Investigation Challenges and Problems (Page 11) a New Terrain Profile Analysis Technique (Page 15) Useful Human Factors Investigative Techniques (Page 20) CONTENTS

APRIL–JUNE 2011

Investigative Data Mining: Challenges And Innovative Outcomes (Page 5) Heathrow 777: Investigation Challenges And Problems (Page 11) A New Terrain Profile Analysis Technique (Page 15) Useful Human Factors Investigative Techniques (Page 20) CONTENTS

Volume 44, Number 2 Publisher Frank Del Gandio FEATURES Editorial Advisor Richard B. Stone Editor Esperison Martinez Design Editor William A. Ford 5 Investigative Data Mining: Challenges Associate Editor Susan Fager And Innovative Outcomes Annual Report Editor Paul Mayes By Mark Ford, Senior Inspector of Air Accidents (Engineering), AAIB—The ISASI Forum (ISSN 1088-8128) is published data-mining process, results, and issues faced during the AAIB’s investigation quarterly by International Society of Air of the Boeing 777 fuel-icing accident in January 2008. Safety Investigators. Opinions expressed by authors do not necessarily represent official ISASI position or policy. 11 Heathrow 777: Investigation Challenges Editorial Offices: Park Center, 107 East Holly Avenue, Suite 11, Sterling, VA And Problems 20164-5405. Telephone (703) 430-9668. By Brian McDermid, Senior Inspector (Engineering), AAIB—The investigation Fax (703) 430-4970. E-mail address isasi@ team’s challenges in understanding unusual properties in aviation fuel and erols.com; for editor, espmart@comcast. in conducting tests to determine the vulnerability of an aircraft’s fuel system to net. Internet website: www.isasi.org. ISASI Forum is not responsible for unso- the accumulation and release of ice. licited manuscripts, photographs, or other materials. Unsolicited materials will be 15 A New Terrain Profile Analysis Technique returned only if submitted with a self-addressed, stamped envelope. ISASI Forum By Frederico Moreira Machado and Umberto Irgang, Embraer Air Safety Department reserves the right to reject, delete, sum- —By using the radio altimeter and the pressure altitude parameters recorded in marize, or edit for space considerations the FDR, it’s possible to determine the terrain’s topographic profile, which when any submitted article. To facilitate editorial production processes, American-English compared to the terrain’s actual profile obtained from the SRTM (Shuttle Radar spelling of words will be used. Topography Mission) data allows for refinement or validation of a rough trajectory Copyright © 2011—International Society of obtained from less-accurate means. Air Safety Investigators, all rights reserved. Publication in any form prohibited without permission. ISASI Forum registered U.S. 20 Useful Human Factors Investigative Techniques Patent and T.M. Office. Opinions expressed By David Ross, Regional Senior Investigator, Operations, TSB of Canada— by authors do not necessarily represent of- Investigation of a 2007 commercial Beech King Air medical evacuation flight ficial ISASI position or policy. Permission to reprint is available upon application to the accident required use of several methods for investigating human factors to editorial offices. properly collect and analyze relevant information. Publisher’s Editorial Profile: ISASI Forum is printed in the United States and published for professional air safety investigators who are members of the In- DEPARTMENTS ternational Society of Air Safety Investiga- 3 President’s View tors. Editorial content emphasizes accident 4 V.P.’s Corner investigation findings, investigative tech- 25 ISASI RoundUp niques and experiences, regulatory issues, industry accident prevention developments, 30 ISASI Information and ISASI and member involvement and 32 Who’s Who—A brief corporate member information. profile of Flight Data Services Subscriptions: Subscription to members is provided as a portion of dues. Rate for nonmembers (Domestic and Canada )is US$28; Rate for nonmember international is US$30. Rate for all libraries and schools is US$24. For subscription information, call (703) 430-9668. Additional or replace- About the Cover ment ISASI Forum issues: Domestic and On Jan. 17, 2008, a Boeing 777-236ER powered by Rolls-Royce engines, registered Canada US$4; international member US$4; G-YMMM, while on approach to London (Heathrow) experienced a loss of power to domestic and Canada nonmember US$6; and international nonmember US$8. both engines, which resulted in the aircraft touching down approximately 330 meters short of the paved surface of the runway. The investigation undertaken by the United Kingdom Air Accidents Investigation Branch determined that the probable cause was the formation and sudden release of ice in the aircraft fuel delivery pipes, which caused a restriction at the engine fuel oil heat exchangers (FOHE) during a critical stage of the flight. Photo: Crown copyright by courtesy of the AAIB and Metropolitan Police ASU.

2 • ISASI Forum April–June 2011 PRESIDENT’S VIEW

Revisiting ISASI’s ‘Criminalization’ Position By Frank Del Gandio, ISASI President Just a year ago, I wrote on this page that your prosecutors for the purpose of assessing guilt and punishment, Society had become a signatory to the Joint could discourage persons from providing accident information, Resolution Regarding Criminalization of Avi- thereby adversely affecting flight safety; ation Accidents. The resolution declares that Recognizing that under certain circumstances, including acts criminalizing aviation accidents has a deleteri- of sabotage and willful or particularly egregious reckless con- ous effect on the appropriate investigation of duct, criminal investigations and prosecutions may be said occurrences, the finding of contributing appropriate; factors and probably causation, and the formulation of recom- Concerned with the growing trend to criminalize acts and mendations to prevent recurrence. omissions of parties involved in aviation accidents and The most recent example of such criminalization is the filing incidents; of preliminary manslaughter charges by French Judge Sylvie Recognizing that the sole purpose of protecting safety Zimmerman against Air France and Airbus related to the June 1, 2009, crash of Air France Flight 447. The Airbus A330 crashed into the Atlantic Ocean between Brazil and western I believe it is appropriate to refresh Africa while on a flight from Rio de Janeiro to Paris. All 228 persons aboard perished. Preliminary charges allow investi- ourselves on the criminalization position we gating judges to continue their probe before deciding whether have taken along with the other signatories, to send the case to trial. The BEA is now in the midst of its including the Flight Safety Foundation, the fourth underwater search for the flight data and voice recorders. The BEA investigation is incomplete, but problems with Civil Air Navigation Services Organization the pitot tube have been recognized. (CANSO), the Royal Aeronautical Society I believe it is appropriate to refresh ourselves on the criminalization position we have taken along with the other (RAeS), the Academie Nationale de l’Air signatories, including the Flight Safety Foundation, the Civil et de l’Espace (ANAE) in France, the Air Navigation Services Organization (CANSO), the Royal European Regions Airline Association, Aeronautical Society (RAeS), the Academie Nationale de l’Air et de l’Espace (ANAE) in France, the European Regions the Professional Aviation Maintenance Airline Association, the Professional Aviation Maintenance Association, and the International Association, and the International Federation of Air Traffic Controllers Associations, on the joint resolution. Federation of Air Traffic Controllers The joint resolution reads, in part, as shown below. Associations, on the joint resolution. “Recognizing the importance in civil aviation accident investigations in securing the free flow of information to determine information from inappropriate use is to ensure its continued the cause of accidents and incidents and to prevent future availability to take proper and timely preventative actions and accidents and incidents; to improve aviation safety; Recognizing the actions taken recently by the International Considering that numerous incentives, including disciplinary, Civil Aviation Organization in promoting amendments to civil, and administrative penalties, already exist to prevent and Annex 13–Aircraft Accident and Incident Investigations to deter accidents without the threat of criminal sanctions; the Convention on International Civil Aviation, encouraging Being mindful that a predominant risk of criminalization contracting states to adopt by November 2006 certain actions of aviation accidents is the refusal of witnesses to cooperate to protect the sources of safety information; with investigations, as individuals invoke rights to protect Recognizing the importance of preventing the inappropri- themselves from criminal prosecution, and choose not to freely ate use of safety information, including the increasing use admit mistakes in the spirit of ICAO Annex 13 for the purpose of such information in criminal proceedings against opera- of preventing recurrence; tional personnel, managerial officers, and safety regulatory Considering that the vast majority of aviation accidents result officials; from inadvertent, and often multiple, human errors; Recognizing that information given voluntarily by persons in- Being convinced that criminal investigations and prosecu- terviewed during the course of safety investigations is valuable tions in the wake of aviation accidents can interfere with the and that such information, if used by criminal investigators or efficient and effective investigation of accidents and prevent

April–June 2011 ISASI Forum • 3 the timely and accurate determination of probable cause and accidents is not an effective deterrent or in the public interest. issuance of recommendations to prevent recurrence; Professionals in the aviation industry face abundant incentives for the safe operation of flight. The aviation industry every day BE IT THEREFORE RESOLVED puts its safety reputation and human lives on the line, and has that the signatory organizations a remarkable safety record that is due in large measure to the current willingness of operators and manufacturers to cooper- Declare that the paramount consideration in an aviation ate fully and frankly with the investigating authorities. The accident investigation should be to determine the prob- benefit of gaining accurate information to increase safety stan- 1able cause of and contributing factors in the accident, not dards and reduce recurring accidents greatly outweighs the to punish criminally flight crews, maintenance employees, retributive satisfaction of a criminal prosecution, conviction, airline or manufacturer management executives, regulatory and punishment. Increasing safety in the aviation industry is officials, or air traffic controllers. By identifying the ‘what’ and a greater benefit to society than seeking criminal punishment the ‘why’ of an accident, aviation safety professionals will be for those ‘guilty’ of human error or tragic mistakes. better equipped to address accident prevention for the future. Criminal investigations can and do hinder the critical infor- Urge states to exercise far greater restraint and adopt mation gathering portions of an accident investigation, and stricter guidelines before officials initiate criminal inves- subsequently interfere with successful prevention of future 3tigations or bring criminal prosecutions in the wake of aviation industry accidents. aviation disasters. Without any indicia of proper justification for a criminal investigation or charges, the aviation system Declare that, absent acts of sabotage and willful or par- and air disaster victims and their loved ones are better ticularly egregious reckless misconduct (including misuse served by resort to strong regulatory oversight and rigorous 2of alcohol or substance abuse), criminalization of aviation (continued on page 30) V.P. ’S Corner Making ISASI More Active and Dynamic By Paul Mayes, ISASI Vice-President

The annual ISASI Executive meeting and The recent failure of the fuselage skin on a Boeing 737 in the International Council meeting (ICM) are the U.S. has attracted worldwide attention, and there have been lots Society’s main focus this time of year. These of news media comments and concerns for passengers. There are are the primary meetings where we can review uninformed comments and much speculation coming from some of the previous year’s financial performance, the the news media. When an event such as this occurs, should ISASI membership status, and the success of our safety issue a press release and have a spokesperson provide informed seminars and workshops. And more importantly, we begin planning for the next 3-5 years and set the goals and targets for a financially sound and active Society. One of the things we will be considering at We already have a very active Society with several safety programs. Everyone is aware of ISASI’s annual international the annual International Council meeting is seminar, but there are several other seminars that attract a lot what else we can do to make the Society more of support. Two examples are the annual Australasian Safety active and to enhance our aims of promoting Seminar hosted by the Australian and New Zealand Societies aviation safety worldwide. and the European Safety Seminar organized by the European Society. Each year there are several other safety meetings and comments? This would be one way of bringing the Society to the seminars in North America and Asia—all run and organized by attention of a much wider audience. Likewise, the recent accident volunteers. Similarly, the Reachout program continues to be a of a Boeing 747 freighter due to an inflight fire, which rapidly major safety program for ISASI. We are deeply indebted to our made the aircraft uncontrollable, has serious implications for our members who give their time to plan and run these events. freighter industry. Lithium batteries are again in the spotlight. The working group structure is also a very positive concept Should ISASI have a position on this and produce a statement or for the Society, but again we rely on volunteers to give their time. paper to assist with introducing safety recommendations? Some groups are more active than others. Some have produced One of the things we will be considering at the annual ICM very valuable publications, guidelines, and “standards.” Some have is what else we can do to make the Society more active and to added to the work of ICAO and other international bodies. As a enhance our aims of promoting aviation safety worldwide. If you member of the Executive, I would like to encourage the working have any suggestions or ideas, please contact me by e-mail: can- groups to be as active as possible. What can the Executive do to [email protected]. All ideas and feedback will be welcome assist the groups and make them more active and successful? and considered. ◆

4 • ISASI Forum April–June 2011 Investigative Data Mining: Challenges and Innovative Outcomes The author discusses the data-mining process, results, and issues faced during the AAIB’s investigation of the Boeing 777 fuel-icing accident in January 2008. resulted in the aircraft touching down accident flight. Also, we wanted to under- By Mark Ford, Senior Inspector of approximately 330 meters short of the stand further the reason why the engine Air Accidents (Engineering), Air paved surface of the runway (see Figure rollbacks had occurred on the G-YMMM Accidents Investigation Branch, 1). The investigation undertaken by the accident flight and the later N862DA Department for Transport United Kingdom Air Accidents Investi- incident flight, but not on the other thou- (This article is adapted, with permission, gation Branch determined that the prob- sands of flights. Initial analysis of the from the author’s paper entitled AAIB’s able cause was the formation and sudden accident flight data identified that certain Use of Data Mining in the Investigation of release of ice in the aircraft fuel delivery fuel flow and fuel temperature features the Fuel-Icing Accident: Innovative Out- pipes, which caused a restriction at the were unusual or unique when compared comes and Challenges Faced presented at engine fuel oil heat exchangers (FOHE) to a small number of flights having oper- the ISASI 2010 seminar held in Sapporo, during a critical stage of the flight. ated on the same route and under similar Japan, Sept. 6–9, 2010, which carried the A second incident occurred on Nov. 26, atmospheric conditions. However, it was theme “Investigating ASIA in Mind— 2008. A Boeing 777-200ER registration difficult to place a statistical significance Accurate, Speedy, Independent, and N862DA, also powered by Rolls-Royce en- on these findings alone due to the small Authentic.” The full presentation, includ- gines, was being operated from Shanghai to sample size. Analysis of a much larger ing cited references to support the points Atlanta, when it suffered an uncommanded data set was required, and this was best made, can be found in ISASI Proceedings reduction in engine power during the supported by tools specifically designed 2010 on the ISASI website at www.isasi. cruise. Preliminary conclusions issued by for the purpose of data mining. A team org.—Editor) the NTSB were that the FOHE on the right was formed of statisticians from QinetiQ, engine had become restricted with ice. together with specialists from the aircraft n Jan. 17, 2008, a Boeing 777-236ER The intent of our data-mining activity and engine manufacturer, the operator, powered by Rolls-Royce engines, was to identify if any parameters or a com- and the AAIB. Data points from more than Oregistered G-YMMM, while on ap- bination of parameters were unique to the half-a-million flights were analyzed during proach to London (Heathrow) experienced the course of the investigation. a loss of power to both engines, which Data mining Mark Ford joined the Data mining in itself is not a new devel- Air Accidents Investiga- opment, but its application to aircraft tion Branch in 2003 and accident investigation is relatively new. now serves as a senior Humans have been “manually” extracting inspector of air acci- patterns from data for centuries, but the dents, working within increasing volume of data in modern times the Flight Data Record- has called for more automated approaches. ing and Analysis Department. Mark Early methods of identifying patterns in has worked on more than 100 hundred data include Bayes’ theorem (1700s) and investigations to date and holds a regression analysis (1800s). The prolif- private pilot’s license. He formerly was eration and increasing power of computer with British Airways as a development technology has resulted in the increased engineer specializing in data acquisi- collection and storage of data. As data sets tion and recording systems, working have grown in size and complexity, direct within the Flight Data Monitoring/ hands-on data analysis has increasingly Flight Operations Quality Assurance been augmented with indirect, automatic Department. Just prior to joining the data processing. This has been aided by AAIB, he worked as communications other discoveries in computer science, manager for the technical director of Figure 1. G-YMMM at Runway 27L under- such as neural networks, clustering, ge- engineering at the airline. shoot shortly after the accident. netic algorithms (1950s), decision trees

April–June 2011 ISASI Forum • 5 (1960s), and support vector machines the determination of the cause particularly Strategy (1980s). Data mining is the process of challenging. The group’s concept was to sit within the applying these methods to data with the In the weeks immediately following existing investigation group structure, to intention of uncovering hidden patterns. the accident, data from the engine health identify unique or unusual features of the It has been used for many years by busi- monitoring program identified that both accident flight, and to explore the data nesses, scientists, and governments to sift the takeoff fuel temperature (-2°C) and based on requirements from other groups. through volumes of data such as airline cruise fuel temperature (-34°C) were at It was especially important that the data passenger trip records, census data, and the lower end of the distribution when group remain appraised of the fuels sys- data for market research purposes. compared to other flights made by Rolls- tem testing so that analysis models could An unavoidable fact of data mining Royce-powered Boeing 777 aircraft. A be progressively modified. is that when analyzing subsets of data, second-by-second evaluation of QAR the data may not be fully representative (quick access recorder) data from the Tools for the job of the whole domain. In our case, data operator of G-YMMM for about 50 flights Efforts to define standards for data mining were not available for every flight made include the 1999 European Cross Indus- by Boeing 777s, so we were reliant on a try Standard Process for Data Mining smaller detailed subset equaling about 5% (CRISP-DM 1.0) and the 2004 Java Data of the total flights (~4 million). Certain Mining standard (JDM 1.0). These are critical relationships and behaviors may evolving standards; later versions of these only become apparent when analyzing the standards are under development. Inde- whole domain. The investigation team was pendent of these standardization efforts, confident that it could identify unique or freely available open-source software unusual features from the accident flight, systems such as the R Project, Weka, although the difficulty then became dem- KNIME, RapidMiner, and others have onstrating if the features were contribu- become an informal standard for defining tory or causal to the accident. data-mining processes. Notably, all these Where only subsets of data have been systems are able to import and export available, data-mining results have been also indicated that the fuel flows and models in PMML (Predictive Model Mark- augmented with other approaches, such temperatures were unusual in having up Language), which provides a standard as experiments. In our case, the decision, low temperatures and flow rates during way to represent data-mining models so independent of the data mining, was to the cruise, accompanied with a series of that the models can be shared between conduct an exhaustive series of tests on the high fuel flow rates peaking at 12,288 pph different statistical applications. fuel itself and the associated fuel system to immediately before the restriction of fuel Boeing and Rolls-Royce used the understand the principles of ice formation flow had occurred to both engines. MATLAB application produced by Math and its release. These tests are covered in Although useful, the engine health data- Works with the operator using SAS. Qine- more detail in “Heathrow 777: Investiga- base consisted of a series of data snapshots tiQ predominantly used SPSS although tion Challenges and Problems,” page 11, taken at various phases of flight, such as supplemented by in-house-developed by Brian McDermid of the AAIB. takeoff and while in the cruise. The trigger applications. for the snapshots was not predicated on fuel The team temperature being at its minimum. While The data The investigation benefited from having the snapshots provided a good indication The data sets analyzed consisted of an aircraft that remained relatively intact, of cold routes flown by the Boeing 777, it • takeoff fuel temperature snap- all the persons on board survived, there could not be guaranteed that the minimum shots—610,000 flights (11 operators were many witnesses to the accident, and fuel temperature had been captured. The globally based). data were available from several sources. practicable solution was to evaluate QAR • QAR data from 13,500 flights provided However, it was not possible to determine data, which leant themselves to being ma- by the operator of G-YMMM (~1,100 the most likely cause without an extensive nipulated by data-mining tools. parameters). test and research program. Early in the A data group was formed within the exist- • minimum fuel temperature snapshots investigation it became apparent that the ing group system. The group consisted of a from 191,000 flights (mix of northern, reason for the rollbacks of both engines team of statisticians from QinetiQ (contract- tropics, and southern-hemisphere-based was due to a restriction of the fuel flow, but ed to the AAIB), together with specialists operators). the lack of physical evidence, apart from from the aircraft and engine manufacturer, • fuel flow and fuel temp snapshots at var- cavitation marks on the outlet ports of the the operator, and the AAIB. The core team ious phases of flight from 178,000 flights engine high pressure fuel pumps, made of 10 was chaired by the AAIB. (mix of northern, tropics, and southern-

6 • ISASI Forum April–June 2011 During the investigation, the team touched on only some of the available data-mining techniques. It was difficult to automate the detection of unique or unusual features when analyzing a flight in its entirety. For example, when compar- hemisphere-based operators). lead to erroneous results. ing average fuel flows of two flights, both The takeoff fuel temp was one of the While analysis of the initial 600 flights initial data sets analyzed. The team then was ongoing, the operator was preparing analyzed the QAR data before moving to the remaining 12,900 flights. In support obtain data from other operators. of its FDM (Flight Data Monitoring program), the operator dedicated a depart- The analysis process ment to the analysis of flight data. The The process of data mining is well docu- department prepared the QAR data for mented, from the initial stages of cleaning the data-mining systems, extracted the the data to selecting analysis techniques selected 350 parameters, and provided it to final processing. When applied to flight in a format agreed to with the data-mining data, the process is similar to that for other team. Due to the quantity of data (equiva- Fuel delivered at less than -20°C and data types. lent to an excel file containing more than max fuel flow of 10,000 pph. An initial 600 QAR flights were se- 400 million rows and 350 columns of data), lected from the 13,500; this was termed the extraction process took more than a the “training set” and consisted of the week, running continuously. The data were accident flight and a selection of aircraft distributed on portable hard drives. Hav- that had operated the same route, as well ing an operator capable of pre-processing as some different routes. The investigation the data was beneficial. Had that capability had identified that a fuel restriction had occurred, and this enabled the team to not been available, data would need to be select a sub-set of about 350 parameters taken in its entirety (all 1,100 parameters) from the 1,100 available. In addition to with the associated overhead of storage powerplant and fuel system parameters, requirements and processing; or the data a selection from other systems was also may need to be taken in its raw undecoded Fuel delivered at less than -20°C and added; having to return to the main data format and then converted to engineering max fuel flow of 11,000 pph. set to add parameters at a later date is best units by the data-mining team. avoided, if possible, due to the overhead in processing time. Analysis techniques and results The training set was used to develop Data mining provided a number of analysis algorithms and to identify potential prob- options, varying in degrees of complexity. lems with the data, before analysis of the Data-mining experts advised that the larger 13,500 data set. Several issues were team should start with a simplistic ap- identified with the quality of the QAR proach before moving to some of the more data. The most significant was that a small complex techniques. This would enable us number of flights demonstrated sections to learn about the data progressively. of data where parameters changed instan- Fuel delivered at less than -20°C and taneously to a value that exceeded the max fuel flow of 12,000 pph. practicable limits of the parameter. It was unclear if the erroneous data were a result may have been similar, but one may have of a defect in the QAR itself or the ACMF uniquely experienced both a very high and (Aircraft Condition Monitoring Function) low fuel flow that would not be evident in system that provided data to the QAR. such a calculation. A number of analysis To ensure that these random parameter methods would need to be combined to de- excursions did not impair the analysis, termine if one or the other flight contained parameter filtering was rigorously tested higher or lower maximum fuel flows. The and applied. Failure to include cleaning highest fuel flow rates normally occur at techniques before mining the data may takeoff, which again would make determi-

April–June 2011 ISASI Forum • 7 nation of peak fuel flows later in the flight at a higher flow rate, similar to that which removed. Removal of this feature left the difficult to detect. To this end, the solution occurred during the approach, shortly accident flight among a group of 66 Rolls- was to cut each flight into sections or flight before the fuel flow had been restricted. Royce-powered aircraft flights. phases so each phase could be analyzed Testing also established that water, when Modification of the features based on separately. introduced into the fuel flow at the boost the accident flight fuel flows and fuel The Boeing 777, as do many other pump inlet at extremely high concentra- temperature at the time the restriction modern aircraft, calculates and records tions, could form sufficient ice to restrict occurred, which for N862DA had also been its phase of flight on the QAR. Typically, fuel flow through the FOHE. During these the same at -22°C, identified that the ac- between 10 to 14 phases may be defined for tests it was concluded that it was not pos- cident flight was unique among the 35,000 modern aircraft, such as pre-start, engine sible to restrict the fuel flow through the Rolls-Royce-powered aircraft flights and start, taxi, initial takeoff roll, takeoff, ini- FOHE when the temperature of the fuel that only two flights from 142,000 Pratt tial climb, climb, top of climb, cruise, etc. in the main tank was above -10°C and the and Whitney powered aircraft flights had The team took a more simplistic approach fuel flow was less than 12,000 pph. Fuel these same features: and cut each flight into takeoff, climb, temperature at the time of the restriction • Fuel flow from the main fuel tanks less cruise, descent, and approach phases. We had been -22°C. than 8,897 pph, and fuel temperature in found that the aircraft-generated phase Following analysis of the initial 13,500 the main tanks remaining below 0°C dur- was not sufficiently accurate though, with flights, the investigation sought to obtain ing the cruise. early analysis containing inaccuracies due additional data from other Boeing 777 • Fuel flow from the main tanks greater to the data having been incorrectly cut. operators, with the aim of establishing the than 12,287 pph, and fuel temperature in Later, the team developed a more robust uniqueness of features believed to have the main tanks at or below -22°C during algorithm to be run by the data-mining been contributory to the formation of ice the approach. tools. and its subsequent release. A total of ap- Fuel temperature in flight—The acci- Once the data had been cut, it was proximately 178,000 flights were obtained, dent flight’s minimum fuel temperature easier to identify features of the accident a mixture of Rolls-Royce (35,000), General of -34°C was identified as being unusual, flight that were unusual or perhaps unique Electric (1,000), and Pratt and Whitney although testing showed that most ice during each flight phase. The data-mining (142,000) powered aircraft. The process accumulates on the inside of fuel feed tools could be used to extract relevant of how the investigation obtained this ad- pipes at temperatures between -5°C and data sets, which could be readily manipu- ditional data is discussed later. -20°C. The rate that ice accumulates will lated using more simplistic spreadsheet Initial analysis of a combination of reduce as the temperature drops further programs. The term “outlier” was also takeoff, cruise, and approach fuel tem- toward the minimum experienced in flight. used during the investigation, where a peratures and flows identified that the Therefore, the minimum fuel temperature parameter or statistical measure was in accident flight was unique among the experienced on the accident flight was not itself not unique but sat within a small Rolls-Royce-powered aircraft flights, with considered a causal factor; however, it did minority of flights having similar features. 32 Pratt and Whitney powered flights hav- contribute to the low fuel temperature of Some of the work based on whole flight ing the same features: -22°C on approach. analysis also provided some interesting • Fuel temperature in the main tanks Engine fuel flow—The accident flight had results, with the accident flight being one below 0°C at takeoff. operated for more than 8 hours in cruise, of only a few other flights having operated • Fuel flow from the main fuel tanks less at an average fuel flow of about 7,000 pph. for prolonged periods with fuel flows below than 10,000 pph, and fuel temperature in During the same period, fuel temperatures 10,000, 11,000, and 12,000 pph with fuel the main tanks remaining below 0°C dur- had remained below -20°C, and, due to temperatures below -20°C. ing the cruise. the use of the vertical speed mode of the Although analysis tended to focus on • Fuel flow from the main tanks greater autopilot (which was normal) for the step fuel flow and fuel temperature features, than 10,000 pph, and fuel temperature in climbs, fuel flows had not exceeded 8,897 each of the 350 parameters was also ana- the main tanks at or below -10°C during pph. Testing showed that at similar tem- lyzed for unusual or unique features. Some the approach. peratures and flow rates, ice can be formed parameters were identified as outliers, but Further laboratory testing confirmed within the fuel feed pipes. Testing also sound engineering knowledge was able to that adding warm fuel to cold fuel, as demonstrated that ice may be released confirm that they were not contributory or would have occurred during the accident from the fuel feed pipes at higher levels of causal to the accident. flight refueling at Beijing, or taking off fuel flow, similar to those attained during Test observations indicated that ice with fuel below 0°C, would have had little the final stages of the approach when the could form at flow rates and temperatures or no bearing on whether ice was later maximum fuel flow reached 12,288 pph. similar to those experienced during the formed on the inside of fuel feed pipes. The Unique features—Analysis of 178,000 accident flight. Ice could then be released criterion of takeoff fuel was subsequently flights identified that the accident flight

8 • ISASI Forum April–June 2011 was unique among 35,000 Rolls‑Royce- engine. This command (referred to as position and expected fuel flow algorithm. powered flights in having a combination Control Loop 17) was recorded on both The characteristics of the restriction to the of the lowest cruise fuel flow, combined the DFDR (digital flight data recorder) FOHE on N862DA were different to that of with the highest fuel flow during approach and QAR. The position of the FMV (fuel G‑YMMM, with a progressive rather than while at the lowest temperature on ap- metering valve), which directly controls almost instantaneous restriction having proach. Just two flights from 142,000 Pratt the fuel flow delivered to the engine, was occurred. The restriction was not detected and Whitney powered aircraft flights had also recorded, albeit only on the QAR. by the algorithm until several minutes after these same features. However, analysis of Prior to the N862DA incident on Nov. the FOHE had started to restrict. This was the N862DA incident and subsequent data 26, 2008, it had been determined that a due to the initial restriction resulting in less mining identified that this flight was not search for previous occurrences of fuel than a 2,000 pph mismatch. unique with respect to its combination of flow restrictions be carried out. If other Although other flights having similar fuel temperature and fuel flows, although events could be identified, information levels of fuel restriction to G‑YMMM and only a relatively small percentage (0.3%) such as similarities in fuel flow and tem- N862DA were not discovered, it could not of flights shared the same features. peratures to that of the accident flight be ruled out that other aircraft experi- Flights having similar features as the could be established. enced a lower level of fuel flow restriction N862DA incident flight—During the A retrospective analysis of the 13,500 that could not be detected. incident flight of N862DA, fuel tempera- flights provided by the operator of G‑YM- tures did not reduce below 0°C until about MM was conducted for cases of the EEC QAR and sourcing data 3 hours into the flight, when the aircraft system having commanded maximum fuel The release of QAR type data is an espe- was in cruise. Fuel temperatures then flow. An algorithm was also developed to cially sensitive one for most operators. progressively reduced to a minimum of identify a mismatch between the FMV During the course of the investigation, -23°C. Unlike the accident flight, N862DA position and expected fuel flow. Other than the team had not only asked for historical had made four step climbs at fuel flows in the accident flight, no occurrences were data relating to the accident aircraft from excess of 11,000 pph prior to the restric- detected. It should be noted, though, that the operator, but also data from across tion occurring. The third and fourth step parameter recording limitations meant its fleet of Boeing 777s. The operator climbs both occurred at fuel temperatures that the FMV position and expected fuel was keen to assist, but initial questions below 0°C. The third occurred shortly flow algorithm was incapable of detect- posed by the operator were, “Why do you after the fuel temperature had reduced ing mismatches that had resulted in less require this much data?” and “How can it below 0°C, and the fourth just more than than a 2,000 pph discrepancy (the accident be protected?” To this end, the AAIB was 3 hours later when the fuel temperature flight had a mismatch of more than 20,000 able to demonstrate the need to mine the was approaching -15°C. The fuel then pph). Both detection methods were also additional data, and the operator was also continued to reduce to its minimum tem- implemented by the operator of G‑YMMM included within the data-mining team. The perature. as part of its ongoing fleet monitoring protocols for protection of the data took About 3 hours later the aircraft carried program. No further occurrences were some time to put in place but were ensured out a further step climb, with a maximum detected. through a combination of agreements and fuel flow of just more than 11,000 pph. It For the previous 10 years, the aircraft UK laws. The measures put in place by was during this engine acceleration that manufacturer had records of six occur- the AAIB ensured that the data remained engine oil temperature was observed to rences of the EEC system having com- protected. At the end of the investigation, rise due to a loss of FOHE efficiency. manded maximum fuel flow, triggering the the QAR data were returned. The restriction gradually increased over Control Loop 17 message. Explanations Following analysis of the initial 13,500 a number of minutes. Fuel temperature were available for all of the occurrences, flights, the investigation sought to obtain at the time was -22°C. Approximately and they were all for reasons not relevant additional data from other Boeing 777 20,000 Rolls‑Royce-powered flights were to the accident to G‑YMMM. operators to determine the uniqueness analyzed for a combination of a maximum Following the incident to N862DA, retro- of some of the features identified. A total fuel flow of 11,000 pph and greater when spective analysis for previous occurrences of approximately 178,000 flights were in cruise and fuel temperatures of -22°C or of anomalous oil pressure behavior was obtained, composed of a mixture of Rolls- below. Sixty flights were identified. evaluated. Due to complexities of the en- Royce (35,000), General Electric (1,000), gine oil pressure and FOHE relationship, and Pratt and Whitney (142,000) powered The search an automated search of the 13,500 flights aircraft. To negate the need for operators Following the reduction in fuel flow during could not be readily implemented. A small to provide second-by-second QAR data, a the accident flight, the EEC (Electronic subset of flights was manually analyzed, specification was produced that enabled Engine Control) system commanded but no anomalies were found. The incident operators to extract data points using maximum fuel flow to its respective flight was also processed through the FMV their FDM systems. The data points pro-

April–June 2011 ISASI Forum • 9 vided sufficient information so that the through the FOHE is consistent with the —negated IT issues of inter-company initial 13,500 flights could be compared rollback on both engines occurring almost data transfer. directly with the new data. A downside of simultaneously. —time to build working relationships. this method was that some of the FDM The data mining was successful in its —used operator software to quickly view systems could not be readily modified. remit of identifying unusual and unique and analyze data. The AAIB approached all of the Rolls- features. Through laboratory testing, it was • Team selection. The team consisted of a Royce-powered operators and some using demonstrated that fuel temperatures at the mix of data-mining experts, subject-mat- different manufacturers. As the team was beginning of the flight were not causal to ter experts (fuel systems and powerplant), looking at how frequent certain features the accident but that other features were and flight recording specialists. could occur, the significance of different conducive to the formation and subsequent —mix of expertise proved successful, with engine types was not critical during this release of ice. It was not fully understood subject-matter experts being able to steer type of analysis. why other Rolls-Royce-powered Boeing the work of the data mining experts. Where an engineering-based investiga- 777 flights having similar features to the • Duplication of work tion is established, operators, in general, G-YMMM accident flight, and perhaps —The AAIB, Boeing, and Rolls-Royce had support the provision of QAR type data to more so the N862DA incident flight, did access to the QAR data, and each had the accident investigators (at least in the UK). not experience similar fuel restrictions. ability to process the data independently. Where operational issues are being ex- Laboratory testing did offer some explana- —The team had a limited resource and plored, the release of data is perhaps more tion, with the observation of “randomness” so had to work smartly with regard to tightly controlled. As the G-YMMM inves- in the formation of ice, indicative that there unnecessary duplication of work. tigation was engineering based, the issue may also be a variance in the quantity of ice —Did not want to constrain the explora- of analyzing the data for operational issues generated during similar flights. tion of the data. It was important to remain was less of a concern. It may be suggested Similarly, differences between the flexible and allow the exploration of data, that if the need to explore operational is- G-YMMM accident flight and N862DA not constrain it. sues is required, the need for a data-mining incident flight, with one experiencing a —Regular progress meetings meant that program as used during the G-YMMM more rapid onset and the other a more as wide an area of the data could be ex- investigation may be negated by using the progressive restriction, indicate that fac- plored in the shortest time frame. operator’s own FDM/FOQA system with tors other than flow rate and temperature • IT issues oversight from the investigator. Where an may affect the release of ice from within —E-mail was restrictive in transportation operator does not have an FDM system, fuel feed pipes. The properties of ice gen- of flight data due to file size limitations. it would be more likely that an archive of erated within an aircraft, rather than a —IT policies regarding usage of non-com- QAR data would not be available, as one of laboratory environment, may also have pany-approved software applications. the main drivers for retaining QAR data is different characteristics. —WebEx used for dissemination of in- that of a FDM/FOQA program. formation. Lessons learned —Data transfer, portable hard drives, and Conclusions • Collocation of the team. In the weeks encrypted data. The investigation considered the pos- immediately following the accident, the • Program set up—the initial planning sibility that the rollback on each engine AAIB, Boeing, and Rolls-Royce data phase proved to be time consuming. occurred for a different reason. The fuel group staff collocated at the operator’s —Agreement for release of data by op- feed systems on each side of the aircraft engineering facility. This proved to be erator. are almost identical and were exposed to extremely beneficial for the following —Selection of data, parameters, flights, the same fuel, environmental factors, and reasons: etc. motion of the aircraft. Moreover, there —close proximity to the data ensured —Elapsed time to prepare the data. was a high level of repeatability during prompt and easy access. —Data distribution. the tests to restrict the fuel flow through —removed the difficulties of remote work- —Contract of support by third parties. the FOHE and some consistency in the ice ing, UK/U.S. time zones. —Cleaning of the data. accumulation and release tests. Therefore —enabled the exploration of ideas. —Initial processing. the scenario that ice accumulated within —number of areas expediently explored, —Results analysis. the fuel feed system and subsequently with work being shared. —Subsequent algorithms development released and restricted the fuel flow —daily debrief of progress. and evolution. ◆

10 • ISASI Forum April–June 2011 Heathrow 777: Investigation Challenges And Problems The author discusses his team’s challenges in understanding unusual properties in aviation fuel and in conducting tests to determine the vulnerability of an aircraft’s fuel system to the accumulation and release of ice. By Brian McDermid Senior inspector (Engineering), Air Accidents Investigation Branch

(This article is adapted, with permission, from the author’s paper entitled Heath- acted as our independent fuels adviser. In row 777: Challenges in Understanding Unusual Properties in Aviation Fuel and excess of 66 fuel samples were taken from Problems in Conducting Tests to Determine the Vulnerability of an Aircraft’s Fuel a variety of locations on the aircraft and System to the Accumulation and Release of Ice presented at the ISASI 2010 semi- engines. In addition, around three tons nar held in Sapporo, Japan, Sept. 6–9, 2010, which carried the theme “Investigating of fuel were removed from the aircraft ASIA in Mind—Accurate, Speedy, Independent, and Authentic.” The full presenta- fuel tanks and had to be kept in case the tion, including cited references to support the points made, can be found in ISASI fuel was required for further testing. The Proceedings 2010 on the ISASI website at www.isasi.org.—Editor) logistics of finding a sufficient number of

n Jan. 17, 2008, a British Airways that we experienced during the investiga- Brian McDermid is a 777-236ER, powered by Rolls-Royce tion and give you some background on the senior inspector (engi- Oengines, registered G-YMMM, on decisions that were made and the evolution neering) with the UK approach to London’s Heathrow Airport of the Boeing fuel test rig. Air Accidents Investiga- lost power to both engines and touched For my group, the initial priority was tion Branch. Prior to down approximately 330 meters short of testing the fuel. And like many aspects of joining the Branch in the paved surface of the runway. The in- the investigation, the extent of the testing 2004, he spent 27 years vestigation was conducted by the UK’s Air was agreed to by telephone conferences in the Royal Air Force as an engineer- Accidents Investigation Branch (AAIB). involving representatives from the AAIB, ing officer. He has an MSc from Lough- I chaired the Fuel and Aircraft Systems the NTSB, and specialists from Boeing, borough University, is a Chartered Group of that investigation. In this adapted Rolls-Royce, and the fuels division at Engineer, and a member of the Royal article, I will highlight some of the problems QinetiQ, who throughout this investigation Aeronautical Society.

April–June 2011 ISASI Forum • 11 he extensive testing conduct a more detailed inspection and test the inside of the fuel delivery system, of the aircraft fuel delivery system prior to but he also had a great ability to tease and examination of the any part of the fuel system being disturbed. the probe around the many contours and Taircraft fuel system could This would require us to carry out pressure corners in the long pipe runs. not identify a fault that would and vacuum tests during which we would The extensive testing and examination of have caused the engines to have to listen for and trace leaks in a fuel the aircraft fuel system could not identify delivery system containing more than 110 a fault that would have caused the engines roll back. Therefore, many of feet of fuel pipes. to roll back. Therefore, many of the fuel the fuel system components Unfortunately, the hold for Runway 27 system components were removed and in were removed and in most Left was adjacent to the area in which we most cases sent to the original equipment cases sent to the original were working on the aircraft, and it was im- manufacturer for further inspection and possible to detect any leaks over the noise testing under the supervision of one of equipment manufacturer for from the engines of aircraft waiting to line our inspectors. We also assembled the left further inspection and testing up on the runway. The constant exposure side of the engine and aircraft fuel delivery under the supervision of one to the noise was also very tiring; and com- system removed from the accident aircraft of our inspectors. munication, and any type of fault finding, in one of our hangars at Farnborough. This was difficult when this runway was used for reconstruction proved to be invaluable. It suitable containers and the secure han- aircraft taking off. While noise-abatement was the first time that most people involved dling of such a large number of samples procedures are a sensitive issue at Heath- in the investigation had actually seen a were an early indication that a complex in- row, the investigator-in-charge negotiated large aircraft fuel system laid out. vestigation of a large aircraft brings large with the airport authorities for a 48-hour The reconstruction was also useful in problems, which, to an extent, dictate the period during which Runway 27 Left would identifying potential scenarios and sub- pace of the investigation. only be used for landings. However, it still sequently helped us define the boundaries Extensive testing could identify noth- took more than 24 hours for the operational and factors that we wished to be included ing unusual about the fuel samples taken changes to be instigated. in the Boeing fuel test rig. We also con- from the aircraft; and as aviation turbine The large aircraft syndrome came into structed a fluid dynamic model of the fuel fuel contains thousands of different hy- play again during inspecting and testing the feed system, and again the reconstruction drocarbons, we could not establish if there aircraft fuel system. The fuel delivery pipes proved to be very useful as pipe dimen- was a specific combination that made this still contained fuel that could not be drained sions and gradients could be taken directly batch of fuel more susceptible to icing. We out. This meant that it was not possible to from the reconstruction. compared the main hydrocarbon groups use the videoscopes that are normally used While the work on the aircraft was with the industry standards, and the fuel in the aviation industry, as they are not safe still ongoing, representatives from all the was found to be within the normal range. to use in an explosive environment. We tried parties in the investigation met in Seattle QinetiQ undertook a comparison of the to blow the fuel out of the pipelines with to develop possible scenarios and provide fuel on the accident flight with more than nitrogen, but this was unsuccessful, and technical support for the fieldwork. As 1,200 batches of fuel sampled during 2007. consequently there was a further delay as various causes were eliminated, the pos- In terms of the distillation range, the fuel we tried to find an explosive proof video- sibility that ice in the fuel might have from Mike Mike was more or less in the scope with a probe at least 30 feet long. A caused the accident gradually took greater middle of the distribution. suitable videoscope was eventually hired precedence, and Boeing identified two of So that the runway could be returned to from a company in Hamburg. its test facilities where it could carryout full operational use, the aircraft was moved Later in the investigation, we discovered some fuel system icing tests. from the accident site to a maintenance that the water industry uses explosive- area adjacent to the threshold of Runway proof videoscopes to inspect sewers and one Small-scale tests 27 Left. The proposed site seemed to be was used during an inspection of another Small-scale fuel testing was done in a cli- ideal. Close by there was a good size office, Boeing triple seven aircraft to determine matic chamber at the Boeing Kent facility toilets, and storage facilities. Engineering where ice and water might accumulate in to allow us to understand how ice forms support from British Airways was also the fuel tanks. Nevertheless, the issue of in cold fuel. At the same time, Boeing as- readily at hand, and there was excellent cameras plagued us throughout this inves- sembled a large-scale fuel test rig at its IT and administrative support from our tigation, and none of the parties in the in- north Boeing field facility. While it was own staff. So what could possibly be wrong vestigation could identify a suitable camera not intended to replicate the fuel system with such an ideal site? From the initial that we were happy to use in the explosive on the aircraft, the rig did use 2-inch di- examination of the aircraft, analysis of the environment of a wet fuel system. Instead, ameter fuel pipes and components fitted data on the flight recorders, and testing we relied on still photographs taken from to the Boeing triple seven aircraft and the of the fuel samples, it quickly became ap- the videoscope. Trent 800 engine. Over time a number of parent that the engine control system had On the positive side, we were very changes were made to the rig such that it functioned correctly and there was nothing thankful for an early decision to accept the became more complex, and components apparently wrong with the fuel remaining offer from Boeing for one of its videoscope such as the engine-driven low pressure on the aircraft. With no obvious cause for operators to be flown over from Seattle. fuel pump was fitted and hot oil was fed the double engine roll back, we decided to He was not only familiar with inspecting to the fuel oil heat exchanger.

12 • ISASI Forum April–June 2011 Royce, GE, and Pratt I told you that this was taken from a snow and Whitney. boarding website on the Internet, and no one in the aviation, or fuel industry, could Fuel icing provide us with anything like this for ice D o c u m e n t a t i o n that forms in aviation fuel? searches showed The more we delved into the early that fuel icing was research papers on fuel system icing, the a known problem on more we began to understand how com- civil aircraft in the plex it is. The size, and perhaps the type, 1940s and 1950s and of the ice crystals is dependent on the size that some research of the water droplets, the rate of cooling, had been carried out amount of agitation, and the number and to address problems type of nuclei. Large water droplets settle such as blocked inlet quickly; larger ice crystals cannot negoti- screens and fuel fil- ate corners as easily as smaller crystals. ters. While these ear- As an industry, we appear to know rela- ly papers frequently tively little about ice in fuel. This lack of Figure 1: The crystal structure of water ice recommended that knowledge was a concern to us during the at different temperatures. further research was investigation as we could not be totally required to under- sure that the type of ice that we generated The tests carried out on the rig consis- stand the root cause of fuel icing, the on the fuel test rig was representative of tently proved that it was possible to restrict recommendations did not appear to have the ice that is generated in flight. the fuel flow through a hot fuel oil heat ex- been taken forward. Instead, measures The data-mining group activity identi- changer with a relatively small quantity of such as fuel heaters and filter bypasses fied the low temperatures experienced water, providing the water was introduced were introduced, which addressed the on the accident flight as being a possible at a high enough concentration. symptom rather than the root cause. significant factor, and there were sugges- However, we had less success in gener- During the 1950s, the United States Air tions from certain quarters outside the ating ice in other parts of the fuel system; Force suspected that a number of accidents Air Accident Investigation Branch that and even with identical conditions, we involving B-52 aircraft were caused by ice as an interim measure the Boeing triple experienced poor repeatability and the in the fuel system; but given the perishable seven should not be used on routes where term “the randomness of ice” regularly nature of ice, it could not find any evidence. extreme low temperatures were likely to cropped up in test reports and briefings. That was until 1958 when on a cold day, all be encountered. However, from our docu- Consequently, we began to question if the eight engines on a B-52 lost power during mentation review we knew that it was dif- variations between the aircraft and fuel the approach, and the aircraft crashed in ficult for ice to adhere to components when test rig, and the technical innovations used South Dakota where the ambient tempera- the fuel temperature was extremely low to try and maintain the water concentra- ture was below freezing. Despite the aircraft and that ice was most likely to accumulate tion in cold fuel, might mask other subtle catching fire, ice was found throughout the when the fuel temperature was between causal factors with the risk that we might fuel system and in the engine fuel filters. -8 and -20 degrees Celsius. inadvertently engineer a restriction that Because of this finding, the United States Figure 2 summarizes some of the facts could not occur in flight. Air Force initiated an extensive research we know about water ice in aviation fuel, It is worth stating that there was tre- program that resulted in the development though I should caveat this information by mendous support from within the avia- and introduction of a fuel system icing inhibi- warning you that these temperature bands tion industry. While Boeing was running tor. However, it is extremely difficult to es- are not well defined and that several papers the tests on its fuel rig, we explored the tablish what research military organizations appear to contradict each other. While we problems of ice forming in aircraft fuel have carried out. It is even more difficult to had some knowledge of the sticky range of systems with other aircraft manufacturers, obtain copies of their test reports. This is ice, we could not say with any great confi- universities, and research organizations. a particular problem with foreign military dence that the very low fuel temperature Information was also freely exchanged organizations. But we also had difficulty in experienced on the accident flight was a between Airbus and Boeing, which both obtaining test reports for the spar valve fit- coincidence, rather than a causal factor, use the Trent engine on their aircraft. As ted to the Boeing triple seven as the testing until we analyzed the data from the roll investigators, we go to great lengths to pro- had been carried out to meet a military re- back that occurred on one of the engines on tect proprietary information, and therefore quirement. Despite this difficulty, some test a Delta aircraft in November 2008. it was a new experience to be in the same reports and supporting documentation were room with two of the major aircraft manu- eventually released to the investigation. Flight testing facturers as they described how their fuel Figure 1 shows the crystal structure of With our increasing concern that the Boe- systems were designed and discussed how water ice at different temperatures, and I ing fuel test rig might mask some subtle the system may or may not be susceptible think most of you can look at some of these factor, a number of options were explored to to icing. We were also present at a similar structures and hazard a guess at the prop- try to more accurately replicate the aircraft meeting that Boeing arranged with Rolls- erties of the ice. Would you be surprised if installation and the environment during

April–June 2011 ISASI Forum • 13 the facility is heavily t is important that the used and there was only a 3-week win- regulative authorities dow available, which Iinstigate a number of would have given us coherent research programs around 10 days of into fuel system icing in testing. The facility would have allowed order to underpin the future us to expose the air- design and certification craft to the total air requirements for temperature expe- commercial aircraft. rienced during the accident flight for an Boeing had a suitable fuel tank available unlimited period. We in which we could mount the fuel delivery could have used the pipes removed from the right main fuel aircraft boost pumps tank of Mike Mike. These fuel pipes were Figure 2: A summary of some of the facts we know about to pump fuel from fed from a supply tank that had been water ice in aviation fuel. the main tanks to cooled and conditioned with water to rep- the engine where the resent the condition of the fuel during the the accident flight. These options included fuel would be tapped off to a collector tank. accident flight. flight testing, full scale testing of an aircraft Alternatively, we could have run one of the The results from the environmental in a climatic chamber, and testing the fuel engines at cruise power for one hour at the testing were very consistent, and the final system in an environmental test rig. fuel flow experienced during the accident test proved the theory that ice can build up Flight testing initially appeared to be flight. Unfortunately, like the flight testing in the pipes and then release in a sufficient the most obvious choice and was some- option, we would still have the problems quantity to restrict the fuel flow through thing that Boeing and Rolls-Royce were of aircraft availability, matching all the the fuel oil heat exchanger. prepared to support. The main advantage environmental factors, and the detection This has been a very quick overview of is that you test the actual aircraft systems of the formation of ice. the fuel systems aspect of the Mike Mike in its normal operating environment. How- investigation. However, I hope that you do ever, a number of disadvantages swayed Single pass testing not fall into the trap of believing that it was us from going down this path: Testing the fuel system in an environmen- a fault in either the fuel oil heat exchanger • We needed a suitable aircraft that tal fuel rig appeared to be the only viable or the aircraft fuel system that was the might need to be modified with sensors option remaining, and we discussed our cause of the accident to the British Airways and recorders. desired requirement for a single pass Boeing triple seven. Modification of the • We would have been unable to control test of sections of the aircraft fuel system FOHE will make the system more tolerant the external environment. with a number of agencies. Single pass of ice, but it will not prevent ice accretion • We weren’t sure what we were look- testing is where fresh conditioned fuel is and release within the fuel feed system. ing for. pumped from a supply tank through the The problem of fuel system icing was • Since a fuel flow restriction caused by a test section and into a collector tank. For identified in the 1940s and 1950s and rec- blockage of ice was such a rare event, there a large aircraft system, this requires a ommendations were made on a number was a real possibility that it might not oc- considerable quantity of fresh fuel that of occasions that further research was cur during any of the test flights. needs to be stored and cooled down to the required to fully understand the extent of There was also the difficulty in establish- required temperature. the problem. However, research to estab- ing when ice was forming as the roll back By recirculating the fuel, it is possible to lish the root cause of fuel system icing does experienced on the accident flight would use a smaller quantity of fuel and therefore not appear to have been carried out, and require around 97% of the cross-sectional smaller storage tanks. However, a disad- instead a number of measures such as the area of the pipe to be blocked by ice. A vantage of a recirculating test rig is that it introduction of fuel heaters and bypasses lesser amount of ice would have little effect effectively dries the fuel out, and we were were introduced to fix specific problems. on the fuel pressure and temperature, so concerned that introducing additional wa- But as we have seen, these measures pressure and temperature instrumentation ter to maintain the required concentration only store up problems for the future, would have been of little help. We also could might give us unrepresentative results. and we do not know what combination of not use cameras to detect the accumulation Unfortunately, few facilities could carry out aircraft, engine, and environmental factors of ice as cold fuel containing suspended single pass testing on the scale required. will result in the next fuel icing accident. It water, and ice, is very cloudy. In the end we had to accept the limita- is for this reason that the we believe it is The McKinley climatic chamber at tions of a recirculating test rig in order to important that the regulative authorities Eglin Air Force Base in Florida was achieve the desired long endurance runs, instigate a number of coherent research identified as a suitable facility in which to which were necessary to establish if ice programs into fuel system icing in order to conduct full scale testing of a Boeing triple would accumulate along the inside of the underpin the future design and certification seven aircraft. The downside was that fuel delivery pipes. We were fortunate that requirements for commercial aircraft. ◆

14 • ISASI Forum April–June 2011 A New Terrain Profile Analysis

TBy using theechnique radio altimeter and the pressure altitude parameters recorded in the FDR, it’s possible to determine the terrain’s topographic profile, which when compared to the terrain’s actual profile obtained from the SRTM (Shuttle Radar Topography Mission) data allows for refinement or validation of a rough trajectory obtained from less-accurate means.

By Frederico Moreira Machado and Umberto Irgang, Embraer Air Safety Department

(This article is adapted, with permission, However, thousands of older genera- aircraft fitted with solid-state recorders from the authors’ paper entitled Terrain tion aircraft are still in operational today. are subject to the shortage of important Profile Analysis using Radio Altimeter These aircraft represent a challenge to parameters due to external factors. An Data from FDR presented at the ISASI flight data analysts as a restrictive set of example of this is the lack of ILS devia- 2010 seminar held in Sapporo, Japan, parameters is recorded in the FDR, mak- tion parameters on approach and landing Sept. 6–9, 2010, which carried the theme ing it more difficult to draw conclusions accidents that occur on airports that are “Investigating ASIA in Mind—Accurate, from the limited information available. not equipped with an ILS system. Speedy, Independent, and Authentic.” The Furthermore, even new generation The basis of this article is the involve- full presentation, including cited references to support the points made, can be found in ISASI Proceedings 2010 on the ISASI website at www.isasi.org.—Editor)

rom 1999 through 2008, according to Boeing’s statistical summary of commercial jets, 56 percent of fatal accidents occurred during Feither takeoff, initial climb, final approach, or landing phases. This statistic indicates that every organization in the industry somehow involved with accident investigation must be prepared to investigate that class of accident. Fortu- nately and of late, more parameters are being recorded in flight data recorders (FDRs). This allows for a more detailed analysis, thus improving the investigator’s work of determining the contribut- Figure 1. Determination of the terrain profile by subtracting the value of the ing factors of the occurrences. radio altitude parameter from the pressure altitude parameter.

April–June 2011 ISASI Forum • 15 ment of an Embraer-manufactured air- altimeter measures height above terrain craft in a runway excursion accident at by means of electromagnetic waves that an airport that lacked this system and for are transmitted toward the ground. This which Embraer provided support to the device transmits a radio signal toward the investigation authority. The lack of geo- ground and measures the time delay to graphic coordinates and ILS parameters the reflected return signal. Commercial in the FDR motivated Embraer to develop aircraft equipped with both systems are a technique that relies on altitude param- Figure 2. Schematic representation of a 1 required to record both pressure and radio eters to draw the terrain contour of the arc-sec resolution SRTM tile. altitude parameters in the FDR. region over which the aircraft has flown. Usually, the pressure altitude parameter By comparing the terrain profile obtained able to determine the aircraft position with is greater than the radio altitude parameter, from the FDR parameters with the actual respect to the ground with the parameters except when the airplane is operating on an terrain contour obtained by topographic available. As in any other flight data aerodrome located below mean sea level. data, it was possible to “link” the aircraft analysis technique, this technique must Therefore, the simple subtraction of the trajectory with the ground, i.e., deter- be applied when accident circumstances radio altitude from the pressure altitude mine the touchdown point on the runway. are suitable for it. And the results should yields the terrain profile. The principle is il- Several other studies have addressed the be cross-checked with every other source lustrated in Figure 1. The pressure altitude subject of trajectory reconstruction; but of information available so that wrong measures the aircraft altitude with respect in this case, the parties involved were not conclusions aren’t reached. to a predetermined reference (usually the To explain this new technique, we need sea level) whereas the radio altimeter mea- Frederico Moreira to begin with a description of the determi- sures the aircraft altitude with respect to Machado graduated nation of the terrain profile from the FDR the terrain beneath; the subtraction results with a degree in comput- parameters and then discuss the deter- in the terrain profile er engineering and has a mination of the actual topographic profile For the scope of this technique, the master’s degree in aero- from the SRTM data. Next, the process of numeric value of the terrain elevation is nautical engineering. He comparison of both terrain profiles needs not critical, but its shape is so that it can joined the Embraer Air to be described. Finally, the case study be compared to the actual topographic Safety Department in 2008 and since that motivated the development of the outline later. It is important to note that then has worked with the Flight Data technique is briefly presented, followed by the radio altitude parameter is required to Analysis and Statistics Group, which is a discussion of the use of the technique for be recorded up to the elevation of 2,500 ft responsible for providing support to ac- validation of trajectories obtained by FMS above ground (FAA, 2010). Therefore, the cident investigations in the field of flight (flight management system) coordinates. altitude profile cannot be determined when data recorders. the airplane is flying above that. Terrain profile—altitude parameters Umberto Irgang holds a This section describes the determination of Shuttle Radar Topography Mission Bsc in mechanical engi- the terrain profile from altitude parameters The Shuttle Radar Topography Mission neering, and an Msc level recorded in the FDR, hereafter referred to (SRTM) that flew in February 2000 was in aviation propulsion. as altitude profile. According to airplane an initiative to obtain a high-resolution He is the air safety senior flight recorder specifications, there are two digital elevation model of the earth. manager at the Embraer distinct sources for altitude information on The project was a joint endeavor of the headquarters in Sao Jose a commercial aircraft recorder: static pres- National Aeronautics and Space Admin- dos Campos, Brazil. He is responsible for sure altitude and radio altimeter. Pressure istration (NASA), the National Geospatial- the corporate activities of the Air Safety altitude is the height of the aircraft above Intelligence Agency, and the German and Department and the air safety offices in sea level derived from the measurement of Italian space agencies. It used dual radar the North American, Europe/Africa, Asia the static pressure, assuming a standard at- antennas to acquire interferometric radar Pacific, and China regions, with his main mosphere. The value of the static pressure data, processed to digital topographic data activities encompassing data analysis, is associated with a pressure altitude value at 1 arc-sec resolution. occurrences investigation, safety preven- by means of the international standard The space shuttle Endeavour was tion, and product safety monitoring. atmosphere (ISA) model. In turn, the radio equipped with the radar system and flew

16 • ISASI Forum April–June 2011 Figure 3. Sequence of geographical coordinates (gray dots) defining the prolonged centerline calculated from a point on the runway. This sequence can then be used to calculate the SRTM terrain profile.

Figure 4. Comparison of two different terrain profiles. Top, profile from 3 arc-sec resolution SRTM data. Bottom, profile from 1 arc-sec resolution data. On both plots, the runway is located in the leftmost section of the graph.

to the prolonged runway centerline. To calculate these coordinates, it is possible to use the so-called great circle distance equations starting from an arbitrary point located on the runway centerline. Figure 3 depicts a sequence of coordinates showing the prolonged centerline. The distance between the points depends on the resolution of the SRTM data being used. For the cases in which the aircraft is not aligned with a runway, it’s possible to find a reference on the ground that might be related to the aircraft trajectory, such for 11 days around the planet. Although Terrain profile—SRTM as a VOR/DME station that the aircraft the data were originally collected with 1 To determine the terrain profile from the was using as a navigation aid. In theses arc-sec resolution, the results were made SRTM data, it’s necessary to know the cases, determining the coordinates might public with either 1 or 3 arc-sec resolu- final approach trajectory in terms of geo- be more difficult because more complex tion. Only the United States has access to graphical coordinates (i.e., only latitude calculations are required. the higher 1 arc-sec resolution. The rest and longitude parameters). These coor- Once the coordinates have been deter- of the planet is presented with 3 arc-sec dinates can be considered the projection mined, it’s necessary to determine the data. In practical terms, 1 arc-sec data of the actual aircraft trajectory onto the elevation of each of the coordinates by correspond to a distance of approximately ground. In other words, this projection is a looking into the SRTM file. The tile that 30 m between adjacent samples, whereas rough trajectory that will be used to obtain contains the phase of flight must be used. 3 arc-sec data correspond to a distance of a valid trajectory. The projected trajectory As previously mentioned, the SRTM file approximately 90 m. is necessary so that it’s possible to look is a grid composed of elevation samples Elevation data are presented on thou- inside the SRTM file and then determine separated by 1 or 3 arc-sec of degree. sands of tiles, with each tile covering a the terrain elevation of each of its coordi- Since the trajectory coordinates do not square area of 1 latitude degree in width nates. The resulting elevation data make necessarily coincide with the points in and 1 longitude degree in height. Each up the SRTM terrain profile. the SRTM grid, it’s necessary to either tile is formatted as a two-dimensional However, the technique would not be interpolate the elevation samples or find array whose elements are 16-bit signed necessary if these aforementioned co- the nearest match in the SRTM grid. For integers. Figure 2 shows a schematic view ordinates were known in the first place. the purposes of this technique, the nearest of a portion of an SRTM tile of 1 arc-sec Fortunately, for the cases in which few match approach proved to be adequate. resolution. parameters are available, it’s relatively Figure 4 shows the SRTM terrain pro- SRTM data also contain occasional easy to determine a sequence of latitude/ files of two distinct airports. The top one is voids due to several different causes, such longitude pairs that correspond to the the terrain profile obtained by extending as shadowing, phase anomalies, or other flight phase whose profile one wants to the Runway 17/35 centerline toward the radar-specific reasons. Elevation voids are determine. For flight phases in which the south at Mariscal Sucre International flagged with the value -32768. Naturally, aircraft is aligned with a runway (either Airport (SEQU), Quito, Ecuador (3 arc- the presence of data voids is a factor that in final approach or initial climb), it’s sec resolution). The bottom one is the might impair the use of the terrain profile necessary to determine a sequence of terrain profile obtained by the extension technique. geographical coordinates that corresponds of the Runway 05/23 centerline toward

April–June 2011 ISASI Forum • 17 Figure 5. Process of determining the horizontal distance. GSPD is the ground speed parameter. Figure 6. Comparison of altitude and SRTM profiles of the occurrence flight. the northeast at Yeager Airport (KCRW), Both depict similar features that are displaced from each other. Charleston, W.Va. (1 arc-sec resolution). Notice that the 3 arc-sec resolution pro- circle equations. To obtain the distances the distance between samples matters, not file depicts sharp edges where the relief between the elevation samples of the al- the relative bearing between them. The im- is irregular. This effect is a consequence titude profile, the analyst must consider portance of the horizontal distance lies on from the lower 3 arc-sec resolution and is the aircraft ground speed registered in the fact that it defines if the altitude profile a factor that hampers analyses in regions the FDR, which then makes it possible to seems distorted (“stretched” or “shrunk”) outside the United States. Furthermore, determine the horizontal distance between when compared with the SRTM profile. in the 3 arc-sec profile, it’s possible to see the elevation samples obtained from the It’s possible, however, that the ground the aforementioned data voids between 0 altitude parameters. One point is chosen speed parameter is not available in the and 4 km from the runway. The occurrence as the distance reference and from that FDR. In that case, it’s necessary to use the of voids, however, is not restricted to lower point, the next points are calculated, one recorded airspeed, making the appropri- resolution data only. after the other. By integrating the ground- ate wind corrections. In addition to low resolution data and speed parameter in time, it’s possible to Once the horizontal distance between the presence of data voids, other circum- obtain the traveled distance between two the altitude samples is determined, the stances may cause SRTM profiles not to elevation samples. Figure 5 shows the pro- profiles are plotted and that plot will re- provide useful information to be compared cess of calculating the horizontal distance veal that both of them show similar relief with the altitude profile. SRTM data do not between the elevation samples so that the features, such as hills and valleys. As render the best results when applied in altitude terrain profile can be plotted as a the SRTM profile was assumed to begin regions with characteristics of flat terrain function of that distance. in an arbitrary point (see section “Ter- or flights above the sea. Additionally, as the An important aspect to consider is the rain profile—SRTM”), it’s likely that the SRTM data were originally collected in the timing between samples of the involved profiles will be displaced from each other. year 2000, many relief aspects may have parameters, as the integration process That displacement will define the horizontal changed since then as many of its charac- depends on the association between the distance from the arbitrary point and the teristics are subject to human activities or ground speed and the altitude parameters. actual point. For example, during a land- environmental processes (e.g., construct- For example, if the sample rates of these ing, the altitude profile might begin at the ing new buildings, earthquakes, etc.). parameters do not match, it’s necessary point the aircraft touches the ground, and to carefully select which samples will be the SRTM profile begins at the touchdown Comparison of terrain profiles used in the integration process. Otherwise, aiming point, located approximately 1,000 Once both SRTM and radio altimeter the analysis might not be as accurate. ft from the runway threshold. In this case, profiles have been determined, it’s neces- It’s important to note that the horizontal the displacement between both profiles sary to plot them both as a function of the distance is not necessarily a distance corresponds to the distance between the horizontal distance from a given reference. measured along a straight line. Even if the arbitrary point in the SRTM profile and the Plotting the SRTM profile as a function of trajectory is curvilinear, the method is still actual touchdown point on the runway. distance is quite simple, as the geographi- applicable because the elevation profile is cal coordinates of the elevation samples a sequence of terrain elevation samples Case study—runway excursion are known, and consequently the distance measured along a sequence of points that This case study describes how the terrain between them can by obtained by great are not necessarily aligned. Therefore, only profile technique was applied in the inves-

18 • ISASI Forum April–June 2011 error in the direction of motion. Figure 7 shows the comparison of both profiles using this technique during the landing of an E-Jet at Sao Jose dos Campos Airport, Brazil. The profiles match, and thus the trajectory error is smaller than the SRTM data resolution of 3 arc-sec, approximately 90 m.

Summary We have presented a technique based on the comparison of terrain profiles obtained from two different sources. The technique proved to be useful in the investigation of a runway excursion in which the FDR data alone could not be used to determine Figure 7. Comparison between SRTM and ALT terrain profiles. Notice that both depict the touchdown point. The merit of the the same relief features without displacement. The runway is located in the leftmost technique, therefore, lies in its capacity section of the plot. to correlate the aircraft trajectory with the ground when the available data do tigation of a runway excursion involving terrain features occur “before” in the not allow it based on other analyses. an Embraer aircraft. The approach took SRTM profile. That is, for a given terrain Furthermore, we discussed how the tech- place during adverse weather conditions. feature, its horizontal distance from the nique can be used to perform a validation The occurrence aircraft did not record origin is smaller for the SRTM profile. of trajectories obtained from other FDR latitude and longitude parameters. This indicates that the arbitrary point in parameters. Furthermore, although the airport did which the SRTM profile begins is located Yet the tool also has its restrictions. have ILS antennae, the corresponding forward (in the direction of the runway As mentioned, the SRTM profile does frequency on the navigation radio was not threshold) the point at which it should not provide adequate information when set by the flight crew. Therefore, the ILS actually be. By comparing the profiles, it applied to flat terrain or water. Moreover, deviation parameters were not available was determined that they were displaced the altitude profile cannot be determined for analysis as well. Moreover, although by 1,036 m. That discovery showed that when the aircraft reaches 2,500 ft above the aircraft did record the groundspeed the aircraft actually touched down ap- ground level. All these restrictions must parameter, it was not possible to use this proximately 4,400 ft from the runway be considered carefully prior to drawing parameter to determine the touchdown threshold of a 9,700-ft runway and the any conclusions from the application of point because the FDR recording ceased discovery ultimately helped investigators this technique. while the airplane was in motion. to better understand the occurrence and Nevertheless, as investigators are more The occurrence took place at an airport the involved factors. and more often required to timely respond with hilly terrain near the runway, and this to occurrences with accurate conclusions, motivated developing the technique. Both Trajectory validation it’s always desirable to have an additional altitude and SRTM terrain profiles were So far we’ve discussed how the terrain means to extract useful information from determined following the steps described profile analysis can be used for trajectory flight data, further enhancing their ability in the previous sections. The chosen arbi- determination. However, even for cases in to adequately investigate incidents or ac- trary point where the SRTM profile begins which more parameters are available and cidents. If applied correctly, this tool is a was the touchdown aiming point, whereas the trajectory is known, the technique can step in that direction. ◆ the point in which the altitude profile be a useful tool for cross-checking data. begins is the instant at which the aircraft For example, cases in which FMS latitude Acknowledgments air/ground logic indicated the aircraft had and longitude are available in the FDR, the We thank the Embraer Air Safety Depart- landed. Figure 6 shows both profiles. altitude and SRTM profiles can be plotted ment staff and the Brazilian Aeronautical The profiles are very similar in shape together to ensure that these geographic Institute of Technology for their constant but are displaced from each other. The coordinates do not present displacement support.

April–June 2011 ISASI Forum • 19 Useful Human Factors Investigative Techniques Investigation of a 2007 commercial Beech King Air medical evacuation flight accident required use of several methods for investigating human factors to properly collect and analyze relevant information. By David Ross, Regional Senior Investigator, Operations, Transportation Safety Board of Canada

(This article is adapted, with permission, The investigation team quickly became like the one involved in this occurrence. from the author’s paper entitled Useful aware of multiple instances of flight crew We needed to know the extent to which Human Factors Investigative Techniques: practices that varied substantially from pilots used aircraft performance data. The A Case Study of a Fatal King Air Accident the procedures and policies of the air oper- survey summary showed that most of the in Canada presented at the ISASI 2010 ator company. We decided investigative pilots interviewed did not make landing seminar held in Sapporo, Japan, Sept. 6–9, assistance was necessary, and an investi- performance calculations required by 2010, which carried the theme “Investigat- gator from the TSB Human Performance policy, while some others rarely did so (see ing ASIA in Mind—Accurate, Speedy, Division was assigned. With this addition Table 1). This information led directly to a Independent, and Authentic.” The full to the investigative team, we continued to finding regarding causes and contributing presentation, including cited references review the CVR and conduct interviews. factors: the crewmembers did not assess to support the points made, can be found First, we verified and documented the the aircraft performance and did not iden- in ISASI Proceedings 2010 on the ISASI variation of crew practices on the occur- tify runway length as a threat. website at www.isasi.org.—‑Editor) rence flight from policies and procedures. Second, the Sandy Bay aerodrome did At the end of this process, we were con- not have any instrument or visual vertical n the evening of Jan. 7, 2007, a cerned that the variations in practices guidance system for pilots and also did commercial Beech King Air medi- could extend beyond the occurrence crew. not have any communications facilities. cal evacuation flight inbound to Consequently, we expanded the scope of Consequently, company policies and pro- Sandy Bay, Saskatchewan, aban- the investigation to examine organiza- cedures prohibited straight-in approaches Odoned its landing attempt, but the aircraft tional factors in more detail. and required pilots to visually inspect the did not climb sufficiently and collided with runway before landing. We needed to trees beyond the end of the runway. While Interview survey know whether pilots were aware of and all four occupants evacuated the aircraft, One month after the accident, we inter- complied with these policies. The survey the captain died of injuries before rescu- viewed seven pilots who operated the summary showed that half the pilots ers arrived. Two passengers (medical company’s two King Air aircraft. We interviewed were not aware of this pro- technicians) were seriously injured, and also interviewed the pilots’ supervising hibition, and the remainder reported flying the first officer had minor injuries. The managers. straight-in approaches when prohibited aircraft was destroyed by fire. Using the record of variant crew (see Table 2). This adapted article focuses on investi- practices from the occurrence flight, we This interview survey proved to be gative methods. Some information about developed an informal survey of 13 ques- a very effective data collection method. the occurrence is used to illustrate these tions to examine pilot knowledge of and Formatting the data in a summary docu- methods. For full details of the occurrence, compliance with the company’s proced- mented the extent of pilot non-compliance, see TSB Investigation A07C0001-Collision ures and policies. This was consistent with which supported our finding that substan- with Terrain-Transwest Air Beech A100 TSB investigative guidance to examine the tial and widespread deviations from stan- King Air C-GFFN Sandy Bay, Saskatch- 4 P’s of philosophy, policies, procedures, dard operating procedures had developed ewan, available on the Transportation and practices. and persisted within the company’s King Safety Board (TSB) of Canada website. The survey was conducted by asking Air operation. Examination of the wreckage revealed questions at appropriate times during During interviews with flight operations no indication of pre-impact anomalies. interviews. Interview subjects were not A cockpit voice recorder (CVR) was re- aware of the survey, and the sequence and David Ross has been an covered from the wreckage and proved timing of questions varied between inter- operations investigator to be an important information source. views. The interviews were conducted with the Transportation Subsequent review of the CVR, aircraft by operations and human performance Safety Board of Canada records, and initial interviews revealed the investigators and were recorded and since 1999. He was previ- aircraft had operated normally throughout transcribed. From the transcripts, we ously a transport pilot the flight. Consequently, the investigation developed a survey summary. The follow- with the Canadian mili- focused on human and environmental ing are two examples of the responses to tary. He has experience as a training factors. This article addresses only hu- survey questions. and check pilot, and also as a flight op- man factors; see the investigation report First, the company frequently had erations supervisor and holds a current regarding environmental factors. flights operating on short runways much Canadian air transport pilot license.

20 • ISASI Forum April–June 2011 Useful Human Factors Investigative Techniques Investigation of a 2007 commercial Beech King Air medical evacuation flight accident required use of several methods for investigating human factors to properly collect and analyze relevant information. By David Ross, Regional Senior Investigator, Operations, Transportation Safety Board of Canada

oversight agency. Time lines were de- Position Answer veloped to establish the sequence of events Training Captain Performance charts not used. within both of these organizational levels Training Captain Performance charts not covered in ground school. and to help investigators understand the Captain Performance charts not used. interrelationships between the levels. First Officer Used charts during training, rarely used them since. The organizational time line for the First Officer Used charts during training, rarely used them since. company was useful in that it organized First Officer Not asked. supervisory activities into chronological order, again with linkages to underlying Table 1: Survey Summary—Landing Performance Calculations factors. This enabled a cross-reference to the crewmember time lines, helping investigators to better understand the Position Answer company’s supervisory capabilities and Training Captain Aware of policy. Thinks compliance good with occasional limitations. intentional deviations in visual conditions. The organizational time line for the Training Captain Likes to circle, but has done straight-in approaches. regulator helped document events we had Captain Unaware of policy. Flies straight-in approaches if winds known. identified in chronological order. However, First Officer Unaware of policy. Thinks decision is at captain’s discretion. this time line was of low resolution and First Officer Unaware of policy. dealt with events that had occurred up to First Officer Aware of policy. Thinks compliance is good with occasional 2 years previously. The limited number intentional deviations. of events we identified were specific to investigative areas of interest, and, to Table 2: Survey Summary—Straight-in Approaches investigators, these events took on the appearance of a linear chain of events. In managers, investigators also asked ques- investigative function. ISIM is embedded reality, these events were far from linear. tions regarding supervisory practices in the TSB’s transportation investigation Hundreds of other events we did not know and knowledge of pilot compliance with information management system (TIIMS) about created a complex organizational policies and procedures. This revealed through the use of a number of software context. Within this context were the that supervisors were unaware of the pilot tools for documenting and analyzing time selected events we studied. practices that deviated from policies and lines. Our recommendation is to use such a procedures. In this investigation, high-quality data time line with caution regarding hindsight While the interview survey was very from the CVR enabled investigators to bias and to work to understand the overall useful, one negative consequence was that develop a detailed occurrence sequence organizational context. it substantially increased investigative of events. However, not all events were workload, because many more interviews recorded on the CVR, and many safety Conceptual deconstruction were conducted compared to other TSB issues involved events that should have Portions of the analysis in the investigation investigations of similar occurrences. happened but did not. The occurrence time report discussed three broad concepts: line was used to integrate events identified crew resource management (CRM), situa- Time lines from all sources and to identify times when tional awareness, and safety management A time line is a useful tool to help inves- the non-events should have occurred. The systems (SMSs). We were unsuccessful in tigators understand why people did what occurrence time line was extremely useful our initial attempts to develop convincing they did. According to S. Dekker (2006), in determining the sequence of events, arguments to support our findings in these “If you want to begin to understand human and aided us in understanding the flight areas. This resulted from describing how error,…a good starting point is to build a crew’s behavior in the context of the many the occurrence events indicated problems time line.” underlying factors. with each concept as a whole, with inves- Establishing and documenting a se- In addition to the events during the acci- tigators expecting that our findings were, quence of the occurrence events is part of dent flight, the investigation also examined to a large extent, self-evident. However, the TSB’s integrated safety investigation events at two organizational levels: the as Dekker (2006, 2002) points out, we had methodology (ISIM) and is a normal TSB air operator company and the regulatory made a “leap of faith” by using the cat-

April–June 2011 ISASI Forum • 21 egories as labels, and we had not clearly landing charts for contaminated runway crewmember was the pilot flying the ap- demonstrated that the facts led to our operations, the occurrence crew did not proach to Sandy Bay. conclusions or that the problems identified make any landing performance calcula- A second example of ineffective decision- had contributed to the occurrence. tions. Both pilots had previously flown making is the occurrence crew’s conduct Once the draft report had been re- into Sandy Bay without incident, and of the final approach and go-around (see viewed externally, it was obvious from they likely expected this flight to be little Figure 1). These portions of the flight also reviewer comments that our initial analy- different from previous flights. Addition- serve as an example of ineffective crew sis needed to be revised. The approach ally, the interview survey of other pilots problem solving. The crew was conducting taken was to deconstruct each of these showed they, too, did not normally conduct a non-precision instrument approach with three broad concepts into smaller, more aircraft performance calculations. We the first officer flying the aircraft. Both manageable components. concluded that pilot practice across the crewmembers acquired visual reference company’s King Air operations was to with the runway about 4 miles from the CRM The definition of CRM that we used is the use of all human, hardware, and information resources available to the flight crew to ensure safe and efficient flight operations. In this occurrence, among the information resources available to the crew was extensive operational risk management guidance in the company’s flight operations manual and standard operating procedures. Canada requires that flight crews operating airline category aircraft with 20 or more passenger seats must receive CRM training. However, crews operating smaller aircraft, such as the King Air, are not required to receive such training. The Commercial Air Services Standards of the Canadian aviation regulations lists Figure 1. Sequence of events. eight CRM components for which training must be provided to airline category pilots. base expectations of aircraft performance threshold. Subsequently, the captain Several of these components were used in on past experience. identified that the aircraft was high on the the revised analysis to better describe the The occurrence crewmembers did not approach and began coaching the first of- problems that existed on the occurrence assess the aircraft landing performance or ficer. The first officer made an unassertive flight and within the company’s King Air identify runway length as a threat. Con- suggestion that they conduct a go-around, operation. Let’s look at the CRM com- sequently, they did not discuss and agree but the captain rejected the suggestion ponents of problem solving and decision- on a point at which a safe landing was no and continued coaching the first officer making. longer possible, and they were unprepared into the landing flare. In the flare, the Problem solving is a CRM compon- to make an informed and timely go-around captain decided to initiate a go-around, ent listed in the training requirements. decision as a crew. but his communication of this decision to When this portion of the analysis was Decision-making is a second listed CRM the first officer was non-standard and did revised, we used a number of examples component for which training is required. not have the desired effect of triggering of crew behavior as premises to support We again used examples of occurrence the correct sequence of go-around actions our argument that their problem solving crew behavior to enhance our argument required. was ineffective. that decision-making was ineffective. All of these examples had been included The destination of the occurrence flight One example occurred during the in the factual section of the initial draft was a 2,880-foot gravel runway. Post- after-start check, when the captain desig- report. However, discussing them in the accident calculations showed the landing nated the first officer as the pilot flying revised analysis in the context of specific distance on a bare and level paved surface for the leg and the first officer concurred. CRM components provided a more convin- was 1,600 ft, resulting in a touchdown zone This was contrary to one company policy cing argument to support our conclusions length of 1,280 ft. However, compacted requiring the captain to be pilot flying on that the flight crew exhibited ineffective and loose snow contaminating the runway the first leg of the day, and a second policy CRM and that the ineffective CRM con- would increase the landing distance and requiring captains to conduct landings tributed to the occurrence. reduce the touchdown zone length. on runways shorter than 3,500 ft. The Although company procedures re- investigation could not determine why Situational awareness quired pilots to make pre-flight aircraft this decision was made. A result of this A second broad concept the investigation performance calculations and to consult decision was that the less experienced examined was situational awareness.

22 • ISASI Forum April–June 2011 The company was working toward, but SMS directive to flight crews regarding the had not yet received, regulatory approval A third broad concept we examined was numerous flight operations regulatory to conduct GPS approaches. The com- SMS. violations incurred by the company and pany’s aircraft were equipped with GPS In 2005, the Canadian aviation regula- pilot meetings to be held at each base to certified for instrument approaches, and tions were revised to require specified discuss the violations. flight crew training was being developed. organizations to implement an SMS. The Follow-on action was to be a line check The occurrence crew used the GPS to occurrence air operator company was of the crew to assess compliance with provide distance-to-go to the aerodrome required by the new regulations to have regulations and standard operating identifier waypoint, and this practice was an SMS because it operated three airline procedures. The captain and first officer also used by the company’s other King category aircraft. Implementation of the were scheduled to fly together only once Air pilots. SMS was being done in four phases under in December 2006 following their suspen- However, the geographic coordinates the oversight of Transport Canada. sions; consequently, the company intended of an aerodrome identifier waypoint are The regulations and Transport Canada to conduct a line check in January 2007 but those for the aerodrome geometric center. guidance material divide an SMS into six had not yet scheduled it when the accident In Sandy Bay, this point was the center of components. Three of the components are occurred. the runway, equidistant from both ends of further divided into elements for a total of The company’s SMS was immature the runway. 17 SMS elements. and still under development, and this was We wanted to assess the effect on In January 2007, at the time of this oc- reflected in the SMS investigation of the flight crew situational awareness of using currence, the company was in phase 2 of November 2006 incident. We concluded GPS distance-to-go to the center of the implementation. During phase 2, among that the company’s SMS was not yet runway rather than the threshold. The other SMS elements, the company was capable or expected to be capable of de- actual distance to the threshold was about implementing a non-punitive reporting tecting, analyzing, and mitigating the risks ¼ nautical mile less than the distance to policy; a reactive reporting system; and presented by the hazards underlying this the aerodrome waypoint coordinates, and reactive investigation, analysis, and occurrence. This finding was listed with our hypothesis was that this may have risk management processes. Proactive “Other Findings,” which are intended to contributed to the aircraft being high on processes would be implemented during clarify a point of ambiguity or controversy. the final approach. phase 3. The company did not have a fully This issue had not contributed to the oc- We used a model of situational aware- functioning SMS and was not required to currence. ness described by N. Brunelle, in her have one until the completion of phase 4, We were also interested in the com- paper “Conversations in the Cockpit: in September 2008. pany’s use of punitive suspension from Pilot Error or a Failure to Communicate?” We limited our examination of the com- duty when an SMS non-punitive represented at ISASI’s 2008 seminar in pany’s SMS to only those elements being porting system was being implemented. Halifax, Canada, wherein the concept is implemented during phase 2. Our investigation revealed that, in the divided into five elements. We focused on We determined that the company’s fall of 2006, a consultant audited the the spatial/temporal element, in particular immature SMS had not detected some company’s operations and found, in the ability of the crew to anticipate the previous occurrences involving the ac- part, that the company’s management projected flight path of the aircraft. cident crew or many underlying factors response to repeated flight crew regu- We concluded that the crewmembers identified as contributing to the accident. latory infractions was insufficient and were likely unaware of the ¼ mile differ- From this, we concluded that the com- recommended that the company imple- ence between the depicted GPS distance pany’s reactive reporting system was not ment a disciplinary policy. The company and the distance to the runway threshold. yet functioning. initially used unpaid suspension from We were unable to determine whether this In November 2006, 6 weeks before the duty as punishment, with a subsequent contributed to the aircraft being high on accident, the company’s SMS did detect revision to fines of 10 percent of monthly final approach. However, both crewmem- and investigate a regulatory infraction salary for a first offense and 20 percent bers had visual contact with the runway involving the accident crew. We examined of monthly salary for a second offense, for at least 2 minutes before the landing at- the reactive investigation, analysis, and with no suspension from duty. Within 2 tempt, and the captain did identify visually risk management processes used by the months of implementation of this policy, that the aircraft was high on approach SMS in this instance. six company pilots had been disciplined, and took corrective action. Therefore, the We determined that the company’s including the accident crew. crew was able to accurately predict the investigation was well documented but Our investigation determined that use projected flight path of the aircraft during was limited in scope. The company SMS of punitive action can substantially impair the final approach. analysis focused solely on the crew and safety reporting systems. We made a find- Our examination of situational aware- did not identify underlying supervisory ing as to risk that, in an SMS environment, ness did not extend beyond this issue. and operational control deficiencies. inappropriate use of punitive actions can However, the ability to divide the overall Short-term corrective action taken by the result in a decrease in the number of haz- concept into smaller elements helped company was an immediate suspension ards and occurrences reported, thereby investigators determine that the use of without pay for 2 weeks for the captain reducing effectiveness of the SMS. GPS distance-to-go had not contributed and 1 week for the first officer. Long-term The ability to divide the overarching to the occurrence. corrective action included both a safety SMS concept into smaller, more manage-

April–June 2011 ISASI Forum • 23 able elements proved to be quite helpful officer on numerous occasions, sometimes ous flights, the first officer released the to our investigation. We were able to more doing so using the phrase in the standard control column, also without making any effectively demonstrate that the facts sup- operating procedures, “I have control,” verbal statement, using the non-standard ported our conclusions. sometimes using non-standard verbal practice they had employed on previous phrases, and sometimes without making flights. Local rationality any verbal statement. In instances when The first two scenarios listed above did Hindsight bias strongly influenced initial the captain took control without making not occur because the first officer released attempts to understand the many devia- any verbal statement, the first officer’s the control column. tions from policies and procedures that practice was to release the controls upon On previous flights, the captain had occurred during the accident flight. At that sensing pressure from the captain’s con- taken control from the first officer both time, the focus of the investigation was on trol inputs. on approach and during landing. Given the explaining what should have been done Our problem was that the captain had captain’s mistrust of the first officer’s abil- but was not. This approach influenced the been fatally injured, and we were unable to ity to land the aircraft, the lack of response analysis and findings in the initial draft confirm that he had, in fact, taken control from the first officer to the captain’s am- report. When external reviewers provided from the first officer during the go-around. biguous go-around communication, and comments on the draft report, it became In the initial draft report, our analysis of the fact that the remaining runway was clear that revisions were necessary. this control transfer was inconclusive. insufficient to land safely, we concluded During the post-review phase, our focus Applying the principle of local rationality that it was very likely that the captain shifted to explaining why the crewmem- helped us to revise our analysis. did take control from the first officer and bers behaved as they did, rather than As previously discussed, the flight was became the pilot flying for the remaining pointing out what they should have done high on final approach, the first officer was 20 seconds of the flight. but did not. To help us do this, we applied the pilot flying, and the captain coached We also concluded that the scenario in the principle of local rationality, as put the first officer into the landing flare. The which neither pilot was controlling the forth by D. Woods and R.I. Cook in their captain decided to initiate a go-around and aircraft was very unlikely. “Perspectives on Human Error: Hindsight communicated this decision to the first of- The conclusions we reached in the Biases and Local Rationality.” ficer with a non-standard and ambiguous revised analysis made sense to us in the As Woods and Cook noted, people do statement. context of the crew’s local rationality. not go to work with the intent of causing Having advised the first officer of his These pilots did things for reasons that an accident. Their decisions and behavior intent to conduct a go-around, the captain made sense to them at the time, given their make sense to them in the context of their would have expected the first officer to ad- circumstances, knowledge, and goals. knowledge, circumstances, and goals. vance the power levers. However, because Although there may be limited informa- the captain’s statement was non-standard Conclusions tion available, their situation may seem and ambiguous, the first officer was unsure • Conducting a survey within interviews ambiguous, or they may have multiple of the captain’s intentions and did not initi- proved to be a very useful means of obtain- conflicting goals, they make the best of ate the go-around by advancing the power ing information. what they have in order to get their work levers. Four seconds after communicat- • Use of a time line was very helpful to done. ing his go-around decision, the captain, analyze and understand the occurrence Our challenge was to understand the likely feeling a sense of urgency by now, sequence of events and underlying factors. world as the crew perceived it, in order to advanced the power levers himself. An organizational time line for company understand how they made sense of the The captain almost certainly took this managerial activities was also helpful. situation. We used this approach to revise action because it was clear to him that • The regulator time line was of low the analysis of the transfer of control that they could not land safely on the remain- resolution but was useful to establish occurred during the go-around. ing runway, and the first officer had not chronological sequencing. However, it Procedures for clear and consistent responded to his communication of his actually introduced confusion because of verbal communications prevent confusion go-around decision. the inability to portray the complex orga- between pilots as to who has control of the We examined four possible scenarios of nizational context within which decisions aircraft, and the company had a control aircraft control during the go-around: and actions were taken. Such a time line transfer procedure that was standard • The first officer was in control. should be used with caution. throughout its fleet. • Both pilots were attempting to control • Arguments regarding deficiencies in However, the investigation revealed the aircraft. concepts such as CRM may not convince that the captain and first officer occa- • The captain was in control. the reader. Dividing the concepts into sionally used a non-standard transfer of • Neither pilot was in control. smaller components will provide a trail to control practice that varied substantially Immediately after the captain had ad- your conclusions that the deficiencies ex- from the procedure specified in the stan- vanced the power levers, the first officer isted and contributed to the occurrence. dard operating procedures. This practice perceived pressure on the control column • The principle of local rationality helped resulted from the captain’s mistrust of the and observed the captain’s hand on the us to understand why the flight crew’s first officer’s ability to land the aircraft. control column. Believing the captain was decisions and actions made sense to them, During previous flights, the captain had taking control without making any verbal and to avoid the negative effects of hind- taken control of the aircraft from the first statement, as had occurred on previ- sight bias. ◆

24 • ISASI Forum April–June 2011 ISASI ROUNDUP

ISASI 2011 Registration Opens

Registration is now open for ISASI fare greater than $120. To receive the management), maintenance and quality 2011, the Society’s 42nd annual in- discount, customers should call reserva- engineers, aviation security personnel, ternational conference on air accident in- tions at 1-800-328-1111 and provide the and safety department personnel. Some vestigation to be held in Salt Lake City, group discount code of NM74B. The participants were from other Air Astana Utah, USA, from Monday, September 12 discount is valid for travel between Sept. stations, such as the capital Astana. All through Thursday, September 15. The 9, 2011. and Sept. 18, 2011. received ISASI completion certificates. conference theme is “Investigation—A Full conference details may be found Workshop instructors were Caj Shared Process.” The seminar’s website on the ISASI website or in the Forum Frostell and Mike Doiron. Their training is accessible through the ISASI website, January-March 2011, page 26. Regis- material, which each participant received, www.isasi.org, and is now accepting tration information is also available via was comprised of paper handouts and a registrations for both the conference e-mail: [email protected] or via telephone: CD with published manuals and booklets and hotel accommodations. The seminar 604-874-4806. ◆ that provided considerable background program registration fee (in U.S. dol- materials for future reference. In ad- lars) before Aug. 15, 2011, is member, Air Astana Hosts 39th dition, ISASI membership forms were $550; non-member, $600; and student made available to the participants. The member, $200. A one-day pass is $200; Reachout Workshop program included several interactive case tutorial only, $150; and companion, $325. Air Astana hosted the 39th ISASI studies and working group assignments If registration is made after August 15, Reachout Workshop on incident inves- Being a corporate member of ISASI, the fees are members, $600; non-mem- tigation and safety risk management the management of Air Astana was bers, $650; and student member, $225. in Almaty, Kazakhstan, February 7-11. pleased to welcome ISASI activities A one-day pass is $225; tutorial only, The workshop was held at the training at their home base. Coetzee and the $175; companion, $350. The cost of a facilities of Air Astana and was attended participants were most appreciative of single event is—Welcome reception, $50; by 18 participants. Gerhard Coetzee, ISASI for bringing the Reachout Work- Tuesday night dinner, $100; and awards senior vice-president of corporate safety shop to Almaty and to the instructors banquet, $100. and quality Assurance of Air Astana, for sharing their knowledge and experi- The seminar hotel is the Salt Lake attended the closing ceremonies. ence. Coetzee mentioned that ISASI has City Marriott Downtown located in the The 18 participants from Air Astana certainly found a new group of admirers heart of downtown. The conference represented all operational areas, includ- in his staff and welcomed ISASI back to room rate is US$175, based on single or ing pilots (involved in company safety Almaty on another occasion. ◆ double occupancy. Reservations must be made through the noted website link to ensure the seminar rate. Reservations may be made as early as September 8 and extended to September 17. This rate includes daily room Internet access and use of the pool, sauna, hot tub, and fitness center. The hotel is 15 minutes or a US$20 cab fare from the Salt Lake City Inter- national Airport. Public transportation is readily available, as is XPRESS Shuttle of Salt Lake City, which provides hotel service for about $8 per person. Another option is Quicksilver Private Transporta- tion Services. Delta Air Lines is the official airline of ISASI 2011. The airline is offering a discount on roundtrip tickets that originate Participants at the 39th ISASI Reachout Workshop in Almaty, Kazakhstan, in the U.S. or Canada and have a base hosted by Air Astana.

April–June 2011 ISASI Forum • 25 ISASI ROUNDUP Continued . . .

SER Chapter Meets in how this resulted in a crash of the first F-14. There was coverage of the specific Key West, Fla. details of the first lunar module in which The Southeast Regional Chapter of a roach that climbed onboard caused a ISASI held its annual meeting on Febru- major upset and might have altered the ary 26 in Key West, Fla. Thirty-one schedule if it had not been found after persons attended, including 12 student exhaustive searching. He also covered members. Robert Rendzio, the chapter the route and paths taken to land the president, and Dan McCune, vice-presi- first shuttle on the moon, and how Neil dent/treasurer, opened the meeting and Armstrong had described the moon welcomed all to the relaxed resort area surface as “grey flour.” of Key West. The Chapter’s next spring meeting Anthony Brickhouse of Embry-Riddle will be held in New Orleans, La. More Aeronautical University was the first information will be sent out regarding speaker of the day and talked about the 2012 meeting, at a later date. ◆ mental health aspects of aircraft accident investigation: protecting the inves- Bob Watkins of the Grumman Corporation ERAU Student Chapter Is tigator. He discussed the different levels addresses the SERC meeting in Key of stress experienced by investigators West, Fla. an Active ISASI Group during aircraft accident investigations The student Chapter of ISASI at and emphasized that there is currently players have begun to install the warn- Embry-Riddle Aeronautical University no official training for the mental health ings through TCAS systems. in Daytona Beach, Fla., has been very of investigators, He asked the question: Dr. Paul Schuda of the NTSB made active in promoting aviation safety and “How can we diagnosis mental stress?” a presentation on the TWA Flight 800 offering networking opportunities to His hope is that one day there will be an (N93119) investigation. The Boeing 747 student members. With the support of examination of the feasibility of devel- accident happened on July 17, 1996, faculty advisor Anthony Brickhouse, a oping an annual mental conditioning and took the lives of 230 people. He speaker at the 2010 ISASI Seminar in program in order to prevent acute stress discussed the headlines and conspiracy Sapporo, the student Chapter currently disorder and post-traumatic stress dis- theories that went along with the event. has 32 student members, many of whom order (PTSD). Thanks to wreckage recovery, disper- are also members of the international Charley Pereira from Transportation sion charts and studies, reconstruction Society. The current officers are Michael Safety and Security Consulting, Inc. of the aircraft, and beneficial parties spoke next regarding low airspeed alert- to the investigation, it was determined ing systems and how a modern system that the most likely ignition event was a consists of visual and aural alerts well short-circuit within the empty but highly before activation of the stall protection volatile center wing fuel tank. Because system or natural aerodynamic stall. of this tragedy, fuel tank inerting sys- He discussed how in October 2002 Sen. tems have been mandated by the FAA Paul Wellstone died tragically when the that will reduce the amount of oxygen in Beech King Air he was in crashed due the tanks, almost eliminating the risk of to low airspeed. He informed the group explosion. that in December 2003 recommenda- The final speaker of the day was Bob tions were made to require low airspeed Watkins of the Grumman Corpora- altering system be installed in aircraft. tion. He provided an entertaining and Pereira mentioned that it took until informative presentation on the NASA February 2010, but new low airspeed Apollo lunar module. He began by dis- alerting systems were recommended cussing the F-14 Tomcat and the origin ISASI Student Chapter officers are, from to the FAA. References can be made to of its name. He discussed the pressure left to right, De Paul Sunny, Maggie A-10-011 and 012. And now key industry under which the pilots were placed and Wong, Michael Gaver, and Gaston Gaber.

26 • ISASI Forum April–June 2011 2010 Annual Seminar Proceedings Now Available

Active members in good standing and web page at www.isasi.org. The seminar US$75. A limited number of paper cop- corporate members may acquire, on a papers can be found in the Members ies of Proceedings 2010 are available no-fee basis, a copy of the Proceedings section. Alternatively, active members at a cost of US$150. Checks should of the 41st International Seminar, held may purchase the Proceedings on a CD- accompany the request and be made in Sapporo, Japan, Sept. 6-9, 2010, by ROM for the nominal fee of $15, which payable to ISASI. Mail to ISASI, 107 downloading the information from covers postage and handling. Non-ISASI E. Holly Ave., Suite 11, Sterling, VA the appropriate section of the ISASI members may acquire the CD-ROM for USA 20164-5405. ◆

Speakers and Technical Papers Presented Was It Really Pilot Error? A Case Study of an Useful Human Factors Investigative at ISASI 2010—Sapporo, Japan Indian Military Helicopter Accident Techniques: A Case Study of a Fatal King Opening Address—Frank Del Gandio, By Capt. Samir Kohli, Head of Safety, Saudi Air Accident in Canada President, ISASI Aviation Flight Academy By David Ross, Operations Investigator, Keynote Address: A Japan Transport Safety TSB, Canada Board Air Safety View—Norihiro Goto, Preparing for Investigation Effects of Mental Stressors During Flight Chairman, JTSB Planning for Sea Search and Recovery on Prosodic Features of Speech and Auto- Operations—A Small Investigation Agency nomic Nervous Response TUESDAY, SEPTEMBER 7 Perspective By Hiroto Kikuchi, Japan Air Self Defense Authentic Investigations By the Air Accident Investigation Bureau of Force How Can We Have an Authentic Investi- Singapore Recent Accidents: Lessons, Techniques, gation? Hazards at Aircraft Accident Sites: Training and Challenges Heathrow 777: Challenges By Guo Fu, Deputy Director, Aviation Investigators in Line with the ICAO Circular in Understanding Unusual Properties in Safety Office, East China Regional Admin- 315 Guidelines Aviation Fuel and Problems in Conduct- istration, Civil Aviation Administration, By Nathalie Boston, Safety and Accident Inves- ing Tests to Determine the Vulnerability China tigation Centre, Cranfield University, Graham of an Aircraft’s Fuel System to the Ac- A Quarter Century and Still Learning— Braithwaite, Cranfield University, and Sid cumulation and Release of Ice Lessons from the JAL123 Accident Hawkins, AAIB By Brian McDermid, Air Accident Investi- Investigation Mental Health Aspects of Aircraft Accident gation Bureau, United Kingdom By John Purvis and Ron Schleede, Former Investigation: Protecting the Investigator Undersea Search Operations: Lessons and Directors of Accident Investigation at By Brian Dyer, Nevis Disaster Management Recommendations from Flight 447 Boeing and NTSB. Department, and Anthony Brickhouse, As- By Alain Bouillard, Head of Safety Inves- sistant Professor of Aviation Safety, Embry tigations, and Olivier Ferrante, Head of Asia—Trends and Issues Riddle Aeronautical University Recovery Group, BEA, France Leading ‘Just Culture’ Toward Pragmatic Investigating Accidents Related to Errors Colgan Flight 3407: Achieving the Application in Japan of Aeronautical Decision-Making in Flight Delicate Balance Between Timely and By Hiromitsu Mizutani, Japan Aircraft Operations Thorough While Staying True To the Pilot Association, ANA Corporate Safety By Wen-Chin Li, Head of the Graduate School Investigative Process Captain of Psychology, National Defense University, By Lorenda Ward, Accident Investigator, Accident Trends in Asia: Major Improve- Taiwan; Don Harris, Managing Director of NTSB, USA ments and Remaining Challenges HFI Solutions Ltd., United Kingdom; Lun-Wen By Robert Matthews, Senior Analyst, Ac- Li, Industrial Engineering and Engineering The following papers were presented, but cident Investigation and Prevention, FAA Management, Tsing Hua University, Taiwan; no text was available for publication. Yueh-Ling Hsu, Professor in the Department A Review of Aviation Recorder Develop- WEDNESDAY, SEPTEMBER 8 of Air Transportation, Kainan University, ment and Challenges in China Innovative Uses of Data and Intellectual Taiwan; and Thomas Wang, Acting Managing By Yang Lin, Senior Engineer for Aviation Models Director and the Head of the Flight Safety Divi- Recorders, Civil Aviation Safety Technical AAIB’s Use of Data Mining in the Investi- sion, Aviation Safety Council, Taiwan Center, CAAC China; gation of the 777 Fuel-Icing Accident: In- Social-Technical Systems and Proactive novative Outcomes and Challenges Faced THURSDAY, SEPTEMBER 9 Accident Prevention By Mark Ford, Senior Inspector of Air Ac- Investigative Tools and Lessons By Yu-Hsing Huang, Assistant Professor, cidents, AAIB UK The Use of Commercial Satellite Imagery in National Pintung University of Science and The Contribution of Safety Reporting Aircraft Accident Investigation: Results from Technology, Taiwan; and Investigations to Safety Management Recent Trials Boeing Airways 777 Accident Investiga- Systems By Matthew Greaves and Graham Braithwaite, tion: What We Don’t Know About Ice and By Paul E. Mayes, Investigation and Safety and Accident Investigation Centre, Jet Fuel Analysis, Safety Risk and Environment, Cranfield University By Mark H. Smith, Air Safety Investiga- Cobham Aviation Services, Australia Close Cooperation in Investigations has tions, Boeing Commercial Airplanes Improved Technical Partnership Applying Intellectual Models By Michael Guan, Director of the Investigation Limitations of ‘Swiss Cheese’ Models and Lab, Aviation Safety Council, Taiwan, and the Need for a Systems Approach Christophe Menez, Head of the Engineering De- By John Stoop, Delft University of Technol- partment, Bureau d`Enquêtes et d`Analyses, ogy, and Sidney Decker, Lund University France (Recipients of the Award of Excellence for Best Seminar Paper) Terrain Profile Analysis Using Radar Altim- eter Data from FDR By Frederico Moreira Machado and Umberto Irgang, Embraer Air Safety Department

April–June 2011 ISASI Forum • 27 ISASI ROUNDUP Continued . . .

In Memoriam Col. Regev Baruch (MO3718), Rechovot, Israel, 2010 Garver (president), Gaston Gaber (vice- Harry H. Black (LC0096), Annandale, chairman, served as a keynote debate president), De Paul Sunny (secretary/ Virginia, USA, 2010 speaker at the CHC Safety and Qual- Alexander A. Lanoway (LC0109), Punta treasurer), and Maggie Wong (public Gorda, Florida, USA, Jan. 20, 2011 ity Summit, which was promoted as the relations), an ISASI 2010 “Kapustin” Christian H. Schuberdt (MO4225), world’s largest aviation safety confer- scholar Braunschweig, Germany, Dec. 23, 2010 ence, in Vancouver. John L. Sheehan (AO3618), Vale, Oregon, A major accomplishment of the Chap- USA. Sept. 10, 2010 He participated in the keynote debate ter occurred when the officers planned, Lt. Col. (Ret.) Patrick “Pat” J. Ash with Tony Kern and John Nance, which initiated, and successfully completed a (AO4621) Anchorage, Alaska, USA, was facilitated by Scott Shappell, that Feb. 16, 2011 ◆ student petition to establish an aircraft covered questions ranging from “Has accident investigation lab (crash lab) on SMS become just another three-letter campus. With more than 300 student enhance their hands-on learning experi- word?” to “In times of economic hard- signatures and the support of faculty ence. The lab is also used for profes- ship, should organizations be investing members, the university approved the sional courses affiliated with ERAU’s in safety?” The keynote debate lasted petition and established the crash lab Center for Aerospace Safety/Security for 90 minutes and was delivered in front that the students had wanted. The crash Education. of the 675 attendees as a presidential- lab is currently used by the students Over the past 2 academic years, the style debate. enrolled in the aviation safety courses to student Chapter has also hosted numer- During the afternoon, Graham gave ous guest speakers who are industry a few sessions aimed at CEO/SVP level professionals from companies, organiza- attendees who worked for a range of tions, and agencies such as Delta Air fixed- and rotary-wing operators, oil and lines, Southwest Airlines, the FAA, L-3 gas producers, insurers, regulators, etc. Moving? Communications, JetBlue Airways, and Graham discussed the importance of Please Let Us Know other consulting companies. Besides investigation to the smooth running of a Member Number______the prominent guest speakers, student safety management system and the role Fax this form to 1-703-430-4970 or mail to members also had the opportunity to that senior managers play in ensuring ISASI, Park Center tour the facility at Piper Aircraft, Inc., in that investigators are suitably trained, 107 E. Holly Avenue, Suite 11 Vero Beach, Fla., where they were able resourced, and empowered in the role. Sterling, VA USA 20164-5405 to experience and learn more about the The importance of an organization’s cul- Old Address (or attach label) aircraft manufacturing process. ture regarding a successful investigation Student members stay active in the and the effect of a successful investiga- Name______international Society by attending annual tion in defining an organization’s culture Address______and regional conferences, including the were discussed. The final session was City______2009 ISASI Seminar in Orlando, the 2010 a workshop on accident investigation, State/Prov.______ISASI Seminar in Sapporo, and most which attracted more than 125 partici- recently the Southeast Regional Chapter pants ranging from small operators to Zip______Workshop in Key West. The students con- national investigation agencies. Country______tinue to promote aviation safety among In accepting the invitation to speak, New Address* aspiring aviation professionals at Embry- Braithwaite said, “I am absolutely de- Name______Riddle Aeronautical University and look lighted to be a part of what I consider to forward to meeting more professionals at be such a world leading event. The CHC Address______future ISASI events. ◆ Safety and Quality Summit has estab- City______lished itself as the gold standard for State/Prov.______Braithwaite Speaks at applied safety management within the Zip______rotary and fixed-wing sector of the air CHC Safety Summit transport industry. CHC’s inspirational Country______Graham Braithwaite, director of the leadership in safety is always clearly E-mail______Cranfield Safety and Accident Investiga- demonstrated by the speakers and *Do not forget to change employment and e-mail address. tion Centre, and ISASI’s Investigators attendees of this event—professionals Training and Education Working Group from all over the world who come to

28 • ISASI Forum April–June 2011

NEW MEMBERS Individual Jenkins, Kenneth, D., Dallas, TX, USA Abdulhamid Belama, Salah, Maydan Little, Emma, L., Conder, ACT, Australia Elzazayer, Libyan Masters, Greg, F., Daytona Beach, FL, USA Acosta-Martinez, Leo, G., Daytona Beach, Moore, Wiley, L., Tacoma, WA, USA FL, USA Oliveira, Ivan, Vitória, Espírito Santo, Brazil Adamson, Keenon, Los Angeles, USA Phillips, Jonathan, C., Blackwall, TAS, Alencar, P. Allan, Sugar Land, TX, USA Australia Branham, Brittnee, N., Daytona Beach, FL, Robinson, Christopher, G., Holly Hill, FL, USA USA Cabrera, Ricardo, C., Miami Springs, FL, Robson, Ainsley, M., Levittown, PA, USA USA Salas Montilla, Ricardo, J., Sugar Land, TX, aircraft accident investigation courses Chan, Anthony, G., Prescott, AZ, USA USA and will be co-teaching several other Flóvenz, Gunnar, J.Ó., 110 Reykjavik, Shea, William, Hurst, TX, USA courses with the company. He will also Iceland Sizemore, Gary, R., Coatesville, PA, USA Garver, Michael, Gulf Breeze, FL, USA Smith, Kimberly, L., Daytona Beach, FL, actively be reviewing and upgrading the Gee, Clifton, E., Hagerstown, MD, USA USA curriculum in the entire Investigation Herl, Cody, J., Daytona Beach, FL, USA Sumner, Thomas, L., Wahroonga, NSW, Certificate Program. When asked about Hewitson, Robert, L., Seacliff, SA, Australia Australia Ibarra, Adolfo, Prescott, AZ, USA White, James, M., St. Charles, MO, USA his transition to program director, Bill Iyengar, Nitish, P., Saint Augustine, FL, Zhao, Karen, Daytona Beach, FL, USA said, “With every class, I truly enjoy ◆ USA Ziehm, Robert, Las Vegas, NV, USA meeting these outstanding professionals and sharing my experiences and knowl- learn from each other and share their you have a learning opportunity that is edge with them as we work toward our own experiences.” second to none.” ultimate goal of making aviation safer Now in its seventh consecutive Prior to joining SCSI, Fowler’s most worldwide.” year, the Summit is an internationally recent appointment was with Transport In other SCSI news is the announce- recognized, non-profit aviation safety Canada Aircraft Services Directorate ment that SCSI and Global Aerospace conference aimed at improving safety as the Atlantic region manager of flight Logistics, LLC (GAL) have teamed up in aviation globally through excellence operations, responsible for the safe to jointly pursue business opportunities in human factors. The Summit is hosted operation of multiple fixed and rotary within the United Arab Emirates (UAE) by CHC Helicopter, one of the world’s wing aircraft. Prior to this, he was in connection with aviation-related largest providers of civilian search and the Atlantic regional manager for the safety education and safety manage- rescue services and transportation for Transportation Safety Board, where he ment system development. Under their the global offshore oil gas industry. CHC was responsible for all of the regional agreement, SCSI will work with GAL to has more than 250 aircraft operating in investigations. It was during this period provide proven, comprehensive training some 30 countries worldwide. ◆ that he was extensively involved in the solutions and address the immediate Swissair Flight 111 accident, which safety education requirements for the SCSI Appoints New tragically took the lives of all 229 people UAE’s armed forces, as well as the UAE on board just eight kilometers from the civil sector. The initial primary focus is Investigation Director shore of Nova Scotia. Also during this to meet immediate requirements of the ISASI corporate member the Southern time, he was the IIC of the MK Airlines UAE armed forces and subsequently to California Safety Institute (SCSI) has B-747 crash in Halifax. His leadership market the highly respected SCSI line appointed William Fowler as the com- as IIC ensured that the lessons learned of products. ◆ pany’s new investigation program direc- from the accident would benefit global tor. He brings an extensive background aviation. NTSB to Revamp Its Most in aviation safety and investigations to He also has extensive regulatory SCSI’s programs, including experience experience with Transport Canada. Wanted List Process as investigator-in-charge (IIC) of the He has held positions as the chief of The NTSB has announced plans to mod- MK Airlines B-747 crash in Halifax and airline inspection (responsible for the ernize it decades-old safety recommen- as one of the lead investigators of the major airlines in Canada) and as chief of dations program. Board members voted Swissair Flight 111 crash over Nova foreign inspection (responsible for the unanimously to change its Most Wanted Scotia. Stephen Milam, chairman of the certification of foreign carriers operating List Safety Recommendations Program Board of Directors, said, “Bill has an into Canada). At Transport Canada, his Board Order. The Board Order is an incredible depth and breadth of experi- responsibilities also included the Atlan- internal document that provides policy ence from which to draw, and his keen tic region flight operations management, guidance and establishes procedures for insights stem from a truly unique back- training, certification, and proficiency of identifying, developing, selecting, and ground rich with expertise in investiga- crews as well as operations management implementing safety recommendations tion, safety, and human factors. Combine of the regional Canadian Coast Guard on the NTSB’s Most Wanted List. this with his regulatory background, helicopter and fleet crews. “With this week’s vote, the NTSB leadership positions, industry knowl- Fowler is teaching the SCSI investiga- will begin a significant transformation edge, and level of professionalism and tion in safety management systems and of one of our flagship programs, the

April–June 2011 ISASI Forum • 29 Most Wanted List,” said NTSB Chair- the way for those important updates to man Deborah A.P. Hersman. “For the take place. past 20 years, the Most Wanted List has “The beauty of this new process is ISASI Information spotlighted certain critical transporta- the fact that the Most Wanted List can tion safety issues and the NTSB’s safety be changed completely each and every recommendations that would address year, if the Board so chooses,” Hersman them. It has been one of the NTSB’s said. “This will go a long way to keeping most effective tools; but after 20 years, the Moat Wanted List fresh, dynamic, it is in need of a face lift and procedural and current for the next 20 years of its streamlining. The Board has now paved life.” ◆ OFFICERS President, Frank Del Gandio ([email protected]) Executive Advisor, Richard Stone ([email protected]) President’s View, continued from page 4 Vice-President, Paul Myers ([email protected]) enforcement by national and inter- with the official accident investigation. Secretary, Chris Baum ([email protected]) national aviation authorities, and by Treasurer, Tom McCarthy pursuit of claims through civil justice Urge national aviation and acci- ([email protected]) systems to obtain compensation. dent investigating authorities to: (i) assert strong control over ac- COUNCILLORS 5 Australian, Lindsay Naylor Urge states to safeguard the safety cident investigations, free from undue ([email protected]) investigation report and probable interference from law enforcement Canadian, Barbara Dunn cause/contributing factor conclu- ([email protected]) 4 authorities; (ii) invite international European, Anne Evans sions from premature disclosure and cooperation in the accident investi- ([email protected]) International, Caj Frostell use directly in civil or criminal proceed- gation under Annex 13; (iii) conduct ([email protected]) ings. Although use of official accident professional investigations to identify New Zealand, Peter Williams ([email protected]) reports may save criminal investigators probable cause and contributing fac- United States, Toby Carroll the considerable expense of conduct- tors and develop recommendations in a ([email protected]) ing an entire separate investigation, deliberative manner, avoiding any ‘rush a considerable and serious risk exists to judgment’; (iv) ensure the free and NATIONAL AND REGIONAL of diverting these reports from their voluntary flow of essential safety infor- SOCIETY PRESIDENTS ASIASASI, Chan Wing Keong original purpose, as technical causes mation; (v) provide victims’ loved ones ([email protected]) often cannot be equated to legal causes and their families with full, accurate, Australian, Lindsay Naylor ([email protected]) necessary when establishing either civil and precise information at the earliest Canadian, Barbara M. Dunn or criminal liability. In addition, use of possible time; and (vi) address swiftly ([email protected]) European, David King ([email protected]) relatively untrained and inexperienced any acts or omissions in violation of Latin American, Guillermo J. Palacia technical ‘experts’ by prosecutorial or ju- aviation standards.” ◆ (Mexico) New Zealand, Alan Moselen dicial authorities, as compared to official ([email protected]) accident investigating authorities, can (The resolution may be viewed in its Russian, Vsvolod E. Overharov ([email protected]) result in flawed technical analyses and a entirety on the Society’s website: www. SESA-France Chapter,Vincent Fave miscarriage of justice, while interfering isasi.org.) ([email protected]) United States, Toby Carroll ([email protected])

Who’s Who, continued from page 32 UNITED STATES REGIONAL CHAPTER PRESIDENTS to Microsoft PowerPoint presentations, community to further facilitate and Alaska, Craig Bledsoe ([email protected]) Excel spreadsheets, and Adobe PDF promote knowledge sharing within the Arizona, Bill Waldock documents. Interactive dashboards allow industry. Air safety professionals are ([email protected]) Dallas-Ft. Worth, Tim Logan users to interact with their data and per- invited and encouraged to contribute. ([email protected]) form investigations into trends. Built- A place for like-minded professionals to Great Lakes, Matthew Kenner ([email protected]) in modern visualization tools include provide input, the POLARIS community Los Angeles, Inactive interactive graphs, cockpit displays, and ensures that contributions will be made Mid-Atlantic, Ron Schleede ([email protected]) Google maps. A built-in technical sup- accessible to the aviation safety world. Northeast, Inactive port function is also available. ISASI membership promises to be Pacific Northwest, Kevin Darcy ([email protected]) For air safety investigators, the value very beneficial to Flight Data Services Rocky Mountain, David Harper of POLARIS lies in its simplicity of use, in building a community relationship ([email protected]) San Francisco, Peter Axelrod cost effectiveness, and accessibility— with flight safety specialists to develop ([email protected]) whether the user is in the office or work- best practices for sharing flight data Southeastern, Robert Rendzio ing in the field. analysis algorithms and lessons learned ([email protected]) FDS is initiating an online POLARIS from past investigations. ◆

30 • ISASI Forum April–June 2011 American Eagle Airlines Hong Kong Civil Aviation Department COMMITTEE CHAIRMEN IFALPA Audit, Dr. Michael K. Hynes American Underwater Search & Survey, Ltd. ([email protected]) AmSafe Aviation Independent Pilots Association Award, Gale E. Braden ([email protected]) Aramco Associated Company Int’l Assoc. of Mach. & Aerospace Workers Ballot Certification, Tom McCarthy ASPA de Mexico Interstate Aviation Committee ([email protected]) Association of Professional Flight Attendants Irish Air Corps Board of Fellows, Ludi Benner ([email protected]) Atlantic Southeast Airlines—Delta Connection Irish Aviation Authority Bylaws, Darren T. Gaines Australian and International Pilots Association (AIPA), Japan Airlines Domestic Co., LTD ([email protected]) Australia Australian Transport Safety Bureau Japanese Aviation Insurance Pool Code of Ethics, Jeff Edwards Aviation Safety Council Japan Transport Safety Board ([email protected]) Aviation Safety Investigations, UK Jeppesen Membership, Tom McCarthy Avions de Transp ort Regional (ATR) JetBlue Airways ([email protected]) AVISURE, Australia Jones Day Nominating, Troy Jackson BEA-Bureau D’Enquetes et D’Analyses KLM Royal Dutch Airlines ([email protected]) Korea Air Force Safety Ctr. Reachout, John Guselli Board of Accident Investigation—Sweden Boeing Commercial Airplanes Korea Aviation & Railway Accident Investigation ([email protected]) Board Seminar, Barbara Dunn ([email protected]) Bombardier Aerospace Bundesstelle fur Flugunfalluntersuchung—BFU Kreindler & Kreindler, LLP CAE-Flightscape, Inc. L-3 Communications Aviation Recorders WORKING GROUP CHAIRMEN Cathay Pacific Airways Limited Learjet, Inc. Air Traffic Services, Scott Dunham (Chair) Cavok Group, Inc. Lockheed Martin Corporation ([email protected]) Centurion, Inc. Lufthansa German Airlines Ladislav Mika (Co-Chair) ([email protected]) Charles Taylor Aviation, Singapore MyTravel Airways Cabin Safety, Joann E. Matley ([email protected]) China Airlines National Aerospace Laboratory, NLR Corporate Affairs, Erin Carroll Cirrus Design National Air Traffic Controllers Assn. ([email protected]) Civil Aviation Safety Authority Australia National Business Aviation Association Flight Recorder, Michael R. Poole National Transportation Safety Board ([email protected]) Colegio De Pilotos Aviadores De Mexico, A.C. Comair, Inc. NAV Canada General Aviation, Open Nigerian Ministry of Aviation and Accident Government Air Safety, Marcus Costa Continental Airlines ([email protected]) Continental Express Investigation Bureau Human Factors, Richard Stone COPAC/Colegio Oficial de Pilotos de la Aviacion Comercial Northwest Airlines ([email protected]) Cranfield Safety & Accident Investigation Centre Nova Aerospace, Australia Parker Aerospace Investigators Training & Education, Curt Lewis & Associates, LLC Phoenix International, Inc. Graham R. Braithwaite DCI/Branch AIRCO Pratt & Whitney ([email protected]) Defence Science and Technology Organization (DSTO) Qantas Airways Limited Unmanned Aerial Systems, Tom Farrier Delta Air Lines, Inc. Qatar Airways ([email protected]) Directorate of Aircraft Accident Investigations— Qwila Air (Pty), Ltd. Namibia Raytheon Company Directorate of Flight Safety (Canadian Forces) Republic of Singapore Air Force CORPORATE MEMBERS Directorate of Flying Safety—ADF Rolls-Royce, PLC Dombroff Gilmore Jaques & French P.C. Royal Netherlands Air Force AAIU Ministry of Transport Bulgaria Dutch Airline Pilots Association Royal New Zealand Air Force Accident Investigation Board, Finland Dutch Transport Safety Board RTI Group, LLC Accident Investigation Board/Norway EL AL Israel Airlines Sandia National Laboratories Accident Investigation & Prevention Bureau Embraer-Empresa Brasileira de Aeronautica S.A. SAS Braathens Administration des Enquêtes Techniques Embry-Riddle Aeronautical University Saudi Arabian Airlines (Luxembourg) Emirates Airline SICOFAA/SPS Aeronautical & Maritime Research Laboratory Era Aviation, Inc. Sikorsky Aircraft Corporation AeroVeritas Aviation Safety Consulting, Ltd. European Aviation Safety Agency Skyservice Airlines, Ltd. Aerovias De Mexico, S.A.De C.V. EVA Airways Corporation Singapore Airlines, Ltd. Air Accident Investigation Bureau of Singapore Exponent, Inc. SNECMA Moteurs Air Accident Investigation Unit—Ireland Federal Aviation Administration South African Airways Air Accidents Investigation Branch—U.K. FedEx Express South African Civil Aviation Authority Air Astana (Kazakhstan) Finnair Oyj Southern California Safety Institute Air Canada Pilots Association Finnish Military Aviation Authority Southwest Airlines Company Air Line Pilots Association Flight Attendant Training Institute at Melville College Southwest Airlines Pilots’ Association Air New Zealand, Ltd. Flight Data Services Ltd., United Kingdom Spanish Airline Pilots’ Association Airbus S.A.S. Flight Safety Foundation Star Navigation Systems Group, Ltd. Airclaims Limited Flight Safety Foundation—Taiwan State of Israel Aircraft Accident Investigation Bureau—Switzerland Galaxy Scientific Corporation Transport Canada Aircraft Mechanics Fraternal Association General Aviation Manufacturers Association Transportation Safety Board of Canada Airservices Australia GE Transportation/Aircraft Engines U.K. Civil Aviation Authority AirTran Airways Global Aerospace, Inc. UND Aerospace Airways New Zealand Gulf Flight Safety Committee, Azaiba, Oman University of NSW Aviation Alaska Airlines Hall & Associates, LLC University of Southern California Alitalia Airlines—Flight Safety Dept. Hellenic Air Accident Investigation Volvo Aero Corporation Allianz Aviation Managers, LLC, USA & Aviation Safety Board WestJet ◆ All Nippon Airways Company Limited Honeywell Allied Pilots Association Hong Kong Airline Pilots Association

April–June 2011 ISASI Forum • 31 Non-Profit ISASI Org. U.S. Postage 107 E. Holly Ave., Suite 11 PAID Sterling, VA 20164-5405 USA Permit #273 CHANGE SERVICE REQUESTED ANNAPOLIS, MD

WHO’S WHO Flight Data Services: Offering Complete Flight Data Management

(Who’s Who is a brief profile prepared from more than 70 aircraft types, FDS is data processing, and data validation or a by the represented ISASI corporate unique in providing benchmarking statis- hosted service, which is an ideal plat- member organization to provide a more tics across its customer base, benefiting form for operators that wish to maintain thorough understanding of the organi- both small and large fleet operators. ownership of the data validation process. zation’s role and functions.—Editor) FDS also offers a consultancy The innovative Internet-based service, designed to assist airlines in POLARIS program is an integrated, light Data Services (FDS), from carrying out flight safety activities, open-source solution that can be ac- its head office in the UK, offers a providing everything from Fcomplete flight data management a simple gap audit to set- service to the commercial aviation in- ting up a complete safety dustry. As a global leader in flight safety department. innovation, FDS recently delivered the With a premium, com- first major advancement in flight data plete, and dedicated service monitoring (FDM) for the decade—a that is accessible 24/7, FDS flight data analysis tool designed specifi- maintains the highest ratio cally for the Internet. of analysts per aircraft Since opening its doors for business in in the industry. The customer friendly cessed from anywhere an Internet con- 2000, FDS has delivered tailored moni- analyst team includes professionals from nection is available. There is no propri- toring services to its global customers, many sectors of the industry—flight etary hardware or software to purchase, setting up a U.S. business division in 2007 crew, navigation, engineering, dispatch, learn, or maintain. POLARIS is a zero- to support Flight Operations Quality and air traffic control—offering special- footprint, cross platform solution that Assurance (FOQA) requirements. Today, ized expertise and a full range of quality allows users to browse, investigate, and FDS monitors more than 800 aircraft services. use statistics immediately upon set up. worldwide. With well more than a mil- Operators can choose from a full-ser- Statistical reports can be exported lion flights in its data archive, collected vice program that includes data transfer, (continued on page 30)

32 • ISASI Forum April–June 2011