no survivors.TheflightwasdestinedforAbuja,Nigeria. from MurtalaMohammedAirport,Lagos,Nigeria.There were 737-200, with117personsaboard, crashedshortlyaftertakeoff On Oct.25,2005,about2035hours,BLV 210,5N-BFN, aBoeing Bellview Airlines(BLV) Flight 210 the applicableairlinesofficialsparticipatedininvestigations. to theU.S.team,personnelfrom theNigeriaCivilAviation and The on-sceneactivitiesincluded,butwere notlimitedto,the The crashsiteconsistedofaninitialandprincipalimpact cra- The IICheldafteranorganizational meetingwhentheU.S. During thedayspreceding oftheU.S.team, thearrival Often duringtheearlystagesofaninvestigation,erroneous The wreckage ofBLV 210wasfoundabout1000hoursthe The AIPBinvestigatorswere returning toAbujafrom anorga- About 2030hours,BLV 210wascleared totake offonRunway • ISASI 2007 ISASI Proceedings 140 on nationaltelevision. ers from thelocalofficialtoAIPBwouldbelaterbroadcasted recorders onthedayofaccident.The transferoftherecord- bance ofthewreckage. Theairportofficialslocatedtheflight removal oftherecovery ofthevictims,there wasminimaldistur- after thecrashtopreserve thewreckage. Consequently, otherthan the endofdebrispath. tion, consistingoftheflightcrew compartment ,cametorest at nose section,maincabinandtailsection.The sec- 1,100 meters.Theaircraft broke upintothree majorsections— pact sequencesacross theground overadistanceofmore than the edgeofRunway21andbroke upduringthesubsequentim- impacted aconcrete drainageculvertlocated70metersleftfrom crashed onairportproperty. Thetailsectionoftheairplane had and soonrealized thatcontrarytoearlyreports, theaircraft had atthecrashsitenextcials arrived dayonachartered aircraft, tigators wouldnowjointheSosolisoinvestigation. who were abouttodepartfortheBellviewmeeting.Theseinves- visors, andspecificallycommunicatedwiththeU.S.investigators launch totheaccidentsite.TheUSARnotifiedtechnicalad- Sosoliso crashcamequicklytotheAIPB,andplanswere madeto other U.S.teammembersforthemeeting.Notificationof inadvanceofthe also inLagoswiththeAIPB,havingarrived progress meeting fortheBellviewinvestigation.TheUSARwas before theaccidentoccurred, inpreparation foraplanned mas holiday. gious boarding schoolwhowere returning homefortheChrist- among thefatalitieswere more than60studentsofapresti- post-crash fire. TheflightoriginatedatAbuja,Nigeria,and passengers survived.Theaircraft wasdestroyed andthere wasa ing aheavyrainshower. There were 110personsaboard, and2 approach toPort Harcourt, Nigeria.Theaccidentoccurred dur- crashedduringaninstrument McDonnell DouglasDC-9-32, On themorningofDec.10,2005,5N-BFD, OSL Flight1145,a Sosoliso Airlines(OSL)Flight1145 ment. Theinvestigationisstillongoing. solicited inputfrom theU.S.teamindraftingofdocu- AIPB produced aninterimreport fortheMinistry, andtheIIC possible, includedallmembersoftheinvestigationteam.The ponent examinations intheU.S.Themeetings,toextent the investigation,twoofwhichwere inconjunctionwiththecom- with thetechnicaladvisors,coordinated theactivities. included thoseofNTSBandBoeing.TheNTSB,inconjunction examination ofaircraft componentsatfacilitiesintheU.S.,which culminated withidentificationoffollow-up activities,including pants were givenfullconsideration.Theon-sceneinvestigation the investigators;suggestionsandcommentsfrom allpartici- day’s activities.Severalaccidentscenarioswere discussedamong cation ofcomponentsforfurthertesting. understanding ofthecrashdynamics,andaidedinidentifi- airplane were atthecrashsite.Also,layoutprovided abetter recovered, thelayoutconfirmedthatmajorstructures ofthe airplane. Although,nomore than30to40%oftheaircraft was Local andairportofficialshadsecured thecrashsiteshortly andotherNigerianaviationgovernmentoffi- The IIC,USAR, The AIPBinvestigatorswere theday inLagos,havingarrived Several progress meetingsoccurred duringthemonthsafter Progress meetingwere helddailytodiscusstheresults ofthe 1/14/2008, 9:44 AM onds before the crash, the airplane descended through 357 ft (ASL) at the airspeed of 153 knots and a heading of 207.3 degrees. The airplane heading at this point is a departure from its initial heading of 211 degrees. At 23 seconds before the crash, the airplane leveled off at an altitude of about 204 ft, which is below the decision altitude (DA) of 307 ft (ASL). The altitude then remains relatively steady for the next 14 seconds. During this time, the airspeed decreased below 145 knots. “At 7 seconds before the crash, the airspeed began to increase reading 151.3 knots. The increase in speed would indicate an engine power input by the crew to initiate a go-around: Meanwhile, the aircraft sunk further below 204 ft (ASL), and its heading deviated to the left of the runway magnetic heading of 210 degrees. The aircraft could not recover when the crew later decided to initiate a go-around. At the time of impact when the FDR recording stopped, the aircraft [had a] heading of 196.9 degrees and airspeed of 160.2 knots and a descent rate of over 2000 ft/min.” The AIPB concluded the accident probable cause of the accident was “The crew’s decision to continue the approach beyond the deci- Scene of Sosoliso Flight 1145. sion altitude without having the runway and/or airport in sight.” The contributory factors were “The crew’s delayed decision to carry The flight recorders were taken to the AAIB in the U.K. for out a missed approach and the application of improper procedure while analysis, and an NTSB investigator from Washington, D.C., par- executing the go-around. The aircraft encountered adverse weather con- SESSION 6—Moderator David King ticipated in the activities. The flight data recorder was a solid- ditions with the ingredients of windshear activity on approach. The re- state type and contained about 26 hours of data. The FDR reducing visibility in thunderstorm and rain at the time the aircraft came corded five parameters, including pressure altitude, indicated in to land was also a contributory factor to the accident. And the fact the airspeed, magnetic heading, vertical acceleration, and VHF key- airfield lightings were not on may also have also impaired the pilot from ing. Sink rate was calculated based on pressure altitude. The cock- sighting the runway.” pit voice recorder was a polyester type and contained 30 minutes Another contributory factor was the fact that the aircraft had of audio data. The review of the recorders did not disclose evi- an impact with the exposed drainage concrete culvert, which led dence of mechanical malfunction. to its disintegration and subsequent fire outbreak. The U.S. team further assisted with analyzing the CVR audio rerecording, in an effort to help identify cockpit sounds. The ADC Airline (ADK) Flight 053 team also assisted with the FDR evaluation to help determine On Oct. 25, 2005, 5N-BFK, ADK Flight 053, a Boeing 737-2B7, aircraft performance. crashed shortly after takeoff from Runway 22 at Nnamdi Azikiwe Less than 6 months after the accident, the AIPB produced a International Airport, Abuja, Nigeria. There were 9 survivors and draft report of the investigation. A copy of the draft was pro- 96 fatalities, including the flight crew. The airplane impacted vided to the NTSB for review and comments, allowing 60 days into a corn and bean field in Tungar Maje Village, about 1 nauti- to respond. cal mile from the departure end of Runway 22. The airplane was The final report was released in July 2006. According to re- destroyed by impacted forces and post-crash fire. port, “The cockpit conversation within the environment reveals that the According to witnesses, a rainstorm was occurring at the flight was uneventful until the final approach to land. The CVR readout time of departure. Airport fire and rescue officials quickly shows that the aircraft was configured for landing when one of the pilots reached the scene and provided aide to survivors and secured called for gear down approach checklist. the crash site. AIPB investigators quickly responded to the “At about 16 seconds to crash, the captain called for a go-around, gear accident site and notified the NTSB. A survey of the accident up, and flaps before the crash. A warning horn then came on followed by site, photographic documentation, and a preliminary wreck- a ‘too low gear’ aural sound from the cockpit area microphone. It appears age diagram was conducted. The flight recorders were also that the crew had difficulty in sighting the runway and should have car- found and secured. ried out a missed approach at the decision altitude (DA) of 307 ft ASL On the day of the accident, the AIPB began gathering docu- instead of continuing descent below 204 ft (ASL). ments, including records from air traffic service, the airline, and “The gear was down and locked with the landing flap set prior to the meteorological services. Also, the AIPB established communica- go-around. When the crew decided to go around, the flap lever was se- tion with forensic personnel to establish postmortem protocol lected up while the gear was still in the extended position, but probably for the bodies of the flight crew. not locked. The warning horn then sounded because the gears were no The U.S. team arrived in Abuja 3 days after the accident. Simi- more in the landing position and flaps had not yet retracted to less than lar to the previous investigations, the AIPB conducted an organi- approximately 18 degrees. The warning horn was immediately followed zational meeting and briefed the U.S. team. It was later deter- by the ‘too low gear’ sound, i.e., Ground Proximity Warning System mined that the investigation team would be organized into op- (GPWS). erational and airworthiness groups with subgroups for weather, “The FDR readout indicates that the flight was normal until the last witnesses, aircraft performance, and air traffic. moment into the final approach to Port Harcourt Airport. At 30 sec- During the course of the on-scene investigation, the U.S. team

ISASI 2007 Proceedings • 141

Proceedings 2007.pmd 141 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 142 vestigation. mental inidentifyingpertinentareas toaddress during thein- outs wasconveyedtotheinvestigators,andproved tobeinstru- corders. Abriefingofthedataretrieved from therecorder read- specialists were onhandtoimmediatelystartanalysisofthere- inWashingtontor arrived ontheweekend where NTSBrecorder Abuja tosecure visasfortheurgent trip.TheAIPBdeputydirec- Washington, D.C.TheUSARcoordinated withtheU.S.Embassy- records andaudiorecordings from airtrafficservice. persons knowledgeableoftheaccident,andreview ofaircraft amination ofaircraft components,interviewofwitnessesandother assisted withtheon-sitedocumentation,wreckage diagram,ex- Scene ofADCFlight53. Post on-sceneactivitieshavebeenunderwayintheU.S.in- The flightrecorders were analyzedattheNTSBfacilitiesin • ISASI 2007 ISASI Proceedings 142 tigation isstillinprogress. volving componenttestingandaircraft performance.Theinves- investigation benefittheglobalaviationcommunity. tion safetyinNigeriaandtoensure thelessonslearnedfrom the ous mannertoward thecommongoaltoultimatelyimprove avia- gators andresulted intheamalgamationofeffortsaharmoni- rences brought togetheradiversegroup ofinternationalinvesti- among theNigerianandU.S.investigators.Thetragicoccur- were strengthened, aswellthelevelofconfidenceandtrust only individualinvestigators,butalsofortheteamasawhole. opportunities forexchanges thatcontributedtothegrowth ofnot knowledge, andabilitiesamongtheparticipantsprovided several were investigatedtothefullestextent. Thewiderangeofskills, were givenfullconsideration,andwhendeemedappropriate, they ent accidentscenariospresented withintheteamandexternally full consideration,andproblems were resolved quickly. Thediffer- tions andcommentsdiscussedamongthememberswere given tions duringthevariousphasesofinvestigations.Thesugges- an atmosphere thatencouraged different opinionsandsugges- of safetyrecommendations, andcompletionofthefinalreport. tion abouttheaccident,determinationofprobable cause,issuance Annex 13withtheobjectiveofdevelopingallavailableinforma- sized theimportanceofadheringtorequirements ofICAO cooperative mannerduringtheinvestigations.TheAIPBempha- The NigerianandU.S.investigatorsworked closelytogetherina Summary 1 TheNigeriaCivilAviation Actof2006reestablished theAIPBasacci- Endnotes dent investigationboard (AIB). Overall, duringtheinvestigationsprofessional relationships There wasanopenexchange ofinformationandAIPBcreated 1/14/2008, 9:44 AM ◆ Critical Aspects of International Incident Investigations By Deborah J. Lawrie, Robert N. van Gelder, and Jan Smeitink, Independent Safety Investigation & Consultation Services Deborah Lawrie was born in Australia and This is a Greenland glacier melting into the sea. Imagine these graduated with a BSc and bachelor of education from icebergs as the “incidents” that are occurring every day, repre- Melbourne University. She taught mathematics and senting the precursors of global warming. In much the same way physics and was a flying instructor from 1976 until we can think of incidents in aviation as being the precursors of 1979, when she joined Ansett to become Australia’s accidents. first female airline pilot. Deborah joined KLM And these larger icebergs here, I like to think of as serious cityhopper in 1993. She instructed on the Fokker 50 incidents and as being a very clear signal that global warming is and later operated the Fokker 70/100. In 1998 she established the a reality. company’s Flight Safety Department. She held the position of safety manager and chief investigator for 8 years. Deborah was chairman of Introduction the ERA Air Safety Working Group from 1998-2004. She is currently This paper will feature a case study of a serious incident that had flying the A330 for KLM. significant consequences for ground handling supervision and SESSION 6—Moderator David King developed into a broad based international investigation that was Robert van Gelder was born in the Netherlands. conducted in accordance with ICAO Annex 13. After his initial commercial pilot’s flight training at We will cover the Royal Dutch Flight Academy in 1973, he • case study outline of a serious deicing incident. graduated with a BSc. honors from Loughborough • investigation Quality/the role of the airline investigator as University of Technology in human factors/ergonom- advisor. ics in 1982. Robert joined KLM Royal Dutch • airline investigator training within a flight safety program. Airlines in 1978 where he is currently employed as a • benefits of interactive and customized training for airline in- Boeing 747-400 captain. During the last 17 years, Robert has held vestigators. the positions of ergonomics engineer/human factors specialist, line and simulator instructor, chairman of the Standardization Committee on Case study outline of a serious deicing incident the Boeing 737, founder and editor-in-chief of KLM’s flight safety Background information magazine in for SAFETY, and chief investigator. Back in 2002, I was a line captain on the Fokker 70 and I had also had the function of chief investigator for the company for Jan Smeitink is a member of the management team of the Dutch the previous 4 years. Up until that time I had managed several Safety Board, which investigates transport accidents and incidents and incident investigations such as GPWS warnings, loading errors other types of disasters, serious accidents and incidents, as well as crisis and aircraft controllability problems, etc. Then in 2001, investi- management and disaster control. He joined KLM shortly after gation of an accident involving a ground engineer who walked graduating as a mechanical engineer at the polytechnic college in through the propeller of a Fokker 50 was delegated to me un- Arnhem, the Netherlands. He flew as a flight engineer on the B-747- der the supervision of the Dutch national investigating author- 200/300 and has more than 10,000 flying hours. ity. Such was my investigation experience until that point in time. General Early one very bleak and cold, typical winter morning in Hol- Robert van Gelder, Jan Smetink, and I are founders of the ISIS land in February 2002, while I was watching my son play soccer, group and part of our work is to teach others and, especially the Fokker 70 chief pilot called me regarding a possible incident airline operators, how to investigate serious incidents. Today with one of our aircraft in Turin. As the chief investigator for the Robert and I are here to present a paper on the critical aspects of company it was my decision to go to Turin immediately. I con- international incident investigations. tacted the Fokker 70 technical pilot to come with me, as I thought My first challenge, however, is how to illustrate the impor- he would be able to provide some valuable assistance and this tance an incident. An accident is easy to illustrate—after all, was to be the beginning of my involvement in an investigation there are usually several graphic pictures that can tell us a that would last more than 2 years. story, but an incident, on the other hand, is far more difficult to visualize. Turin incident After giving this some thought, I decided to use the topical So what actually happened to the Fokker 70 in Turin? subject of global warming as an analogy and some pictures of The aircraft had been parked in Turin overnight. Rain and Greenland that I took from 38,000 feet on a flight from snow fell during the night with light and variable winds and the Amsterdam to Vancouver. temperature/dew point ranged between 2/0°C and 0/-1°C, and

ISASI 2007 Proceedings • 143

Proceedings 2007.pmd 143 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 144 both engines. tion SafetyBoard). control oftheinvestigator-in-charge from theANSV(ItalianAvia- tion oftheincidenthadalready commencedandwasunderthe inTurinBy thetimeIarrived withthetechnicalpilot,investiga- The aftermath ing airbornefor29minutes. return foranILSapproach onRunway36at Turin. tain declared aMAYDAY, andarequest wasmadeforvectorsto flying really wellandtheenginedidnotfeel smooth.”Thecap- first officerlaterdescribedthesituationas“theaircraft wasnot the onlyremaining enginewasnotfunctioningnormally. The Multi-Function DisplayUnit,thecrew thenbecameaware that gine forthenext 10minutes. mained unaware ofthehigh-vibrationproblem withtheleften- Function DisplayUnit.Duetoalltheotherfailures, thecrew re- able todisplayallthewarningsatsametimeonMulti- the aircraft’s warningsystemandinsufficientspacebeingavail- “hidden” byalltheotherfailures duetothepriority allocationof fuel asymmetrywarning. throttle failure, anautopressurization failure, andeventuallya and severalotherfailures thatoccurred—those being an auto right engine,whichdisruptedtheengineshutdownprocedure, that wasnownecessaryat500feet,ajammedfuelleveronthe Throttle linkagewasdetachedfrom thefancase. • Gearboxhousingwascracked intwoplaces. • Power levertransducerwashanging onitswiring. • Accessorygearboxandhydraulicpumphousingwere cracked. • damage toseveralfanbladesintheleftengine. ing violentandimmediatedestructionoftherightengine rotation large piecesofcleariceseparatedfrom bothwingscaus- above limits.We nowknowthatasthewingsflexed duringthe to engineNo.2andthefanvibrationin1increased and atliftoffthere wasasuddenlossofoilpressure andfuelflow but duringtherotation thefanvibrationinengineNo.1increased dew pointwas1/0°C. was scattered cloudat500feet,light rain,andthetemperature/ anti-ice on.Thewindwasfrom thenorth/eastat3knots.There due tothecloseproximity ofhighterrain. fied inthecaseofenginefailure duringtakeoff from thisrunway way 36.Aspecialprocedure witharightturnat500feetisspeci- tion wasfinished.(Kilfrost ABC3Type 2/50%). performed avisualcheckofthewingsafterdeicingopera- the topofwings.Theaircraft wasdeiced,andthecaptain wings, andamixture ofslushandicewasfoundinsmallareas on ice 1.5–2cmthickwere foundundertheleadingedgesof the next day. enough fuelremained onboard forthereturn flighttoAmsterdam Other damagetothefuselage andthesurfaceofrightwing At thisstage,itwasnotsure whathadcausedthe damage to The aircraft finallylandedsafelybackonRunway36afterbe- When thehigh-vibrationwarningeventuallysurfacedon The high-vibrationwarningontheleftenginewastemporarily The situationontheflightdeckwascomplicatedbyturn All theengineindicationswere normalduringthetakeoff roll The takeoff wasperformedusingfullthrustwiththeengine A shorttimelatertheaircraft taxiedfordeparture from Run- During thepre-flight inspectionthenext morning,ridgesof • ISASI 2007 ISASI Proceedings 144 ters forconsiderationindependentinvestigators. other issuesthatIhadtodealwithandare notnormallymat- and personalacquaintanceofbothpilotswhowere involvedwere should addthatatthisstage,feelingsofloyaltytothecompany going todevelopintoalengthyandcontroversial investigation.I parties involvedwasgoingtoprove tobeinvaluableinwhatwas about myentitlementsandresponsibilities andthoseoftheother standing oftheICAOinvestigationprocess aswellknowledge ICAO Annex 13philosophy. Turin situationcalledforanapproach thatdeviatedfrom the pervision thecompanyinvestigatorwouldactasanadvisor, the procedure callsforanaccredited representative underwhosesu- of aseriousincidentratherthananaccident.Whiletheformal charge. Thistypeofsituationismore likely todevelopinthecase several partiesandIwasdealingdirectly withtheinvestigator-in- site, inwhatwastobeaninternationalinvestigationinvolving Quite suddenlynow, however, Ifoundmyselfastheonlypartyon gation thatwasconductedundersupervisionatanationallevel. had beenconductedonaninternalbasisandaccidentinvesti- some previous experience withseveralincidentinvestigationsthat failure oftherightengine. have beencausedbyingestionofdebrisfrom thecatastrophic led toinitialspeculationthatthedamageleftenginemay investigator asadvisor Investigation quality/theroleofairline rounding area atthepointwhere theaircraft hadrotated. We the aircraft wasperformed. and abriefinspectionofthe enginesandexternal conditionof and discussed,adetailedinspectionofthecockpitwas made, IIC. Aircraft documentsandoperatingmanuals were identified ated, andwemanagedtoestablishagoodrelationship withthe in-charge. Ouroperationalknowledgewasverymuchappreci- cal pilotandIworked sidebywiththeItalian investigator- of luck. Fokker 70in2002resulting inaseriousincidentwasanelement in1991resultingbetween theMD-81 inanaccidentandthe entered bothenginescausingthemtofail.Theonlydifference and latertheinvestigationrevealed thaticefrom thewingshad the impact.Remarkably, inthisaccidentthere were nofatalities, to aforced landing inafieldwhere itbroke intothree partsafter 1 minutelater, both enginesfailed.Theaircraft wascommitted were noticed25secondsafterbecomingairborne. Approximately morning ofDec.27,1991.Vibrations from engines theMD-81’s 81 thattookofffrom Stockholm’sArlandaAirportearlyinthe print” astheScandinavianAirlinesaccidentthatinvolvedanMD- to it. much, ifnotmore, aboutallthecontributingfactorsthat ledup ter, theninvestigation ofthiseventhadthepotentialtoreveal as as Turin where theoperatorhadbeenfortunatetoescapedisas- location ofresources asifithadbeenanaccident.Incasessuch should beperformedascomprehensively andwiththesameal- is justasimportantanaccidentinvestigationand,therefore, This casestudywillalsoshowthatseriousincidentinvestigation In theTurin situation,acomprehensive knowledgeandunder- As mentionedearlier, aschiefinvestigatorfortheairlineIhad The IICorganized forustoinspecttherunway andthesur- In Turin during thefirsthoursofinvestigation,techni- It waslaterrevealed thattheTurin eventhadthesame“foot- 1/14/2008, 9:44 AM retrieved pieces of engine acoustic lining among other broken with no certification rules for ground handling companies. bits and pieces. It was at this critical point in time, however, that • evidence of previous substandard deicing operations in Italy. the driver of the airport safety car casually mentioned that ear- In the case of Turin, the company had a written contract with lier that morning, just after the incident, he had found some a deicing agent but only a verbal contract with the post deicing very large pieces of ice at the same location. He was also able to inspecting company, which was a separate company to that which describe the size and shape of the pieces of ice. performed the deicing. As the last thing on that day, we were invited by the IIC to go The crew documentation on board the aircraft indicated that with him to interview the air traffic controllers who were on duty the handling agent would perform the deicing and the post deic- in the tower at the time of the incident. ing inspection, but in this case no post deicing inspection was I must emphasize that this event did not have the high-profile performed other than the visual check performed by the cap- media attention that one associates with an accident, and it was tain. Furthermore, several findings in relation to training and not until much later that day that the seriousness of the event contracts remained open from the deicing pool audit that had started to filter through to the interested parties. The company been conducted in January of the previous year. reported the matter to the Dutch investigation authority, which Tension between investigators was apparent and understand- was known then as the RVTV. The following day, representatives able. Pending insurance claims and political issues also added from Fokker and Rolls-Royce arrived in Turin. pressure to the investigation. The importance of the role and the A formal international investigation had been commenced entitlements of the Dutch accredited representative were abso- under the direction of the Italian Aviation Safety Board but our lutely vital to the progress of the investigation. In turn, the Dutch position as advisor to the Dutch accredited representative was accredited representative relied heavily upon the support, knowl- not formalized until after we returned to Holland 2 days later. edge, and objectiveness of his advisors. By the time we returned to Holland we had, however, Several analysis and recommendation meetings were convened, • established a good working relationship with the IIC. some of which were held in The Hague and some in Rome. The SESSION 6—Moderator David King • met several of the other parties who would be involved in the Dutch accredited representative could not attend all the meet- investigation. ings in Rome, so on some occasions we were present at these • established our value as advisors in terms of knowledge, ex- meetings as replacements. We were, therefore, playing a variety pertise, and availability. of roles on different occasions throughout the investigation rang- The operating company also commenced a formal investiga- ing from a subordinate role to a leadership role. We had to bal- tion of the incident that was to be done in conjunction with the ance diplomacy with assertiveness and, above, all we had to keep RVTV. An accredited investigator from Dutch ALPA was assigned our focus on getting to the bottom of the true causes of the event. to me, and together we acted as advisors to the RVTV. As this was an international investigation, the importance of a Among the vast quantity of data that was collected, informa- final report in the English language was apparent. Because we tion from the digital flight data recorder was available, but infor- were more fluent in English, the union investigator and I were mation from the cockpit voice recorder was unfortunately not given the very important job of writing the report under the su- available due to the jammed fuel lever that had caused the CVR pervision of the IIC. The task of writing the report was enormous to keep recording for several hours after the incident. and extremely time consuming, but one that we were grateful to After all the data were collected and extensive analysis of both have, given the importance of the report and its recommenda- engines had been performed by Rolls-Royce, the process of elimi- tions not only to our company but also to many other operators nation led to the conclusion that the most probable cause of the who had a vested interest in this very critical safety issue. event had been the ingestion of large amounts of ice by both The costs of the investigation were never really evaluated. An engines. The focus of the investigation turned to the deicing analysis of costs, however, would have revealed that the operator operation, the post de-icing inspection and the operator’s super- had made a very significant contribution in both man-hours and vision of ground handling. expertise. Also significant was the comprehensive engine analy- Deicing at European airports was a very controversial and high- sis performed by Rolls-Royce and a high-altitude test flight that profile safety concern at the time, and a few years earlier the was organized by the operator to obtain infrared camera mea- DAQCP (De-icing and Quality Control Pool) had been established. surements of temperature distribution on the wing surface area The DAQCP was an organized group of operators who shared with the same amount of cold-soaked fuel in the fuel tanks as the the auditing of several deicing contractors throughout Europe. incident aircraft. In the Turin investigation there was controversy over • knowledge of and training of the correct techniques for the Airline investigator training within a flight safety program removal of clear ice. As illustrated by the example in Turin, proper training of airline • ownership of the final responsibility for the post deicing in- investigators is a vital facet of the operator’s flight safety pro- spection. gram and more importantly the training should be within the • the operator’s contractual arrangement with the handling agent reach of, and available to, all operators. that performed the de-icing and the agent that performed the One of the most striking aspects of many formal accident in- inspection. vestigation courses is that the bulk of such courses are not rel- • the separate arrangement between the handling agent per- evant to the airline investigator. Also many courses are out of the forming the deicing and the agent performing the post deicing financial reach of smaller operators and those who it could be inspection. argued may need it most. • the structural safety deficit at an international regulatory level Fortunately, most airlines tend not to have accidents. Con-

ISASI 2007 Proceedings • 145

Proceedings 2007.pmd 145 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 146 and organization andmanagement ofoutstationground handling, • theDe-icingandQualityControl Pool auditingsystem, • preflight inspections, • crew hand-overprocedures, • fuelingpolicy, • recommendations inregard to incidents wemaintainisvitaltotheimprovement ofsafety. incident occurrences andrecognition andinvestigationofthese lems. Theseoperatorsare, however, justasvulnerable toserious hampered bylimitedbudgetallocationsand/orproduction prob- tigation team. with otherinvestigatorsandtheabilitytomanageasmall inves- tions, andtodevelopasenseofwhenriskshouldbemitigated. dent, howtowriteareport thatsupportseffectiverecommenda- recognize aseriousincident,howtoinvestigateinci- safety program. sponsibilities andentitlements. tigation, thentheairlineinvestigatorshouldbeaware ofitsre- ifthestateinvestigationauthorityconductsanincident inves- • tigation authority. serious incidentswithorwithouttheassistanceofstateinves- theairlinemustbeprepared toparticipate ininvestigationsof • rately bymeansofacomprehensive risk-assessmentprogram. theseriousnessofaneventisrecognized and assessedaccu- • performed incidentinvestigationsandqualityreport writing. is anindustrywideunderestimation oftheimportancewell- from incident investigations,andweare oftheopinionthatthere tigators. There isnodoubtthatvaluablelessonscanbelearnt investigation dependsuponthetrainingofoperator’sinves- cated totheoperatoritselfand,therefore, thequalityofsuchan Annex 13,thereality isthatthistaskmore oftenthannotisallo- serious incidentshasbeenmandatedinthelatestversionofICAO able togivelimitedattention.Eventhoughtheinvestigationof to investigateallseriousincidentsandatbestare sometimesonly investigation authoritiesdonothavesufficienttimeorresources shortages orotherinvestigationsalready inprogress, thenational sometimes theseincidentsare serious.Often,though,duetostaff vestigator-in-charge. at bestbeanadvisorandwillcertainlyneveractingasin- each daysomeone,somewhere breaks theerror chain. that matterwilleverknowthisfact.Itisjustoneofthemanytimes prevent arunwayincursion,butneitherthecompanynorATC for other numberofthings.Onthisoccasion,however, theyactually It couldbebecauseofcommonsense,airmanship,training,orany not make sensesotheyrequest clarification.Whydidtheydothis? currence developingintoaseriousincidentorevenanaccident. times anearlybreak ina“chainofevents”hasprevented anoc- versely, however, mostairlinesare mostlyunaware ofhowmany In thecaseofTurin, thereport alsoanalyzedandproduced Many smalloperatorsorlesswell-established are Equally importantistheairlineinvestigator’sabilitytowork We wouldargue thatinvestigatorsshouldbetrainedhowto So there are severalimportantelementsforaneffectiveairline The lastpointappliesequallyinanaccidentinvestigation. In termsofanairlinesafetyprogram itisimportantthat Airlines do,however, haveincidentsfrom timetoand If anairlinedoeshaveaccident,theinvestigatorwill For example, pilotsdiscussthefactthatanATC instructiondoes • ISASI 2007 ISASI Proceedings 146 Latvia, Malaysia,andGreece. Australia. Dedicatedin-housecourseshavebeendelivered in Kingdom, Luxembourg, Austria,Germany, Surinam,Latvia,and from avarietyofcountries,includingGreece, Norway, theUnited pany ISISisbased,otherattendeeshavebeenfrom operators nel from manycountries.Apartfrom Holland,where ourcom- incident investigation. they maybeabletoperformtherole asadvisorinanaccidentor they mayleadandmanageanincidentinvestigationthat course wasdevelopedspecificallywithairlineoperatorsinmind. separate from ourday-to-day airlinesafetybusiness;however, the develop theISISincidentinvestigationcourse.Thisinitiativewas personnel. know-how andmanpowerbetweenthesafetymanagement different withineachcompany, there wasan activeexchange of partments andthepositionofsafetydepartmentswasslightly parent anddaughtercompanieseachhadtheirownsafetyde- of theparent companyKLM,Royal DutchAirlines.Althoughthe line captainontheBoeing747-400,Iwasalsochiefinvestigator At thetimeofFokker 70incident,apartfrom myfunctionas training forairlineinvestigators Benefits ofinteractiveandcustomized problems. Increased flexibility forthe companyincaseofproduction • home basebeingrequired. Less downtimeforpersonnel duetonotravelingawayfrom • Lesscostsperheadforthecompany. • cuss “regional” issues. Bettercapacity andmore timetoconcentrateuponanddis- • standing ofoneanother’sroles withinthecompany. gether, whichincreased theirindividualknowledgeandunder- Persons from severaldifferent departmentswere trainedto- • able tothinkonthesamewavelength. Persons were trainedinthesame“vein” andwere therefore • safety assessments,andanalysis. More peoplewere trained andready toperforminvestigations, • for thecompaniesinvolvedhavebeen The specificadvantagesofin-housecourses and proficiently. and incidentinvestigationscouldbepreformed more thoroughly also thatallcompanieswouldbenefitfrom anexchange ofideas skills byworkingalongsidemore experienced investigatorsbut the opportunitiesnotonlyfortheirinvestigatorstoimprove their of limitedresources andcapabilitywouldbenefitenormouslyfrom pools orexchange programs existed thenseveralsmallerairlines ciation AirSafetyWork Group, itstruckmethatifinvestigator tigator exchange programs. sideration shouldbegiventoairlineinvestigatorpoolsorinves- priate investigatortrainingcourses.We alsobelievethatduecon- sense, therefore, togiveconsiderationaffordable andappro- dations thatarisefrom acomprehensive investigation,itmakes internaldistributionandcontrol ofcompanydocumentation. • During thelast4years,wehavebeentrainingairlineperson- The ISIScourseisdesignedtotraininvestigatorsinorder that In 2003aninitiativewastaken byDeborah,Jan,andmeto During myyearsaschairmanoftheEuropean AirlinesAsso- In viewofthepotentialvaluewell-formulatedrecommen- 1/14/2008, 9:44 AM Why a stand-alone incident investigation course and not We place a very high value on incident investigations, not only an integrated accident investigation course? from the cost aspect for smaller companies but for the added • Airlines have more incidents than accidents, and proper in- value to safety that will come with comprehensive, well-performed vestigation of an incident can help to prevent an accident. investigations and associated quality reports. • Investigation training also requires consolidation, and work- Investigation of an incident can provide ing with other experienced investigators and advanced training • “cheap” knowledge; try an accident. is only of value after a suitable consolidation period. • more information due to the availability of more data and wit- • Cost, spread of costs, employees are only absent from duties nesses who are still alive. for 1 week at a time instead of the usual 2 weeks or more. • a valuable precursor warning to an accident. • Specific learning—more concentration on the topics and dis- It is often the case that many serious incidents will have the ciplines that are relevant to airline operations. same “footprint” as an accident but that a stroke of luck or good • Learning over a longer period of time plus the opportunity to fortune breaks the error chain and an accident is avoided. revise and update previous learning by doing the accident inves- This was seen in the case of the Fokker 70 icing incident at tigation training module 6 months to 1 year after the incident Turin. Many accidents, on the other hand, would have or could investigation module. have been serious incidents save for one factor such as in the case of Cali when the speed brakes remained extended when the Why did ISIS set up this course, while there B-757 attempted to clear the high terrain. If Cali had been a are already other courses available? serious incident and not an accident, then the investigation of We wanted this event would have been vitally important. The interesting • to see more emphasis placed on incident investigation. thing, however, from our point of view is that had Cali only been • to see the inclusion of more relevant material and to give more an incident, the investigation may have had to have been per- hands on practice. formed by the airline itself. SESSION 6—Moderator David King • this type of training to be available for all operators, large and small. We believe that accidents such as the one at Cali and serious • investigators to be able to recognize the intrinsic value of other incidents such as the one at Turin clearly demonstrate the very investigation reports. fine line between incident and accident and clearly emphasize • to create a course that is portable. the importance of having well trained airline investigators. We believe that the delivery and teaching methods are just as Thank you. ◆ important as the content of the course. Lecturers are trained in teaching skills in line with recognized university teacher training Links to the ANSV and the Flight Safety Foundation where the methods. The ISIS course is highly interactive, and the number report may be found are of attendees is restricted to smaller groups in order to guarantee www.ansv.it/cgi-bin/eng/Final%20report%201-2-04PH-KZH.pdf. individual attention and feedback. www.flightsafety.org/ao/ao_jan-feb05.pdf (FSF Volume 31, No. 1).

ISASI 2007 Proceedings • 147

Proceedings 2007.pmd 147 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 148 universities, thearmedforces, airlines,andotherorganizations. teers whocomefrom variousdifferent institutions, including due toalackoffull-time,qualified investigators. No-blamesafetyinvestigations:We are alsofacingproblems • cient numberofqualifiedinspectors. Regulatory: We are stillfacingproblems inpreparing asuffi- • includes ciently followedbythegrowth ofsupportinginfrastructure. This 300% duringthelast6years. creased byabout300%. According toICAOobservation,theoverallvolumehasin- • flights in2006. This increase inactivitieshasresulted inverycloseto1million • ing to2006statistics. Theinternationalpassengernumberwas11million,accord- • 2010. sengers ayeartoday, withtheprediction of70millionbyyear 10 millionpassengersbackin2000to30domesticpas- Thenumberofpassengershasdramaticallyincreased, from • count aircharteroperators. We have21activedomesticairlines,withouttakingintoac- • Currently, wehave187activeairportsinthecountry. • the distancebetweenLondontoTeheran. The longestdistanceofIndonesianairspaceisequivalent to • Indonesia. an overviewofthecurrent situationoftheaviation ground, organization, andchallengesfortheNTSC andgive the NTSC.Mypresentation will cover IndonesiaNTSCback- member. once againthankyouverymuchforacceptingmeasafullISASI MyapplicationwasacceptedlastJuly,member ofISASI. andI use thisopportunitytointroduce myselfasaverynewjunior board.tee, toAAIB,and,ofcourse,theISASI Letmealso NTSC chairman. be assignedhere inpresenting thismaterialonbehalfofour craft thatwasinvolvedinanaccidentlastJanuary. Iwaslucky to important mission:theyare recovering theblackboxes ofanair- somewhere around theSulawesiOceanconductingavery, very being abletoattendthismeetingpersonally. Tatang Kurniadi, ourchairmanoftheIndonesiaNTSC,fornot Good afternoonladiesandgentlemen. Within theNTSC,20aviationinvestigators are mostly volun- The growth ofaviationindustriesinIndonesiawasnotsuffi- In otherwords, wehave beenexperiencing agrowth ofabout During thenext 15minutes,I’dlike topresent alittleabout Let mealsoexpress ourappreciation commit- totheISASI Mr. Tatang andsomeotherNTSCteam members are now First ofall,I’dlike topassonadeepapologyandregards from Committee ofIndonesiaPresentation • ISASI 2007 ISASI National Transportation Safety By Tatang Kurniadi, Chairman,NationalTransportation SafetyCommittee,Indonesia Proceedings 148 Presentation orallydelivered byA.Toos Sanitoso

industry in We are preparing theprocedures andpoliciestomonitorthe • include revised policiesandprocedures. We are addressing therecent ICAOauditfindings,whichwill • act. We are alsoworkingonatransportationsafetyinvestigation • an independentbodyadministrativelyaswellfinancially. We are expecting to seeinthenearfuture theNTSCbecome • body.” establish anindependentandeffectiveaccidentinvestigation tural reforms shouldbeinitiatedtostrengthen theDGCAand Indonesia,struc- tegic summitonaviationinIndonesia:“Within Foundation, ifImayquoteoneofhiscommentsduringthe stra- Inlinewiththecommentof president oftheFlightSafety • report publiclyavailable. Standard 6.5,tomake itclearthatrelease meanstomake the timely manner. not beenabletofinishandreport ourrecommendations ina tigation andreport preparation—which wewouldhave otherwise an enormousamountofeffortinassistingusduringtheinves- America, ATSB Australia,andinparticular AlanStray, whoput all oftheaccredited representatives, whorepresent NTSB laboration. Onceagain,I’dlike toexpress ourappreciation to gators. We were internationallyassistedinaverysupportivecol- byNTSCinvesti- place. TheCVRwastranscribedinCanberra the CVRpointswere reset andthereading datadownloadtook manufacturer’s facilityinSeattle,Washington, intheU.S.,where analysis. TheCVRmalfunctionedsoitwastaken tothe sent totheATSB Australia, forreplay facilityinCanberra, and participated withtheinvestigationteam.Theblackboxes were operation. together inaharmonyofinternationalcollaborationandco- very goodexample ofhoweveryone’ssafety concerns came inJogyakartaacouplemonthsagowas tional flagcarrier we have. final report inatimelymanner, inspiteofallthehandicaps ommended practices.We putalloureffortstoaccomplishthe possible afteranaccident,followingICAOstandards andrec- very usefulforus. cooperation withtheIndonesianaerospace facilityhasalsobeen analysis andmechanicalnormallytake place. Having with theInstituteTeknologi ofBandung,where metallurgical big advantagefortheNTSCisthatwehavesolidcooperation They are supportedbyanumbersofadministrativestaff.The We ICAO recently havesentaletterclarifyingICAOAnnex 13, The NTSB,ATSB, andtheSingapore AAIBspontaneously The recent investigationoftheaccidentinvolvingourna- We normallystartconductinganinvestigationassoon

face thefollowingchallengesasanorganization: 1/14/2008, 9:44 AM implementation of recommendations made by the NTSC. common goal as an international aviation community. So we, • We are looking for a number of well-trained and qualified full- therefore, honestly invite every party in the world that could par- time investigators. ticipate hand-in-hand with us as an aviation community in Indo- • We are hoping to have our own CVR/FDR laboratories, so we nesia to build a strong and solid international collaboration and don’t have to do it overseas. walk and work together toward better and safer aviation indus- We are facing these situations as challenges that we believe we tries throughout the world. will be able to solve nationally as well as internationally. That concludes my presentation, and I would be happy to an- We strongly believe that aviation safety improvement will not swer any questions you may have. Thank you very much for your only be a national issue, but also will more likely become our attention. ◆ SESSION 6—Moderator David King

ISASI 2007 Proceedings • 149

Proceedings 2007.pmd 149 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 150 to exigent circumstances. * Articleacceptedforpresentation butnotorallydelivered due tion andregulations considermanypossiblefailure scenariosthat aircraft systemorcomponentdesignstobesafe.Also,certifica- edge isoneofourbestfriends.Obviously, engineersintendfor dents” and“incidents”(asdefinedbytheNTSB).Empiricalknowl- and comprehensive methodologyfordocumentingboth“acci- when possible.Onewaytoachievethisismaintainaconsistent jor accidents;therefore, weshouldthoroughly documentallevents We needtokeep inmindthatminorincidentscanturnintoma- tion, anditishumannature to“relax” whennobodygetshurt. visibility andliabilitytypicallydrivethedepthofaninvestiga- cal answer:Itshouldn’t. Practical answer: Itusuallydoes.High investigation whencompared toacomplex accident?Theoreti- Does arelatively simpleaccidentchangeourapproach tothe defining theminimumcriteria Foundations ofaproperinvestigation— tions are presented toshowwhythisissoimportant. to investigations.Then,someexamples ofactual“field”investiga- problems. Thisarticlewillbrieflydiscussa“back-to-basics”approach making effectivejudgmentstoresolve immediateandlong-term This situationaffectsourabilitytoassisttheaviationindustryin complete probable causeslitterthe“field”investigationdatabases. substantialincreasesout incurring incost.Inaccurateand/or in- still canmake substantialimprovements toourmethodologieswith- facturers andgovernmentagencies.However, weasinvestigators accidents are understandableduetothelimitedbudgetsofmanu- the majorityofinvestigationsare related togeneralaviation. age andtypicallyresult inamultitudeofinjuries/fatalitiesatonce, gation. Eventhoughairlinecrashesreceive more mediacover- visibility or“major”investigationversusatypical“field”investi- air safetyworldistheamountofattentiondedicatedtoahigh- tion industry. Oneoftheareas thathasnotchangedmuch inthe rate and/orincompleteinvestigationscanimpacttheentire aviation consultant(since1999)hasopenedmyeyestohowinaccu- Aircraft (1990-1999)andanaccidentwreckage reconstruc- Working asanair safetyfieldinvestigatorandengineerforBeech Introduction students aswelljourneymenengineers. investigation coursestoundergraduate andgraduateengineering aircraft. Donalsodevelopsandteachesaccredited aircraft accident hobby, where heenjoysflyingandmaintaininghisownexperimental investigations throughout theworld.Aviation isbothhisprofession and accident investigator. Hehasconductedmore than175comprehensive IA), airplaneandhelicopterpilot,mechanicalengineer, andaircraft work. HeisanexperiencedFAA-certificated A&Pmechanic(withan Donald Knutson To someextent, thelimited effortsdevotedtogeneralaviation • ISASI 2007 ISASI ’s career hasbeenfocusedentirely onaviation-related Proceedings 150 Going theExtraMile* By DonaldF. Knutson(MO4529) but noevidenceexists todeterminetheoriginofthis particular the factthathehasseenthishappen 100timesduringhiscareer that thefire startedatthefurnace.Ifhisfindingsare basedupon ence mightinvestigateahouse thatburneddownanddetermine overconfident orcomplacent.Afireman with30years’experi- based upontheirexperience, wemustguard againstbecoming with experienced investigators onourteam. ter atthisconceptaswegaininvestigationexperience andwork the box”tosolveproblems practically. Typically, webecomebet- an investigatormustknowhowtothinkcreatively and“outside theory, priortodecidingonafull-blowntestprogram. Thismeans setting uparelatively inexpensive testtoprove or disprove a important partstodocumentandpreserve. Anotherexample is age ASAP, theinvestigation teamneedstoprioritizethemost ting seriouspressure bythelocalauthoritiestorecover thewreck- major metropolitan highwayandtheinvestigationteamisget- vestigation. For instance,ifaircraft wreckage isscattered alonga lyze fatiguefailures orcockpitresource management. tors, whoare notmetallurgists orhumanfactorsexperts, toana- having thisexperience. Likewise, itistypicalforfieldinvestiga- involving flightandmaintenanceoperationswithoutactually find specialists,whoare notpilotsormechanics,analyzedetails ists are neededtosupporttheinvestigation.Itisnotunusual industry alongwiththeabilitytorecognize whattypesofspecial- most fieldinvestigators,require abroad-based knowledgeinthe metallurgist who isusuallyaspecialist.Generalists,whoinclude dent reconstructionist isusuallyageneralist,compared witha successful insomecases,butwemustremember thatthe acci- to alsobetheaccidentreconstructionist. Thisapproach maybe example, intheconsultingworlditiscommonforametallurgist have enoughbackground toproperly coveralltheseareas. For pert—this canbeaproblem becauseitisrare foran“expert” to ing thereconstructionist, metallurgist, andhumanfactorsex- accidents. Investigatorssometimeswearseveralhatssuchasbe- meteorologists, metallurgists, etc.,couldallbeneededforboth experts, radar/flightdataexperts, structuralandsystemengineers, perts required tofindthecausemaynot—pilotandmechanic money spenttoconducttheinvestigationwilldiffer, buttheex- which accidentshouldgetthemostattention.Ordoesit?The spin resulting in2fatalities,itdoesn’t take muchthoughttosee 747 mid-airexplosion with500fatalitiesversusaCessna152stall/ be neglectedduetolackofresources. WhencomparingaBoeing expertise. Asindicatedinmyintroduction, generalaviationmay lost opportunitiestotake advantageofempiricalknowledge. an aircraft accident.Inconsistentdataandlimitedresult in investigators endupwithlimitedempiricaldatatocompare with and fortunately, results inlimitedaccidents;butthisalsomeans engineers attempttodesignoutoftheequation.Thisusually, Even thoughinvestigatorsbecomesavvierandmore confident We normallyhavelimited timeandmoneytoconductourin- Complex investigationsrequire ateamwiththeappropriate 1/14/2008, 9:44 AM fire, then he has used flawed analysis. Investigators must base their conclusions on facts and scientific principles, not just experience. Remember this adage: “Evidence is king.” We need to maintain the investigation’s integrity by staying away from putting our “gut feelings” ahead of actual physical evidence. Investigators should be disciplined and patient about gathering all possible evidence and look past the perceived obvious, i.e., use in-depth analysis. Do not start forming any conclusions until the facts are completely documented and evaluated. Examples in this article Figure 1: Nine-box matrix. will show how inaccurate or incomplete investigation findings result from selective gathering of evidence. ing quality control no matter how we would like to justify it. No matter how many investigations you conduct, there is al- Solve the following sentence: KFDE W CWMDCWZZ ways something new to experience. This means that there is al- XDZUDPDX FWM YZL MGVBNTVM, TED OTLZA MWG ways room for improvement when it comes to both our commu- FD NFXTKM WN W YDPDX BUNOF. First clue is Z = L. nication and learning process. The previously mentioned em- Tools needed to solve this puzzle are knowledge of the En- pirical knowledge can be enhanced when we share our glish language (reading, writing, and spelling), similar to un- investigation experiences and use them as lessons to be learned. derstanding engineering and sciences. Also, knowledge of the Effective ways to do this include attending and presenting at semi- American culture is required (e.g., sports, slangs, and humor), nars organized by the International Society of Air Safety investi- similar to understanding the various facets of aviation. We should gators and general aviation air safety investigators. logically start by replacing all the Zs with L. Next, evaluate the small words to determine their vowels, knowing that one-letter Who’s on the team? words are either A or I. Another helpful clue is that two words Imagine a mechanic trying to fix an airplane without using the proper have the same suffix. Note that during this process we start by tools, or a pilot flying in unfamiliar airspace without using the proper concentrating on the words in the sentence and not the entire aeronautical maps. This is similar to an investigator not being aware sentence. Likewise, when we are documenting pieces of wreck- of all the expertise that is available and may be necessary for the age, our focus starts on each piece and not the entire wreckage. investigation. We should develop a strong awareness of the follow- After we make some educated guesses on which letters can work, ing areas of expertise (I’m probably missing something): we start to string two or more words together. Then, we iterate • Air traffic control and radar the process until we see that the sentence makes sense. Like- • Airport operation and design wise, as we accumulate our wreckage findings piece by piece, we • Biomechanics theorize realistic possibilities based on the available evidence. • Certification and airworthiness Then, we compare relationships between two or more findings • Engineering (aerodynamics, safety, structural, systems, etc.) and iterate through logic and tests to find out whether we can • Fire and explosion connect the dots. Our goal is to eventually “visualize” the acci- • Flight data and cockpit voice recording dent; in other words, establish the sequence of events leading • Human factors (machine-person-environment interface issues) to and including the accident. • Maintenance An effective investigation tool is the “nine-box matrix” depicted • Materials (metal, composite, and plastic) in Figure 1. This tool helps us derive a comprehensive checklist in • Meteorology addition to the basic established report format. The nine-box ma- • Pathology and toxicology trix also prompts us to account for the small pieces of evidence • Piloting (test, instruction, or general operation) before looking at the big picture and helps establish a game plan • Simulator and animation for further investigation needs. For example, questions involving • Sound spectrum analysis (tower recordings and CVR) the “Machine” should include radar and ground support equip- • Test and system modeling ment along with the aircraft. “Environment” involves the airport • Tribology (lubrication, friction, and wear) operations and company policies as well as the weather. Each box • Wreckage and accident reconstruction eventually evolves into a multitude of specific questions. As indicated before, we may possess knowledge in areas beyond our primary expertise, but we need to understand our limi- Scientific method tations and know when to involve the appropriate generalists or We want to minimize the influence of any bias or prejudice of the specialists. Build a network of experts and learn as much as pos- investigation team by evaluating a hypothesis or theory through sible about what/how they can add to your investigation. accurate, reliable, consistent, and non-arbitrary representation of the investigative findings. The flow chart depicted in Figure 2 con- Concentrating on small pieces of evidence cisely shows the basic process. Integrating the nine-box matrix with until understanding the big picture this process will provide investigators with a comprehensive ap- When have you heard someone ask, “How do you take all those proach along with quality control of the investigative findings. broken pieces and understand what happened?” The answer is, “One piece at a time.” This seems so simple; yet our experience, Art versus science knowledge, and ego can prompt us to cut corners or jump to con- The old adage that “physics doesn’t change” is alive and well. clusions. Sometimes we get away with this, but we are not exercis- Mechanisms and structures have physical properties that “talk”

ISASI 2007 Proceedings • 151

Proceedings 2007.pmd 151 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS medium (cuttingthrough trees), whilesystematically strikingthe been rotating under power(2,000-2,700RPM)through adense the bladecurlingtotake place,thepropeller neededtohave tip did bent inoppositedirections. Physicstellsusthatthecurledblade from theplaneofrotation), and thetwonon-curledbladesare blades appeartobeinafeathered position(~90°pitchangles blades exhibiting relatively simplebending.Alsonoticethattwo nounced aftcurlingofonlyonebladetip,withtheother two minum propeller damagedepictedinFigure 3.Noticethepro- downstream ofthemain wreckage. Studythethree-bladed alu- The propeller hadseparatedfrom theengineandwasfound just feet from theinitialtree impactandsustainsapost-impactfire. densely forested Themainwreckage terrain. comestorest ~500 level atcruisespeedwhilecrashingintograduallyrising and surd.” For example, visualizeapropeller-driven airplaneflying ence (orlackthereof) andhaveawillingnesstoconsiderthe“ab- herent biasessuchaspreconceived notionsbasedonourexperi- etc.)areFDR, unavailable. proven empiricalknowledge,orcrash-recording devices(CVR, necessary whenconvenientlyrelated testorengineeringdata, and matchitwithlogicalperception. Thisbecomesevenmore into playwhenweneedtogloballyconsiderevidence,thenmix combination ofexperience, creativity, andimagination)comes emergency inZseconds,etc.Our factors studiesshowapersoncanoptimallyreact toaspecific showed fatiguecracksanddissimilarmetalcorrosion; human cause ofdeathfrom bluntforce trauma;metallurgical findings ing atXftanddescendingYperminute;autopsyrevealed together withpartBfracture; radardatashowedtheaircraft fly- tific 152 flow chart. Figure 2:Basicscientificmethod To becreative andimaginative,weneedtorecognize ourin- findingsusuallyare whattheyare: Part A fracture profile fits • ISASI 2007 ISASI not impactatree andwraparound abranch.Inorder for Proceedings 152 artistic wreckage reconstruction. cally the normal wear).Thisistypi- pre-impact damage(or tinguish impactversus age layout.We trytodis- frame orduringawreck- wreckage togetherona alize damageisbypiecing common methodtovisu- and orientation.One ometry, volume,direction, parts regarding theirge- damage orchangein describe theamountof ways. We measure and and quantifiedinmany materials canbeverified Physical properties of and oppositereaction. action there isanequal big pieces,e.g.,forevery laws ofnature thesameas pieces obeythephysical tric!) Also,miniature to us.(No,I’mnoteccen- side(skillacquired bya Specific detailsor scientific part of scien- age examination. ing anopenmindalongwithbeingthorough during thewreck- during theimpactsequence.Themoralofthisexample iskeep- create afalseperception thattheengine wasnotproducing power fire hadconsumedjustthecurledbladetip.Thiscouldeasily what aninvestigatorwouldpossiblyconsiderifthepost-impact times. Thinkabouttheoddsofthishappening.Now, thinkabout tally twistedittoward lowpitchuntilfinally curlingabout1½ trees withonlyoneblade.Eachstrike ofthebladetipincremen- accurate analysis.Pleasenote thatI’vebrieflysummarizedtwo mentioned investigationprinciples canresult inincomplete or in- Now let’slookatafewexamples ofhowfailingtoapplythe afore- “Proof is inthepudding” Figure 3:Propeller bladecurl. 1/14/2008, 9:44 AM Cessna models not with the intention of picking on Cessna aircraft. his shoulders and thorax downward (simulating vertical G-loads), Correspondingly, I’ve chosen two NTSB investigations not to single without exerting any excessive pull force on the seat back, and lean out the NTSB. These case studies just happen to demonstrate in- forward enough to make facial contact with the control wheel. Two vestigative concepts that are easy to follow in a concise format. other persons (5’11”, 175 lbs, and 6’0”, 230 lbs) duplicated the seated test without changing the seat and control positions—both Case study #1—Cessna 525A (CJ2) runway overrun, were able to droop their shoulders and thorax downward, and NTSB Report No. NYC03FA002: lean forward enough to make facial contact with the control wheel. The pilot landed the airplane too fast down the runway and failed In addition, static pull tests on the ends of both shoulder har- to properly abort and execute a go-around. The airplane rolled ness belts were conducted. The shoulder harness belts were jerked off the end of the runway and impacted upward-sloping terrain forward and held to the least possible inertia reel payout length. while trying to become airborne. Both front-seat (cockpit) occu- The straps were then pulled forward at 20, 40, 60, 80, and 100 pants sustained serious facial injuries, and both rear-cabin occu- lbs. During each pull force, the elastic displacement of the upper pants were uninjured. The NTSB probable cause was “the pilot’s portion of the seat back was measured. The forward seat back improper decision to land with excessive speed, and his delayed deflections (i.e., roughly corresponding to the forward motion of decision to perform an aborted landing, both of which resulted the pilot’s upper torso) were 1/8, 5/8, 7/8, 1-1/8, and 1-5/16 inches, in a runway overrun. A factor was the tail wind.” This case study respectively; therefore, the pilot’s cheek would translate forward discusses the implications of the field investigation falling short at least another one inch into the control wheel with a shoulder of looking into what caused the cockpit injuries. harness tension force of 100 lbs. Both front-seat occupants sustained serious head impact inju- Per FAR 23.561, the pilot should be given “every reasonable ries, which rendered the pilot unconscious as well as required the chance of escaping serious injury” during emergency landing right front-seat passenger to have facial reconstruction. NTSB conditions, with static inertia loads of 9.0 G forward. Also, FAR investigative findings showed that the left front-seat inertia reel 23.562 requires the seat assembly to withstand peak dynamic loads passed its acceptance test, and the right front-seat inertia reel of about 26 G forward (with 10° yaw) and 19 G downward (with did not. Both acceptance tests resulted in the reels locking at 1.5 30° pitch up). This means that the pilot’s upper torso would eas- G, yet both shoulder harness assemblies did not appear to ad- ily exert more than 100 lbs of forward pull force on the shoulder equately restrain the occupants. harness and more than 1-5/8 inches of seat back deflection dur- Examination/comparison of the subject Cessna CJ2 wreckage ing a dynamic crash condition. and an exemplar CJ2 have revealed that significant crushing of While researching cockpit seat certification, it’s interesting to the fuselage nose section absorbed most of the impact energy note that crash sled tests were conducted with the seat and re- and prevented the occupants from sustaining fatal deceleration/ straint assembly, an instrumented crash dummy, and a mock in- G-loads. Per the wreckage recovery crew, both front-seat assem- strument panel and glare shield. A control column and wheel blies had remained attached to the cockpit floor structure, i.e., assembly were not included because head impact with the glare relative displacement of the floor and seat assemblies were simi- shield, not the control wheel, was assumed. The occupant’s chest lar. Both control column assemblies remained intact and were is expected to impact the control wheel, and the crash dummy is displaced aft and upward in concert with both front seat-tracks, not designed to simulate the drooping of the shoulders and tho- i.e., relative displacement of the front-seat occupants in relation rax during the impact tests. Airplanes have to deal with both the with their control wheels. The right side of fuselage nose section horizontal and vertical components during an emergency land- exhibited a 44-45° crush line, and the left side exhibited a 35-36° ing. The normal response for a pilot preparing to contact terrain crush line, which are consistent with the occupants flailing pri- would be to pull the nose up to minimize a direct head-on colli- marily forward and slightly to the right during the ground im- sion; therefore, facial impact with the control wheel should be a pact. Biomechanics analysis and evaluation of the overall cockpit practical consideration during the crash sled tests. deformation revealed that the facial injuries sustained by both front-seat occupants were caused from striking their respective Case study #2—Cessna 152 stall/spin, control wheel. Vertical G-loads sustained during the terrain im- NTSB Report No. NYC05FA069: pact did not result in serious back injuries. An instructor and student took off in good weather with full fuel. During the exemplar CJ2 inspection, the accident pilot (6’3”, They apparently were practicing a stall/spin from approximately 170 lbs) was positioned in the left front seat with the five-point 3,000 feet AGL. Available radar data and witness statements in- restraint system properly adjusted against his body. The pilot posi- dicated that the airplane maintained its descent until ground tioned his seat the same as when he is flying—adjusted to its most impact. Witnesses saw the airplane “spiraling” in a nose-down aft-locked position on the seat tracks, with the seat back at its most attitude but could not determine its direction of rotation. Both upright setting. The pilot adjusted his seat height via the sight occupants sustained fatal injuries during terrain impact. Wreck- gage mounted above the center of the glare shield. The shoulder age remained together and was resting upright, with no debris harness belts were jerked forward and locked at the least possible path or horizontal ground scars.Pertinent NTSB wreckage in- inertia reel payout length. Shoulder harness belt tension was main- spection findings included the following: tained. The pilot’s left hand held the control column full aft with • No evidence of fire or smoke in cockpit the control wheel rotated approximately 45° from a neutral set- • Cockpit instrumentation and flight controls destroyed ting, and the pilot’s right hand was on the engine controls in the • Engine mixture control (vernier type) pulled out and bent full power position (normal positions when a pilot is trying to liftoff downward (?) and avoid impact with terrain). The pilot was then able to droop • Engine throttle control full in/forward (?)

ISASI 2007 Proceedings • 153

Proceedings 2007.pmd 153 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 154 Elastic properties ofrudderassembly onlyallowedaforced • Saint-Francois accident). erly riggedruddertravel(unlike reported findingsfrom theLac spective boltheadsexhibited wearpatternsconsistentwithprop- Contactareas betweentherudderstopplatesandtheirre- • recommendation: that donotsupporttheNTSBprobable cause,northesafety Cessna ServiceBulletinSEB01-01. directive21, 2007,requiring anairworthiness tocomplywith issued asafetyrecommendation (A-07-33)totheFAA onMarch not complywiththeservicebulletin.”Furthermore, theNTSB uncontrolled Afactor wastheoperatordid descentintoterrain. resulted inarudderjamduringspintrainingandsubsequent able causewasan“improperly installedrudderbumper, which Safety Board ofCanadaReport No.A98Q0114).TheNTSBprob- Francois, Quebec,Canada,onJuly18,1998(Transportation what appeared tobeacloselyrelated accidentinLacSaint- rudder stopplateswere notreplaced orrepaired. bulletin wasnotcompliedwith.Records also indicatethatthe the stopboltduringafullleftorrightdeflection.Thisservice to assistinpreventing thepossibilityofrudderoverriding which provided anenhancedrudderstopinstallationdesigned tin SEB01-01wasissuedabout3½yearspriortothisaccident, performed ontheruddercontrol system.CessnaServiceBulle- 10,700 hourstotaltime,andnomajorrepairs oralterationswere Nostructuralanomalieswere found(e.g., fatigue failures) • Flightcontrol continuitywasestablished • backwards Rudderstopplates(rivetedonrudderhorn)were installed • to Figures 4and5) plate over-traveledandsnaggedunderthestopbolthead(refer Rudderexhibited fullleftdeflectionwithitsrudderhornstop • Flapsup/retracted • i.e., noevidenceofenginetorque duringground impact Propeller bladesdidnotexhibit twistingorchordwise scratches, • tion—view ofrightstopplatesnaggedonitsbolthead. Figure 4:SubjectCessna152rudderstopover-travel condi- Beyond theNTSBinvestigation,furtherfindingscametolight Research ofotherCessna150/152 stall/spinaccidentsrevealed Maintenance records indicatedthattheairframehadatleast • ISASI 2007 ISASI Proceedings 154 both 9. Maintainacomprehensive databaseandthoroughly document investigation. equate altitudeoverterrain. engine control inputsandperformingthestall/spinwithinad- the pilotsnotregaining control oftheairplane,e.g.,improper impactandthatsomethingelsewasinvolvedwith during terrain above-noted clearlyshowsthattherudderover-traveloccurred applied tothesubjectaccidentwithoutbeingsubstantiated.The “cut-and-paste” analysisfrom theLacSaint-Francois accidentwas bly wouldnotcreate arudderover-travelcondition.Inessence, up/test fixture aswellthesubjectdamagedtailsection assem- left control cable)onbothanexemplar tailsectionassemblymock- Ruddercablepulltests(>350lbstensiononeither rightor • der stopplatewasinstalled(tabforward versusaft). create arudderover-travelcondition,regardless ofhowtherud- als) onexemplar/serviceable Cessna150/152modelswouldnot Extreme rudderpedalpushtests(justshortofdamagingped- • cables/pilot input). over-travel conditioninaftdirection (i.e.,cannotbepulledvia 8. Share knowledgeandworkclosely with 7. Foster teamworkandrequire generaliststoworkwithspecialists. stand vide appropriate trainingwhere it’sneededtohelpthem under- 6. Break investigatorsintogeneralistsandspecialists,pro- gation findings. 5. No“cut-and-paste”analysesallowed—confirmotherinvesti- conclusions. 4. Completelydocumentandevaluatefactsbefore formingany 3. Alwayslookpasttheperceived obvious,andeventhe“absurd.” 2. Basethefactsonscientificprinciples,notjustexperience. philosophy. 1. Establishthecriteriathat and incompleteinvestigationfindings? So, practicallyspeaking,whatcanwedotoreduce inaccurate Summary deflection. of leftstopplateagainstitsbolt,i.e.,fullrightrudder Figure 5:ExemplarCessna 152rudderstopinstallation—view majorandminoreventswhen possible. how tosupporteachother. 1/14/2008, 9:44 AM everyone needstobuyintoasound ◆ all partiestothe ISASI 2007 Pictorial Review Photos by Esperison Martinez ISASI 2007 PICTORIAL REVIEW

ISASI 2007 Proceedings • 155

Proceedings 2007.pmd 155 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 156 • ISASI 2007 ISASI Proceedings 156 1/14/2008, 9:44 AM ISASI 2007 PICTORIAL REVIEW

ISASI 2007 Proceedings • 157

Proceedings 2007.pmd 157 1/14/2008, 9:44 AM Proceedings 2007.pmd ISASI 2007 PROCEEDINGS 158 • ISASI 2007 ISASI Proceedings 158 1/14/2008, 9:44 AM