AeroSafety world
STEADY STATE FAMILIAR ACCIDENTS RULED 2008 GOL MIDAIR REPORT ATTITUDE ADJUSTMENT NTSB comments critical New jet upset training ASAP FLAP DELAYED ROTATION Death/rebirth of airline program Pre-takeoff settings critical
The Journal of Flight Safety Foundation February 2009 “Cessna is committed to providing the latest safety information to our customers, and that’s why we provide each new Citation owner with an FSF Aviation Department Tool Kit.” — Will Dirks, VP Flight Operations, Cessna Aircraft Co.
afety tools developed through years of FSF aviation safety audits have been conveniently packaged for your flight crews and operations personnel.
These tools should be on your minimum equipment list.
The FSF Aviation Department Tool Kit is such a valuable resource that Cessna Aircraft Co. provides each new Citation owner with a copy. One look at the contents tells you why.
Templates for flight operations, safety and emergency response manuals formatted for easy adaptation Sto your needs. Safety-management resources, including an SOPs template, CFIT risk assessment checklist and approach-and-landing risk awareness guidelines. Principles and guidelines for duty and rest schedul- ing based on NASA research.
Additional bonus CDs include the Approach and Landing Accident Reduction Tool Kit; Waterproof Flight Operations (a guide to survival in water landings); Operator’sMEL Flight Safety Handbook; item Turbofan Engine Malfunction Recognition and Response; and Turboprop Engine Malfunction Recognition and Response.
Here’s your all-in-one collection of flight safety tools — unbeatable value for cost. FSF member price: US$750 Nonmember price: US$1,000 Quantity discounts available! For more information, contact: Feda Jamous, + 1 703 739-6700, ext. 111 e-mail: [email protected] President’sMessage
When The Sun Doesn’t Shine his year is expected to be very tough for our Few people realized that this frugal and indus- business all over the world. Fewer people are trious man was also an astute investor. He amassed flying, but a lot of people still are. The Inter- a significant estate that ultimately he left to the avia- national Air Transport Association (IATA) tion community he considered his family. When Testimates that the world’s airlines last year flew about he died not long ago his will revealed that he had 2.3 billion passengers. This year they will fly about dedicated several million dollars for aviation safety 2.2 billion passengers, IATA predicts. Revenues will research. His trustees distributed this substantial take a serious tumble, and, with staffs reduced, over- gift to the Aircraft Owners and Pilots Association’s worked people will be stretched even further. This Air Safety Foundation, the American Bonanza isn’t the easiest time to dedicate resources to aviation Society and the Flight Safety Foundation. safety; in the absence of an obvious safety threat, it is The Foundation will use his gift to fund two not the first thing people think about. programs. First, some of it will be used to support It is a funny thing about our business: Those 2.2 some near-term work on the safety of helicopter billion passengers flying this year still expect to arrive emergency medical services (HEMS). In the U.S. safely. We have to find a way to continue doing our there has been an alarming increase in HEMS ac- jobs. Lucky for us there are some people who know cidents, and we intend to help by bringing some of that the continual pursuit of safety cannot stop when the data gathering and analysis techniques from the sun refuses to shine. The Flight Safety Foundation airline and corporate aviation to bear on the prob- owes a profound thanks to our members who keep lem. In funding this work, Manny’s gift will help contributing during difficult times. We also owe a people stay safe on the worst day of their lives. very special thanks to a major new benefactor who The remainder of the gift will launch an endow- has made a lasting gift to support aviation safety. ment, its earnings indefinitely funding research The Foundation has received a major gift programs. I’ll ask the Foundation’s think tank — the from the estate of Manuel Maciel, a modest and Icarus Committee — to identify key aviation safety hard-working man known to his friends as Manny. issues requiring targeted research. That work will Manny was born in the Azores and immigrated to be conducted under the auspices of the Manuel S. the United States in the 1940s. He worked nearly Maciel Chair for Aviation Safety Research. all his adult life at California’s Sonoma County Thanks to our members, and dedicated people Airport. He started as a ramp service employee like Manny, we can keep doing what is needed to and eventually ran his own fixed base operation, support safety in our industry — even when the Sonoma Aviation Fuel Services. Pilots from all sun doesn’t shine. over the U.S. knew him for his outstanding service and friendly manner. Even though he owned the place, he didn’t think twice about working the ramp and pumping gas himself. After living on that ramp for 54 years, he sold the business and William R. Voss started a small restaurant on the airport where he President and CEO could remain with his aviation family. Flight Safety Foundation www.flightsafety.org | AeroSafetyWorld | February 2009 | 1 AeroSafetyWorld
contents February2009 Vol 4 Issue 2 features A 11 CausalFactors | Midair over the Amazon
16 InSight | Investigation Turns Criminal S 11 18 CoverStory | 2008 Accident Review A 16 26 MaintenanceMatters | Error Management P 34 FlightOps | Attitude Adjustment
40 SafetyCulture | Rebuilding ASAP
44 FlightTraining | Mistrim Takeoff
departments 18 1 President’sMessage | When the Sun Doesn’t Shine 5 EditorialPage | Absolutely Nuts
6 AirMail | Letters From Our Readers
7 SafetyCalendar | Industry Events
8 InBrief | Safety News
2 | flight safety foundation | AeroSafetyWorld | February 2009 26 34 44
AeroSafetyWORLD telephone: +1 703.739.6700 24 LeadersLog | James C. May William R. Voss, publisher, FSF president and CEO [email protected] 32 | CASS 2009 Preliminary Agenda FoundationFocus J.A. Donoghue, editor-in-chief, FSF director of publications 48 DataLink | U.K. Business Jet Accident Rates [email protected], ext. 116 Mark Lacagnina, senior editor [email protected], ext. 114 53 InfoScan | Drive to Succeed Wayne Rosenkrans, senior editor [email protected], ext. 115 57 OnRecord | Engine Cowling Departs on Landing Linda Werfelman, senior editor [email protected], ext. 122 Rick Darby, associate editor [email protected], ext. 113 Karen K. Ehrlich, web and print production coordinator [email protected], ext. 117 Ann L. Mullikin, art director and designer [email protected], ext. 120 Susan D. Reed, production specialist [email protected], ext. 123 About the Cover Patricia Setze, librarian Most accidents in 2008 were familiar types. © Ron Stroud/Masterfile [email protected], ext. 103 Editorial Advisory Board We Encourage Reprints (For permissions, go to
www.flightsafety.org | AeroSafetyWorld | February 2009 | 3 Serving Aviation Safety Interests for More Than 60 Years
Officers and Staff light Safety Foundation is an international membership organization dedicated to Chairman, the continuous improvement of aviation safety. Nonprofit and independent, the Board of Governors Amb. Edward W. Stimpson Foundation was launched officially in 1947 in response to the aviation industry’s need President and CEO William R. Voss F for a neutral clearinghouse to disseminate objective safety information, and for a credible General Counsel and knowledgeable body that would identify threats to safety, analyze the problems and and Secretary Kenneth P. Quinn, Esq. recommend practical solutions to them. Since its beginning, the Foundation has acted in the Treasurer David J. Barger public interest to produce positive influence on aviation safety. Today, the Foundation provides
Administrative leadership to more than 1,170 individuals and member organizations in 142 countries.
Manager, Support Services Linda Crowley Horger MemberGuide Flight Safety Foundation Financial 601 Madison St., Suite 300, Alexandria, VA, 22314-1756 USA Chief Financial Officer Penny Young tel: +1 703.739.6700 fax: +1 703.739.6708 www.flightsafety.org Accountant Feda Jamous
Membership
Director, Membership and Development Ann Hill
Membership Services Coordinator Namratha Apparao
Membership Services Coordinator Ahlam Wahdan
Communications
Director of Communications Emily McGee Member enrollment ext. 105 Ann Hill, director, membership and development [email protected] Technical Seminar registration ext. 101 Director of Namratha Apparao, membership services coordinator [email protected] Technical Programs James M. Burin Seminar sponsorships ext. 105 Technical Ann Hill, director, membership and development [email protected] Programs Specialist Norma Fields Exhibitor opportunities ext. 105 Ann Hill, director, membership and development [email protected] Technical Specialist/ Safety Auditor Robert Feeler FSF awards programs ext. 111 Feda Jamous, accountant [email protected] Manager of Aviation Safety Audits Darol V. Holsman Technical product orders ext. 111 Feda Jamous, accountant [email protected] Library services/seminar proceedings ext. 103 Past President Stuart Matthews Patricia Setze, librarian [email protected] Founder Jerome Lederer Web Site ext. 117 1902–2004 Karen Ehrlich, web and print production coordinator [email protected]
flight safety foundation | AeroSafetyWorld | February 2009 Editorialpage Absolutely Nuts
t is ironic when governments, often on But the EU, in a misguided effort to adopted, airlines face the threat of hav- the lookout for risky airline behavior, protect consumers from airline abuses, has ing to pay a hefty penalty to hundreds of invent new rules that pressure airlines opened a new front in the battle between passengers if a flight is canceled, adding into making unsafe decisions. The government rules and safe operations. yet another financial pressure to the go/ IEuropean Union (EU) has done this, and A recent court case based on the EU’s no-go decision. seems very satisfied with its actions. Air Passenger Compensation Regulation, Not our problem, the court ruled: “The There always has been and always will which took effect in early 2005, set a new resolution of a technical problem caused by be a potential tug of war between aviation precedent. A family trying to make a con- failure to maintain an aircraft must [there- safety and money. For the most part, it nection in Rome had their first leg canceled fore] be regarded as inherent in the normal stays that way, just a potential conflict, because of an engine problem discovered exercise of an air carrier’s activity. Conse- especially in the world’s developed avia- the night before. In the end, it took 10 days quently, technical problems which come to tion markets where that threat is clearly to repair the engine and return the aircraft light during maintenance of aircraft or on recognized. to service, but the Commercial Court of account of failure to carry out such main- In the developing world, we see every Vienna, later affirmed by the European tenance do not constitute, in themselves, year the catastrophic results of failing to Court of Justice, ruled that the airline was ‘extraordinary circumstances.’” spend money on aviation safety basics, but not protected by the rule’s exemption for The European Commission “wel- most of the time, the financial pressures “extraordinary circumstances which could comed” the ruling, with European Com- are more subtle. However, the EU now has not have been avoided even if all reason- mission Vice-President Antonio Tajani moved far from subtlety to a rule of law able measures had been taken.” adding, "The effective respect of passen- that says if an airline cancels a flight, even Even though the rule states that one ger rights is one of our major priorities." due to a mechanical problem, it will owe of the “extraordinary circumstances” is Too bad the safety of flight is not so highly the flight’s passengers tens of thousands of “unexpected flight safety shortcomings,” regarded. euros, regardless of whether the operation the Vienna court said the airline owed A friend had the right words to de- of the flight would have been unsafe. the passengers €250. Compensation for scribe the EU’s position: “That’s absolutely It isn’t a new thing for governments to denied boarding can go as high as €600 nuts.” set up situations that might increase risk. per passenger, depending on the flight For example, noise abatement procedures length. can call for tailwind landings, increasing The engine problem in question was the risk of a runway excursion, and eve- so bad that no one would have considered ning curfews might push crews to rush flying with that engine, so safety was not J.A. Donoghue to beat the clock, possibly creating an at issue, at least in this case. But now, Editor-in-Chief unstabilized approach. as predicted when the regulation was AeroSafety World www.flightsafety.org | AeroSafetyWorld | February 2009 | 5 AirMail
Another checklist reminder simply skip an item and nearly impos- Furthermore, it is always attractive he recent article entitled “Deadly sible to skip an entire checklist such as to look at and brilliantly laid out. Omissions” [ASW, 12/08, p. 10] the “Taxi” checklist. One area it does Thanks very much to all involved Twas a great review regarding check- not address is the problem of “expecta- for such an outstanding publication. list use and design. While we know how tion bias.” It seems that most of the in- Keep up the great work. easy it is to become complacent about dustry considers the “say-look-touch” Rob Neil such a critical function as running confirmation technique as just that, Pacific Wings Magazine checklists, a reminder every now and pilot technique. Amberley, New Zealand then is certainly worthwhile. Perhaps it’s time to consider making After reading the article, I believe it part of the SOP. there is one more mitigation strategy Keith Baumgart that is worth suggesting. At the risk of Aviation Services promoting a piece of equipment or any Kraft Foods Global encourages vendor, there is a device we have had in Milwaukee AeroSafety World comments from readers, and will our cockpits for years that does a very assume that letters and e-mails nice job in addressing some of the issues. Honorific from the Pacific are meant for publication unless Compared to so much of what we just wanted you all to know how otherwise stated. Correspondence have in the cockpit today, the “Heads- much I enjoy seeing and reading is subject to editing for length Up” voice checklist is relatively low AeroSafety World. I and clarity. tech and relatively low cost. It includes I consider it to be — without ques- a light-emitting diode (LED) readout tion — the best aviation publication Write to J.A. Donoghue, director as well as the generated voice annun- of any kind that I have ever seen. It is of publications, Flight Safety ciation of each item, backed up for always extremely readable and inter- Foundation, 601 Madison St., minimum equipment list purposes by a esting (even subjects with the potential Suite 300, Alexandria, VA paper checklist. to be as dull as ditchwater are made 22314-1756 USA, or e-mail While nothing is foolproof, this readable and interesting ... as they
6 | flight safety foundation | AerosafetyWorld | February 2009 ➤ safetycalendar
FEB. 3–4 ➤ Aviation Crisis Management MARCH 15–18 ➤ Operations and MARCH 30–APRIL 2 ➤ International 2009. International Airport Review. Abu Technical Affairs Conference.Airports Operators Conference. National Business Dhabi, United Arab Emirates. Georgina Council International–North America. San Aviation Association. San Diego. Dina Green, Hooton,
www.flightsafety.org | AeroSafetyWorld | February 2009 | 7 inBrief Safety News Concorde Trial Set
manslaughter trial is scheduled from a Continental McDonnell for February 2010 for Continental Douglas DC-10 during takeoff from AAirlines, two Continental employ- the same runway several minutes ees and three former aviation officials earlier. The resulting tire failure sent charged in connection with the July 25, pieces of tire into one of the Con- 2000, crash of an Air France Concorde corde’s engines and a fuel tank; the after takeoff from Paris Charles de subsequent fire and loss of control Wikimedia Gaulle International Airport. The crash preceded the crash. killed all 109 people in the airplane and The BEA report said that the metal Flight Safety Foundation and other four on the ground. strip was a stainless steel wear strip from aviation organizations have denounced French prosecutors say the trial of the DC-10’s no. 3 engine. Maintenance the decision to proceed with criminal Continental, a Continental maintenance records showed that wear strips on prosecutions. technician, the airline’s chief of main- the engine fan reverser cowl had been “Absent willful intent or highly tenance, a former French civil aviation replaced during scheduled maintenance egregious conduct, we seriously question official and two former officials of the performed by Israel Aircraft Industries the basis for putting companies and Concorde manufacturing program is in Tel Aviv on June 11, 2000. On July aviation professionals through the ordeal expected to last about three months in 9, maintenance personnel in Houston of criminal prosecutions,” said Founda- a criminal court in Pontoise, a suburb noticed that the lower left wear strip was tion President and CEO William R. Voss. of Paris. twisted and sticking out of the cowl, and “In addition, we’re very concerned that The French Bureau d’Enquêtes et they replaced it. The BEA report said criminal prosecutions will discourage d’Analyses (BEA) said in its final re- that the replacement was not performed the free flow of information from opera- port on the accident that the Concorde in compliance with manufacturer tors to management to regulators, to the ran over a strip of metal that had fallen specifications. detriment of aviation safety.”
Simulator Requirements
he U.S. Federal Aviation Administration (FAA) is propos- ing to require the use of flight simulators to enhance New Beacons Ttraditional air carrier training programs for flight crewmembers. In a notice of proposed rulemaking (NPRM), the FAA said that the proposed change would require crewmembers to be trained and evaluated in “a complete flight crew environ- ment.” The proposal would require line oriented flight training (LOFT) in a full flight simulator during recurrent training, as well as training, testing and checking of flight crewmembers using a flight simulation training device. Other requirements would include special hazard training on loss of control and controlled flight into terrain, additional train- ing in crew resource management and annual performance drills © Boeing for flight attendants using emergency equipment and procedures. obtain proper clearances before crossing or entering active In addition, training and experience requirements for check runways, observe runway hold lines and other markings and dispatchers and dispatcher instructors would be standardized, lighting intended for surface movement guidance, and ensure supervised operating experience requirements would be put in that their takeoff calculations have been performed using the place for aircraft dispatchers, and requalification training would correct runway information. be developed for aircraft dispatchers and crewmembers. The changes prescribed by the proposal “make a significant Another provision addresses runway safety goals with a contribution to the FAA’s accident-reduction goal,” the agency said. requirement for operators to ensure that flight crewmembers The FAA said it would accept comments on the proposal use an airport diagram to help maintain positional awareness, until May 12.
8 | flight safety foundation | AeroSafetyWorld | February 2009 inBrief
Icing Warnings
new safety alert from the U.S. National Transportation Safety Board (NTSB) says that pilots should activate Aleading-edge deice boots as soon as icing is encountered, unless the aircraft flight manual or pilot operating handbook specifically tells them not to do so (ASW, 12/08, p. 20). “For 60 years, pilots have been taught to wait for a pre- scribed accumulation of leading-edge ice before activating the deice boots because of the believed threat of ice bridging,” the NTSB said, referring to a theory that early activation of the boots might push the ice into a frozen “bridge” around the U.S. National Aeronautics and Space Administration boot, making it ineffective. However, the safety alert said, “ice bridging is extremely In a related appeal, the U.K. Civil Aviation Authority rare, if it exists at all. Early activation of the deice boots limits (CAA) cautioned pilots and ground crew “to not underesti- the effects of leading-edge ice and improves the operating safety mate the dangers posed to aircraft of ice and ground frost this margin.” winter.” The safety alert also cautioned pilots to “maintain extreme- The CAA added, “Ultimately, an aircraft should never take ly careful vigilance” about airspeed and aircraft handling quali- off with any form of contamination on its surfaces, particularly ties, especially if the aircraft flight manual or pilot operating ice, snow and frost, although some types may be permitted handbook says that deice boots should not be activated until a some frost on lower wing surfaces.” specific amount of ice has accumulated. The CAA cited the January 2002 crash of a Bombardier The National Business Aviation Association (NBAA), how- Challenger 604 during takeoff from Birmingham International ever, urged operators to “continue to base their decisions about Airport, noting that the U.K. Air Accidents Investigation de-icing on their experience and judgment, because proving the Branch had said in its final report on the accident that the existence of ice bridging after an accident is difficult, and many airplane’s left wing had stalled at “an abnormally low angle-of- documented cases resulted in successful outcomes due to the attack due to flow disturbance resulting from frost contamina- skill and professionalism of the flight crew.” tion of the wing.” All five people in the airplane were killed.
New Beacons
ow that the international “With a 121.5/243 MHz beacon, regulations to require a switch to 406 program that coordinates the only one alert out of every 50 alerts is a MHz ELTs. Ndetection of distress signals genuine distress situation,” Cospas-Sarsat The Cospas-Sarsat decision affects has stopped monitoring signals from said. “This has significant effect on the all ELTs; all maritime beacons, known 121.5/243 MHz emergency locator resources of search and rescue services. as emergency position-indicating radio transmitters (ELTs), civil aviation With 406 MHz beacons, false alerts have beacons (EPIRBs); and all personal authorities are requiring aircraft to be been considerably reduced (about one locator beacons. Homing transmitters, equipped with 406 MHz ELTs. alert in 17 is genuine), and when [bea- man-overboard systems and other 121.5 The long-planned action by the cons are] properly registered, [signals MHz devices that do not require satellite International Cospas-Sarsat Programme from 406 MHz beacons] can normally detection are not affected. took effect Feb. 1. Cospas-Sarsat said be resolved with a telephone call to the it made its decision in the 1990s in beacon owner using the encoded beacon response to recommendations from the identification. Consequently, real alerts International Civil Aviation Organiza- can receive the attention they deserve.” tion and the International Maritime ICAO previously required 406 MHz Organization, which several years ago beacons on all international commercial acknowledged the superior speed and passenger aircraft and now recom- © SERPE-IESM accuracy of 406 MHz beacons in relay- mends their use on all other aircraft. In ing position information of aircraft and recent months, civil aviation authorities ships in distress. worldwide have begun changing their
www.flightsafety.org | AeroSafetyWorld | February 2009 | 9 inBrief
Increase Reported in U.K. Laser Incidents Filling the Gap
iting a “marked utomatic dependent surveil- increase” in incidents lance-broadcast (ADS-B) air Cin which powerful Atraffic surveillance technology hand-held lasers have been has helped eliminate an 850,000-sq- pointed at aircraft in flight, km (382,187-sq-mi) gap in Canadian the U.K. Civil Aviation Au- radar coverage over the Hudson Bay, thority (CAA) has issued Nav Canada says. guidance to air naviga- Nav Canada, which operates tion service providers Canada’s civil air navigation service, (ANSPs) on reporting the says that the use of ADS-B will provide events to law enforcement for more efficient use of airspace over authorities. the bay for about 35,000 flights every Wikimedia “The CAA has become year, as well as shorter flight times, aware of a significant increase in the misuse of hand-held, high-powered lasers lower fuel costs and reduced emissions against aircraft in flight,” the CAA said in an Air Traffic Services Information No- of greenhouse gases. tice (ATSIN). “Such lasers represent a danger not only to the safety of the aircraft The first flight across the bay us- but also to the health of the flight crew. To date, 150 instances have been reported ing ADS-B was an Air New Zealand to the CAA’s Safety Investigation and Data Department.” flight from London to Los Angeles The CAA said that, although detection, arrest and prosecution are handled on Jan. 15. Using ADS-B, controllers by the appropriate law enforcement officials, ANSPs must promptly notify police tracked the airplane on their displays of laser incidents. The ANSPs should “liaise with the local police force in order to as it was flown through Hudson Bay establish the most expedient and appropriate means of contact between the [air airspace, which previously had been traffic services] unit and the relevant police authority.” without radar coverage.
In Other News …
ustralia, one of the first coun- tries in the world to develop Amulti-crew pilot license (MPL) training, has graduated the
first six students from an MPL Press Day/Associated © Steven program. The six cadets, from two Chinese airlines, completed flight assessments in December 2008. … The U.S. Federal Aviation Adminis- tration has lowered Israel’s aviation safety standard rating following a 2008 evaluation of the Israeli civil aviation authority. The Category 2 rating is given to coun- tries that lack laws or regulations to oversee air carriers in accordance with International Civil Aviation Passengers on a US Airways Airbus A320 wait on the wings to be rescued by Organization (ICAO) standards or Hudson River ferries after the airplane was ditched on Jan. 15 following takeoff countries that do not meet ICAO standards in specified areas such as from LaGuardia Airport in New York. None of the 155 people in the airplane was technical expertise and inspection killed; one person received serious injuries. Preliminary reports said that both procedures. engines lost power following multiple bird strikes.
Compiled and edited by Linda Werfelman.
10 | flight safety foundation | AeroSafetyWorld | February 2009 causalfactors
BY MARK LACAGNINA
he airplanes converged nearly head-on, striking their left wings first. The business jet lost most of its left winglet and the tips of the left horizontal stabilizer and elevator, but it remained controllable and was Tlanded without injury to the seven people aboard. The air- liner initially lost about a third of its wing and then broke up during a spiral dive into the Amazon rain forest; all 148 passengers and six crewmembers were killed. The 282-page final report by the Brazilian Aeronautical Accident Investigation and Prevention Center — the Centro de Investigação e Prevenção de Acidentes Aeronáuticos (CENIPA) — concludes that loss of situational awareness
U.S. National Aeronautics and Space Administration National Aeronautics U.S. by the Embraer Legacy 600 pilots and by the air traffic
Controversial Brazilian report cites over the lossMidair of situational awareness by pilots and controllers. www.flightsafety.org | AeroSafetyWorld | February 2009 Amazon | 11 causalfactors
on a scheduled flight from Manaus to Rio de Janeiro, with a technical stop at Brasília.
Partial Clearance The report said that because of their haste to de- part — to avoid flying over the Amazon at night — the Legacy flight crew did not have adequate knowledge of the flight plan that had been prepared for them by Embraer personnel. It also concluded that transmission of an incomplete departure clearance by the ground controller at the São José dos Campos airport “favored the understanding by the pilots that they had to maintain FL 370 all the way to Manaus.” The Brasília Area Control Center (ACC) had given the ground controller a clearance that specified three flight levels: FL 370 on Airway UW2 to the Brasília VHF omnidirectional radio (VOR), FL 360 from the VOR to an intersection on Airway UZ6, and FL 380 thereafter. When The Legacy pilots controllers handling the flights were among sever- the ground controller relayed the clearance to experienced control al factors that led to the business jet proceeding out the Legacy pilots, he included only the initial difficulties after the of radar and radio contact — and with a nonfunc- flight level, saying, in part, “clearance to Edu- collision but were tioning transponder and traffic alert and collision ardo Gomes [the Manaus airport], Flight Level able to land the avoidance system (TCAS) — at a flight level that three seven zero.” airplane. The 737 placed it in conflict with the Boeing 737-800. “As a result, the pilots understood that FL 370 descended out of The report’s findings and conclusions have was cleared up to Manaus,” the report said. “In control after losing been questioned by organizations that include an interview … the pilots of N600XL confirmed the outer portion of the U.S. National Transportation Safety Board this understanding.” its left wing. (NTSB), a party to the investigation. NTSB said, The Legacy departed at 1751 coordinated uni- for example, that although the report acknowl- versal time (1451 local time). The airplane was on edges air traffic control (ATC) safety deficien- Airway UW2, which has a centerline track of 006 cies, it does not provide sufficient analysis of the degrees, and 52 nm (96 km) south of the VOR deficiencies or include them in conclusions about about one hour later when it was handed off by the cause of the accident. the Brasília ACC Sector 5 controller to the Sector The collision occurred in visual meteorolog- 7 controller. The Sector 5 controller did not tell ical conditions at Flight Level (FL) 370 (approxi- the Sector 7 controller or the pilots that a change mately 37,000 ft) the evening of Sept. 29, 2006. from FL 370 to FL 360 was to be made before the Both airplanes were nearly brand-new. The airplane crossed the VOR and began navigating Legacy, N600XL, had been purchased by Excel on the 335-degree centerline track of UZ6. Aire Services, a U.S.-based charter and aircraft Noting that the Brasília VOR is well within management company, and was en route from Sector 5 airspace, NTSB said that the hand-off the Embraer factory at São José dos Campos to was made “unusually early” and that it was the Fort Lauderdale, Florida, U.S., with an overnight Sector 5 controller’s responsibility to instruct technical stop at Manaus, Brazil. The 737, PR- the crew to descend to FL 360. “Alternatively, he GTD, had entered service with Gol Transportes should have either changed the data [shown on Photo: Agência Brasil/Wikipedia.org; illustration: CENIPA and Susan Reed Brasil/Wikipedia.org; illustration: CENIPA Agência Photo: © Chris Photography Sorensen Aéreos the month before the accident and was the ATC radar displays] to accurately reflect the
12 | flight safety foundation | AeroSafetyWorld | February 2009 causalfactors
clearance [i.e., the assigned altitude] or advised not adequately addressed by the report (see the Sector 7 controller of the actual clearance.” “Missed Opportunity,” p. 14). The report said that the Sector 7 control- ler assumed that the crew already had been Squawk Stopped instructed to descend to FL 360 even though the Seven minutes after the airplane crossed the copilot reported that they were maintaining FL VOR — its transponder stopped replying to 370 when they established radio communication ATC radar interrogations. The report said that with him. After the controller told the crew that neither the pilots nor the controller noticed the airplane was in radar contact and the copilot this, and that cockpit voice recorder data indi- acknowledged the information, there was no cated that the attention of both pilots was fo- further communication between the crew and cused on conducting performance calculations ATC until after the collision. for the landing and takeoff at Manaus. “With adequate planning, this task should have been ‘Bad System Design’ finished on the ground before departure,” the NTSB said that a change on the controller’s report said, noting that the pilots had found radar display when the airplane neared the VOR after they were under way that the preflight at 1855 likely contributed to the controller’s paperwork assembled by Embraer included a misunderstanding of the assigned flight level. notice to airmen about a reduction of the avail- The aircraft data blocks on Brazilian ATC radar able runway length at the Manaus airport. All 154 people aboard displays show two flight levels, side by side Investigators were unable to determine con- the 737 were killed and separated by a symbol. On the left is the clusively how the transponder had been switched when the airplane Mode C flight level transmitted by the aircraft’s to the standby mode, which requires pressing the broke up during transponder; next to it is the “cleared flight level” transponder/TCAS button — one of 12 buttons descent and crashed that has been issued, and entered in the data on the sides of a radio management unit (RMU) in the rain forest. block, by a controller. Normally, the symbol “=” appears between the two flight levels. However, the cleared flight level automatical- ly changes to the “requested flight level” about two minutes before the aircraft crosses a naviga- tion fix at which a level change should be made. Thus, when the Legacy neared the Brasília VOR, the flight level information displayed in its data block changed from “370=370” to “370=360.” Nevertheless, the controller did not notice that the airplane was “flying at a flight level that was different from the flight level requested in the active flight plan,” the report said. Noting that the report did not fault the flight level display itself, NTSB said that “a design in which two distinctly different pieces of informa- tion — that is, requested altitude and cleared altitude — appear identical on the display is clearly a latent error.” A similar opinion was expressed by the International Federation of Air Traffic Controllers’ Associations, which called the flight-level-display feature “non-error-
Eraldo Peres/Associated Press Eraldo Peres/Associated tolerant … and a bad system design” that was © Chris Photography Sorensen
www.flightsafety.org | AeroSafetyWorld | February 2009 | 13 causalfactors
the flight level display in the data block ‘Missed Opportunity’ would have changed from “370=360” to “370Z360,” to indicate that the airplane was being tracked by primary radar he final report on the midair system design” that created a trap for collision failed to provide “clear the pilots and controllers involved with an altitude sweep. This system is Tconclusions” about known prob- in the collision. The accident report intended to be used only for military lems in the Brazilian air traffic control discusses this feature but includes no aircraft in emergency or air-defense situ- (ATC) system and how they contrib- recommendation about it. ations. However, the “Z” also is automati- uted to the accident, said a position “IFATCA thinks the identified cally displayed when a civil aircraft stops statement issued in January by the shortcomings in the CENIPA report replying to radar interrogations. International Federation of Air Traffic are a missed opportunity for the Controllers’ Associations (IFATCA). Brazilian aviation authorities to “Although the system presented the “Whereas the inquiries in regard to restore trust and safety in the national prescribed indications for the loss of the events in the cockpit of the Legacy aviation system. This final accident the N600XL transponder, they did not private jet seem to have received a lot report could have served as the draw the attention of the controller to of attention and were done with rather starting point for an extensive and the need for changing the flight level,” detailed care by CENIPA [the Brazilian desperately needed healing process. the report said. It also said that during Aeronautical Accident Investigation … This has unfortunately not oc- and Prevention Center], the same can- curred, as CENIPA — an integral part the 57 minutes preceding the collision, not be said for investigations on the of the same Brazilian Air Force that the Legacy pilots failed to notice a tran- ATC side,” said the federation, which is responsible for the provision of air sponder “STANDBY” indication on the represents more than 50,000 control- traffic control — has chosen to put RMUs and a “TCAS OFF” indication lers in 130 countries. the main responsibility for the midair on the primary flight displays. For example, IFATCA noted a “non- collision of 2006 on the front-line At 1926 — 34 minutes after the last error-tolerant” ATC software feature operator only. This CENIPA decision that occasionally changes the flight appears driven by a reluctance to ex- radio communication — the Sector 7 level shown on the controller’s radar pose staff and departments situated relief controller made the first of seven display, with no input by the control- in its own organization.” calls to the Legacy, which had by then ler. The federation called this a “bad — ML flown beyond the area covered by the last assigned radio frequency. The controller’s calls were made simultane- — twice within 20 seconds. The report away from delicate instruments which ously on six radio frequencies. However, said that the most likely explanation is could be damaged if contacted inadver- NTSB said that he “never attempted to that the pilot inadvertently switched tently,” the report said. try a relay through other flight crews, the transponder to standby while using NTSB said that misuse of the footrest the emergency frequency or any other other RMU features for the performance is another possibility. “In certain forward means to treat the flight under lost- calculations. seat positions, there appeared [during ob- communication procedures.” The board Among other possibilities consid- servation flights] to be a very comfortable said that the controller also failed to ered was that a laptop computer acci- resting position that involved resting the inform the Amazonic ACC, which dentally struck the transponder/TCAS feet on top of the footrest guards rather was handling the 737, about the loss of button on one of the RMUs when it was than inside the designated footrest areas,” radio and radar contact with the Legacy. passed between the pilots. However, it the board said. “This … located the At 1948, the copilot began using was determined that the control yoke captain’s right foot in the area of the RMU the five Sector 7 frequencies shown on would have prevented this. so it could make unintended contact his navigation chart in an attempt to Another possibility is that the but- without the captain’s awareness.” re-establish radio communication with ton was accidentally struck when the ATC; he made 19 calls. However, only pilot placed a foot on the footrest at Warnings Undetected one of the frequencies shown on the the bottom of the panel. However, “the While briefing his relief controller at 1918, chart actually was usable. Two of the footrest has a metal plate, called a foot the Sector 7 controller said that the Lega- frequencies had not been selected at the protector, designed to keep the foot cy was maintaining FL 360. At this point, controller’s console, one was erroneous,
14 | flight safety foundation | AeroSafetyWorld | February 2009 causalfactors
and one had not been “connected” to the thick forest in the county of Peixoto de copilot, 34, had 6,400 flight hours, center’s audio equipment, the report said. Azevedo, Mato Grosso State.” including 3.5 hours in type and nearly The copilot heard part of the con- 400 flight hours as pilot-in-command troller’s last transmission at 1956. He Misplaced Blame? of Embraer regional jets, which are requested that the controller repeat the Among the report’s conclusions was that similar to the Legacy. message, but his call was not heard. The the Legacy crew had not been trained The report also concluded that the collision occurred one second later. adequately and had not prepared prop- pilots were distracted by the perfor- The Legacy rolled left and began erly for the delivery flight, and that their mance calculations and lost situational to descend, but the crew was able to limited experience with the airplane and awareness. “Although they were main- regain control. They used the emer- its avionics equipment was a likely factor taining the last flight level authorized by gency frequency, 121.5 MHz, to relay in the inadvertent deactivation of the [ATC], they spent almost an hour flying a message to Amazonic ACC through transponder and TCAS. at a nonstandard flight level for the the crew of a Polar Air Cargo aircraft NTSB said that the facts do not heading being flown and did not ask for that they were declaring an emergency support these conclusions. “The crew any confirmation from ATC,” it said. because of flight control difficulties and flew the route precisely as cleared and The controllers were faulted for fail- would conduct an emergency landing complied with all ATC instructions,” it ing to provide proper traffic separation. at the military airport in Cachimbo, said. “Although the transponder outage “The air traffic control units involved … about 100 nm (185 km) ahead. was likely because of an inadvertent ac- did not correct the flight level and did “After landing, the N600XL crew re- tion, no evidence in the factual record not perform the prescribed procedures ported that their airplane had collided indicates that a lack of familiarity with for altitude verification when they in flight with an unknown object,” the the avionics is related to the outage.” stopped receiving essential information report said. “The wreckage of the [737] The pilot, 42, had 9,388 flight hours, from [the Legacy’s] transponder,” the was found the next day … in a region of including 5.5 hours in the Legacy. The report said. “The controllers assumed that the traffic was at a different flight Brazilian investigators considered the possibility that the Legacy’s transponder might have level without even being in two- been deactivated when the captain’s foot, when placed on the footrest shown by the arrow, way radio contact with N600XL for inadvertently touched the radio management unit above and to the right of the footrest. confirmation.” NTSB said that its analysis of the facts led to the conclusion that the probable causes of the accident were “ATC clearances which directed [the pilots of both airplanes] to operate in opposite directions on the same airway at the same altitude. … The loss of ef- fective air traffic control [resulted from] a combination of numerous individual and institutional ATC factors which reflected systemic shortcomings.” A separate investigation was con- ducted by the Brazilian Federal Police and resulted in criminal charges against the Legacy pilots and several of the controllers (see “Investigation Turns Criminal,” p. 16).
This article is based on Final Report A-00X/ CENIPA/2008, available online at Benjamin Schuhmann/Jetphotos.net gov/Aviation/Brazil-CENIPA.htm>. 15 | www.flightsafety.org | AeroSafetyWorld | February 2009 | 15 insight © DECEA BY EDVALDO PEREIRA LIMA Investigation TurnsPilots, controllers indicted in wakeCriminal of collision that rocked Brazil. ore than two years after the crippled inquiry that was initiated immediately after the Gol Boeing 737-800 crashed in the accident and later turned into a criminal inves- Amazon rain forest, the global avia- tigation by federal prosecutor Thiago Lemos tion community received much- de Andrade. Contrary to the traditional global Manticipated news about legal cases resulting aviation paradigm of non-criminalization of from the midair collision that downed the 737, air accidents, the justice system in Brazil went killing 154 people. by the letter of the law, Article 261 of its penal A few days before the Aeronautical Accident code. The article paves the way for criminal Investigation and Prevention Center (CENIPA, punishment of people “who expose aircraft to a unit of the Brazilian Air Force) made public peril” with imprisonment for six months to 36 its final report on the collision in December years, depending on whether the person’s ac- 2008, federal judge Murilo Mendes pronounced tions resulted in a crash and loss of life. his first verdicts in a parallel investigation by Other articles of the penal code establish federal police that indicted the two pilots of the two different degrees of guilt, depending on ExcelAire Embraer Legacy business jet that col- whether the event is judged to have resulted lided with the 737, and two air traffic controllers from intentional or unintentional criminal (ATCOs) and two assistant ATCOs who were on behavior. Unintentional behavior includes poor duty when the accident occurred. airmanship (the lack of proper professional His decisions to drop some charges and skills), negligence (careless performance) and amend others related to a federal policy imprudence. 16 | flight safety foundation | AeroSafetyWorld | February 2009 dence, or professional poor performance, in but isjudged to be still on charges of impru negligence unintentional of charge a from free Lucindo Tibúrcio deAlencar. Alencar is now ATCO to flight the off handing when mation and for providing incorrect level flight infor Legacy the of handling his in guilt intentional Fernandes dosSantos from intentional to un Jomarcelo ATCO against charge the reduced and Barros, de José Leandro and Reis dos Santos Felipe ATCOs assistant ACC Brasília Braziliantheir counterparts. U.S. are who court officers cooperating with before testify to them allowed has that States treatya legal Brazil and between United the to continue judged being likely are Paladino and Lepore transponder. their off turning inadvertently allegedly for omnidirectional radio)and airmanship poor VOR(VHF Brasília the crossing after soon 360 FL to 370 Level Flight from descent a designated that plan flight a following not pilotsthe facecharges still of imprudence for but Mendes dropped charges. those However, began, (ACC) Center Control Area Brasília radiocommunicationwhen problems with the guilt for prescribed procedures neglecting unintentional of charges faced Paladino, Paul Gol 737 was en route from Manaus to Brasília Brasília to Manaus from route en was 737 Gol The Manaus. to way the all 370 FL maintain would they that believe to pilots the caused allegedly This segment. flight later a for VOR and that aclimb to FL380was required Brasília the crossing after required was 360 FL to descent a that clarify not did but 370, level, clearancerules that included flight initial the flight instrument an issued Silva that is tion to United the States Manaus. via The conten flight its on departed Legacy the when airport Campos dos José São the at control ground of charge in was Silva da Batista João court. to frequencies. alternate through pilots Legacy the with tion to re-establishnot trying radiocommunica www Mendes dropped all charges against against charges all dropped Mendes Jan and Lepore Joseph pilots, ExcelAire The Mendes now wants ATCO to bring afifth .flightsafety.org | AeroSafety in absentia World World | F ebruary 2009 ebruary through through - - - - - tions and safety threats ( and publicly denounced working poor condi slowed they when down or stopped air traffic system to its on knees three different occasions that nearly draggedBrazilian the air transport military. is systemic, involving management poor by the prove his defense thesis, that real the problem chargesdismissed against two of controllers the attorney, Sobral, points Roberto out that the control air traffic military country. inthe Their ian Air Force, manages which civilian both and procedure. pilots adheredLegacy to standard operating the to relayed he clearance the that contends Silva occurred. collision the when 370 FL at in Brazil. Edvaldo Pereira Lima an is aviation journalist living roads on issues. both ATCthe system. Brazil is approaching cross of control military of effectiveness the Brazil, in and, information safety aviation of flow free nonpunitive standard to designed protect the collision include criminalization versus the it is apparent that issues the resulting from the tion of human rights. tions International of Justice Court for viola next move to appeal be to United will the Na his work, not does that if and, Court Supreme the to appeal will he guilty, judged ATCOs are the if that says He Bueno. Carlos Luís Brig. Air mander of air the force, and his predecessor, Lt. denouncing Lt. Air Juniti Brig. Saito, com Brazil of Court Supreme the to statements as retaliation.sees since actionsjailed then, that attorney Sobral of ATCO Associations have sued, or fired been About 98members of Brazilian the Federation andruling, thus many placed of on them trial. of enlistment, their are they subject to military are members by of choice free the military the air force took position the that ATCOs because The collision stirred areaction by ATCOs The ATCOs are sergeants all Brazil inthe As these legal proceedings move forward, forward, move proceedings legal these As sent has Sobral reasons, other and this For ASW , 11/07,p. 18).The - - - - - - [email protected]. V S F publications, of J. to opinions. S and con, abouttheexpressed constructive discussion,pro stimulating for and safety aviation to importance of issues about opinions personal I n oundation, 601Madison t., A 22314-1756USAor S ight is a forum for expressing expressing for forum a is ight S A uite 300, 300, uite . . D onoghue, director director onoghue, end your comments A lexandria lexandria F light light in sight S afety afety | 17 U.S. National Aeronautics and Space Administration Coverstory Steady State BY JAMES M. BURIN Accident categories in 2008 were mostly familiar, including the unwelcome return of the no-flaps takeoff. A Boeing 737 verage to below average” is the best way to describe the year 2008 in terms of was destroyed safety performance for all segments of professional aviation, including com- in a runway mercial and corporate jets and commercial turboprops. The big killers remain, excursion on particularly loss of control in commercial jets and controlled flight into terrain “(CFIT)A in commercial turboprops. Even though there are occasionally new types of acci- takeoff at Denver International dents — for example, the British Airways Boeing 777 landing accident at London Heathrow Airport. — the majority of accidents in 2008 are types we have seen before, including CFIT, runway excursion and no-flap/no-slat takeoff. This raises the question, why are we failing to fully benefit from aviation safety lessons learned? The total fatality count in all commercial jet, commercial turboprop and corporate jet major accidents was 688, down from 763 in 2007 and well under the 903 deaths reported in 2006. Last year, the commercial jet fleet grew approximately 3 percent over 2007 numbers, while the commercial turboprop fleet stayed virtually unchanged. The corporate jet num- bers showed the largest change, with a 9 percent increase. Some 8 percent of the world’s commercial jet fleet is Eastern-built, while approximately one-third of the turboprop fleet is Eastern-built. The active fleets, the aircraft actually in service, are somewhat smaller. Approximately 7 percent of the jet fleet is inactive, while 14 percent of the turboprop fleet is inactive. © David Zalubowski/Associated Press © David 18 | flight safety foundation | AeroSafetyWorld | February 2009 coverStory on takeoff. There were Major Accidents, Worldwide Commercial Jets six commercial jet loss Jan. 1, 2008–Dec. 31, 2008 of control accidents Date Operator Aircraft Location Phase Fatalities in 2008, nearly one of Jan. 2, 2008 Iran Air F-100 Tehran, Iran Takeoff 0 every three accidents. Jan. 17, 2008 British Airways 777 London, England Landing 0 The major accident Feb. 1, 2008 LAB 727 Trinidad, Bolivia En route 0 rate for Western-built commercial jet aircraft Feb. 14, 2008 Belavia CRJ-100 Yerevan, Armenia Takeoff 0 in losses per million April 15, 2008 Hewa Bora Airways DC-9 Goma, Democratic Takeoff 3 Republic of Congo departures for the May 25, 2008 Kalitta Air 747 Brussels, Belgium Takeoff 0 last 10 years had been decreasing but now has May 30, 2008 TACA A320 Tegucigalpa, Honduras Landing 3 leveled (Figure 1, p. June 10, 2008 Sudan Airways A310 Khartoum, Sudan Landing 29 20). The rate is only for June 30, 2008 Ababeel Aviation Il-76 Khartoum, Sudan Takeoff 4 Western-built aircraft July 6, 2008 USA Jet Airlines DC-9 Saltillo, Mexico Approach 1 because, even though July 7, 2008 Kalitta Air 747 Bogotá, Colombia Takeoff 0 we know the number Aug. 20, 2008 Spanair MD-82 Madrid, Spain Takeoff 154 of major accidents for Eastern-built aircraft, Aug. 24, 2008 Itek-Air 737 Vishkek, Kyrgyzstan Approach 65 we do not have reliable Aug. 30, 2008 Conviasa 737 Toacaso, Ecuador En route 3 worldwide exposure Sept. 14, 2008 Aeroflot Nord 737 Perm, Russia Approach 88 data to calculate rates Sept. 22, 2008 ICARO F-28 Quito, Ecuador Takeoff 0 for them. There were 12 ma- Nov. 10, 2008 Ryanair 737 Rome, Italy Approach 0 jor accidents involving Nov. 27, 2008 XL Airways Germany A320 Perpignan, France Approach 7 corporate jet aircraft Dec. 20, 2008 Continental Airlines 737 Denver, Colorado, U.S. Takeoff 0 in 2008, killing 39 people (Table 2, p. 21). Loss of control accident Controlled flight into terrain accident Approach and landing accident Runway excursion Reliable worldwide exposure data is not Source: Ascend, Aviation Safety Network available to calculate Table 1 rates for corporate jets, Reviewing 2007 data for commercial jet ma- but assuming that exposure has been increasing jor accidents in all scheduled and unscheduled along with the annual increases in aircraft in the passenger and cargo operations for Western- corporate jet fleet and their number of depar- and Eastern-built commercial jet aircraft, there tures, the accident rate is estimated to be decreas- were 17 major accidents, 16 involving Western- ing slightly. There also were 12 corporate jet built aircraft, killing 583 people. Of the 17 acci- accidents in 2007; 21 people died as a result. dents, 12 were approach and landing accidents, In 2008, there were 29 major accidents two were CFIT accidents and four were loss of involving Western- and Eastern-built turboprop control accidents. aircraft with more than 14 seats, causing 292 In 2008, there were 19 major accidents, one deaths, compared to 24 accidents in 2007 that of which was an Eastern-built jet; fatality totals killed 159 (Table 3, p. 22). Eight of this year’s 29 declined to 357 (Table 1). Only eight of the 2008 major turboprop accidents were CFIT accidents, accidents were approach and landing accidents, more than one of every four. and two were CFIT accidents. Six of the 19 major Focusing on specific high-risk accident accidents were runway excursions, four occurring categories shows that CFIT, loss of control, and www.flightsafety.org | AeroSafetyWorld | February 2009 | 19 Coverstory A Fokker F-28 ran off the runway during takeoff at Quito, Ecuador. Press Ochoa/Associated © Dolores approach and landing accidents continue to claim system (TAWS) installed, we still suffered 10 the majority of the aircraft and account for the CFIT accidents during that period. There has majority of the commercial aircraft fatalities. never been a CFIT accident involving an aircraft There were two commercial jet CFIT accidents equipped with a functional TAWS. in 2008. The CFIT accident record over the years Last year was the first in recent memory shows the difficulty the industry has encountered that fewer than half of the commercial jet and in eliminating CFIT as an accident class. corporate jet accidents occurred during approach Although fewer than 10 percent of commer- or landing. Flight Safety Foundation and its cial jets in the world during the past four years CFIT and Approach and Landing Action Group did not have a terrain awareness and warning (CAAG) team started their worldwide approach and landing accident reduction (ALAR) cam- Western-Built Commercial Jet Major Accident Rates, 1997–2008 paign in 2001. There are now more than 40,000 FSF ALAR Tool Kits distributed, and the CAAG 1.2 Major accident rate team has conducted 30 ALAR workshops around Five-year moving average 1.0 the world — four in 2008, including one in Trip- oli, Libya. It is hoped that some of the success we 0.8 are now seeing in reducing the incidence of ap- 0.6 proach and landing accidents is the result of the CAAG team’s efforts. The Foundation is updating 0.4 its ALAR data, and an updated ALAR Tool Kit, to 0.2 include a module on reducing the risk of runway excursions, will be available in 2009. Accident rate per million departures rate Accident 0.0 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 The loss of control accident category, how- Year ever, has taken over from CFIT as the leading Note: Total departure data are not available for Eastern-built aircraft. killer in commercial jets (Figure 2, p. 23). The Source: Ascend term “loss of control” is somewhat misleading, since many times in this type of accident the Figure 1 flight crew has full control of the aircraft. The 20 | flight safety foundation | AeroSafetyWorld | February 2009 coverStory FSF definition for a loss of control accident is progress in reducing the risk of these high- “an accident in which an aircraft is unintention- fatality accident types. ally flown into a position from which the crew is To help reduce risk, there are many chal- unable to recover due to either aircrew, aircraft, lenges that need to be addressed. One of these environment or a combination of these factors.” is safety culture. Safety culture is a very popular There are basically two types of loss of con- topic these days, and rightfully so. It is a criti- trol accidents. First, there is the type in which cal element in reducing risk. There are multiple upset recovery train- ing will reduce the Major Accidents, Worldwide Corporate Jets, Jan. 1, 2008–Dec. 31, 2008 risk and if possible prevent the accident. Date Operator Aircraft Location Phase Fatalities In most of these cases Feb. 1, 2008 Symons Living Trust Citation I Augusta, Maine, U.S. Climb 2 the crew has full con- Feb. 18, 2008 Avion Sales Citation III Venezuela En route 3 trol of the aircraft at March 4, 2008 Southwest Sports Clinic Citation I Oklahoma City, Takeoff 5 all times, such as the Oklahoma, U.S. Adam Air and Flash March 4, 2008 Confort Vuela HS125-800 Monterrey, Mexico Landing 0 Air accidents. The March 30, 2008 Relton Muse Aviation Citation I London, England Climb 5 second type of loss June 12, 2008 FAI Rent-a-Jet Lear 35 Kisangani, Democratic Takeoff 0 Republic of Congo of control accident July 30, 2008 My Aviation Eclipse 500 West Chester, Takeoff 0 is one in which no Pennsylvania, U.S. amount of upset July 31, 2008 East Coast Jets Hawker 800 Owatonna, Approach 8 recovery training will Minnesota, U.S. help — for example, Aug. 18, 2008 Corus Hardware Corp. Citation I Santo Domingo, Climb 1 taking off with ice on Dominican Republic the wings, or taking Sept. 19, 2008 Inter Travel and Lear 60 Columbia, South Takeoff 4 Services Carolina, U.S. off with retracted Nov. 4, 2008 Mexican Government Lear 45 Mexico City, Mexico Approach 9 flaps and slats. As Dec. 7, 2008 Tlaxcala State Lear 23 Tlaxcala, Mexico Approach 2 the data show, we are Government © Marc-Antony Payne/Airliners.net © Marc-Antony not making much Loss of control accident Controlled flight into terrain accident Runway excursion Source: Ascend, Aviation Safety Network Table 2 A Boeing 777 landed short after power was lost in both engines on final approach to London Heathrow Airport. www.flightsafety.org | AeroSafetyWorld | February 2009 | 21 Coverstory definitions of safety culture, such as “the shared way we do things around here”; or even “what values, beliefs, assumptions and norms that gov- you do when nobody is looking.” Many people ern decision making that may affect individual stress the need for a safety culture, or express the and group attitudes about risk, safety and the desire to establish a safety culture in their organi- proper conduct of hazardous operations”; or “the zation. Those sorts of discussions are misguided. Every organization Major Accidents, Worldwide Commercial Turboprops has a safety culture — Jan. 1, 2008–Dec. 31, 2008 it is impossible not to Date Operator Aircraft Location Phase Fatalities have a safety culture. Jan 4, 2008 Transaven LET-410 Caracas, Venezuela Descent 0 What is needed is a Jan. 14, 2008 Alpine Aviation Beech 1900 Lihue, Hawaii, U.S. Landing 1 positive safety culture. Jan. 25, 2008 Aero Servis AN-12 Point Noire, Congo Landing 0 Likewise, a strong safety culture is not Jan. 26, 2008 Dirgantara Air Services CASA 212 Indonesia En route 3 necessarily desirable. Feb. 21, 2008 Santa Barbara Airlines ATR-42 Venezuela Climb 46 An organization can March 6, 2008 Manunggai Air Transal C-160 Vamena, Indonesia Landing 0 have a very strong March 15, 2008 Wings Aviation Beech 1900 Nigeria En route 3 safety culture, and it March 19. 2008 Cirrus Airlines DO-328 Mannheim, Germany Landing 0 can be all negative. April 3, 2008 Blue Wing Airlines AN-28 Benzdrop, Suriname Approach 19 What we want to do to reduce risk is to April 9, 2008 Avtex Aviation Metroliner III Bundeema, Australia Climb 7 create and maintain a April 11, 2008 Kata Air Transport AN-32 Chisinau, Moldova Landing 8 positive safety culture. April 21, 2008 RICO Linhas Aéreas Bandeirante Coari, Brazil En route 0 A positive safety May 2, 2008 Flex Air Beech 1900 Rumbek, Sudan En route 21 culture is unique in May 23, 2008 Alpine Aviation Beech 1900 Billings, Montana, U.S. Takeoff 1 many ways, and here May 26, 2008 Moskovia Aviation AN-12 Chelyabinsk, Russia Climb 9 are two. First, it cannot May 26, 2008 Great Lakes AN-32 Goma, DRC Landing 0 be purchased. No mat- June 15, 2008 China Flying Dragon Y-12 Chifeng, China En route 3 ter how much money your chief executive June 18, 2008 Wiggins Airways DHC-6 Hyannis, Massachusetts, U.S. Takeoff 9 officer (CEO) is will- June 27, 2008 Juba Air Cargo AN-12 Malakai, Sudan En route 7 ing to spend, you July 10, 2008 Aerocord Beech 99 Puerto Montt, Chile Takeoff 9 cannot buy a positive July 14, 2008 Maldivian Air Taxi DHC-6 Maldives Landing 0 safety culture. It must July 16, 2008 North-Wright Airways DHC-6 Hook Lake, Canada Approach 0 be created. Second, a Aug. 13, 2008 Fly540 F-27 Mogadishu, Somalia Approach 3 positive safety culture Sept. 1, 2008 AirServ International Beech 1900 Bukavu, Democratic Approach 17 is the single most Republic of Congo important element Sept. 1, 2008 Air Tahoma CV-580 Columbus, Ohio, U.S. Approach 3 of a successful safety Sept. 13, 2008 MAS Wings DHC-6 Ba Kelalan, Malaysia Approach 0 program. You cannot Oct. 8, 2008 Yeti Airlines DHC-6 Lukla, Nepal Approach 18 have a successful flight Nov. 6, 2008 Xpressair DO-328 Fak Fak, Indonesia Approach 0 operational quality Nov. 13, 2008 British Gulf AN-12 Falluja, Iraq Climb 7 assurance program, an International Airways aviation safety action Loss of control accident Controlled flight into terrain accident Runway excursion program or establish Source: Ascend a just culture without the cornerstone of a Table 3 positive safety culture. 22 | flight safety foundation | AeroSafetyWorld | February 2009 coverStory You can institute a safety management Loss of Control Major Accidents, Commercial Jets, 1997–2008 system (SMS) without a positive safety culture, but don’t expect it to be success- ful. Your SMS may influence your safety 6 culture. Your safety culture will influ- 5 5 ence your SMS. A positive safety culture must 4 4 4 4 be fully supported by the top of the 3 3 3 organization. If it is not supported there, it will not last. Changing the 2 Number of accidents safety culture in an organization is an 1 evolutionary process, not a revolu- tionary process. In other words, the 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 change takes a while — any existing Year corporate culture, regardless whether it is positive or negative, has a lot of Source: Ascend, Boeing momentum to overcome. No matter Figure 2 how many statements the CEO has signed or how many of the right words members of the organization that their accidents happened in organizations he uses, you cannot fake a positive leaders are committed to safety. without a culture assessment workshop. safety culture. If the organization from Many organizations do not only That is one reason why these assessment top to bottom does not practice the measure safety culture or climate, but workshops are now mandatory for all words they publish, the safety culture can compare one organization’s safety Naval aviation organizations. will be bad. culture to similar organizations. Even All this information on safety Today, several aviation organiza- better, they can provide recommenda- culture and the adoption of a positive tions, particularly in the military, are tions on how to improve weak areas safety culture will not reduce anyone’s measuring their safety culture, or their identified in a safety culture. risk to zero. But it will reduce risk. safety climate. Climate is an important The U.S. Navy’s cultural assessment The Foundation’s goal is “to make indicator of the underlying safety cul- program showed that in the 2002–2004 aviation safer by reducing the risk of ture and refers to the perception of the period, 93 percent of the Navy’s major an accident.” We have achieved great successes advancing toward this goal, but as can be seen from last year’s Accident Classification safety record, there are still challenges, such as learning from lessons of the wo years ago, Flight Safety Foundation changed from using “hull loss” as the past and ensuring a positive safety primary accident criterion to a new standard, “major accident.” A major accident is culture. Tdefined as an accident in which any of three conditions is met. The first condition In an industry where risk will never is that the aircraft is destroyed or sustains major damage. Major damage is defined be zero, we face a constant challenge by the Ascend Damage Index (ADI), a measure developed by Paul Hayes of Ascend. of meeting the public’s expectation of The ADI is the ratio of the cost of repairs to the projected value of the aircraft had it been brand new at the time of the accident. If the ADI is over 50 percent, the damage perfection as the minimum acceptable is considered major. The second condition defining a major accident is that there are standard. However, the aviation indus- multiple fatalities. The third condition is that there is one fatality and the aircraft is sub- try continues to successfully address stantially damaged. The major accident classification criteria ensure that an accident that challenge and is constantly work- is not determined by an aircraft’s age or by its insurance coverage, and it gives a more ing to make aviation safer by reducing accurate reflection of the high-risk areas that need to be addressed. the risk of an accident. — JB James M. Burin is FSF director of technical programs. www.flightsafety.org | AeroSafetyWorld | February 2009 | 23 LEADERSLOG Reinvest By James C. May in America’s MRO James C. May is president and chief executive officer, Air Transport Association of America. resident Barack Obama is committed to 1. Retrain and certificate skilled auto work- creating three million new jobs over the ers to perform MRO on aircraft and all of next two years through the promised their high-tech components; American Recovery and Reinvestment 2. Redevelop idled military air bases and refur- Plan.P The new president proposes to spend at bish hangars to handle civil aircraft MRO; least US$775 billion to double production of 3. Upgrade the equipment and technology of renewable energy, renovate aging infrastruc- the 4,000 certificated aircraft repair facili- ture, modernize healthcare technology and ties in the United States; do other things to stimulate high skill–based 4. Create a real partnership between U.S. employment and create substantial economic airlines, contract MRO facilities and labor and social benefits for the American people, unions to generate high-paying U.S. jobs including investment in critically important in a way that stimulates technological technologies. innovation and helps U.S. airlines become While the airline industry is focusing its more competitive with their global coun- efforts on securing stimulus funding for terparts; and, new air traffic management technologies, as 5. Create regional centers of excellence well as related energy and environmental for maintenance and alteration of major improvement investments and jobs, more can aircraft types, such as widebody airplanes, be done. I hope that Obama’s plan includes to enhance the U.S. reputation for excel- grants and tax incentives aimed at creating lence in the MRO field. That will cause U.S. 100,000 new jobs in aircraft maintenance, and non-U.S. carriers alike to locate and repair and overhaul (MRO) with these five increase MRO work in this country on the outstanding goals: basis of cost and quality. 24 | flight safety foundation | AEROSafetyWorld | February 2009 LEADERSLOG U.S. airlines employ about 72 threat to safety, independent govern- industry, U.S. policymakers and repre- people per airplane, which includes ment figures do not support that con- sentatives of labor — should be doing six per airplane in maintenance jobs. clusion. To the contrary, data compiled all that we can to enhance the competi- With an overall fleet of more than 7,800 by the NTSB clearly show that as U.S. tiveness of U.S.-based MRO operations airplanes, U.S. airlines employ approxi- airlines increased contracted main- to gain the lion’s share of a $42 billion mately 50,000 people in their main- tenance work to vendors around the global business. tenance departments. However, that world, accidents with maintenance as a The largest “airline” MRO provid- does not include the far larger number probable cause declined from 0.05 per ers in the United States earn annual of people taking care of airplanes and 100,000 departures to absolute zero in revenues of several hundred million engines through service contracts. recent years (Figure 1). dollars by servicing other carriers. U.S. aircraft repair stations current- In the post-9/11 environment, as Compare that to Lufthansa Technik, ly employ more than 212,000 people. airlines downsized to meet a reduced the maintenance arm of the leading These stations perform work not only demand for air travel, it became German carrier, with annual revenues for U.S. airlines but for many non-U.S. more difficult for them to efficiently of $3 billion from contracted mainte- Reinvest airlines as well. use their exhaustive maintenance nance for customers beyond Lufthansa The type of MRO provided ranges infrastructure. That is the primary and a workforce of 19,000. from minor servicing to major over- cause for increased contracting, mostly The value of supporting this impor- haul of components, engines and to U.S. vendors but also including some tant industry has not gone unnoticed. in America’s MRO airframes. It should be noted that all internationally. However, as the chart In 2008, with the help of several nations third-party mechanics are required to demonstrates, maintenance-related that recognized the advantage of estab- meet the same professional standards safety performance has not declined. It lishing world-class MRO capabilities as those employed by the airlines. And is the best that it has ever been. within their borders, Lufthansa Technik all maintenance work is subject to FAA We need to accept that air transport expanded its operations. As similar audits and airline quality assurance is a global business and must be con- international growth moves rapidly programs, regardless of whether that ducted globally. Even the largest engines ahead, we must not be left behind. work is performed by the carrier or a are readily transportable, enabling ac- While several world-class facilities contract maintenance vendor. cess to repair centers around the world. exist in the U.S. today, we do not have While some critics have charged Safety is not an issue. Rather than trying the capacity to support the domestic that outsourcing airline MRO poses a to erect barriers, we — the U.S. aviation fleets. On a national level, we should strive to further develop capabilities Maintenance Safety Improves With Increased Outsourcing and turn U.S. MRO operations — whether airline or independent — into 0.25 Amount outsourced 45% the world’s best. We are the country, Maintenance-related accident rate 40% after all, that is known for its “can do” 0.20 Share of total maintenance spirit. 35% spending outsourced As well as being great inventors, 30% 0.15 Orville and Wilbur Wright exempli- 25% fied the U.S. tradition of producing 0.10 20% superb mechanics. From a bicycle shop in Dayton, Ohio, they created (per 100,000 departures) 15% 0.05 the aviation industry. There is no 10% reason why those with well-developed Accidents with maintenance as probable cause as probable with maintenance Accidents 0.00 5% 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 mechanical and technical skills should Year not be able to make a similar move from automobiles to high-paying jobs Source: U.S. Bureau of Transportation Statistics and U.S. National Transportation Safety Board in the maintenance, repair and over- Figure 1 haul of aircraft. www.flightsafety.org | AEROSafetyWorld | February 2009 | 25 MaintenanceMatters Error ManagementBY LINDA WERFELMAN Only in recent years have aviation maintenance errors been recognized as a symptom of wider problems in the workplace. aintenance error presents a factors training, and maintenance strenuous, clerical skills and attention to “significant and continuing personnel have been largely overlooked detail are required, along with good com- threat” to aviation safety, and by human factors researchers, who munication — even in very noisy areas. effective management of the focused instead on pilots, air traffic “Maintenance personnel also face Mthreat requires the proactive identifica- controllers and cabin crew. unique sources of stress,” the report said. tion of “error-producing conditions” and The report described the aviation “Air traffic controllers and pilots can an acknowledgment that maintenance maintenance environment as more leave work at the end of the day knowing error will never be completely eliminat- hazardous than most other work environ- that the day’s work is complete. In most ed, according to an Australian Transport ments, in part because of time pres- cases, any errors they made during their Safety Bureau (ATSB) report.1 sure but also because duties often are shift will have either had an immediate The report on human factors in performed in difficult situations — at impact or no impact at all. In contrast, aviation maintenance, by Alan Hobbs, heights, in confined spaces and in ex- when maintenance personnel leave work said that until recently, maintenance treme cold or heat. In addition, although at the end of their shift, they know that technicians have rarely received human some aspects of the work are physically the work they performed will be relied © Chris Photography Sorensen 26 | flight safety foundation | AeroSafetyWorld | February 2009 MaintenanceMatters on by crew and passengers for months or years. … action that should have been performed is left The emotional burden on maintenance person- undone, such as failing to secure an oil cap; and nel whose work has been involved in accidents is acts of timing and precision in which actions are largely unrecognized outside the maintenance fra- performed “at the wrong time, in the wrong order ternity. On more than one occasion, maintenance or without the necessary level of precision,” such personnel have taken their own lives following as using the wrong torque setting on a wrench to aircraft accidents caused by maintenance error.” secure a fastener, the report said. Another way of describing an error is with a Tracking Human Error psychological description — which evaluates the The first step in understanding how mainte- likely intentions of the person who made the er- nance errors occur is understanding the organi- ror. “For example,” the report said, “rather than zational context in which they occur, the report just concluding that an engineer did not secure a said. An individual’s actions, which may trigger plumbing connection, we would try to under- an accident or incident, are influenced by local stand their mind set at the time of the error. … conditions, such as communication and work- We would want to know: Did they forget? Did ing conditions; risk controls, such as procedures they intend to leave it loose? Did they assume and precautions designed to manage hazards; that a colleague was going to complete the task? and organizational factors, such as management Obviously we can never know for certain what decisions and resource allocation (see "Major a person was thinking, but we can usually make Maintenance-Related Crashes," p. 28). reasonable judgments.” “In many cases,” the report said, “main- One advantage of using psychological error tenance errors are symptoms of underlying descriptions is that they “enable us to place the problems within the organization.” error in its organizational context and then Descriptions of errors often are physical develop countermeasures tailored to the root descriptions — which describe the observable causes of the problem,” the report said. actions of the person who made the error and “For example, if we conclude that someone assign them to one of three categories: acts of did not perform a necessary action because they commission in which an action is performed that forgot, we might consider the prompts to mem- should not have been performed, such as cross- ory available to them, such as documentation. © Chris Photography Sorensen connecting cables; acts of omission in which an We might also consider what could be done in [the] future to catch similar memory lapses. “If, on the other hand, we conclude that a per- son did not perform a necessary action because they thought the procedure did not require it, our investigation might lead us to organizational issues such as training or procedure design.” The report identified six types of psychologi- cal errors that are relevant to maintenance: • Errors of perception, in which a person fails to detect an item he or she should have noticed, such as a worn tire or a vis- ible crack in a metal part; • Memory lapses, in which a person forgets to perform an intended action, such as forgetting to reconnect a disconnected sys- tem after a maintenance task is completed; Continued on page 30 www.flightsafety.org | AeroSafetyWorld | February 2009 | 27 MaintenanceMatters Major Maintenance-Related Crashes The flight crew tried to steer the 747 using engine power, but they were unable to maintain control. About 30 minutes after the decompression, the airplane struck a mountain northwest of Tokyo. Investigators attributed the failure of the bulkhead to a fatigue fracture in an area that had been repaired follow- ing a tail scrape years earlier. “The repair had included replacing the lower half of the bulkhead,” the ATSB report said. “The new lower half © Dennis Oda/Associated Press should have been spliced to the upper Aloha Airlines 737, April 1988 half using a doubler plate extending under three lines of rivets. However, he Australian Transport Safety stabilizer and rudder and the loss of pres- part of the splice was made using Board (ATSB) cited several ac- sure from all four hydraulic systems. two plates instead of a single plate, as Tcidents and incidents associ- ated with human aspects of aviation maintenance, including the April 1988 Upper bulkhead explosive decompression of an Aloha Force ow Force ow Airlines Boeing 737-200 — an accident that revealed the human factors of inspection and maintenance as a major safety issue.1 Splice plate The decompression, during a flight from Hilo, Hawaii, U.S., to Honolulu, L18 sti ener Rivet ripped an 18-ft (5-m) section of cabin skin away from the airplane. One cabin Mis-repaired crewmember was killed. The flight crew Part indicated in blue should be single plate diverted the airplane to Maui for an emergency landing. Fracture site The accident investigation found that Force concentrated at this row the accident was a result of the airline’s Sealant Sealant failure to detect the disbonding and Splice plate fatigue damage that ultimately led to the separation of the section of fuselage. ‘Dormant’ Errors Lower bulkhead Three years earlier, in August 1985, a Japan Airlines 747-100 crashed, killing 520 people — the greatest number of (cabin side) (outside) fatalities in any single-aircraft accident. The airplane was in cruise flight at Directed repair Actual repair 24,000 ft during a domestic flight from Tokyo to Osaka when a rear pressure Note: Faulty repair work on a Japan Airlines 747-100 was cited in an August 1985 crash that killed 520 people. bulkhead failed, causing a sudden decompression that resulted in the sepa- Source: Australian Transport Safety Board, citing Kobayashi, H.; Terada, H. Crash of Japan Airlines B-747 at Mt. Osutaka (2006). In Japan Science and Technology Agency Failure Knowledge Database. ration of most of the airplane’s vertical 28 | flight safety foundation | AeroSafetyWorld | February 2009 MaintenanceMatters intended. … As a result, the join relied said. “The mobile stand set up at the travel,” the ATSB report said, adding that on only a single row of rivets.” aircraft did not give easy access to the the accident highlighted “the difficulties After that repair, the airplane was windscreen, and the shift manager had of capturing maintenance errors once flown more than 12,000 flights and to stretch to install the bolts, giving they have been made.” underwent six C checks — major him a poor view of his work. Partly as Missing O-Rings maintenance checks that included a result of this, he did not notice the In May 1983, an incident involving visual inspections of the airframe, in- excessive amount of countersink left an Eastern Airlines Lockheed L-1011 cluding the rear pressure bulkhead — unfilled by the small bolt heads.” illustrated “the potential for preventa- before the accident, which the ATSB The ATSB report said that the acci- tive maintenance to introduce risk, report said “highlighted the potential dent highlighted issues involving parts and how a single error could be carried for maintenance errors to remain dor- storage, night shift work, staffing levels across multiple systems,” the ATSB said. mant for long periods before having and the involvement of supervisors in The L-1011 was descending to their effect.” hands-on maintenance. Nassau, Bahamas, after a flight from Miami with 172 people aboard, when © Associated Press Wirephoto the “LOW OIL PRESSURE” light for the center engine illuminated. The captain shut down the engine and decided to return to Miami; en route, at 20,000 ft, the “LOW OIL PRESSURE” lights for the two wing-mounted engines illuminated, and both engines flamed out. The passengers were told to prepare for a ditching, but at 4,000 ft, the crew restarted the center engine; minutes later, they landed the airplane at Miami International Airport. No one was injured. Investigators found that mag- netic chip detectors (MCDs) had been installed without O-rings on all three engines and that, as a result, oil leaked from the engines during flight. The Japan Airlines 747, August 1985 maintenance personnel involved in the task assumed that O-rings were — as Windshield Failure Rigging Error In June 1990, the windshield of a British In January 2003, an Air Midwest Beech Airways BAC-111 was blown out during 1900D crashed after takeoff from O-ring seals Magnetic probe climb to cruising altitude after depar- Charlotte, North Carolina, U.S., killing ture from Birmingham, England, for a all 21 people in the airplane. flight to Málaga, Spain, partially eject- The accident investigation found ing the captain through the broken that the pilots had been unable to window. Flight attendants held him control the airplane’s pitch attitude, in place while the first officer flew the partly because its center of gravity airplane to Southampton Airport for an was outside limits and partly because emergency landing. the elevator control system had been Note: The installation of magnetic chip The accident investigation found incorrectly rigged during maintenance detectors without O-rings was cited in a May that, during maintenance the previ- two days before the crash. 1983 incident involving an Eastern Airlines ous night, a shift manager had used The maintenance work was per- Lockheed L-1011. smaller-than-specified bolts to hold the formed by a technician who had not Source: Australian Transport Safety Board, citing Marx, D.; Graeber, R.C. “Human Error in Aircraft Maintenance.” windshield in place. done the task before and who, in tight- In N. Johnson, N. McDonald and R. Fuller (editors). “The manager’s errors did not occur ening the cables, “inadvertently restrict- Aviation Psychology in Practice (1994): 87–104. Aldershot, U.K.: Ashgate, 1994. in isolation, however,” the ATSB report ed the amount of nose-down elevator www.flightsafety.org | AeroSafetyWorld | February 2009 | 29 MaintenanceMatters usual —attached to the replacement metal particles — an early warning of circumstances and concluded that the MCDs, the ATSB report said, noting that engine failure. problem was with the mechanics and another complicating factor was the Estimates were that, in the 18 not with the maintenance procedure.” fact that the replacement MCDs were months that the practice had been in The ATSB added, “Rather than ad- installed by feel, “with no direct view of place, maintenance technicians had per- dressing the wider system problems such the task.” formed the task an average of 100 times as poor procedures and undocumented The MCD replacement was per- each. The airline had experienced 12 norms, the incidents resulted in indi- formed in accordance with the airline’s incidents of in-flight engine shutdowns vidual disciplinary action and training.” practice of removing and inspecting and unscheduled landings because — LW MCDs “at 22-hour intervals, whenever of problems with O-rings and MCD Note the aircraft overnighted at an Eastern installation. The ATSB quoted the U.S. 1. Hobbs, Alan. An Overview of Human Airlines maintenance station,” the National Transportation Safety Board Factors in Aviation Maintenance. ATSB ATSB report said. The inspections were accident report, which said, “In every in- Transport Safety Report, AR-2008-055. designed to check for the presence of cident … management investigated the December 2008. • Slips, in which a familiar skill- “The issue of maintenance viola- I was notified by my shop stew- based action is absent-mindedly tions is one of the most difficult human ard that the hydraulic shutoff valve performed at an unintended factors issues currently facing the I removed from a Fokker 100 was time or place, such as automati- aviation industry,” the report said. “Yet the same serial number of the new cally signing off a task while not many aviation professionals outside the parts tag. … I removed the valve intending to do so; maintenance field are either unaware of from the aircraft during which I • Technical misunderstandings, in the issue or else take a simple moral- had gotten [hydraulic fluid] in my which a maintenance technician istic approach when they hear of the eyes and could not see for about does not possess the knowledge extent to which maintenance workers 30 minutes. I tried to keep work- required to perform a given task; routinely deviate from procedures to ing because time was short and I • Wrong assumptions, in which a accomplish tasks. Maintenance person- needed to complete the job [as soon person misidentifies a familiar nel are often confronted with a double as possible]. I apparently installed situation, such as incorrectly standard of task performance: On the the old valve back on the aircraft. I assuming that a colleague will one hand, they are expected to comply completed a flap test with no faults. perform a specific step in an with a vast array of requirements and Other local conditions include “unwork- assigned task — for example, as- procedures while also being expected to able or awkward” procedures described suming that the power supply will complete tasks quickly and efficiently.” in manuals — a problem often cited by be disconnected by a colleague maintenance personnel as leading to a who always does so; and, Local Conditions procedural violation; misunderstandings • Procedure violations, in which Individual actions — and individual er- and ineffective communication with co- someone strays from the specified rors — typically reflect local conditions in workers; group norms, or unspoken in- process for accomplishing a task, the workplace when the actions are taken. formal rules about how work is done in either in a way that is routine, such One of the most common condi- a specific workplace; fatigue, especially as driving a few kilometers faster tions is time pressure, which sometimes fatigue associated with long work shifts than the speed limit, or exceptional, leads maintenance technicians to use a and/or working at night; insufficient in response to an unusual situation. procedural shortcut to complete a job knowledge or training for a specific task; Past surveys of maintenance personnel more quickly and enable an on-time and a lack of specialized tools for the job, in Australia, Europe and the United aircraft departure. As an example, the the report said. States have indicated that procedure report cited the following event, which violations are widespread, and that was reported to the U.S. National Risk Controls they often are committed in an effort to Aeronautics and Space Administration Risk controls are the defenses estab- complete a task on time, the report said. Aviation Safety Reporting System: lished in the workplace to manage 30 | flight safety foundation | AeroSafetyWorld | February 2009 MaintenanceMatters safety hazards. In aviation mainte- organizational conditions such as plan- the report said. “In some companies, nance, most controls are one of two ning, staffing levels or work scheduling.” common errors such as leaving oil filler types: preventive risk controls, which caps unsecured will result in several are designed to reduce the chances of New Emphasis on SMS days without pay or even instant dis- human error — for example, stream- The first human factors training courses missal. It is hardly surprising that many ers attached to rigging pins to help for maintenance personnel were not of- minor maintenance incidents are never maintenance personnel notice the pins fered until the 1990s, about 20 years after officially reported.” and remember to remove them — and airlines begin providing similar instruc- The report cited a 1998 survey of recovery risk controls, designed to tion for flight crewmembers, the report Australian maintenance personnel identify a developing dangerous situa- said. This early training in maintenance in which more than 60 percent said tion and prevent it from continuing — resource management emphasized com- they had corrected an error made by a for example, functional checks. munication skills and assertiveness, stress colleague but never documented their Other actions, such as read-backs management and conflict resolution. action because they hoped to avoid any of verbal instructions, also can help More recent human factors training disciplinary action against the colleague. identify errors. However, the report said, has been developed in the aftermath of The organizational response to “checks, inspections and read-backs rely new requirements by the International maintenance error should involve on human performance and are them- Civil Aviation Organization and national efforts to identify and counteract error- selves subject to human fallibility. In a civil aviation authorities for maintenance producing conditions, as well as an ac- survey of airline maintenance personnel, personnel to understand human factors knowledgement that maintenance error over 30 percent of respondents reported principles. In some cases, this training can be reduced but not eliminated. that they had skipped a required func- has been incorporated into development “Airlines can learn to manage the tional check (such as an engine run) in of an organization’s safety management inevitable threat of maintenance error the preceding 12 months.” system (SMS) — a coordinated ap- in the same way they deal with natural Risk controls differ in their effec- proach to managing safety that includes hazards such as weather,” the report said. tiveness, the report said, noting that an emphasis on error management and “Organizational resilience in the face engineered solutions, such as reverse development of a just safety culture. of human error can be maximized by threaded connections that prevent two SMS typically includes a nonpuni- ensuring that appropriate risk controls parts from being connected, usually are tive confidential reporting system to are in place to identify and correct errors more reliable than self-checks of work. encourage disclosure of events that may and minimize the consequence of those present threats to safety, and the report errors that remain undetected despite Organizational Influences said that the industry is making prog- the best efforts of the organization.” The report said that investigations of ress in developing such systems. airline accidents and incidents involv- “If a maintenance engineer has a dif- Note ing maintenance actions often have ficulty with a maintenance procedure at 1. Hobbs, Alan. An Overview of Human identified organizational factors in those 3 a.m. in a remote hangar, the problem Factors in Aviation Maintenance. ATSB events, including training and qualifica- may remain unknown to the organiza- Transport Safety Report, AR-2008-055. tions systems, allocation of resources tion unless the engineer chooses to December 2008. and the culture within the organization. disclose the issue,” the report said. “Once Further Reading From FSF Publications “For example, a maintenance viola- a maintenance error has been made, Werfelman, Linda. “Working to the Limit.” tion, such as using an incorrect tool, years may elapse before it becomes ap- AeroSafety World Volume 3 (April 2008): 14–18. may occur because the correct tool was parent, by which time it may be difficult Johnson, William B.; Hackworth, Carla. not available, which in turn may reflect to establish how it occurred.” “Human Factors in Maintenance.” AeroSafety equipment acquisition policies or finan- The report said that the “culture of World Volume 3 (March 2008): 34–40. cial constraints,” the report said. “One maintenance around the world” has McKenna, James T. “Maintenance Resource of the most common reasons given for discouraged the reporting of problems. Management Programs Provide Tools for maintenance violations is time pressure, “This is because the response to Reducing Human Error.” Flight Safety Digest and this in turn may be symptomatic of errors has frequently been punitive,” Volume 21 (October 2002). www.flightsafety.org | AeroSafetyWorld | February 2009 | 31 FoundationFocus o r l a n d o , f l o r i d a CASS April 21–23, 2009 What does automatic dependent surveillance–broadcast (ADS-B) mean for corporate operators? This year’s CASS will include a whole panel of speakers to discuss that question. And safety specialists will confront a wide range of important issues, as shown below. To register, contact Namratha Apparao, +1 703.739.6700, ext. 101, e-mail [email protected]. To sponsor an event or exhibit at the seminar, get in touch with Ann Hill, ext. 105, [email protected]. Preliminary Agenda Continental Breakfast in o n d a y p r i l 0730–0830 M , A 20 Exhibit Hall 0830–0925 Seminar Opening — Patricia Andrews, chairman, FSF Corporate Advisory Committee (CAC) 0730 Day One–Emergency Response Tu e s d a yPlanning, Apr Workshop i l 21 Welcome — William R. Voss, president and CEO, Flight Safety Foundation Welcome — Ed Bolen, president 0730 Day Two–Emergency Response and CEO, National Business Planning Workshop Aviation Association 0900–1200 FSF Corporate Advisory 0925–0930 Moderators: Committee (CAC) Meeting Lisa Sasse, vice president, 1200–1700 Registration EVASWorldwide/Aircraft Services Group; Sydney A. Baker, former 1200–1700 Exhibit Hall Open With director of aviation, Eastman Refreshments Kodak Co.; and Edward R. Williams, CEO, The Metropolitan 1700–1800 Speakers’ Meeting Aviation Group 1830–2000 Opening Reception — Hilton 0930–1000 “The Increasing Threat of We d n e sWalt d a Disney y , A pWorld r i l 22 Politicizing and Criminalizing Aviation Accidents” — David Rimmer, executive vice president, ExcelAire The exhibit hall will be open during seminar hours. 1000–1030 “The Criminalization of Aviation Accidents” — Kenneth P. Quinn, 32 | flight safety foundation | AeroSafetyWorld | February 2009 0730–1700 Registration Pillsbury Winthrop Shaw Pittman FoundationFocus 1030–1100 Refreshments in Exhibit Hall 0830–0900 “Fatigue and Sleep Disorders” — Dr. Carol E. Ash, medical director, 1100–1130 “Macro CRM on a Micro Level: Sleep for Life, Somerset Medical Implementing Effective CRM Center in Small Corporate Flight Departments” — Capt. Gary 0900–0930 “The Aviation Personnel Cooke, safety officer, CVS Shortage” — Earl Weener, Ph.D., Caremark fellow, Flight Safety Foundation 1130–1200 “Performance-Based Navigation” 0930–0945 Question and Answers — Timothy Taylor, PBN/RNP program manager, Jeppesen 0945–1015 Refreshments in Exhibit Hall 1200–1230 Questions and Answers 1015–1200 Panel on Automatic Dependent Surveillance–Broadcast (ADS-B) 1230–1400 Lunch Moderator: 1400–1430 “Management’s Role in Creating Steve Brown, ADS-B co-chair, a Safety Culture” — Richard FAA Aviation Regulatory Advisory Bucknell, CEO, Southpac Committee and senior vice Aerospace president, operations, NBAA Panelists: 1430–1500 “Safety Leadership: How David Bjellos, aviation manager, Management Manages the Florida Crystals Corp.; Rick Safety Climate to Shape Safety Ridenour Sr., technical staff Culture” — Kenneth P. Neubauer, engineer/pilot, Aviation technical director, aerospace Communications & Surveillance safety, Futron Corp. Systems; and U.S. Federal Aviation Administration representative 1500–1530 “Unmanned Aircraft Systems: How Can the United States Integrate 1200–1330 Lunch Them Safely Into the National Airspace System?” — Ardyth 1330–1400 “The Right Stuff? Assessing the M. Williams, air traffic manager, Aging Aviator: Safety, Health, unmanned aircraft systems, U.S. Fairness and Dignity” — Quay Federal Aviation Administration Snyder, M.D., M.S.P.H., president and CEO, Virtual Flight Surgeons 1530–1545 Questions and Answers Refreshments in Exhibit Hall 1400–1430 “SMS Audit Results Analysis” — 1545–1615 Steve Witowski, aviation safety program manager, Aviation 1615–1700 “Update on Current Corporate Research Group/U.S. Aviation Accidents” — Hon. Debbie Hersman, member, U.S. 1430–1500 Refreshments in Exhibit Hall National Transportation Safety Th u r s dBoard a y , Ap r i l 23 1500–1530 “Managing Perceptions and Expectations in Incident Investigations” — D. Richard Miekle, vice president, safety, NetJets The exhibit hall will be open during seminar hours. 1530–1600 Questions and Answers 0730–1700 Registration 1600 Seminar Closing — Sydney 0730–0830 Continental Breakfast in A. Baker, director of aviation, www.flightsafety.org | AeroSafetyWorld | February 2009 | 33 Exhibit Hall Eastman Kodak Co. FlightOPS dvances in standardization and Technology promises improvements effective,” says William Bramble, senior new evidence of effectiveness in, and wider use of, flight envelope human performance investigator, U.S. make airplane upset recovery protection provided by the software in National Transportation Safety Board training a more robust ele- fly-by-wire airplanes; an aural “overbank” (NTSB), and a presenter at Flight Safety Ament of airline strategies for managing alert when a transport category airplane Foundation’s International Air Safety the risk of loss of control accidents reaches an angle of bank exceeding Seminar (IASS) in October 2008 in than 10 years ago (see “Steady State,” p. normal operating parameters; directed Honolulu. “Recent accidents suggest 18). Although ongoing research and guidance, an immediate aural message that [automation] might improve safety development efforts expect to im- to pilots about required control inputs; for civil transports. Solutions such as prove existing aircraft-based solutions, micro-tactile alerts about incipient un- modified attitude displays and directed many specialists still see technology as usual attitudes from electronic devices guidance … [also] might only be par- complementary to pilot training — not in a seatback or clothing; and perhaps tially effective.” an alternative. Urgency about address- a pilot-activated automatic recovery Various NTSB safety recommenda- ing loss of control risk (Table 1) was switch that would transfer airplane tions in recent years have urged the reflected during 2008 in more than 40 control to a future autopilot designed for U.S. Federal Aviation Administration scientific papers on relevant issues pre- this purpose, specialists say. (FAA) to require upset recovery train- sented at conferences of the American “Enhanced training and procedures ing for air transport pilots. Among risk Institute of Aeronautics and Astronau- are a countermeasure relatively easy to scenarios of concern have been stalls tics (AIAA) alone.1 implement, but might be only partially caused by airframe icing, stalls without Attitude Adjustment By Wayne Rosenkrans Updated guidance and research findings boost confidence that airplane upset recovery training is on the right track. 34 | flight safety foundation | AeroSafetyWorld | February 2009 FlightOPS Major Causes of Airplane Upset and Loss of Control Accidents, Worldwide Air Transport, 1993–2007 Accidents in Causal Category Accidents/Aircraft Included Category Fatalities Aerodynamic stall 9 events involving contaminated airfoils, 6 events involving autopilot-induced 27 848 stalls (only common factor was no flight envelope protection) (36%) (26%) Flight control system 7 events involving flight control malfunctions or failures, 6 events involving 16 604 autopilot malfunctions or failures (excluding autopilot-induced stalls), 3 events (21%) (19%) involving flight control software issues Spatial disorientation 5 events involving spiral dives (only common factor was no flight envelope 8 630 protection), 3 events involving upset/misjudged flight path (11%) (19%) Contaminated airfoil (ice) 9 events involving contaminated airfoils were listed instead among the 27 events in 8 200 the “Aerodynamic stall” causal category (11%) (6%) Atmospheric disturbance 3 events involved wake encounters 6 477 (8%) (15%) Other causes combined Not specified 6 122 (8%) (4%) Undetermined causes Not specified 4 380 (5%) (12%) Total accidents 75 3,261 Note: Total of percentages may not equal 100 because of rounding error. Source: Lambregts, A.A.; Nesemeier, G.; Wilborn, J.E.; Newman, R.L. “Airplane Upsets: Old Problem, New Issues.” American Institute of Aeronautics and Astronautics Modeling and Simulation Technologies Conference and Exhibit, Aug. 18-21, 2008, Honolulu. AIAA 2008-6867. Table 1 icing, wake encounters, spatial disorientation component elements are more readily available, leading to a spiral dive or misjudged flight path, either together or separately, as free electronic and mechanical failures. Although this training documents that can be downloaded from The second update since 1998 has been gradual airspeed decay and its effects; expecting designed so that adoption, integration or adapta- slow cruise speeds to shorten time available to tion by airlines can be simple and straightforward. respond to an inadvertent slowdown; avoiding “Loss of control accidents can have widely varying inappropriate vertical speed modes during high causes and solutions, so our goal is to get to all the altitude climbs; and responding correctly to a pilots — wherever they might be — to give them thrust-limited condition.4 Also covered are the the knowledge, the understanding and the training risks of operating at maximum altitude, such necessary to address this killer in aviation,” David as reduced bank angle capability and insuffi- Carbaugh, chief pilot for flight operations safety cient thrust to maintain altitude (Figure 1); the at Boeing Commercial Airplanes and a team co- advantages of operating at optimum altitude; the chairman, told IASS attendees. “What is lacking importance of recognizing airplane buffet as the today is a consistency of application throughout first indicator of a high altitude stall; the differ- the industry of this training. … Only when such ences between responding to an impending stall training becomes mandatory will air carriers be versus a full aerodynamic stall; the criticality of getting knowledgeable and fully trained pilots who exchanging altitude for airspeed during upset re- can handle these situations consistently.”2 covery; and the threats in inadvertent excursions One aim is to help airline pilots avoid into extremely high speeds. repeating the errors of others, such as selecting A longstanding issue is that the aerodynamic maximum cruise thrust rather than maximum envelopes of simulators — specifically the angle continuous thrust in response to a gradual, envi- of attack range and sideslip range — simply are ronmentally induced slowdown at high altitude, not extensive enough.5 One NTSB scientist has or selecting inappropriate automation modes noted that fidelity of simulators for upset recov- that can lead to excessive banking and a stall ery training becomes a significant practical issue during routine high altitude operations, such as only in the post-stall flight regime, whereas A forceful navigating around en route weather. many loss of control accidents have occurred nose-down pitch The supplement emphasizes practical ways to after upsets within the nominal aerodynamic input can be apply aerodynamic principles, such as avoid- data envelope (Figure 2).6 essential to some ing high altitude flight in the slow flight speed upset recoveries. range, any speed less than L/D Max;3 recognizing Evidence of Effectiveness When Alteon Training, a Boeing company, recently planned to introduce upset recovery training into all of its initial, transition and recurrent simulator training courses, the course developers could find no scientific study show- ing that such training would achieve what was intended, according to William Roberson, a senior safety pilot for Boeing Commercial Air- planes and an IASS presenter. Another research goal was to identify signifi- cant negative training in light of findings about a pilot’s rudder inputs in the NTSB investigation of the November 2001 in-flight separation of the vertical stabilizer of an Airbus A300, operat- ing as American Airlines Flight 587, in Belle Harbor, New York, U.S.7 “That accident did, in fact, have a chilling effect on upset recovery Airplane Upset Recovery Training Aid, Revision 2 training throughout the world,” Roberson said. 36 | flight safety foundation | AeroSafetyWorld | February 2009 FlightOPS Alteon hypothesized that Boeing 737 pilots Typical Commercial Jet Operating at Maximum Altitude who completed academic work and simulator exercises derived from the training aid would be more successful in coping with upset events than they were before they participated in the Maximum continuous thrust (MCT) study. Thirty-three 737-qualified Boeing pilots Thrust capability received academic training with videos and Drag produced at 30° bank exceeds cruise thrust (FMC) Cruise thrust (FMC) a simulator session, in which they trained to Drag with 30° bank proficiency — until common errors were elimi- Drag (increasing) Drag nated — on each recovery technique. Each pilot was told to “just fly the airplane Drag in level ight Example of — do what you would do if you had this event,” current airspeed which meant to keep the airplane inside the .60 .65 .70 .75 .80 .85 aerodynamic envelope, not induce a stick shaker Mach number warning of approach to stall, and not stall. “We Note: Maximum continuous thrust would be required to maintain altitude under some re-evaluated each pilot to see if performance conditions. had improved one to six months after this train- Source: Airplane Upset Recovery Training Aid, Revision 2 ing, using the exact same initial test and scoring Figure 1 method,” he said. Performance on each test ele- ment and overall was quantified by subtracting Data Sources for Boeing 737 Full Flight Simulator points — for example, for failure to disconnect the autothrottle, a stall, excessive speed or exces- 40 Flight-validated data Wind tunnel/analytical data available sive altitude loss — from a perfect score of 10. Data extrapolated for simulator Upset events in the simulator comprised one 30 scenario of a 737 that was 40 degrees nose high with zero degrees of bank and twice the amount 20 of aft trim required for normal flight; one sce- nario with the airplane 25 degrees nose low with 10 60 degrees of bank and trim neutral; and one 0 scenario with the airplane 25 degrees nose low, Wing angle of attack (degrees) –30 –20 –10 0 10 with 120 degrees of bank and trim neutral. –40 20 30 40 “Pilots who scored zero, one or two points –10 Sideslip angle (degrees) on the first nose-high [scenario] predominantly used the roll recovery technique versus the Note: U.S. Federal Aviation Regulations Part 60 since 2007 has restricted training exercises in which pilots would have to “go beyond the flight-test validated flight envelope,” which real- push recovery technique; those who scored world upset recoveries may require. eight, nine or 10 points on that [scenario] pre- Source: Airplane Upset Recovery Training Aid, Revision 2 dominantly used the push recovery technique,” Roberson said. Figure 2 Taking these pilot decisions and other fac- tors — such as adequate control of airspeed and [after training], such as rolling to level more altitude loss — into consideration, the study quickly and pulling more positively once they concluded that for the nose-high scenarios, got the wings level,” Roberson said. “For the training made a positive difference, three points nose-low and high-bank-angle scenario, consid- on average. For the nose-low and medium-bank ered the most difficult recovery, training made a angle scenario, training made a positive dif- small — 0.4 point — positive difference. Quali- ference, two points on average. “Improvement tatively, this was important because this result occurred because of better recovery technique was not expected given the relative difficulty.” www.flightsafety.org | AeroSafetyWorld | February 2009 | 37 FlightOPS “Over the past six years, FedEx has experienced six upset events that could have led to loss of con- trol,” Ward said. “[One goal,] for the first time in the industry, was to ‘connect the dots’ by evaluat- ing transfer of training from the full flight simula- tor to the real world of the airborne environment.” Ten FedEx pilots from the A300 fleet and 10 FedEx pilots from the MD-11 fleet participated. Performance evaluations were conducted before each of three portions of training: aerodynamics, full flight simulator training and airborne train- ing. Training events comprised unusual attitude recoveries, in which the evaluator maneuvered the simulator or airplane to a nose-high unusual attitude and a nose-low unusual attitude; and pre- programmed upset recovery events in the roll axis and the yaw axis of the simulator and airplane. The A300 pilot group and MD-11 pilot group were divided into two subgroups, a full-program group that received academic training, then U.S. National Aeronautics and Space Administration advanced maneuver upset recovery training in The NASA Vertical The researchers said they were encouraged by a simulator, and a control group that received Motion Simulator, the results. “Each of the maneuvers showed higher the academics but with equal time in a simulator shown here in a scores after training for the majority of the pilots, focused on scenarios unrelated to upset recovery. multiple-exposure but not all the pilots,” Roberson said. “Twenty- The study found that training in the full photo, exceeds nine out of 33 pilots did better on the second test, flight simulator — despite the deficiency in mo- capabilities of four did worse … and those whose overall scores tion cuing and g (load) cuing — produced the conventional full flight deteriorated went from 25.8 to 23.0 points [out of a largest cumulative training effect, especially in simulators. possible 30 points]. These pilots demonstrated the teaching aircraft-specific techniques; airborne largest increase in average score for the nose-high training produced a relatively small training and zero-bank-angle scenario, requiring the most effect; and prior experiences exerted a relatively difficult and challenging maneuver. … We did not large training effect on performance even com- expect to see that. There also was a much higher pared with the academic work. level of consistency of performance among all the For the study, the full flight simulator was pilots after the training.” equipped with a g-meter display as a reference A second report presented at IASS had been for the pilots during recovery maneuvers. The eagerly anticipated by the upset recovery re- meter showed, for example, some pilots exceed- search community.8 FedEx Express and Calspan ing g limits — with up to 8 g displayed on video Flight Research Group developed the “advanced recordings — while incorrectly performing a roll- maneuver–upset recovery training program” ing pullout maneuver that would have subjected a using full flight simulators with motion and an real airplane to the maximum aerodynamic loads. in-flight simulator — a Learjet 25 — then evalu- The upset recovery training in general revealed ated the program’s effectiveness in a simulator pilots’ inadequate knowledge about the relevant and in flights in the airplane, said copresenters aerodynamic principles and how to apply them. Brian Ward, managing director of training, Fed- Therefore, the academic portion of the program eral Express, and Bob Moreau, experimental test alone produced a large increase in training effect. pilot, Federal Express Flight Test. “What stood out was a lack of [understanding of] 38 | flight safety foundation | AeroSafetyWorld | February 2009 FlightOPS fundamental aerodynamic concepts, as so our simulator training [with motion and disorientation, legs dangling off well as alternate control strategy concepts, on] is about making the picture look the rudder pedals, etc., all this affects among the pilots — concepts required for right,” Boeing’s Roberson said. “You the response time and ability to quickly upset recoveries,” Moreau said. cross-check your displays to make effect a safe and proper recovery. Being Little of the improvement in pilot sure you don’t have a display that is able to feel and know the ‘energy state’ test scores on upset recoveries could be lying to you. The fact that the simula- of the aircraft determines the pilot’s attributed to the full flight simulator; tor will give you the wrong vestibular course of action. The ability to provide instead, the lack of adequate motion cu- cue, although problematic, is another sustained g cues to pilots is critical in ing worked against pilots in identifying opportunity for the pilots to override their upset recovery training/loss of what type of event, such as a yaw event what their vestibular senses are telling control decision-making process.” or roll event, was occurring. “This often them, and to do the correct recovery no Boeing’s Roberson expects the led to the incorrect technique being ap- matter how they feel.” updated training aid to enable airlines plied, and that aggravated the situation,” Airlines cannot afford to wait for to sufficiently prepare pilots for the Moreau said. “In comparison, the in- perfect hardware, however, or access for recent types of scenarios. “In most of flight simulator provided critical motion thousands of line pilots to the advanced the loss of control accidents and inci- cues, and the pilots were better able to motion and sustainable g-load fidel- dents that we have seen in the last five correctly identify the event and respond ity of one-of-a-kind simulators such as years, simply leveling the wings and with the correct control technique.” the Vertical Motion Simulator at the putting the thrust where it needed to be In the tests of unusual attitude U.S. National Aeronautics and Space would have solved the [problem],” he recoveries in the simulator, the group Administration Ames Research Center; said. “They were not really complicated with full training showed “markedly the generic large transport/757 configu- events — at least at the outset.” better” results than the control group. ration of the GyroLab-2000 simulator, This difference disappeared when each which is used for upset recovery training Notes group flew the Learjet, and this was at- at the U.S. National Aerospace Training 1. Bürki-Cohen, Judith; Sparko, Andrea tributed to pilots having had equivalent and Research (NASTAR) Center; or the L. “Airplane Upset Prevention Research motion-cue experiences from earlier Desdemona research and demonstration Needs.” In proceedings of the AIAA Modeling and Simulation Technologies unusual attitude training in airplanes. simulator developed by TNO Defence, Conference and Exhibit, Honolulu, Aug. For airlines to make effective use Safety and Security and AMST System- 18–21, 2008. AIAA 2008-6871. of full flight simulators, their programs technik in the Netherlands. 2. Carbaugh, David. “Simulator Upset Recov- must emphasize pilot understanding of Glenn King, chief operating officer ery Training and Issues.” AIAA 2008-6866. simulator limitations compared with con- of the NASTAR Center, expects his 3. The training aid notes that on a graph trol inputs that may be required for upset facility to be part of the solution to loss plotting lift (L) and drag (D) values recovery in the airplane, the researchers of control. “Granted, not all airliner against airplane speed values, the lowest concluded. “Motion cues also should be upset situations place the aircraft in an point on the total drag curve is called L/D de-emphasized due to the limitations of inverted attitude, but some upsets have, Max (or VMD, minimum drag speed). the motion cues that we have in simula- and it is for these extreme situations 4. The training aid notes that some environ- tors today,” Ward said. “A g-meter readout that only a full, multi-axis simulator mental conditions, such as a temperature is essential for effective training.” with sustained g [loads] will have a increase or a mountain wave, may cause Conducting upset recovery training positive transfer of training,” King said. a jet to enter a thrust-limited condition in which the desired altitude cannot be in a full flight simulator with motion “Our advantage is the ability to provide maintained and/or airspeed may decay, off — as some airlines already do — is sustained motion cues and g forces dur- requiring a descent. still advocated by some specialists to ing an upset or loss of control in flight. 5. Crider, Dennis A. “The Need for Upset sidestep misgivings about insufficient We have the ability to physically place Recovery Training.” AIAA 2008-6864. fidelity and unrealistic spatial disori- pilots in an inverted flat spin, hanging 6. Crider. entation practice. “When you enter an in the harness, while sustaining up to upset or have an illusion, your inner ear 2.5 g. When a pilot is hanging in the 7. Ibid. already is telling you the wrong thing, straps, suffering from facial suffusion 8. Bürki-Cohen; Sparko. www.flightsafety.org | AeroSafetyWorld | February 2009 | 39 safetyculture With several aviation safety action programs out of commission, the industry is looking for ways to bolster voluntary safety-reporting endeavors. Rebuilding viation safety action programs (ASAPs) The airlines and the unions said they support and other voluntary, confidential ASAP; their differences involved the issue of safety-reporting efforts have been if and when an airline should penalize a pilot praised since their inception as vital to who has admitted in an ASAP report that he Athe ongoing drive to improve aviation safety. or she made a mistake. Nevertheless, labor disputes at several airlines Officials of the airlines where pilot ASAPs in the United States have put four pilot ASAPs still are out of commission and their pilot temporarily out of business — in one case for unions report varying degrees of success in talks more than two years before its reinstatement in to restore the programs, which all parties insist January. they want to see back in operation. Pilot participation in ASAPs at three The programs have faltered because of the airlines — American Airlines, Comair and US relatively fragile structure of ASAP, developed Airways — lapsed in late 2008 as the programs in the 1990s as an experimental program with came up for their required biennial renewal. a key provision that required renewal every At Delta Air Lines, where pilot participation two years, and allowed an individual airline’s ended in 2006, officials announced an agree- program to expire unless the airline, union ment on Jan. 28 to reinstate a revised ASAP, representatives and the U.S. Federal Aviation which resembles an existing program at North- Administration (FAA) unanimously agreed to west Airlines. Delta and Northwest merged in terms for its continuation. October 2008. “ASAP is still set up like a pilot program that In each case, the lapse came amid dis- can be turned off if anything goes wrong,” said agreements between the airline and its pilots William R. Voss, president and CEO of Flight union over the fairness of the airline’s treat- Safety Foundation. “But ASAP has become part ment of employees who filed ASAP reports. of the backbone of safety management in the 40 | flight safety foundation | AeroSafetyWorld | February 2009 safetyculture United States, and it’s time for us to treat it as the FAA said that nearly 170 were in place though it’s here to stay.” at more than 70 operators across the United The first ASAP was established at Ameri- States. Many of these operators have programs can Airlines in 1994 as the Safety Action not only for pilots but also for maintenance Partnership, one of several demonstration personnel, dispatchers, flight attendants or programs implemented even before the FAA other groups. Among the newest ASAPs is an issued an advisory circular (AC) in 1997 that American Airlines program that began operat- BY LINDA WERFELMAN described ASAP characteristics and objectives ing in January for more than 18,000 flight and provided guidance on how they should be attendants — a program the airline says is the developed. largest in the world. The current version of AC 120-66B, revised Both the FAA and the U.S. National Trans- in 2002, says, “The objective of the ASAP is to portation Safety Board (NTSB) have urged encourage air carrier and repair station employ- wider use of ASAP, and both have called for ees to voluntarily report safety information that a resolution of the differences that led to may be critical to identifying potential precur- suspension of the four airline programs for sors to accidents. … Identifying these precursors pilots. is essential to further reducing the already low ASAP and other similar programs “are accident rate.”1 crucial to ensuring aviation safety and identify- A ASAPs typically are developed as a part- ing problems before they lead to accidents,” the nership between the operator, the FAA and NTSB said. Acting NTSB Chairman Mark V. the employees’ labor organization. In most Rosenker said that the safety board “urges all ASAPs, the partners establish an event review parties to do what is needed to reinstate proac- committee (ERC), which reviews reports on tive safety programs and keep existing programs situations that employees believe may present viable and fully functioning.” safety risks, and develops plans to correct any Robert A. Sturgell, acting FAA administra- problems. tor until he stepped down in January, charac- “The ASAP provides for the collection, terized ASAP and other voluntary reporting analysis and retention of the safety data,” the programs as “crucial to safety,” adding, “It’s in AC said. “ASAP safety data, much of which everyone’s best interest to separate safety from would otherwise be unobtainable, is used to labor issues.” S develop corrective actions for identified safety FAA Associate Administrator for Aviation concerns, and to educate the appropriate par- Safety Peggy Gilligan urged representatives of ties to prevent a reoccurrence of the same type the other airlines operating without ASAPs for of safety event.” their pilots to follow Delta’s lead in resolving Under an ASAP, education and corrective their differences. action are intended to take the place of FAA “ASAP gives us invaluable insight into the penalties or company disciplinary measures. In day-to-day activities of people in our aviation fact, the AC specifies that operators should not system,” Gilligan said. A use information obtained through an ASAP “to And Voss praised Delta and its labor union initiate or support disciplinary action outside representatives for “being persistent and putting of ASAP, with the exception of those events safety above all other considerations.” excluded from ASAP due to the appearance of possible criminal activity, substance abuse, Unanimous Support controlled substances, alcohol or intentional In addition, a recent examination of the FAA’s falsification.” handling of safety issues by an independent Over the past 14 years, ASAPs have become review team (IRT) appointed by U.S. Transpor- P increasingly common, and at the end of 2008, tation Secretary Mary E. Peters found that ASAP www.flightsafety.org | AeroSafetyWorld | February 2009 | 41 safetyculture and two other major voluntary safety-reporting solution also may require new guidance mate- programs are vital to the future of aviation safety rial to specify which types of reports should (ASW, 11/08, p. 10). The other two programs be covered by ASAP protections and which are flight operational quality assurance (FOQA), should not. Resolution of the issue ultimately which involves the collection and analysis of may require regulatory action or legislation, data recorded during flight to improve the safety Voss said. of flight operations, air traffic control proce- The suggestions have generated a mixed dures, aviation maintenance, and airport and response. aircraft design; and the voluntary disclosure Rory Kay, Air Line Pilots Association, In- reporting program (VDRP) — which encour- ternational (ALPA) safety chairman, endorsed ages airlines, repair stations and other regulated the concept of legislation “to provide stronger entities to submit reports of regulatory noncom- protections, to ensure that the data collected is pliance to the FAA for analysis and subsequent only used for intended safety purposes.” monitoring of corrective actions. However, Kay was skeptical about any move In their final report, the members of the to eliminate biennial renewals. IRT said that they had discussed the voluntary “Remember, these are voluntary programs,” reporting programs with virtually everyone he said. Some sort of renewal time period or they interviewed during their research and process is needed because individuals — indi- found that the programs had the unanimous vidual personalities, beliefs, etc. — can change. “ASAP has become support of industry representatives and These are programs built on trust, and with regulators.2 new people, new trust needs to be developed, part of the “They all understand that the majority of re-established.” the information on which such enhancements Billy Nolen, manager of flight/opera- backbone of safety now depend would not surface at all if not tions safety at American Airlines, said the management in the voluntarily disclosed,” the report said. “The FAA should consider action to make ASAP IRT emphatically reaffirms the value of these permanent and that removal of the renewal United States.” programs.” requirements would the ease operation of the program. He noted that FOQA operates with- ‘Quite Healthy’ out such restrictions. Despite the interruption of ASAPs at four “If there had been no FAA requirement major air carriers, Voss said that “a number of to renew every two years, problems probably programs today are quite healthy. They’ve been would not have come up,” Nolen said. working well for a long time.” He believes, however, that the overall health Legal Proceedings of the programs would improve if the biennial Another threat to ASAP, FOQA, VDRP and renewal requirement were eliminated. other voluntary data-gathering programs is “With the renewal requirement, it’s too the prospect that lawyers and judges will seek easy for these programs to be derailed,” Voss access to ASAP data for use in criminal or civ- said. “We set up ASAP as an experiment, but il trials, Voss said. The solution may involve that was 14 years ago. We’re still treating it legislation to extend to ASAP the same statu- like a pilot program, and it is far too fragile tory protections that now prohibit courtroom for that.” use of cockpit voice recorder transcripts, In addition — with ASAPs at risk because Kenneth P. Quinn, the Foundation’s general of differing opinions about whether a “just counsel, said. culture”3 provides absolute protection for “Since prosecutors and courts are not employees who file ASAP reports or whether, protecting the confidentiality of voluntarily in some cases, penalties may be justified — a supplied safety information, legislatures need to 42 | flight safety foundation | AeroSafetyWorld | February 2009 safetyculture step in to prevent critical sources of safety data Notes 4 from drying up,” Quinn said. 1. FAA. Advisory Circular 120-66B, Aviation Safety The Foundation and others have estimated Action Program (ASAP). Nov. 15, 2002. that about 98 percent of the safety informa- 2. Independent Review Team. Managing Risks in Civil tion obtained from voluntary disclosure Aviation: A Review of the FAA’s Approach to Safety. programs would no longer be available if Sept. 2, 2008. participants were subject to prosecution and 3. A “just culture” in which everyone is treated fairly penalties. is considered a primary element of safety culture. “With the renewal The Foundation’s first call for legal protec- Safety specialists agree that in a just culture, people tion of ASAP data came late in 2008, after court usually are not punished for unintentional errors. requirement, rulings in a case involving the Aug. 27, 2006, The International Civil Aviation Organization, in its Safety Management Manual, says a just culture is one crash of a Comair Bombardier CRJ100ER dur- it’s too easy for ing an attempted takeoff from the wrong runway that recognizes that, although punishment “serves little purpose from a safety perspective,” punitive at Blue Grass Airport in Lexington, Kentucky, these programs to action may be necessary in some circumstances, and 5 U.S. A federal district court judge upheld a there is a need to define the line between acceptable be derailed.” lower court’s order calling for the release of and unacceptable actions. Comair ASAP reports, ruling that Congress had 4. Flight Safety Foundation. FSF Calls for Stronger the authority to pass legislation protecting the Protection of Volunteered Aviation Safety Information. confidentiality of ASAP information but had Oct. 30, 2008. never done so. 5. Forty-nine of the 50 people in the CRJ were killed, and the only survivor, the first officer, was seriously Continuing Discussions injured in the crash, which destroyed the airplane. Participants in preliminary discussions have The NTSB said that the probable causes were “the concluded that further conversations among the flight crewmembers’ failure to use available cues and practitioners of ASAP would help, Voss said. aids to identify the airplane’s location on the airport surface during taxi and their failure to cross-check “There’s a need to get together the people and verify that the airplane was on the correct run- who work with ASAP so they can document way before takeoff.” what’s working, the best practices,” he said. “They need to decide first what everyone can Further Reading From FSF Publications agree on and what still needs to be talked out. Stimpson, Edward W.; McCabe, William O. “Managing People shouldn’t have to reinvent their ASAP Risks in Civil Aviation.” AeroSafety World Volume 3 every time there’s a personnel change. (November 2008): 10–14. “We need to close this up like a zipper Rosenkrans, Wayne. “Preventive Fusion.” AeroSafety and continue to narrow down the differ- World Volume 3 (May 2008): 25–29. ences so we don’t have as much room for Rosenkrans, Wayne. “Speaking Up.” AeroSafety World disagreement.” Volume 3 (February 2008): 34–39. > A S A P www.flightsafety.org | AeroSafetyWorld | February 2009 | 43 FlightTRAINING By Wayne Rosenkrans Moment of Truth Rigid adherence to procedures for takeoff weight, center of gravity and stabilizer trim setting reduces the likelihood of uncommanded or delayed rotation. hen the U.S. National U.S.) Airport in February 2005 (ASW, NTSB, to reassess their training. “Pilots Transportation Safety 3/07, p. 30) — was “open — awaiting are less likely to attempt a takeoff with a Board (NTSB) in July 2008 response,” as of late January. mistrimmed stabilizer if they are made issued three safety recom- In the accident, the captain re- aware of the importance of the proper Wmendations about mistrim takeoff, one jected the takeoff when the airplane takeoff stabilizer trim setting on these was remarkable for its scope. It urged did not rotate immediately at rotation particular airplanes and have directly the U.S. Federal Aviation Administra- speed (VR) and the airplane overran experienced the delay in rotation asso- tion (FAA) to encourage all operators the runway. The probable cause was ciated with mistrim-takeoff conditions of the Bombardier Challenger series “the flight crew’s attempt to take off in a flight simulator,” the NTSB said. to provide pilot training to “emphasize with the center of gravity (CG) well Preventing, recognizing and re- the importance of proper stabilizer forward of the forward takeoff limit, sponding to mistrim takeoffs — as op- trim setting,” including type-specific which prevented the airplane from ro- posed to drills on pitch trim runaways mistrim-takeoff characteristics identi- tating at the expected rotation speed.”2 and other equipment failures — ideally fied in the accident investigation.1 The Some aspects of the Teterboro acci- would emerge from risk-identification status of the recommendations (ASW, dent were unique, others were not. The processes within the safety manage- 9/08, p. 10) — based on findings of recommendations open an opportunity ment system of any commercial jet a Challenger 600 departure overrun for all operators, not just those using operator. If an operator does not have accident at Teterboro (New Jersey, the Challengers as specified by the sufficient events to study, voluntary © Chris Photography Sorensen 44 | flight safety foundation | AeroSafetyWorld | February 2009 FlightTRAINING reports from U.S. air carrier pilots since the crew,” said one article for operators. “It usually re- Teterboro accident could be a starting point sults from using erroneous data, the wrong weights for considering factors that have caused un- or an incorrect CG. Sometimes the information commanded early rotations, delayed rotations presented to the flight crew is accurate, but it is and failures to rotate. The reports also suggest entered incorrectly either to the flight management potential subject areas suitable for checking pilot system (FMS) or to the stabilizer itself. In any case, awareness, safety responsibilities of others in the the stabilizer is set in the wrong position.”3 load control system and follow-up to system- One defense before takeoff — often the last level safety threats identified by company pilots. chance to identify the error and correct the Industry-developed training aids for this nar- condition — is for skeptical pilots to chal- rowly focused subject may be sparse, but resources lenge whether the numbers on the final weight such as the Airplane Upset Recovery Training Aid, manifest or load sheet make sense. Vigilance Revision 2 Albrecht Bruno/Jetphotos.net Albrecht tion displayed to the flight crew] corresponding may understand that flight tests for airplane to the opposite CG certification include mistrim takeoffs at the limit.” The green band forward and aft CG limits, but this has led some indicates the range personnel to overestimate the safety margins. in which acceptable The NTSB recently has been concerned about handling qualities can a less-known phenomenon not quantified cur- be expected during rently in flight testing: unusual, but character- takeoff rotation and istic, delays in airplane rotation in response to climb, and that nor- nose-up control input. mal flight operations U.S. Federal Aviation Regulations Part 25, for will remain within the transport airplane certification, specify that during allowable longitudinal “reasonably expected variations” from takeoff range of CG travel. procedures — including over-rotation and out-of- Guidance on tail trim conditions — a flight crew must not experi- strikes from Boeing ence unsafe flight characteristics or a “marked Commercial Airplanes, increase”4 in the scheduled takeoff distances in for example, describes the airplane flight manual. Revisions have been in possible effects of a process for about six years, however, and changes mistrim takeoff. “A that would define safely acceptable delays in rota- mistrimmed stabi- tion at VR have been proposed by the European lizer occurring during Aviation Safety Agency in concert with the FAA. takeoff is not common, One example of guidance prepared in re- but is an experience sponse to earlier NTSB calls for pilot training on shared at least once mistrim takeoff was FAA Advisory Circular 120- by almost every flight 85, Air Cargo Operations, published in June 2005. www.flightsafety.org | AeroSafetyWorld | February 2009 | 45 FlightTRAINING NTSB safety recom- ground — also could enable training developers mendation A-98-44 to cover the recognition of discrepancies that re- had said that the FAA sult in out-of-trim takeoff and CG out of limits. should “require all … Part 121 air carriers to Rotation Surprises provide flight crews Causal factors in the Teterboro crash already with instruction on were familiar. The NTSB had investigated the mistrim cues that March 2001 rejected takeoff of an Airbus A320.8 might be available “The flight crew reported that, during the takeoff during taxi and initial roll at an airspeed of about 110 kt, the nose of U.S. National Transportation Safety Board Safety Transportation National U.S. rotation, and require the airplane began to lift off the runway,” a safety air carriers using full recommendation letter said. “In a post-accident This Bombardier flight simulators in their training programs to interview, the captain stated that he continued the Challenger 600 provide flight crews with special purpose opera- takeoff to [computed VR of 143 kt] but, because pitch-trim position tional training that includes an unanticipated he believed the airplane pitch was uncontrol- indicator is similar pitch mistrim condition encountered on takeoff.” lable, he initiated a rejected takeoff. The airplane to one examined in Another indication of the importance of such then became airborne and climbed a few feet. the Teterboro crash. training is the FAA’s January 2009 proposed rule … The flight crew had incorrectly set the trim on new training requirements5 for pilots and other for the trimmable horizontal stabilizer at minus professions, which includes awareness criteria for 1.7 degrees UP (airplane nose up [ANU]). This pilots to “experience the pitch handling qualities setting resulted in a pitch-up trim condition. The of the aircraft with runaway stabilizer or runaway proper trim setting, 1.7 degrees DN (airplane pitch trim, and pitch mistrim during takeoff or nose down), would have resulted in a correct trim landing and during cruise flight” and to “observe condition for the way the airplane was loaded.” the effects of early versus late detection and de- In the letter about the A320, the NTSB cited activation or correction.” Pilots also would have similar factors in the April 2000 rejected takeoff of to practice the procedures for recovery prescribed another A320, which simulations showed would in the flight crew operating manual. Evaluation of have been controllable if the takeoff had continued. performance would require that pilots in training In this earlier event, the nose also had begun to lift “confirm that the aircraft trim and wing high-lift off below the computed rotation speed. The airplane devices are configured properly.” had been loaded with an aft CG, and the flight crew The FAA also has focused on auxiliary perfor- inadvertently had set the trimmable horizontal mance computers (APCs), sometimes called auxil- stabilizer at minus 2.2 degrees UP rather than the iary performance laptop computers, encompassing correct setting of 2.0 degrees DN. in part processes, procedures and computer pro- Review of U.S. National Aeronautics and ficiency underlying the data for setting stabilizer Space Administration Aviation Safety Reporting trim for takeoff.6 Guidance in this information for System (ASRS) reports about events in 2005– operators also will “cause operators to review those 2008 suggests flight crew training subjects and procedures and related training to ensure their issues to consider in refining aircraft weight and adequacy, if APC is to be used in the operator’s ap- balance control systems. Most fit the same few proved weight and balance control system.” categories mentioned in the 1990s by Boeing. A forthcoming FAA advisory circular for the The first officer of a 747 discovered before on-board aircraft weighing system (OBAWS)7 takeoff that the final weight manifest showed on some large transport airplanes — which takeoff gross weight 98,700 lb (44,770 kg) less provides flight crews a continuous display of than the correct figure, an error later attributed to the aircraft total weight and other safety-critical a dispatcher’s miscalculation. “I was lucky to pick information whenever the airplane is on the up on the error because the takeoff gross weights 46 | flight safety foundation | AeroSafetyWorld | February 2009 FlightTRAINING were significantly different, and the trim stick full down to maintain directional data; count discrepancies of more than required on the final weight manifest control via the nosewheel, I elected to 100 passengers on some flights; errors was significantly different from the accelerate a bit to see if relative airflow in identifying which passengers are trim required in the flight management over the horizontal stabilizer would help children; discontinuation of procedures computer [FMC]. The final weight trim alleviate this tail-heavy scenario. After that had required crewmembers to cross- was 4.4 units and the FMC said [it should about 70 kt, I was hesitant to neutralize check the actual passenger count; mis- have been] 5.5 units, a difference of 1.1. the stick because [I felt that] the nose- communication of bag counts; failure to … It appears there is no safety check wheel was going to lift off the ground. I account for ballast fuel in load planning; between the flight plan, fuel boarded knew the CG was aft because the trim and load-planning computation errors and the final weights. … There is no fleet setting was unusual although within confusing kilograms and pounds. standard operating procedure or guid- the limits on paper. … The aft limit for Notes ance given in the airplane flight manual this was 1,672 units and the aircraft was to help catch this error. If there is, then it actually loaded to 1,680 units. When [we 1. NTSB. Safety Recommendations A-08-48, is not being effectively taught in training asked the loading agent] about the out- -49 and -50. July 17, 2008. and not being used during line opera- of-range number, we were told, ‘There is 2. NTSB. “Runway Overrun and Collision, tions. I routinely watch most 747-400 first slop built into the limits.’”11 Platinum Jet Management, LLC, Bombardier Challenger CL-600-1A11, N370V, Teterboro, officers on the line set the trim based on Takeoff performance of a Mc- New Jersey, February 2, 2005.” Aviation what the final weight paperwork says, Donnell Douglas MD-80 surprised Accident Report NTSB/AAR-06/04, 2006. and never cross-check the FMC.”9 the flight crew, and a load audit was 3. Boeing. “Tail Strike Avoidance.” Aero. A 757 flight crew quickly recog- ordered at the destination. “During October 1998. nized an incorrect trim setting while the takeoff roll at rotation, the aircraft 4. In U.S. and European terminology for air- accelerating for takeoff. “We had a load would not rotate — very heavy [control worthiness certification, marked increase of military personnel with their duffel forces] and extra long takeoff roll,” the means any amount greater than 1 percent bags,” the captain said. “Percent mean report said. “Fuel and passenger load of the scheduled takeoff distance. aerodynamic chord [MAC] was forecast were spot on [according to the audit 5. FAA. “Qualification, Service, and Use of to be 28.8 with 8,190 lb [3,715 kg] in results]. Freight was listed at 198 lb [90 Crewmembers and Aircraft Dispatchers; the front [baggage] pit. … Trim was 3.7 kg], I believe. They unloaded 13 crates Proposed Rule.” Federal Register Volume units [ANU] during the takeoff roll, and out of the mid-cargo area. … Assum- 74 (Number 7), p. 1280. January 12, 2009. at [VR] it took an extraordinary amount ing 900 lb [408 kg] each, that comes 6. FAA. “Weight and Balance Control of control force to rotate. I had to trim to almost 12,000 lb [5,443 kg] differ- Methods: Auxiliary Performance the aircraft in the rotation to help get off ent than reported [to the flight crew], Computer.” Information for Operators, the ground. … The final weights calcula- approximately 6,000 lb [2,722 kg] over InFO 08031. May 16, 2008. tion indicated [that the actual required maximum zero fuel weight. … This was 7. An OBAWS uses strain-sensing transduc- takeoff] trim had been 4.2 units with a potentially deadly error. Good air- ers in each main wheel and nosewheel 4,380 lb [1,987 kg] loaded in the front manship on the part of the first officer axle, a weight and balance computer, and indicators that show the takeoff gross pit, and percent MAC was 25. Basi- prevented disaster. The station manager weight, the CG location in percent of 12 cally, the front pit weight fell off 4,000 lb … should be held accountable.” MAC and attitude. [1,814 kg] from planned, and the trim Other ASRS reports include post- 8. NTSB. Letter regarding safety recom- moved aft from 3.7 to 4.2 units with a takeoff revision of final weight manifests, mendations A-02-06 and A-02-07 to FAA full airplane. Unlikely. These were bad sometimes by thousands of pounds; flight Administrator Jane F. Garvey. April 15, 2002. numbers — from where, I don’t know.”10 crew complaints about load planners’ 9. NASA ASRS report no. 754690, September The flight crew of an A320 rejected apparent ignorance of the takeoff safety 2007. a takeoff at about 80 kt. “Final weights consequences of errors on final weight 10. NASA ASRS report no. 731902, March had the trim set at 38.3 percent MAC,” manifests; flight crew error in departing 2007. the report said. “Once takeoff power was before receiving the final weight manifest; added, I immediately noticed a strong flight crew input of zero fuel weight data 11. NASA ASRS report no. 796177, July 2008. nose-up tendency. … With the control instead of actual takeoff gross weight 12. NASA ASRS report no. 694610, April 2006. www.flightsafety.org | AeroSafetyWorld | February 2009 | 47 DataLink U.K. Business Jet Accident Rates Comparatively High Engine problems were the most frequent factor in serious incidents among large aircraft. BY RICK DARBY ates of reportable accidents were highest This reportable accident rate was also for business jets among all U.K. classes more volatile than the rates for jets and tur- of large public transport aircraft in the boprops when shown as a three-year moving 1998–2007 period, according to a new average (Figure 1).4 At 16.8 per million flight Rreview by the U.K Civil Aviation Authority.1 The hours, this rate for business jets remained reportable accident rate for business jets was lower than that for turboprops (Table 1). more than four times that for jets, a category that The fatal accident rate, 8.4 per million flight excludes business jets.2 Their fatal accident rate hours, compared with 1.4 per million flight was six times higher than that for turboprops and hours for turboprops and 0.04 per million more than 200 times higher than that for jets.3 flight hours for jets. Reportable Accident Rates, U.K. Large Aircraft, 1998–2007 Reportable and Fatal Accident Rates, U.K. Large Public Transport Airplanes, 45 1998–2007 s Jet Turboprop Business jet r 40 Reportable Fatal 35 Accident Rate Accident Rate 30 per million per million n flight hou 25 Class of Aircraft flight hours flight hours o 20 Business jet 16.8 8.4 milli 15 r e Jet 3.9 0.04 p 10 e t Piston 0.0 0.0 a 5 R 0 Turboprop 20.2 1.4 2000 2001 2002 2003 2004 2005 2006 2007 End year of three-year period All classes of 4.8 0.2 aircraft Source: U.K. Civil Aviation Authority Source: U.K. Civil Aviation Authority Figure 1 Table 1 48 | flight safety foundation | AeroSafetyWorld | February 2009 DataLink Incidents, especially serious incidents, are review says. “The three-year moving average widely considered significant because they may high-severity occurrence rate has decreased 70 be “accidents waiting to happen.”5 The serious percent, from 24.7 per million [flight] hours in incident rate for business jets was also volatile, the period 1997– 2000 to 7.4 per million hours but by the last rolling three-year period, ending in in the period 2005–2007.” 2007, it was lower than the corresponding rate for For small public transport airplanes, the both jets and turboprops (Figure 2). In the overall reportable and fatal accident rates showed an 10-year period, business jet serious incidents improving trend, although the reportable ac- clocked in at 8.4 per million flight hours — the cident rate was volatile (Figure 6, p. 50). same as the fatal accident rate — compared with 5.1 for jets and 17.8 for turboprops. The review also categorizes the serious Serious Incident Rates, U.K. Large Aircraft, 1998–2007 incidents for the period involving large public transport airplanes (Figure 3). The 10 factors 45 Jet Turboprop Business jet s most frequently associated with serious incidents r 40 applied to 76 percent of all serious incidents. 35 Heading the list are “engine,” “smoke/fumes in 30 25 cabin or flight deck,” “flight control problem,” n flight hou o 20 “runway excursion” and “runway incursion.” 15 milli r “Over 42,000 occurrences involving large e p 10 e public transport airplanes were reported be- t a 5 R tween 1998 and 2007,” the review says (Figure 0 4, p. 50). “The figure includes both accidents 2000 2001 2002 2003 2004 2005 2006 2007 End year of three-year period and serious incidents, which together form less than 1 percent of the total [occurrences]. The Source: U.K. Civil Aviation Authority three-year moving average occurrence rate has Figure 2 increased 30 percent, from 1,400 per mil- lion [flight] hours in Serious Incidents, U.K. Large Public Transport Airplanes, 1998–2007 the period 1997–2000 16% to 1,800 per million hours in the period 14% s t n 2005–2007.” e 12% d i c Although the n i 10% s overall occurrence u o i r 8% rate increased, the e s f o 6% rate of what the CAA t n e defines as “high- c r 4% e severity” occurrences P 2% decreased (Figure 5, p. 50). “In the 10-year 0% Engine Smoke/fumes Flight Runway Runway Airprox/ Aircraft Depressurization Electrical Weather period, 0.8 percent of in cabin or control excursion incursion TCAS low on failure ight deck problem warnings approach occurrences involving large public trans- Airprox = loss of required separation TCAS = traffic alert and collision avoidance system port airplanes have Source: U.K. Civil Aviation Authority been considered to be high-severity,” the Figure 3 www.flightsafety.org | AeroSafetyWorld | February 2009 | 49 DataLink About 650 occurrences for small public Occurrences, U.K. Large Public Transport Airplanes, 1998–2007 transport airplanes presented a similar picture to their larger counterparts. The three-year 6,000 Occurrences (includes accidents and serious incidents) 2,000 Occurrence rate (three-year moving average) Rate per million flight hours moving average occurrence rate increased by 5,000 1,600 84 percent from 1998–2000 to 2005–2007. 4,000 1,200 The three year moving average high-severity 3,000 occurrence rate, however, decreased by 31 800 2,000 percent in the same time frame (Figure 7). Number of occurrences 1,000 400 Helicopter operations — including all U.K.- registered or -operated helicopters engaged in 0 0 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 public transport operations — were categorized Year as “emergency services,” “offshore” and “other,” Source: U.K. Civil Aviation Authority the last being mainly passenger flights. There were 25 reportable accidents in the 1998–2007 Figure 4 period (Figure 8). Among them were four fatal accidents with a total of 22 fatalities. Of the High-Severity Occurrences, four, two occurred during emergency services U.K. Large Public Transport Airplanes, 1998–2007 and two during offshore operations. 30 “Overall, the rate of reportable accidents in- s High-severity occurrence rate r Three-year moving average volving public transport helicopters was 19.1 per 25 million [flight] hours, and the fatal accident rate 20 was 3.1 per million hours,” the review says. n flight hou o 15 Public transport helicopters were involved in 11 serious incidents during the study period, all milli 10 r e p in offshore operations, except in 2004 and 2005. e 5 t a No serious incidents were recorded in 2000, R 0 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2001, 2003 and 2006. Year During the period, 1.9 percent of occurrenc- Source: U.K. Civil Aviation Authority es were classified as high-severity. There was no obvious trend (Figure 9). Figure 5 Summing up the differences between the latest data and those from the previous edi- Reportable and Fatal Accident Rates, U.K. Small Aircraft, 1998–2007 tion of the safety review, which looked at the 90 1995–2004 period, the review says concerning s r 80 large public transport airplanes, “The number 70 of reportable accidents has [been] reduced from 60 162 to 132 … and the number of fatal accidents n flight hou 50 o 40 has remained the same. A comparison of the milli 30 three-year moving average reportable acci- r e p 20 dent rates at the end of the two time periods e t a 10 examined shows an overall reduction: In the R 0 1998 1999 2000 2001 2002 2004 2005 2006 2003 2007 three-year period ending 2004, the rate was 6.7 Year reportable accidents per million hours, whereas Reportable accident rate Fatal accident rate Three-year moving average Three-year moving average in the three-year period ending 2007, the rate Source: U.K. Civil Aviation Authority was 3.1 reportable accidents per million hours.” In the data subset for U.K. public transport Figure 6 helicopters, the number of reported occurrences 50 | flight safety foundation | AeroSafetyWorld | February 2009 DataLink rose from 2,200 in the previous period to 2,400 High-Severity Occurrences, in the most recent. The number of reportable Public Transport Airplanes, 1998–2007 accidents decreased, from 31 to 25, while the 70 number of fatal accidents was the same — four s High-severity occurrence rate r — in both study periods. 60 Three-year moving average “The three-year moving average report- 50 able accident rate in 2004 was 17.7 per million 40 n flight hou o [flight] hours, but by 2007 this figure had [been] 30 milli reduced to 11.8 per million hours,” the review r 20 e p says. “Similarly, the three-year moving average e t 10 a fatal accident rate [was] reduced from 2.5 in the R 0 period ending 2004 to 2.4 in the period ending 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 Year 2007.” Source: U.K. Civil Aviation Authority Numbered Swiss Account Figure 7 A different report, published by the Swiss Aircraft Accident Investigation Bureau, indi- Reportable Accidents, cated that the total number of accidents and U.K. Public Transport Helicopters, 1998–2007 serious incidents involving Swiss-registered 6 s Other aircraft decreased to 52 in 2007 from 72 in r Emergency services 5 2006 despite an increase in flight hours (Table O shore 2, p. 52).6 It was the lowest combined total 4 since 1998. n flight hou o 3 The 2007 total number of accidents, 43, was milli 2 r the lowest in the period beginning in 1996. Seri- e p e 1 ous incidents were down to nine in 2007 from t a 14 the previous year. R 0 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 For large aircraft — greater than 5,700 Year kg/12,500 lb — the number of accidents and se- Source: U.K. Civil Aviation Authority rious incidents among Swiss-registered aircraft in Switzerland was reduced by half, from 12 Figure 8 to six, between 2006 and 2007 (Table 3, p. 52). None of those occurrences involved injuries. High-Severity Occurrences, The number of accidents involving Swiss- U.K. Public Transport Helicopters, 1998–2007 registered helicopters in Switzerland decreased 60 s Rate of high-severity occurrences from 11 to seven. r 50 Three-year moving average Among accidents and serious incidents involving large airplanes in 2007 — including 40 n flight hou Swiss-registered airplanes in Switzerland and o 30 abroad, and non-Swiss airplanes in Switzerland milli 20 r e — four of nine occurred during the landing p e 10 t phase of flight; three during cruise; and two a R during descent and approach. Among helicopter 0 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 accidents and serious incidents, four of 10 hap- Year pened in descent and approach, four in landing, Source: U.K. Civil Aviation Authority one on the ground, in rolling or in hovering flight; and one during cruise. Figure 9 www.flightsafety.org | AeroSafetyWorld | February 2009 | 51 DataLink Notes transport operations include ambulance, cargo, pas- senger, police support or search and rescue. Large 1. Aviation Safety Review — 2008. Civil Aviation airplanes are those exceeding 5,700 kg/12,500 lb Publication (CAP) 780. Nov. 11, 2008. Covering maximum takeoff weight;small airplanes are those U.K., European region and worldwide occurrence up to that weight. Among large public transport data, the document is available via the Internet at airplanes, U.K. aircraft classes comprise business jet, Accidents and Serious Incidents, Swiss-Registered Aircraft in Switzerland and Abroad, and Non-Swiss Aircraft in Switzerland, 2006–2007 Swiss-Registered Aircraft in Switzerland Swiss-Registered Aircraft Abroad Non-Swiss Aircraft in Switzerland Persons Persons Persons Persons Persons Persons Total Injured Not Injured Total Injured Not Injured Total Injured Not Injured 2007 2006 2007 2006 2007 2006 2007 2006 2007 2006 2007 2006 2007 2006 2007 2006 2007 2006 Aircraft with MTOW 3 0 2 0 1 0 2 0 0 0 2 0 4 1 0 0 4 1 2,250–5,700 kg Aircraft with 6 12 0 0 6 12 1 1 0 0 1 1 2 0 0 0 2 0 MTOW > 5,700 kg Helicopter 7 11 2 2 5 9 3 1 1 0 2 1 0 0 0 0 0 0 MTOW = maximum takeoff weight Source: Swiss Aircraft Accident Investigation Bureau Table 3 52 | flight safety foundation | AeroSafetyWorld | February 2009 InfoScan Drive to Succeed A supplement to the U.K. radiotelephony manual instructs ground vehicle drivers on standardized communication and best practices. REPORTS air-ground communication service operator phraseology. The Phrase That Pays The guide begins with basics that may seem A Reference Guide to UK Phraseology for Aerodrome Drivers obvious to pilots and controllers but could be U.K. Civil Aviation Authority. Supplement to Civil Aviation Publication new to beginning drivers. “Think about what (CAP) 413, Radiotelephony Manual. October 2008. 34 pp. Figures, illustrations. Available via the Internet at driver should immediately ask for directions or facilities is 43 years. Fifteen facilities are more instructions. than 50 years old. Although the terminology applies to U.K. During site visits, the auditors observed vehicle drivers, many of the general principles structural problems and maintenance issues will be useful to drivers at any large airport. at several locations, including “water leaks, Upgrading ATC Facilities mold, tower cab window condensation, deterioration due to poor design and general FAA’s Management and Maintenance of Air Traffic Control Facilities disrepair. While the deficiencies observed U.S. Federal Aviation Administration (FAA). Report AV-2009-012. posed no immediate risk to the operations of Dec. 15, 2008. 32 pp. Figures. Available via the Internet at 54 | flight safety foundation | AEROSafetyWorld | February 2009 InfoScan headquarters was not always aware of which Other changes include: projects had been funded and completed and • A detailed specification is provided for which projects still remained incomplete. This lighting the “H” heliport identification uncertainty made it difficult for FAA head- marking and the touchdown and position- quarters managers to plan for future projects ing marking circle; and accurately estimate their needs.” The agency has since developed a process • A new reference is provided to the final to better manage maintenance needs, the specification for helideck status light report says. The Air Traffic Organization’s Ter- systems; minal Services unit now uses an agency-wide • As a result of completed helideck tool called the Needs Assessment Program. environmental projects, a new turbu- Terminal maintenance projects are entered into lence criterion is published and the a central system, and headquarters is able to longstanding vertical flow criterion prioritize them based on urgency. In addition, is removed; to aid in preventive maintenance, Terminal Services has begun conducting life-cycle as- • New International Civil Aviation Orga- sessments at terminals and has instituted a nization standards and recommended Structured Facility Planning Process that helps practices relating to offshore helidecks the unit determine which facilities most need and shipboard heliports, which are to to be replaced. become applicable in November 2009, are Over fiscal years 2008 through 2015, the included; agency plans to replace 29 of its 397 terminal • Material is added from the fourth edition facilities. The auditors recommend that a similar of the International Chamber of Shipping process be followed for en route facilities. The Guide to Helicopter/Ship Operations, pub- report says that the FAA should “determine lished in December 2008; and, what type of facilities (i.e., terminal versus en route or a hybrid of the two) will be needed, • For the first time, guidance is included for how many of these facilities will be needed, and the design of winching area arrangements where they should be located to effectively sup- on wind turbine platforms. port NextGen.” WEB SITES On the Deck Offshore Helicopter Landing Areas — Knowing Your Avionics Guidance on Standards Aircraft Electronics Association, U.K. Civil Aviation Authority (CAA). Civil Aviation Publication The standing groups and focus teams ad- dress issues related to topics such as air traffic control, crew resource management (CRM), maintenance engineering, ramp safety and human interface design. Proceedings from their conferences, from 1998 through 2007, contain PowerPoint presentations by RAeS members, academia and industry. Conference titles include “Risks in Aviation Maintenance,” 2007; “Management of Human Factors Risk in Safety-Critical Industries,” 2006; and “Human Factors: Making a Difference,” 2008, which focused on human factors in safety manage- ment systems. HFG similarly provides free access to • Technical Training Exam: A copy of related CRM and human factors papers and the exam designed to help member reports; regulatory, standards and guidance companies meet technician-training materials; and journal articles, including some requirements is accompanied by links to from the U.K. Civil Aviation Authority and Avionics News full-text articles that pro- the U.S. Federal Aviation Administration. vide background research to aid in suc- cessfully completing the exam. The 2007 exam with relevant background articles is also available. • Avionics INTEL Sheets: Each two-page briefing paper gives an overview of an avionics system such as terrain awareness and warning system (TAWS), traffic alert and collision avoidance system (TCAS) and emergency locator transmitter (ELT) with product specifications, descriptions of the technology and references to appli- cable U.S. Federal Aviation Regulations. To access most materials, select and click on the conferences icon. Passwords are not re- The Human Touch quired for this portion of the Web site. Docu- Royal Aeronautical Society, Human Factors Group, ments and individual presentations are full 56 | flight safety foundation | AEROSafetyWorld | February 2009 OnRecord Engine Cowling Departs on Landing Distracted maintenance technicians neglected to secure the latches. BY MARK LACAGNINA The following information provides an aware- As the airplane climbed to cruise altitude, ness of problems in the hope that they can be the engine-vibration monitors showed that the avoided in the future. The information is based vibration measurement for the right engine was on final reports by official investigative authori- about twice as high as for the left engine, but no ties on aircraft accidents and incidents. cautions or warnings were generated. “The cap- tain reported that during cruise flight, the no. JETS 2 [right] engine vibration decreased, and about 20 minutes after they leveled off, the airplane Section Strikes Horizontal Stabilizer shuddered as if flying through wake turbulence,” Airbus A319-100. Substantial damage. No injuries. the report said. aintenance had been performed on the The flight proceeded without incident until A319’s right engine the evening before after the airplane touched down in Detroit, Mthe airplane was scheduled for a flight when the lead flight attendant told the flight from New York’s La Guardia International crew that “part of the right engine came off.” Airport to Detroit Metropolitan Wayne County The crew shut down the right engine and taxied Airport with 68 passengers and five crewmem- the airplane to the gate, and the first officer told bers the morning of Jan. 9, 2008. “The first the airport ground traffic controller that there officer reported the engine cowlings were flush might be debris on the runway. and he did not see any ‘hanging’ latches when he Investigators found that half of the engine- looked underneath the engine cowlings during fan cowling had separated when the airplane the preflight,” said the report by the U.S. Na- was on final approach about a mile from tional Transportation Safety Board (NTSB). the runway; the other half had separated on The captain said that taxi and takeoff appeared touchdown. The report said that this part of the normal. However, during initial climb, the lead cowling was struck by an airplane that landed flight attendant told the flight crew that a passen- after the A319, but it provided no details about ger had seen a right-engine cowling flapping after the incident. takeoff. “A pilot-passenger who was sitting behind Investigators also found that part of the this passenger reportedly did not see the cowl- cowling had struck and substantially damaged ing move, nor did the flight attendants when the A319’s right horizontal stabilizer. “In addi- they looked out the window,” the report said. tion, the fan cowling doors, no. 2 engine pylon, www.flightsafety.org | AEROSafetyWorld | February 2009 | 57 OnRecord the no. 2 engine reverser and the right wing no. together. The Global Express had been parked 1 slat were damaged,” the report said. in the open, in heavy rain, for four days at Van The work on the right engine — to replace Nuys (California) Airport. “During this period, the N1, or low-pressure rotor (fan) speed, sensor the wheels were chocked with the brakes off,” the — had been performed by two contract mainte- report said. “Significant rain ceased 11 hours be- nance technicians. “They reported that they had fore takeoff, and no rain fell during the last eight shut the fan cowling but did not latch it, as they hours before departure.” Surface temperature still needed to perform an engine run and check during the last eight hours was 12° C (54° F). for leaks [after replacing the sensor],” the report The operations reference manual, a training said. “They performed the engine run and were document, for the Global Express recommends in the cockpit when another mechanic asked for that when ground surfaces are “contaminated help on another airplane.” or covered with water,” the wheel brakes should Neither maintenance technician returned to be applied while taxiing to warm the brakes and the A319 after assisting the other mechanic, and the wheels so that the brakes do not freeze. the airplane was returned to service with the However, the ramp, taxiways and runways at engine-fan cowlings unlatched. Van Nuys were dry when the occupants boarded the aircraft. Recorded flight data indicated that Tire Failure Traced to Frozen Brake there was minimal brake application — and little Bombardier Global Express. Substantial damage. No injuries. kinetic heating of the brakes — as the aircraft fter a flight of more than nine hours with two was taxied to the departure runway, and a rapid passengers from the United States on Jan. 29, climb subsequently was made to Flight Level A2008, the aircraft was being landed at London 410 (approximately 41,000 ft), where the outside Luton Airport when the pilots heard a rumbling air temperature was minus 25° C (minus 13° F). noise that they identified as a burst tire. They also Investigators found that rainwater on the observed indications of low pressure in the no. 2 upper wing surface of a Global Express can pass and no. 3 hydraulic systems. “The commander through a drain hole and flow along the lower brought the aircraft to a stop on the runway using wing surface until encountering a flush skin normal brakes and, as fire vehicles approached, joint, where it tends to drip onto the inboard shut down both engines,” said the report by the tire and migrate onto the brake stator and rotor. U.K. Air Accidents Investigation Branch (AAIB). “The brake manufacturers have confirmed that The Global Express Investigators determined that the inboard the materials of the rotors and stators, both wheel on the left main landing gear was locked — being carbon-type structures, are porous and had been parked in not free to rotate — on touchdown, causing the tire slightly absorbent,” the report said. “After ex- to burst. Friction forces then caused the wheel to tensive water soaking, they require a prolonged the open, in heavy break free and rotate, and flailing segments of torn period of exposure to dry, warm conditions to rain, for four days. tire tread and tire carcass struck the spray guard. ensure that full drying takes place. Alternatively, “This destroyed the guard, inflicted sig- significant braking action must be deliberately nificant damage to the wing local auxiliary applied during taxiing before departure to en- spar structure and fractured hydraulic pipes, sure brake drying.” resulting in the nos. 2 and 3 hydraulic systems The inboard left brake rotor and stator were becoming inoperable,” the report said. “It also still wet when the accident aircraft departed fractured the flap-drive torque tube, damaged a from Van Nuys, and they froze together dur- major wiring loom and caused metallic debris to ing cruise flight. The tire that burst on landing be forced between and into contact with the two was of cross-ply, or bias-ply, construction. The cables driving the left aileron.” report said that when a radial-ply tire bursts, the The left inboard wheel had become locked “detached or flailing debris is likely to be signifi- because its brake rotor and stator had frozen cantly smaller and lighter.” 58 | flight safety foundation | AEROSafetyWorld | February 2009 OnRecord After the accident, Bombardier published an with the landing gear warning horn, and the advisory reminding pilots and maintenance per- pilot reported that he did not hear a warning,” sonnel that carbon brakes can absorb moisture the report said. and freeze if they are not heated properly. “After There is no preflight test procedure for the exposure to moisture, a prolonged period of dry, landing gear warning horn. However, the horn The pilot asked warm conditions is required to ensure [that] full is shared by the cabin altitude warning system. what happened to drying takes place,” the advisory said. “Alterna- “The cabin altitude warning system is a preflight tively, brake applications must be deliberately check item for flight crews,” the report said. the landing gear. applied during taxi, before departure, to ensure “Therefore, the anomaly that rendered the gear that the moisture is evaporated away.” warning system inoperative would be detectable The copilot AAIB recommended that regulatory authori- during a flight crew’s preflight check because the ties “raise awareness of the vulnerability of carbon cabin altitude warning would fail to function. responded, ‘We brakes to freezing in flight following exposure to “However, a review of available maintenance never put it down.’ moisture on the ground.” The bureau also rec- and discrepancy records revealed no indication ommended that Bombardier modify the Global that any flight crews had previously detected Express to reduce the amount of water that flows and reported an inoperative cabin altitude onto the brakes when the aircraft is parked in rain. warning system. … Therefore, it could not be determined when the wire fracture occurred.” Broken Wire Silences Warning Horn The records indicated that both fuel gauges British Aerospace Hawker 700A. Substantial damage. No injuries. and an interstage turbine temperature gauge o checklist callouts were recorded by the were inoperative. The report said that these cockpit voice recorder (CVR) as the Hawker gauges are required by the airplane’s minimum N— en route with 10 passengers on a business equipment list to be functional for flight. flight from Toluca, Mexico — neared Fort Lau- The report also said that neither pilot was derdale/Hollywood (Florida, U.S.) International properly certificated to fly the Hawker, which Airport the night of Nov. 1, 2006. The flight crew was registered in the United States. The pilot’s advised air traffic control (ATC) that they had U.S. commercial certificate and the copilot’s the airport in sight and were cleared to conduct a U.S. private certificate were based on their visual approach. The pilot told investigators that he Mexican certificates. Neither pilot had a U.S. was distracted during the approach while looking instrument rating, and the captain was not for the runway, the NTSB report said. type-rated in the Hawker. The landing gear was not extended when the “Although there is insufficient evidence Hawker touched down and slid about 2,600 ft (792 to indicate that any of these flight crew dis- m) before coming to a stop on the runway with crepancies were directly related to the cause of substantial structural damage and fire damage to the accident, the FAA [U.S. Federal Aviation the bottom of the fuselage. “Following touchdown, Administration] determined that the discrepan- the CVR recorded that the pilot asked what hap- cies represented noncompliance with numerous pened to the landing gear and the copilot respond- Federal Aviation Regulations,” the report said. ed, ‘We never put it down,’” the report said. Examination of the landing gear extension Collision With a Misplaced Airbridge system showed that it operated normally and Boeing 757-300. Substantial damage. No injuries. that the primary and secondary annunciators he visual docking-guidance system was acti- correctly indicated the position of the gear. vated remotely by an airport apron control- Investigators found, however, that a wire had Tler as the 757 was being taxied to Stand 32 separated from a relay, rendering the landing at Manchester (England) Airport the evening of gear warning horn inoperative. “The CVR had Dec. 12, 2007. “Due to commitments elsewhere captured no sounds that could be associated on the airport, a dispatcher allocated to attend www.flightsafety.org | AEROSafetyWorld | February 2009 | 59 OnRecord the arriving aircraft was unable to reach the The starter on the General Electric CF6- stand before the aircraft,” said the AAIB report. 80E1 engine had accumulated 14,988 flight The commander used references from the hours and 2,428 cycles. The manufacturer’s ex- visual docking-guidance system to turn off the amination of the starter revealed that the failure taxiway and align the 757 with the centerline of was precipitated by a previous “crash engage- the stand, and he reduced groundspeed below 4 ment” of the starter clutch. This is a complex kt as the aircraft neared the indicated stopping phenomenon that can occur when an interrup- position. “Deceleration was more pronounced tion in the flow of pressurized air driving the than he expected, and the aircraft stopped ap- starter turbine causes the clutch to disengage proximately 3 ft [1 m] short of the indicated posi- and the starter shaft to decelerate. When airflow tion,” the report said, noting that the left engine is restored, the starter turbine accelerates to cowling had struck an airbridge. “The pilots shut “free-run speed,” and re-engagement of the down the engine, and the [283] passengers and clutch causes internal components to “crash” [10] crew disembarked without further incident.” against each other. The damage increases during The 757 was the first aircraft to be parked at subsequent engine starts and can spread to other Stand 32 after it was reopened following two days starter components, such as the turbine bear- of maintenance on the airbridge. The airbridge ings. The starter has cutter pins designed to cut had not been retracted so that the wheels on its off the turbine blades if the bearings fail and a outer section were within a designated circle containment ring that is supposed to prevent the painted on the apron. “In the absence of relevant blades from exiting from the starter. procedures, the airport operator did not check The report said that there have been three physically that the airbridge … had been returned starter turbine failures since the CF6-80E1 to its correct parking position,” the report said. engine was introduced in 1993. The incident at “The apron controller was unable to check visu- Darwin was one of two failures that were not ally, prior to its use, that the stand was clear and contained. “As a result of this incident, the en- that [the airbridge was] properly positioned.” gine manufacturer undertook corrective actions AAIB recommended that the airport pro- in the form of a starter containment improve- hibit remote activation of a visual docking- ment plan, which proposed design improve- guidance system until personnel at the stand ments to the starter,” the report said. confirm that the stand is clear. TURBOPROPS Starter Bursts During ‘Crash Engagement’ Airbus A330-300. Substantial damage. No injuries. Frost Blamed for Loss of Control he flight crew made two unsuccessful at- Cessna 208B Caravan. Substantial damage. One serious injury, one minor injury. tempts to start the A330’s right engine while Tpreparing for a flight from Darwin, Austra- ight visual meteorological conditions lia, on Oct. 24, 2007. The first attempt was an prevailed and surface temperature was automatic start that lasted 1 minute 10 seconds Nminus 11° F (minus 24° C) when the pilot but resulted in no N2, or high-pressure compres- prepared the Caravan for a cargo flight from sor, rotation. “The second attempt was a manual Bethel (Alaska, U.S.) Airport on Dec. 18, 2007. start lasting six minutes, at which time smoke The pilot told investigators that he used a broom and sparks were observed from under the engine but no deicing fluid to clean frost off the wing cowlings,” said the report by the Australian Trans- and tail surfaces. port Safety Bureau (ATSB). “Subsequent inspec- The pilot used 20 degrees of flap for the tion of the engine revealed an uncontained failure takeoff and maintained an airspeed of 110 kt for of the starter turbine and secondary damage to the initial climb at 500 fpm. When he retracted the [adjacent] integrated drive generator.” the flaps to 5 degrees, the Caravan began to roll 60 | flight safety foundation | AEROSafetyWorld | February 2009 OnRecord right in what the pilot described as similar to an ground level (AGL) when airspeed decreased encounter with a wake vortex. He applied left below Vref, the target landing speed. The com- aileron and extended the flaps to 20 degrees, but mander told the copilot, “Speed appears to be the rolling tendency became more severe. a bit low.” The copilot moved the power levers The commander “He then noticed that the airplane was de- from flight idle to a position that caused a 1 scending toward the ground, so he attempted to percent increase in torque, to 8 percent; an ap- thought that he put the flaps completely down,” the NTSB report propriate setting was 15 percent torque. needed to increase said. “His next memory was being outside the As airspeed continued to decrease, the com- airplane after it collided with the ground.” The mander thought that he needed to increase pow- power but did pilot received minor injuries; a passenger, a er but did not move the power levers. “He also ground-support employee of the operator, was remembered a sense of ‘why am I not reacting to not move the seriously injured. this?’ and being puzzled by this,” the report said. Investigators determined that the pilot’s Airspeed was 11 kt below Vref when the Dash power levers. description of the rolling tendency was consis- 8 touched down, striking its tail on the runway. tent with airframe contamination by ice. “The The bottom of the rear fuselage was damaged, but airplane’s information manual contains several the pilots were able to taxi the aircraft to the stand, pages of limitations and warnings about depart- where the passengers disembarked normally. ing with even small amounts of frost, ice, snow “The commander stated that after his return or slush on the airplane, as it adversely affects the to work, he did not feel unwell but was getting airplane’s flight characteristics,” the report said. progressively more tired,” the report said. “[He] “The manufacturer … notes that a heated hangar felt he should have been advised to have a longer or approved deicing fluids should be used to recuperation period.” remove ice, snow and frost accumulations.” After the accident, the CAA Aeromedical Section issued expanded guidelines to AMEs for Back to Work Too Soon assessing the fitness of professional pilots to re- De Havilland Dash 8. Substantial damage. No injuries. turn to work after hospitalization for an illness. he commander, 48, had been hospitalized for 12 days for an illness that was not specified Horizontal Stabilizer Strikes Parachutist Tin the AAIB report. After being discharged, Beech 99. Substantial damage. One fatality. he advised his aviation medical examiner (AME) wo of the 12 parachutists aboard the air- about the hospitalization. “The AME advised plane jumped before the pilot reduced air- the commander that … he could return to work Tspeed and illuminated the green jump light when he felt fit and no medical examination during a skydiving flight near Bowling Green, would be required,” the report said. Missouri, U.S., on June 21, 2008. “The first According to the U.K. Civil Aviation Author- parachutist stated that as soon as he jumped, he ity (CAA) Aeromedical Section, however, the realized that the airplane was going faster than illness suffered by the commander could result normal, and he tucked into a ball, barely missing in fatigue that can last for six weeks after the the horizontal stabilizer,” the NTSB report said. main symptoms of the illness abate. “Parachutists that remained in the airplane The commander reported for duty about two recalled that the second parachutist exited the weeks after leaving the hospital. Nine days later, airplane and arched into an ‘X’ before being on May 28, 2008, he was scheduled to adminis- struck by the airplane’s horizontal stabilizer. He ter line training of a copilot during a scheduled never opened his parachute.” flight with 37 passengers and two cabin crew- The pilot aborted the flight, performed a members from Exeter, Devon, England, to Paris. controllability check while returning to the During final approach to Charles de Gaulle departure airport and landed the airplane Airport, the Dash 8 was about 120 ft above without further incident. www.flightsafety.org | AEROSafetyWorld | February 2009 | 61 OnRecord Leaking Windows Cause Short Circuit Examination of the right engine revealed that Shorts 360. Minor damage. No injuries. a cylinder had separated from the case because of hile departing from Inverness, Scotland, fatigue failure of the attachment studs. The report for a cargo flight the night of Aug. 19, said that appropriate procedures for attaching W2008, the commander noticed a large the cylinder had not been followed when the amount of water spilling into the area around engine was overhauled 1,055 flight hours before the flap control lever. The aircraft was climbing the incident. Relatively thick paint, rather than through 6,000 ft when the pilots detected the the thin layer of primer specified by the overhaul odor of an electrical fire. “They attempted to manual, was found between the cylinder flange don their oxygen masks but had some difficulty and hold-down plate. “The presence of this paint in using them because they were different from could have led to an in-service loss of preload the masks on which they had received their [of the cylinder-fastening nuts], even if sufficient training,” said the AAIB report. torque was applied to the cylinder nuts at the Nevertheless, the crew was able to return to time of installation,” the report said. Inverness and land the aircraft without further incident. “The operator has confirmed that the Training Exercise Turns Deadly cause of the electrical smell was water entering Piper Seminole. Destroyed. Three fatalities. past the window seals and causing an electrical he Netherlands-based aviation school required short circuit behind the flap lever,” the report student pilots training for a multiengine rating said. “The leaking window seals have since been Tto practice an in-flight engine shutdown and repaired.” restart with a procedures trainer, and later in an The incident aircraft had a different oxygen aircraft under the supervision of a flight instruc- system and masks than the other two Shorts tor. The school prescribed a minimum altitude of 360s in the operator’s fleet. “The company has 3,500 ft for the actual in-flight training. now introduced additional training to ensure Nevertheless, during a training flight from that all their crews are fully conversant with the Eelde on Aug. 14, 2002, the left engine on one of differences between the aircraft in their fleet,” the school’s Seminoles was shut down at 2,000 the report said. ft. Soon thereafter, “the still functioning right engine also stopped, probably as a result of an PISTON AIRPLANES unintentional, incorrect [action] by the crew, most likely the closure of the right engine fuel Cylinder Separation Causes Fire valve,” said the report published recently by the Piper Aztec. Substantial damage. No injuries. Dutch Safety Board. bout 25 minutes after departing from North- “Because not enough attention was paid to east Philadelphia Airport for a positioning the primary task of [flying] the aircraft, speed Aflight to Newburgh, New York, U.S., the eve- dropped below stalling speed,” the report said. ning of Sept. 6, 2007, the pilot felt a slight vibration “This led to a loss of control of the aircraft at an and noticed decreased fuel flow to the right engine. altitude at which recovery was no longer possible. He turned back toward the departure airport. Witnesses stated that the aircraft lost altitude, A few moments later, the pilot noticed rotating around its vertical axis before hitting the smoke trailing from the right engine cowling water.” The three occupants were killed. and shut down the engine. “He then observed Noting in the report that the training bene- a flame emanating from the right side of the fits of shutting down an engine in flight likely do engine, so he pitched the nose of the airplane not outweigh the risks, the board recommended down, increasing the airspeed and extinguishing that schools providing pilot training in light the fire almost immediately,” the report said. He twins require that engine shutdowns/restarts be landed the Aztec without further incident. practiced only with procedures trainers. 62 | flight safety foundation | AEROSafetyWorld | February 2009 OnRecord Fuel Selector in Wrong Position for Takeoff the helicopter descended in a left turn into a Piper Aerostar 601P. Destroyed. One fatality. wooded area. eather conditions at Chautauqua “No evidence was found during the exami- County Airport in Jamestown, New nation of the wreckage of any pre-impact defect WYork, U.S., the morning of Jan. 8, 2007, or failure which could have caused or contrib- included surface winds from 260 degrees at 6 uted to the accident,” the report said. kt, gusting to 26 kt, 1/2 mi (800 m) visibility in snow and a 600-ft overcast ceiling. Shortly after Bystander Struck by Rotor Blade the Aerostar took off from Runway 25, witnesses Robinson R22 Beta. Minor damage. One fatality. heard a “throbbing or surging” sound and then everal visitors were at the helipad at Mary- saw the airplane descend “straight down” into field Station, Australia, when the pilot took marshy terrain, the NTSB report said. Soff for a cattle-mustering flight the after- Investigators found the right-engine fuel noon of July 24, 2007. “There was no plan for selector in the “X-FEED” position. The airplane positive control of the people in the vicinity of flight manual (AFM) for the 601P says that the departing helicopter,” the ATSB report said. crossfeed should be used only in level, coordi- “The pilot reported that during the initial nated flight. The report indicated that the pilot climb after takeoff and when ‘nearly at tree height,’ used a homemade checklist for takeoff that did the helicopter was struck by a gust of wind that re- not include the AFM requirement to ensure that sulted in height loss and activation of the helicop- the fuel selectors are in the “ON” position for ter’s ‘low rpm’ warning horn,” the report said. takeoff. As the pilot recovered from the upset, a The report said that the probable cause of woman who was walking with her back to the the accident was “the pilot’s incorrect selection helicopter was struck by the tip of a main rotor of the right engine fuel selector position, which blade and later died from her injuries. “Following resulted in fuel starvation of the right engine, a the rotor strike, the pilot turned the helicopter to loss of the right engine’s power and a loss of con- the right into wind and landed,” the report said. trol during initial climb.” Maintenance Error Leads to Drive Shaft Failure HELICOPTERS Bell 206B-3. Substantial damage. No injuries. he pilot was applying collective control to Disorientation Suspected in Control Loss land at Lakeland, Florida, U.S., on Sept. 5, Aerospatiale AS 355F2. Destroyed. Four fatalities. T2007, when the JetRanger yawed right and he Twin Squirrel was on a flight from landed hard. The fuselage was damaged near a Liverpool, England, to a private landing site cross-tube attach point, but none of the four oc- Tin Peterborough the night of May 1, 2007, cupants was injured. when an area of shallow fog and low clouds was The NTSB report said that the no. 5 tail encountered. The pilot descended to 20 ft AGL rotor drive shaft bearing had failed because of and reduced airspeed to 60 kt. The AAIB report improper maintenance. It noted that the tail said that he likely attempted to complete the rotor blades had been replaced after a “sudden flight below the clouds, using an illuminated stoppage” of the tail rotor in 1999. haulage yard and quarry for guidance. “The tail rotor drive shaft [and bearings] “Either imminent contact with the ground were not replaced at that time, as required by the or impending contact with trees ahead forced maintenance manual, and remained installed the pilot to climb, where it is possible that he until 2004, when they were inspected … and ap- became disoriented and lost control,” the report proved for return to service by the same facility said. The pilot and three passengers, including that had scrapped the tail rotor blades in 1999,” the owner of the helicopter, were killed when the report said. www.flightsafety.org | AEROSafetyWorld | February 2009 | 63 OnRecord Preliminary Reports Date Location Aircraft Type Aircraft Damage Injuries Dec. 3, 2008 Planeta Rica, Colombia Aero Commander 500 destroyed 2 fatal The airplane crashed in a field after a technical problem occurred during an air ambulance flight from Medellín to Montería. Dec. 3, 2008 Río Grande, Puerto Rico Rockwell Commander 690B destroyed 3 fatal The pilot was conducting a visual approach to San Juan in instrument meteorological conditions when the Commander struck a mountain. Dec. 6, 2008 Fort Lauderdale, Florida, U.S. Piper Seminole, Cessna 172 destroyed 4 fatal Both airplanes were on instructional flights when they collided at 2,000 ft in a designated flight-training area. Dec. 7, 2008 Tlaxcala, Mexico Learjet 23 destroyed 2 fatal The pilots were conducting a second landing attempt at the unlighted airport when the Learjet descended into a lake on final approach at 1815 local time. Dec. 9, 2008 Millington, Tennessee, U.S. Mitsubishi MU-2B substantial 1 minor The pilot turned back to the airport after the right engine lost power on takeoff. The MU-2 touched down about 1,800 ft (549 m) from the departure end of the 8,000-ft (2,438-m) runway and veered off the side. Dec. 11, 2008 Gulf of Mexico Bell 206L-4 destroyed 5 fatal The JetRanger struck the water shortly after taking off in visual meteorological conditions (VMC) from Sabine Pass, Texas, U.S., for a charter flight to an offshore platform. Dec. 14, 2008 Rocksprings, Texas, U.S. Beech King Air C90B destroyed 1 fatal The King Air crashed under unknown circumstances in VMC during a flight from Hondo, Texas, to Phoenix. Dec. 15, 2008 Turks and Caicos Islands Britten-Norman Trislander destroyed 12 fatal The Trislander is believed to have crashed at sea near Providenciales Island shortly after the pilot declared an emergency about an hour after departing from Santiago, Dominican Republic, for a charter flight to New York with an en route stop at Mayaguana, Bahamas. Dec. 17, 2008 Santa Clarita, California, U.S. Kaman 1200 substantial 1 fatal, 1 none The pilot said that after the engine was started, the helicopter was overturned by a gust. Debris from the rotor blades struck and killed a ground crewmember who was moving away from the helicopter after disengaging a portable ground power unit. Dec. 18, 2008 Buenos Aires, Argentina Piper Cheyenne destroyed 2 fatal The pilots reported a technical problem shortly after takeoff and were attempting to return to San Fernando Airport when the Cheyenne crashed in a parking lot. Dec. 19, 2008 Espiritu Santo, Vanuatu Britten-Norman Islander destroyed 1 fatal, 9 serious The pilot was killed when the Islander struck a mountain shortly after departing from Olpoi for a scheduled flight to Luganville. Thick fog was reported in the area. Dec. 20, 2008 Denver Boeing 737-500 substantial 5 serious, 27 minor, 83 none Surface winds were from 290 degrees at 24 kt, gusting to 32 kt, when the 737 veered off the left side of Runway 34R and crashed in a ravine during takeoff from Denver International Airport. Dec. 21, 2008 Riversdale, South Africa Bell 206B destroyed 1 minor The helicopter crashed while being maneuvered to drop water on a wildfire. Dec. 26, 2008 Wellington, New Zealand ATR 72-500 minor 69 none The airplane was climbing through 500 ft when a cockpit indication prompted the flight crew to shut down the right engine. The crew turned back to the airport and landed without further incident. Dec. 27, 2008 near Honiara, Solomon Islands Hughes 369 destroyed 1 fatal, 1 serious The pilot reportedly did not remove the tail-rotor-pedal lock before departing from a fishing vessel. After liftoff, the helicopter spun into the Solomon Sea and sank. The pilot was killed. Dec. 30, 2008 Cairo, Egypt Airbus A300 minor 227 none The right engine failed during departure. The flight crew turned back to the airport and landed the A300 without further incident. This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed. 64 | flight safety foundation | AEROSafetyWorld | February 2009 Corporate Flight Operational Quality Assurance C-FOQA A cost-effective way to measure and improve training, procedures and safety Using actual performance data to improve safety • Appropriate use of stabilized-approach procedures; by identifying: and • Ineffective or improper training; • Risks not previously recognized. • Inadequate SOPs; • Inappropriate published procedures; Likely reduces maintenance and repair costs. • Trends in approach and landing operations; Accomplishes a critical Safety Management System step For more information, contact: • Non-compliance with or divergence from SOPs; and assists in achieving IS-BAO compliance. Jim Burin Director of Technical Programs E-mail: [email protected] Tel: +1 703.739.6700, ext. 106 November 2–5, 2009 2–5, November or toexhibitat theseminar, contact AnnHill, ext.105;e-mail: [email protected]. tel: +1703.739.6700,ext.101; e-mail:[email protected]. To sponsoranevent, For registration information, contactNamratha Apparao, Beijing, China Joint meeting of the FSF 62nd annual International Air Safety Seminar IASS, IASS, Seminar Safety Air International annual 62nd FSF the of meeting Joint IFA 39th International Conference, and IATA and Conference, International 39th IFA IASS © iStockphoto