AeroSafety world
HEMS FATAL MIDAIR Procedures not followed ADS-B DRAWS NEAR Investment needed for benefits ATR 72 FUEL EXHAUSTION Wrong gauge installed ANAFRONTS Cold, nasty surprises PILOT COGNITION CONSIDERING THE THINKING PROCESS
The Journal of Flight Safety Foundation JULY 2009 “Cessna is committed to providing the latest safety information to our customers, and that’s why we provide each new Citation owner with an FSF Aviation Department Tool Kit.” — Will Dirks, VP Flight Operations, Cessna Aircraft Co.
afety tools developed through years of FSF aviation safety audits have been conveniently packaged for your flight crews and operations personnel.
These tools should be on your minimum equipment list.
The FSF Aviation Department Tool Kit is such a valuable resource that Cessna Aircraft Co. provides each new Citation owner with a copy. One look at the contents tells you why.
Templates for flight operations, safety and emergency response manuals formatted for easy adaptation toS your needs. Safety-management resources, including an SOPs template, CFIT risk assessment checklist and approach-and-landing risk awareness guidelines. Principles and guidelines for duty and rest schedul- ing based on NASA research.
Additional bonus CDs include the Approach and Landing Accident Reduction Tool Kit; Waterproof Flight Operations (a guide to survival in water landings); Operator’sMEL Flight Safety Handbook; item Turbofan Engine Malfunction Recognition and Response; and Turboprop Engine Malfunction Recognition and Response.
Here’s your all-in-one collection of flight safety tools — unbeatable value for cost. FSF member price: US$750 Nonmember price: US$1,000 Quantity discounts available! For more information, contact: Namratha Apparao, + 1 703 739-6700, ext. 101 e-mail: [email protected] President’sMessage
Automation Expectations
o far, 2009 does not look like a great year treat engine failures? I think most of us started for safety. As we hit the halfway mark, the thinking about engine failures at an early stage world already has had as many airline ac- of our aviation consciousness. I remember be- cidents as the recent norm for a whole year. ing 15 years old, dreaming of the day I’d have a IfS things continue at this pace, we could have a handful of throttles and deal brilliantly with an year as bad as 1999, an accident spike. Of course, engine exploding at rotation. Even then I knew recent high-profile crashes of Airbus aircraft have the sequence of events, starting with “dead foot, thrown the debate about automation and envelope dead engine.” This sort of thing is just part of a protection into the spotlight. In the public forum, pilot’s DNA. The “trouble” is, engines just don’t that discussion gets boiled down to some overly quit much anymore. Most of us will retire without basic questions: Is automation good or bad? Is one being a party to an engine failure at any time, much manufacturer’s approach better than the other? less on takeoff. What every pilot will experience, Those are the wrong questions. however, is some sort of confusion regarding the First, it is impossible to turn back the hands of automation. Whether it is due to a system error time on the issue of flight deck automation. Cur- or a human error doesn’t matter. It is a threat that rent aircraft are highly automated, and the next has to be acknowledged and has to be managed generation of aircraft will be more so. I don’t think because it can take down an aircraft. this is bad. But I do think that we all have done a When a pilot flew a DC-6 or a Connie, the big- lousy job — or at least a superficial job — adapting gest worry was an engine failure on takeoff. Now to the reality of automation. Airplanes come with the biggest threat is the possibility of being handed nice checklists to deal with some problems that an aircraft with ambiguous indications, and maybe automation presents, but we generally have fallen a stick shaker in the middle of the night. It is time victim to the unconscious assumption that auto- for young pilots to go to bed thinking about that mation will not fail. Of course it fails. Sometimes threat, and to come up with the equivalent of “dead technicians don’t seat a circuit board properly. foot, dead engine” for that scenario. Just look at the Sometimes a sensor goes bad, like a pitot tube accidents lately; it is time to stop debating the role (maybe the case in the crash of Air France Flight of automation and really start to deal with it. 447) or a radar altimeter fails (certainly the case in the Turkish Airways accident in Amsterdam). Other times, pilots input the wrong weight (e.g., the Emirates tail strike in Melbourne, Australia) or even type in the wrong route. And when automation does fail to protect us, William R. Voss we appear to expect that other automated sys- President and CEO tems will step in to save the day. Is that how we Flight Safety Foundation www.flightsafety.org | AeroSafetyWorld | July 2009 | 1 AeroSafetyWorld
contents July2009 Vol 4 Issue 7 features
13 FlightOps | Extreme Weather Makers
16 CoverStory | Thinking Things Through
13 22 SafetyOversight | Dangerous Goods
26 CausalFactors | ATR 72 Ditching
32 HelicopterSafety | Procedural Disregard
37 InfraStructure | Practical Necessity of ADS-B
42 AircraftRescue | In the Drink 16 departments
1 President’sMessage | Automation Expectations
5 EditorialPage | Failed Justice
6 AirMail | Letters From Our Readers
8 SafetyCalendar | Industry Events 22 9 InBrief | Safety News
2 | flight safety foundation | AeroSafetyWorld | July 2009 ITALY Bari 37
Accident site Palermo SICILY 26 42
AeroSafetyWORLD telephone: +1 703.739.6700 47 DataLink | Route Causes William R. Voss, publisher, FSF president and CEO [email protected] 52 InfoScan | Erring on the Safe Side J.A. Donoghue, editor-in-chief, FSF director of publications 57 OnRecord | Bangs and Flames [email protected], ext. 116 Mark Lacagnina, senior editor [email protected], ext. 114 Wayne Rosenkrans, senior editor [email protected], ext. 115 Linda Werfelman, senior editor [email protected], ext. 122 Rick Darby, associate editor [email protected], ext. 113 Karen K. Ehrlich, web and print production coordinator [email protected], ext. 117 Ann L. Mullikin, art director and designer [email protected], ext. 120 Susan D. Reed, production specialist About the Cover [email protected], ext. 123 Thinking processes in the cockpit. © Chris Sorensen Photography Patricia Setze, librarian [email protected], ext. 103
We Encourage Reprints (For permissions, go to
www.flightsafety.org | AeroSafetyWorld | July 2009 | 3 Serving Aviation Safety Interests for More Than 60 Years
Officers and Staff light Safety Foundation is an international membership organization dedicated to Chairman, the continuous improvement of aviation safety. Nonprofit and independent, the Board of Governors Amb. Edward W. Stimpson FFoundation was launched officially in 1947 in response to the aviation industry’s need President and CEO William R. Voss for a neutral clearinghouse to disseminate objective safety information, and for a credible General Counsel and knowledgeable body that would identify threats to safety, analyze the problems and and Secretary Kenneth P. Quinn, Esq. recommend practical solutions to them. Since its beginning, the Foundation has acted in the Treasurer David J. Barger public interest to produce positive influence on aviation safety. Today, the Foundation provides leadership to more than 1,170 individuals and member organizations in 142 countries. Administrative
Manager, Support Services Linda Crowley Horger MemberGuide Flight Safety Foundation Financial Headquarters: 601 Madison St., Suite 300, Alexandria, VA, 22314-1756 USA tel: +1 703.739.6700 fax: +1 703.739.6708 Chief Financial Officer Penny Young www.flightsafety.org
Membership
Director of Membership Ann Hill
Seminar and Exhibit Coordinator Namratha Apparao
Membership Services Coordinator Ahlam Wahdan
Communications Member enrollment ext. 102 Ahlam Wahdan, membership services coordinator [email protected] Director of Communications Emily McGee Seminar registration ext. 101 Namratha Apparao, seminar and exhibit coordinator [email protected] Seminar sponsorships ext. 107 Technical Penny Young, chief financial officer [email protected] Director of Exhibitor opportunities ext. 101 Technical Programs James M. Burin Namratha Apparao, seminar and exhibit coordinator [email protected]
Technical FSF awards programs ext. 100 Programs Specialist Norma Fields Linda Horger, manager support services [email protected] Technical product orders ext. 101 Technical Specialist/ Namratha Apparao, seminar and exhibit coordinator [email protected] Safety Auditor Robert Feeler Library services/seminar proceedings ext. 103 Manager of Patricia Setze, librarian [email protected] Aviation Safety Audits Darol V. Holsman Web site ext. 117 Karen Ehrlich, web and print production coordinator [email protected] Regional Office: GPO Box 3026 • Melbourne, Victoria 3001 Australia Telephone: +61 1300.557.162 • Fax +61 1300.557.182 Past President Stuart Matthews Paul Fox, regional director [email protected] Founder Jerome Lederer 1902–2004 Amy Beveridge, event manager [email protected]
flight safety foundation | AeroSafetyWorld | July 2009 Editorialpage Failed Justice
he Italian judicial system totally failed of the documents “until ANSV repeatedly in accordance with applicable Italian the cause of aviation safety during pressed for them,” the report said. criminal laws.” the investigation of the Tuninter Access to the flight data recorder Highlighting the safety threats in- ATR 72 ditching accident in 2005 (FDR) and cockpit voice recorder (CVR) volved in being unable to quickly obtain (seeT story, p. 26). This failure, documented was delayed until 10 days after they were information and access to all available in the report of the Agenzia Nazionale per recovered. The data that ANSV labora- help to discover how to prevent future la Sicurezza del Volo (ANSV) aviation tories then extracted from the FDR and such accidents, the ANSV included in its safety investigative authority, was not, for CVR were immediately sequestered by the report recommendations that Italian law the most part, due to capricious decisions authorities, along with the original tapes. be changed to allow ANSV “immediate of any individual, but tragically was in line The ANSV did get a copy of the raw FDR and unconditional access to all elements with what is called for by Italian law. data for decoding; the CVR material was … necessary for the technical investiga- The report, released nearly four years given to the ANSV a few days later. tion,” to ensure the rights of accredited after the accident, states that the ANSV’s As little cooperation as ANSV got, international parties to the investigation ability to conduct its inquiry in accordance accredited representatives of the inter- and to prevent any recordings or tran- with Annex 13 of the Convention on In- ested parties to this accident — including scripts pertaining to the investigation ternational Civil Aviation “was found to be those from Tunisia, where the aircraft was from being improperly used. limited in the light of that envisaged by the registered and the airline is based; France, There are more outrageous elements criminal procedures system in force.” where the aircraft was built; Canada, to this sad tale than space here can ac- The obstructions of the ANSV’s duties where the engines were built; and the commodate, but this colossal cluster were many. ANSV was not allowed to di- United States, where the propellers were of obstructions to the safety process rectly inspect the aircraft wreckage, which built — were more broadly excluded from mounted by government prosecutors was impounded by the judicial authority. the process, even to the point of not being is yet another strong argument for the ANSV personnel could only observe. allowed to receive FDR and CVR data. decriminalization of the accident inves- Prevented from sampling or testing The inability to share FDR data meant the tigation process, a cause Flight Safety fuel and oil samples from the fuel tanks ANSV was unable to mount simulations Foundation is dedicated to advance. and engines, ANSV had to rely on the of the event until more than 15 months judicial authority’s collecting and testing. after the accident. Sadly, on the day that ANSV could only observe. data were released, the general news me- The judicial authority did not pass dia somehow received the CVR recording along to the ANSV documentation of its in both audio and transcript form. J.A. Donoghue findings until the ANSV filed legal appli- Most of the judicial authority’s behav- Editor-in-Chief cations, and even then did not release all ior, the ANSV took pains to note, “was AeroSafety World www.flightsafety.org | AeroSafetyWorld | July 2009 | 5 AirMail
CENIPA Replies able to make a single positive comment mentioned as one of the hypotheses
This letter is a response to “Midair Over the regarding the investigation conducted considered by the Brazilian investiga- Amazon” (ASW, 2/09, p. 11), concerning the by the Brazilian state, which had the tors, but nothing is said about the fact collision of the Gol Boeing 737-800 and the participation of other international or- that such a hypothesis was discarded ExcelAire Embraer Legacy 600 in Brazilian ganizations, and preferred to depreciate after a full demonstration in the final airspace. the two-year-long work done by a team report, by means of a detailed ergono- hen the International Federation composed of more than 50 people. metric study, corroborated by the fact of Air Traffic Controllers’ Asso- Take, for example, the very subtitle that the pilot himself affirmed that he Wciations (IFATCA) criticized the that includes the words “controversial had not utilized it. final report by the Aeronautical Acci- Brazilian report”: Who classified the When the article refers to the “bad dent Prevention and Investigation Cen- final report as controversial? What system design,” it mentions the NTSB, ter (CENIPA) and used the expression are the bases for such a classification? thus inducing the reader to conclude “missed opportunity,” we did not make Apart from the IFATCA, who consid- that such classification had been made any comments, although disagreeing ered the report controversial? by the renowned American investigat- with their standpoint. We understood To affirm that the U.S. National ing organization, and only many lines that they were exercising their right to Transportation Safety Board (NTSB) later does it credit the classification defend a class or group of people; they questioned the findings and conclu- to its real source: the IFATCA. When were just playing their role, and we will sions of the final report is, to say the the article comments on the symbol always defend their right to do so. least, inappropriate, and the few points “=” which is placed between the flight However, when a respected organi- that were not incorporated in the levels, it again induces a reader less zation such as the Flight Safety Foun- report, on account of differences of in- familiar with air traffic control to dation, echoing the words used by the vestigation methodology, were included logically conclude that 370 cannot be IFATCA, decides to lend support to this in an appendix of the report. equal to 360 (“370 = 360”). For the latter organization and criticizes the At one point, the article refers to trained eye, however, the interpreta- serious job done by the Brazilian state, the “probable cause” (which the NTSB, tion is different: the aircraft is at Flight it is time for the chief of the CENIPA to by legislation requirements, is obliged Level (FL) 370 — neither climbing reply to the person who wrote the ar- to report), failing to comment (due to nor descending — and the new flight ticle, and to the Foundation, on account lack of information?) that in Brazil the level requested is FL 360. This does of the aforementioned support. investigators work with contributing not mean that the system has a faulty Unfortunately, the Foundation’s factors without establishing precedence design. Since its creation, it was taught article, despite being totally based on between them. and operated like that for many years the final report made available to the It is worth pointing out that, once without any problems. We know the world through the Internet, was not more, the influence of the footrest is system is not perfect, and we know
6 | flight safety foundation | AerosafetyWorld | July 2009 AirMail
that a perfect system is something crew. Thus, it is not wise to compare “another possibility,” a conclusion the everyone is looking for in the world. the preparedness and performance NTSB reached as well, and the NTSB Can it be improved? Of course, it can. of the controllers to the preparedness report was quoted, too. That’s why (and, again, this is not and performance of the pilots. There is The source of the term “Bad System commented on in the article) the final no doubt that the events related to the Design” in the subhead was clearly noted report established more than 30 safety moments following the change of the as being IFATCA, not NTSB. recommendations forwarded to the transponder to the STBY mode were The story’s presentation of the radar Airspace Control Department. exhaustively analyzed in relation to display symbol “370=360” is exactly At another point, the article says the performance of everyone involved. what the report stated and was fully that the investigators were not able to However, I am not willing to rewrite explained. No attempt was made to learn how the transponder changed to a report of almost 300 pages or refute portray this as a formula. It was the ease standby (STBY). The final report, how- all the improprieties of an article that with which changes in the display might ever, shows that the pieces of equip- reduced them to five. not be identified — given the moderate ment were tested in the laboratories In concluding, I think it is proper visual difference between “370 =370” of the manufacturer, in the presence to praise the author of the article for and “370 =360” — when the change of NTSB representatives, and they func- informing readers that it was based on is made automatically, that led to the tioned faultlessly. They operated nor- the CENIPA report, available on the IFATCA’s critical comments. mally from the departure until after the Internet. The story states the finding that the aircraft passed over the Brasília VOR, As chief of the CENIPA, I expect transponder likely was inadvertently set and resumed transmitting after the that the Foundation will treat this reply to standby and does not state that the collision. Therefore, the most probable with the same consideration given to equipment was faulty, and neither does hypothesis is that the equipment was the article in AeroSafety World. IFATCA. inadvertently set to STBY. Thus, the Brig. Gen. Jorge Kersul Filho Finally, your statement that “it is investigator and the aviation authority, Chief of the CENIPA not wise to compare the preparedness of contrary to what is said in the article Brasília, Brazil the controllers to the preparedness and written by the IFATCA (reprinted in performance of the pilots” in our opinion the FSF article), do not blame A or B The editor replies: The topic of the is not supported by the factual informa- for the accident, simply because, in ac- story was the accident, not the qual- tion included in the report. cordance with the prescriptions of the ity of CENIPA’s investigation of the International Civil Aviation Organiza- accident. The report is indeed contro- tion — of which Brazil is a group 1 con- versial because its findings have been tracting state — it is not the objective of questioned by several organizations, the aeronautical accident investigation including IFATCA and NTSB. Thus, the encourages to establish blame or liability, but solely inclusion of other points of view in the AeroSafety World comments from readers, and will to prevent the occurrence of further story to present a balanced view of what assume that letters and e-mails accidents. might have happened is not, in our are meant for publication unless Last, I would like to comment on judgment, a flaw. otherwise stated. Correspondence the ill-intentioned question of the sub- Regarding the footrest issue, the is subject to editing for length head “Misplaced Blame?” It is not the story stated, “Investigators were un- and clarity. purpose of the investigation to blame able to determine conclusively how the or acquit any individual or organization transponder had been switched to the Write to J.A. Donoghue, director that has played a role in the event; the standby mode,” continuing to say the of publications, Flight Safety author, however, tries to mislead the “most likely explanation” was that it Foundation, 601 Madison St., reader by making illogical comparisons. was an inadvertent result of the use of Suite 300, Alexandria, VA The final report clarifies the findings the radio management unit for other 22314-1756 USA, or e-mail related to the controllers involved, to purposes. Only then did the story note
JULY 7–9 ➤ Deicing Conference. Airports AUG. 26–27 ➤ Safety Management System SEPT. 22–23 ➤ HFACS Workshop. Wiegmann, Council International–North America Overview Workshop. ATC Vantage. Denver. Shappell & Associates. Dallas. Diane Kim,
AUG. 18–20 ➤ Human Factors in Aviation SEPT. 14–18 ➤ ISASI 2009: Accident If you have a safety-related conference, Maintenance Course. Southern California Prevention Beyond Investigations. seminar or meeting, we’ll list it. Get the Safety Institute. San Pedro, California, U.S. Rick International Society of Air Safety Investigators. information to us early — we’ll keep it on Anglemyer,
8 | flight safety foundation | AeroSafetyWorld | July 2009 Safety News inBrief Blacklist Expansion?
he European Commission (EC) necessarily reduce accidents,” Kobeh said. has revised its blacklist of airlines “But I fully agree with … the need of Tbanned in the European Union, working together in order to address defi- Susan Reed accompanying issuance of the new list ciencies affecting air transport security.” with a proposal to develop a worldwide The revised list — made public in blacklist (ASW, 4/09, p. 42). mid-July — lifted the ban on European “Citizens have the right to fly safely operations that previously had been everywhere in the world,” said Antonio imposed on four Indonesian airlines Tajani, EC vice president in charge of “because their [civil aviation] authority transport policy. “We will not accept that ensures that they respect the international airlines fly at different standards when safety standards,” the EC said. Other Indo- they operate inside and outside Europe. nesian air carriers remain on the blacklist. It is high time that the international The previously blacklisted One Two community rethinks its safety policy; Go, based in Thailand, is no longer on the including all carriers from 12 countries — those airlines which are unsafe should list because Thai authorities have revoked Angola, Benin, Democratic Republic of not be allowed to fly anywhere.” its operating certificate, the EC said. Congo, Equatorial Guinea, Gabon (with Roberto Kobeh González, president In addition, TAAG Angola Airlines is exceptions for three carriers that operate of the Council of the International Civil now permitted to operate into Portugal but under restrictions), Indonesia (except for Aviation Organization (ICAO), said he only with specific aircraft and under spe- the four carriers that have been removed does not believe that an international cific conditions. Six other carriers also may from the list), Kazakhstan (except for blacklist is the answer. operate only under specific conditions. one carrier operating under restrictions), “Lists that discourage passengers The list bans 255 air carriers from Kyrgyz Republic, Liberia, Sierra Leone, [from using a specific] airline would not operations in the European Union, Swaziland and Zambia.
Color Vision Recommendations
evised color vision requirements recommendations for new color vision “The results of the test also indicate and testing could lead to the ac- standards (ASW, 12/08, p. 38). The whether the applicant’s color vision Rceptance of 35 percent of color- research was needed because of a “lack meets the minimum requirements for deficient pilots who apply for medical of reliable, standardized tests and the safe performance that have emerged as certification, according to a report by absence of information on the specific necessary from this investigation,” the researchers from the U.K. Civil Aviation color vision needs of professional flight report said. Authority (CAA) and the U.S. Federal crew,” the CAA researchers said in the The report noted that color has Aviation Administration (FAA). foreword to CAA Paper 2009/04, which long been important in aviation in the Research by color vision specialists discussed the work. The report also was coding of signals and other informa- from the two agencies resulted in joint published as FAA Office of Aerospace tion and that, as a result, color vision Medicine report 09/11. requirements are necessary “to ensure In their studies, the researchers eval- that flight crew are able to discriminate uated “the level of color vision loss above and recognize different colors, both on which subjects with color deficiency no the flight deck and externally.” longer perform the most safety-critical, In recent years, the requirements color-related tasks within the aviation adopted by some civil aviation authori- environment with the same accuracy as ties have been criticized as inappropriate; [people with normal color vision],” the critics say the tests have been devised joint report said. so that pilot applicants with minimal The result was a new test that ac- color deficiencies often fail, even though curately assesses a pilot applicant’s color many of them might be able to “perform vision and identifies the type and sever- safety-critical tasks as well as [pilots with
Wikipedia ity of color vision loss. normal color vision].”
www.flightsafety.org | AeroSafetyWorld | July 2009 | 9 inBrief
NSTB Seeks to Replace Oxygen Hoses EASA Safety Review
perators should be required to one minute earlier, the first officer had replace electrically conductive been in the supernumerary compartment, Ocombustible oxygen hoses in their and there had been no smoke or fire at aircraft, and use of the hoses should be that time. prohibited, unless conductivity is an The NTSB said that the probable intentional — and approved — element cause of the accident was “the design of the hoses’ design, the U.S. National of the supplemental oxygen system Transportation Safety Board (NTSB) hoses and the lack of positive separation says. between electrical wiring and electrically The recommendations follow the conductive oxygen system components.” NTSB investigation of a June 28, 2008, fire This lack of positive separation “allowed in an ABX Air Boeing 767-200 before en- a short circuit to breach a combustible gine startup at San Francisco International oxygen hose, release oxygen and initiate Airport. The captain and first officer — a fire,” the NTSB said. the only people in the airplane — evacu- As a result of the investigation, ated through the cockpit windows and the NTSB issued 11 safety recommen- were not injured in the fire, which caused dations to the U.S. Federal Aviation substantial damage to the airplane. Administration, including several that Board Safety Transportation National U.S. The crew said that they had heard concerned requirements for oxygen The NTSB also recommended that loud popping and hissing sounds as they system tubing and other components. ABX Air “modify [its] continuing analy- conducted the engine start checklist and Another recommendation said that sis and surveillance program so that all that the first officer opened the cockpit operators of transport category cargo identified chronic discrepancies, such door and saw “black smoke in the su- airplanes should be required to install as those affecting the oxygen system pernumerary compartment … [and] fire smoke detectors in supernumerary on the accident airplane, are effectively near the ceiling,” the NTSB said. About compartments in their aircraft. resolved.”
Record Review
ilots seeking jobs with U.S. airlines The pilot record checks will be testing practices at airlines that provide will undergo increased scrutiny by conducted in accordance with an regional service, as well as at the coun- Ppotential employers, who have agreed agreement between the airlines, pilot try’s major air carriers,” the FAA said. to review not only records from past em- unions and the FAA. The agreement, The airlines and labor unions also ployers but also all records maintained by which was accepted during a meeting agreed to review and strengthen pilot the U.S. Federal Aviation Administration of all three parties, is part of an effort training programs. Representatives of (FAA) involving pilot applicants. to strengthen “pilot hiring, training and both sides recommended developing mentoring programs to “expose less experienced pilots to the safety culture and professional standards practiced by more senior pilots,” the FAA said. “The programs could pair experienced pilots from the major airlines with pilots from their regional airline partners.” FAA Administrator Randy Babbitt said all airlines will be asked to adopt safety reporting systems such as flight operational quality assurance (FOQA) and the aviation safety action program to generate more useful data on safety issues. © Ad Doward/iStockphoto © Ad
10 | flight safety foundation | AeroSafetyWorld | July 2009 inBrief
EASA Safety Review
nly 5.5 percent of fatal commercial air transport accidents Fatal Accidents in Commercial Air Transport — worldwide involved airplanes registered in a member EASA MS and Foreign Registered Airplanes Ostate (MS) of the European Aviation Safety Agency 12 (EASA), the agency says in its Annual Safety Review for 2008. 10 Three fatal commercial air transport accidents were recorded in Europe in 2008 — the same number that occurred 8 in 2007 and comparable to the lowest annual totals from the 6 previous 10-year period of 1997 through 2006, the report said 4 (see table). The average for the 10-year period was six fatal ac- Foreign registered 3-year average Linear (foreign registered 3-year average) cidents per year. 2 EASA MS registered 3-year average Linear (EASA MS registered 3-year average) Overview of Total Number of Accidents and 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 Fatal Accidents for EASA MS Registered Airplanes
Total Number Fatal Fatalities Ground When accidents were assigned to categories, the highest Period of Accidents Accidents on Board Fatalities accident rates were those associated with “abnormal runway 1997–2006 (average) 32 6 105 1 contact,” “non-powerplant component failure,” “runway excur- 2007 (total) 37 3 25 1 sion” and “ground handling.” 2008 (total) 35 3 160 2 “In many cases, runway excursions are consequential events in accidents, and therefore a large number of accidents The number of on-board fatalities in 2008 was 160 — com- are assigned this category,” the report said. “There has been an pared with the 1997–2006 annual average of 105 — and 154 increase in the rate of accidents associated with ‘flight prepara- of the 160 resulted from the Aug. 20, 2008, crash of a Spanair tion, loading or ground servicing’ (all categorized under ‘ramp’). McDonnell Douglas MD-82 during takeoff from Madrid. Although this rate has increased to an average of almost eight The 2008 fatal accident rate was just over three per 10 million accidents per 10 million flights, it remains relatively low. ‘System scheduled passenger flights averaged over a three-year period, or component failures not associated with the engines’ (SCF-NP) the report said (see figure). “During the past decade,” the report also appear to be ever more present in accidents of EASA [mem- added, “the rate of accidents decreased from an average of four to ber states’] aircraft. Accidents attributed as ‘controlled flight into three accidents per 10 million flights for EASA [member states].” terrain (CFIT)’ appear to have an overall decreasing rate.”
Window Check Annual Report National Transportation Safety Board
to Congress he European Aviation Safety retainer and inner glass ply indicate he U.S. Agency (EASA), citing a recent the presence of deteriorating structural National Trans- Tevent in which a side glass window components in the window,” the agency Tportation Safety of an ATR 72 blew out during a ground said. Board (NTSB) has 2008 ANNUAL REPORT NTSB/SPC-09/01 National Transportation pressure test, is requiring operators of Attempted repairs could lead to delivered its annual Safety Board some ATR 42s and 72s to inspect the the same type of window failure that report to Congress, windows for indications of damage or occurred in the recent event, the EASA summarizing the 19 major accident in- past repairs. said. vestigations — including seven involving The investigation of the incident An EASA emergency airworthiness aviation accidents — that began in 2008. revealed anomalies in the windows that directive cautioned that an in-flight The NTSB also investigates highway, are considered indications of structural failure of a forward side window “could marine, pipeline and railroad accidents. deterioration, the EASA said. “Air or have catastrophic consequences for the The report noted that the NTSB water leakages between the Z-bar and airplane and/or cause injuries to people also initiated 221 other accident inves- the outer glass ply, on the ground. The loss of the forward tigations, including 206 that involved or between the side window while the airplane is on aviation, and provided support in 18 inner the ground with a positive differential international aviation accident inves- cabin pressure could also cause tigations. Of 129 safety recommen- injuries to people inside or dations issued in 2008, 86 involved around the airplane.” aviation, the report said.
© Roberto Benetti/Wikimedia
www.flightsafety.org | AeroSafetyWorld | July 2009 | 11 inBrief
Safety Culture
dministrator Randy Babbitt of the needed, and these actions will be included Under ATSAP, controllers and other em- U.S. Federal Aviation Adminis- in the controller’s record. ployees can report safety problems “with- Atration (FAA) says the agency is “We need quality information in or- out fear of punishment unless the incident “moving away from a culture of blame der to identify problems and learn from is deliberate or criminal,” the FAA said. and punishment” by reducing the incidents before they become accidents,” emphasis on blame when errors by air Babbitt said “The best sources of that in- traffic controllers are reported. formation are our front line employees. “Controllers remain accountable for Our success depends on their willingness their actions, but we’re moving toward a to identify safety concerns.” new era that focuses on why these events Another procedural change, intended occur and what can be done to prevent to avoid disruptions of operations, will them,” Babbitt said. keep controllers in their positions after Under the revised procedure, control- operational errors “unless it is deemed lers’ names no longer will be included in necessary to remove them,” the FAA said. reports sent to FAA headquarters about The FAA said the changes are part of operational errors; removal of names a transition to a nonpunitive reporting will “allow investigators to focus on what system for air traffic controllers known happened rather than who was at fault,” as the Air Traffic Safety Action Program the FAA said. Training and disciplinary (ATSAP), already in place for controllers action will continue to be administered as in about one-third of the United States. © Jennifer Walz/Dreamstime
Manslaughter Probe In Other News …
rance is conducting a judicial French accident report said that the he United Arab Emirates Gen- inquiry into the June 1 crash of an flight crew had been in contact with eral Civil Aviation Authority FAir France Airbus A330 to deter- Brazilian air traffic controllers and that, T(GCAA) has signed an agree- mine responsibility for the accident, more than two hours after departure, a ment with Flight Safety Foundation published reports say. position message and aircraft main- to establish a partnership aimed at The Paris prosecutor’s office said tenance messages were transmitted expanding the GCAA’s access to best it was conducting the inquiry against automatically by the aircraft communi- practices in applying high safety “unnamed persons on charges of cations addressing and reporting sys- standards. … Maintenance perfor- manslaughter.” tem (ACARS). There were no further mance at Qantas has improved in All 228 people in the A330 were communications from the airplane. the wake of reviews in 2008 in which killed when the airplane plunged into Wreckage and bodies were found the Civil Aviation Safety Author- the Atlantic Ocean during a flight from several days later by searchers from the ity of Australia found “emerging Rio de Janeiro to Paris. A preliminary French and Brazilian navies. problems” with the airline’s main- tenance. … Acting Chairman Mark V. Rosenker and Member Kathryn O’Leary Higgins have announced their resignations from the U.S. National Transportation Safety Board (NTSB). Both Rosenker, a former NTSB chairman and member since 2003, and Higgins, a member since January 2006, say they are leav- ing the NTSB for opportunities in the private sector.
© Christopher Weyer/Wikimedia
Compiled and edited by Linda Werfelman.
12 | flight safety foundation | AeroSafetyWorld | July 2009 FlightOPS
extreme
makers Hard-to-forecast anafronts generate unusual combinations of threats.
By Ed Brotak
Weather © Chris Photography Sorensen
udden, drastic weather changes at southwest at 26 kt. At 2,800 ft AGL, the The profile view of the common Dallas/Fort Worth International temperature was 22º F (minus 5.6º C) cold front, called a katafront, shows air Airport during two days in Novem- with icing conditions, and the wind was sinking along a steeply sloping frontal ber 2006 seemed to defy the usual from the north-northwest at 26 kt. It surface that sits on top of a fairly deep Sexplanations. At 1800 the first day, the was a classic example of an anafront, an layer of cold air, and then lifting right temperature was 72º F (22º C), winds exceptional type of cold front. along or even ahead of the surface front. were from the south-southeast at 20 kt All fronts — the boundary layer This is where the clouds and precipita- gusting to 26 kt, skies were broken at between two types of air masses — tion occur. For the anafront, air rises 3,000 ft, and the visibility was greater than have denser, relatively cold air near the along a shallow sloped front that caps 10 mi (16 km). Within minutes, the wind ground and lighter, relatively warm a shallow layer of cold air (Figure 1, shifted abruptly to the north-northwest at air aloft. Their passage poses familiar p. 14). This is similar to a warm front 20 kt gusting to 27 kt, the temperature fell problems in aviation. Low clouds pro- except, in this case, the cold air moves precipitously into the 40s (4.4º to 9.4º C), ducing low ceilings; precipitation re- forward, undercutting the warm air. and the skies became overcast. Soon, rain sulting in poor visibilities; strong winds With the warm air rising along the began to fall, becoming heavy. Ceilings that quickly change direction; and dra- full length of the frontal surface, pre- lowered to below 1,000 ft and visibility matic changes in temperature, humidity cipitation occurs well behind the surface dropped to 4 mi (6.4 km). and air density are all common. cold front in a process meteorologists During the night, a thunderstorm Although such weather conditions call overrunning. If the overlying warm moved over the airport. The tem- often are associated with cold fronts, air is unstable, thunderstorms can perature continued to fall, by morning the situation usually improves rapidly develop by a process called elevated con- going below 32º F (0º C). The rain after the cold front passes.1 When an vection even though the surface air may started to freeze, causing icing condi- anafront passes, the conditions initially be cold and stable. Such thunderstorms tions. Flight crews descending through seem similar to other cold fronts, just can be difficult to forecast because the 4,000 ft above ground level (AGL) more extreme. The apparent similarities convection is not surface-based as usual. encountered an air temperature of 49º quickly end, however, and the challenges During the anafront passage, F (9.4º C) and wind from the south- for flight crews begin. the surface wind direction changes
www.flightsafety.org | AeroSafetyWorld | July 2009 | 13 FlightOPS
temperatures aloft can be warm. Any Atypical vs. Typical Cold Front Weather frozen precipitation that forms in or
Altitude (ft) falls through this warmer layer aloft 18,000 quickly turns to rain. The cold air layer Anafront (atypical) below again cools the water to the freezing temperature but is so shallow that the rain does not have a chance 12,000 to re-freeze into sleet or ice pellets. In- stead, it remains liquid until it encoun- ters a cold surface. Then it freezes on Cold air 6,000 contact, producing glaze conditions. This may occur within several thou- sand feet of the surface, so icing becomes Warm air a low-level hazard. For aircraft in the 0 Cold front at surface descent phase, flight conditions may 0 110 nm 220 nm 330 nm 440 nm 204 km 407 km 611 km 815 km be normal until the airplane flight path Altitude (ft) penetrates the cold layer of air at the ana- 18,000 Katafront (typical) front. The flight crew then may encounter unexpectedly severe icing conditions. The vertical wind structure through 12,000 the frontal zone also can be problem- atic. Near the surface, north to north- east winds in the Northern Hemisphere strongly change direction counterclock- 6,000 wise with increasing altitude to become winds from the southwest or even the south as the airplane climbs.2 Besides Cold air Warm air 0 directional shear, velocity shear can be Cold front at surface 0 110 nm 220 nm 330 nm 440 nm a problem with strong north winds or Susan R eed 204 km 407 km 611 km 815 km even a low-level jet occurring in the ft = feet; nm = nautical miles; km = kilometers cold air.3 The practical effect is that Note: The direction of frontal movement is left to right in both profile illustrations. Behind an anafront, during takeoff and landing, pilots could persistent conditions may include cumulus clouds and thunderstorms; behind a katafront, conditions typically improve quickly. Altitudes and distances shown only provide a rough approximation of the scale. encounter rapid changes in wind direc-
Source: Ed Brotak tion and speed. The bad weather conditions Figure 1 experienced behind the anafront can last for many hours — or many days dramatically, often clockwise by 180 observed. Despite Fahrenheit tempera- — because anafronts are slow-moving. degrees. Drops in temperature also can tures in the single digits, rain falls. This The front itself is usually parallel to the be spectacular, sometimes 30º F (16.7º liquid precipitation can be very heavy upper air flow so there is little energy to C) in a short time. and a major factor in icing risk. Strangely push the front. Typically, there is no precipitation enough, thunderstorms can occur even Unlike common cold fronts, the ahead of or with the actual passage of with temperatures that low. supporting upper-level trough for an the anafront. But the low clouds persist With the anafront, if the very anafront is well displaced to the north, well behind the front, so there is no shallow cold air layer near the sur- often hundreds of miles away. Com- clearing. This is also where precipitation face has temperatures below freezing, puter forecast models, which handle occurs. In winter, freezing rain often is freezing rain is common because the upper-level features better than low-level
14 | flight safety foundation | AeroSafetyWorld | July 2009 FlightOPS
features, therefore don’t predict ana- lasted well into the next day. Thunder- enable the industry to anticipate when fronts as well as other cold fronts. storms were numerous and widespread. and where anafronts are likely to occur. U.S. anafronts most commonly occur Meteorologists recorded these conditions For short-term purposes, a few in the central part of the lower 48 states, as one of the worst ice storms in Okla- hours in advance of flight operations, between the Rocky Mountains and the homa history, and they were a night- the best option for non-meteorologists Appalachian Mountains. The Plains and mare for aviation. The major air carrier is to look at the latest surface analysis Midwest regions of the country are de- airports at Oklahoma City and Tulsa, chart. Real-time radar depictions also void of the topographic barriers that im- Oklahoma, reported almost continuous are a good option to see if the precipi- pede the southward flow of the shallow, freezing rain or drizzle for 36 hours with tation is behind the surface front. For dense and cold air from Canada that thunderstorms occasionally reported, too. a longer-term perspective, surface can generate anafronts. Cold fronts that The charts for the morning of Dec. forecast maps are good. Anytime a cold cross mountain ranges, even those at the 9 at Oklahoma City showed other con- front has thunderstorms or freezing relatively low height of the Appalachians, ditions significant for aviation. At the rain behind it, an anafront — and all have the familiar steep slope because the surface, the temperature was 27º F (mi- that it entails — can be suspected. cold air from Canada behind the fronts nus 2.2º C), and the winds were from Edward Brotak, Ph.D., retired in May 2007 after banks up and becomes deeper. the north at 19 kt. The cold air near the 25 years as a professor and program director in The following case study illustrates ground was only a few thousand feet the Department of Atmospheric Sciences at the how meteorologists can identify ana- thick. Continuing up through this air University of North Carolina Asheville. fronts from upper-level charts, surface mass, the temperature exceeded 50º F weather maps, radar summary charts (10º C) at 4,000 ft. Notes and/or satellite imagery: The surface This meant there was no chance for 1. Common cold fronts occur when a mass weather map for 1200 coordinated snow even though the surface tempera- of cold, dense and stable air advances and universal time (UTC) on Dec. 9, 2007, tures were well below freezing. The replaces a warmer air mass. Distinguish- showed a cold front moving from the wind sharply changed direction coun- ing characteristics may include the length of the front; frontal surface slope; speed north into southern Texas. The front had terclockwise with height: north-north- of movement; and precipitation decrease pushed through Oklahoma the previous east near the surface and southwest after frontal passage. day. A strong, arctic high pressure system just above that. Thunder was reported 2. In the Southern Hemisphere, with cold was to the north. A nose of higher pres- at the airport during the day. Surface- air to the south, anafronts have southerly sure extended southward from the high based air mass stability indexes like the winds at low levels that change direction pressure area into Texas. This cold air had lifted index showed extremely stable clockwise to a northerly component aloft. banked up along the Rocky Mountains conditions. However, the Showalter In- 3. A low-level jet is a wind speed maximum and had been driven well south. dex using conditions at approximately of at least 30 kt below 10,000 ft with wind The 500-millibar (mb) chart, ap- 5,000 ft ASL was minus 1.5, indicating speeds decreasing both above and below proximately 18,500 ft above sea level possible convection.5 that altitude. (ASL), showed quite a different pat- Although these examples come 4. Upper-level charts, such as the 500-mb 4 tern. A deep trough and a closed low from the United States, anafronts can chart, graphically represent a compilation pressure area off the Southern Cali- occur anywhere in the world where a of data from radiosonde soundings, obser- fornia coast were producing a strong source of very cold air exists. They of- vations transmitted from sensors aboard southwest flow over the southern ten, but not exclusively, form on the lee aircraft and satellite data. Plains states. The 850-mb chart (ap- side of mountain ranges for this reason. 5. Any positive number for the Showalter proximately 5,000 ft ASL) showed that Anafronts generate a difficult set of Index — used by meteorologists to assess the flow was even more southerly and problems for aviation interests. They the potential for thunderstorms to develop moisture-laden than on the 500-mb also are more difficult to forecast — indicates stable air. Values from zero to minus 4 signify marginal instability, values chart. This was the warm, moist air accurately than common cold fronts. from minus 4 to minus 7 signify large overriding the frontal surface. Meteorologists have resources, such as instability, and values of minus 8 or less Freezing rain began in eastern Okla- upper-level soundings, and expertise signify extreme instability, the greatest homa during the morning of Dec. 9 and to explain the whole situation. They probability of thunderstorms. www.flightsafety.org | AeroSafetyWorld | July 2009 | 15 Coverstory © Chris Photography Sorensen
16 | flight safety foundation | AeroSafetyWorld | July 2009 coverStory Thinking first of Things two parts Through
BY CLARENCE E. RASH AND SHARON D. MANNING
A pilot’s cognitive processes — thinking and decision-making skills — often are the key to successfully overcoming in-flight safety risks.
n the chilly afternoon of Jan. 15, wishes to solve it within a specific influence a pilot’s level of cogni- 2009, having lost power from environment and set of circumstances.2 tive processing and his or her both engines of their Airbus Although making the right decisions decision-making capability. A320 minutes after takeoff does not always lead to success, making The first two groups are largely predeter- fromO New York’s LaGuardia Airport, the wrong decisions makes success mined and beyond the immediate control the crew of US Airways Flight 1549 considerably less likely. of the pilots. However, the third group landed the aircraft in the Hudson Riv- When the crew is faced with a of factors centers around the human er.1 Although the A320 was destroyed, threatening situation in the cockpit, the performance of the pilots and is within all 155 people inside survived. outcome is largely determined by three their direct control.3 This group includes There is little doubt as to the role that groups of factors: high-profile factors that are recognized as the training and experience of the flight important enough to be regulated, such • External factors, such as weather, crew played in the successful emergency as the amount of rest time provided and runway conditions, takeoff weight landing, but ultimately, it was their alcohol consumed within a specified and presence of birds; decision-making skill that turned a preceding time period, as well as factors • Aircraft and flight deck design fac- potential tragedy into a triumph. that frequently are overlooked, such as tors, such as the structural limits When faced with a challenging situ- nutrition state, hydration level, smoking of the aircraft and the human ation, pilots must use their skills, abili- rate and ambient noise level. These and factors engineering design of flight ties and knowledge to overcome the other seemingly unimportant factors can deck displays and input controls immediate circumstances. Cognitive significantly degrade pilot performance that affect the workload; and, psychologists consider decision making by impairing cognition, and, as a result, as the interaction between a problem • Factors related to human problem-solving and decision-making needing to be solved and a person who capabilities, such as those that capabilities. www.flightsafety.org | AeroSafetyWorld | July 2009 | 17 Coverstory
Cognitive Capacity knowledge that can be used to perform on information available within the im- Although philosophers have been inter- mental tasks. Different cognitive tasks mediate situation. This information is ested in human thought for thousands appear to involve different information- acquired through the five basic human of years, the field of cognitive science — processing systems, and the resources senses — sight, hearing, smell, taste the scientific study of the human mind and limits of these systems determine the and touch — and the so-called sixth or of intelligence — is barely more than cognitive capability to perform a given set sense of proprioception, or the ability 100 years old. Despite tremendous ad- of tasks. One of the main goals of cogni- to sense the position and movement vances in the understanding of how the tive science is to identify the properties of the body and its parts (see “How mind works, it remains difficult, even of these systems and characterize their Humans Obtain Information”). for cognitive specialists, to predict the limits. On the flight deck, there is an un- cognitive capabilities of an individual Scientists have explored human usually broad unitization of the senses in most sets of circumstances. cognition by studying its fundamental to continually update pilot information. When cognitive demands exceed processes and how they are affected For example, vision is used to monitor an individual’s capacity — a condition by internal and external factors called panel displays and to detect airspace referred to as cognitive saturation — stressors. and runway incursions. Hearing is newly presented information may not be used to detect aural warning signals perceived or understood.4 This implies Cognitive Processes and in communication. Smell — and in that individuals have a set amount of cog- To make decisions that lead to doing some cases, taste — can help detect the nitive resources — a term that refers to the “right thing” at the “right time” re- presence of fire, fuel leaks or chemi- information-processing capabilities and quires pilots to acquire, process and act cals. Proprioception supplies not only the sensations associated with “seat of the pants” flying but also a range of other signals from sensors in the skin, muscles, tendons and joints that aid in establishing awareness of the position of the body relative to the Earth. As information is provided by the senses, it is interpreted by the respec- tive cognitive processes of perception, attention, memory, knowledge, prob- lem solving and decision making, after which a course of action is imple- mented. This defines just one cycle in the decision-action sequence, which is a continuous feedback loop of acquisi- tion, processing, decision and action.
Perception Perception is a series of conscious sensory experiences. It is a combination of the information from the stimuli, or sources of information, in the world around us producing sensations in the sense organs — via sensory receptors — and cognitive processes that interpret those sensations. Perception deals with the psychological
awareness of objects in the world, based © Chris Photography Sorensen
18 | flight safety foundation | AeroSafetyWorld | July 2009 coverStory
on the effect of those objects on the sen- How Humans Obtain Information sory systems. It often is defined as the mental umans obtain information via a number of senses. Although most cognitive scientists have organization and moved away from the historical concepts of physiological senses and their resultant sensations interpretation of the Hand toward the psychological concept of perception — the understanding of sensory informa- visual sensory informa- tion — these older concepts are useful in understanding how we obtain information to make decisions. Our senses acquire information using specialized receptors (Table 1). The most basic sense tion with the intent of modes are sight, hearing, touch, taste and smell. attaining awareness Along with the sense of balance (equilibrioception, or vestibular sense), these senses sometimes and understanding of are referred to as exteroceptive senses, because they relate to our perceptions of the world around the objects and events us. However, scientists have identified a second group of senses called interoceptive senses that in the immediate pertain to our sense of self. This group includes thermoception, or temperature; nociception, or pain; and proprioception, the sense of the orientation and position of oneself in space. Proprioception environment. does not result from any specific sense organ but from the nervous system as a whole. Because perception — CER, SDM is an interpretation by the cognitive processes of the information ob- Human Senses tained by the senses, it Human Sense Receptors Sensations/Perceptions is possible for an inter- Sight (Vision) Photoreceptors (Cones and rods) Brightness and color pretation to be wrong. Hearing (Audition) Hair cells (Vibration receptors) Sound These misperceptions Touch (Tactility) Touch receptors Touch and pressure are called “illusions” (Mechanoreceptors) and are attributed to Smell (Olfaction) Chemoreceptors Smell (Odor) all of the senses. The (Odor receptors) flight environment is Taste Taste buds Salty, sour, sweet, bitter and 1 known for inducing umami a host of sensory illu- Thermoception (Temperature) Thermoceptors (Heat receptors Temperature (Heat and cold) in the skin) sions in pilots. When Proprioception Muscle spindles, Golgi tendon Self orientation and position not recognized as organs, and joint receptors incorrect interpreta- Nociception (Pain) Nocioptors (Pain receptors) Pain tions of the current Equilibrioception Otolith organs Balance (Direction of gravity) state of the aircraft, (Vestibular sense) these illusions impair Note: situational awareness 1. Umami, the lesser-known “fifth taste,” is described as savory or “meaty.” and frequently lead Source: Clarence E. Rash and Sharon D. Manning to incorrect decisions Table 1 and courses of action, often with disastrous consequences. “attention.” A stimulus can be processed very dif- Attention ferently when attended to, compared with when it Because humans have limited cognitive process- is unattended. For example, if someone is asked a ing capability, there is a distinction between the question while he is busy attending to something total information provided by the real world and else, he may not even hear the question. the amount of this information that actually is Generally, attention involves a voluntary processed. The mental process that is involved or intended focusing of concentration. It is be- in producing this distinction is referred to as lieved that attention can be directed to different www.flightsafety.org | AeroSafetyWorld | July 2009 | 19 Coverstory
aspects of the environment. In real- Short-term memory deals with result of their training, experts in a par- ity, attention is not based on a single memory of items for several seconds ticular field solve problems faster and mechanism but involves the properties and generally has a relatively small with a higher success rate than novices. of many different cognitive systems. capacity, holding only a few items The primary difference between expert Cognitive scientists distinguish be- before forgetting takes place. Working and novice problem solvers seems to be tween voluntary and involuntary atten- memory, which typically involves the that experts have more specific sche- tion.5 Voluntary attention occurs when manipulation of a piece of information mas for solving problems. a person makes an obvious cognitive — such as the mental comparison of Experts also generally have more effort to remain focused on a particular two remembered airspeeds — is broken knowledge about their field of special- task. Involuntary attention often is re- down into subsystems that process ization than novices. Their knowledge lated to environmental stimuli, such as information in a variety of ways.11 is organized differently than novices’ warning signals, that seem to automati- Long-term memory refers to the knowledge. In particular, experts often cally draw attention. important memories that are stored for organize their knowledge in a way that One attention condition that has long-term use. For example, training reflects the fundamental aspects of been the subject of considerable inter- information, information about rules for solving a class of problems. est in aviation is “cognitive tunneling.” behavior in specific situations and other Cognitive tunneling refers to a dif- developed forms of knowledge are stored Decision Making ficulty in dividing attention between in long-term memory. Closely related to The culmination of the other cognitive two superimposed fields of informa- this type of knowledge is a sort of mental processes is the decision-making process. tion — for example, head-up display model, a cognitive structure called a The major elements of decision (HUD) symbology as one field and “schema,” that helps interpret information making are: outcome selection, certainty see-through images as another field. It about how particular situations typically and uncertainty, and risk. An outcome sometimes is referred to as “attentional play out; for example, of how a specific is what will happen if a particular course tunneling” or “cognitive capture.” In the aircraft will behave under stall condi- of action is selected. Training helps aviation environment, such difficulty tions. Schemas allow people to adapt to identify the list of possible outcomes can lead to serious problems. Studies new situations by using knowledge about and the courses of action that may lead have found that pilots sometimes have other similar situations. to each outcome. Knowledge of possible failed to detect an airplane on a runway The cognitive process of problem outcomes is important when multiple when they are landing while using a solving refers to an immediate distinction courses of action are available. Cer- HUD system.6,7 Cognitive tunneling is between the present state of circumstanc- tainty implies that decision makers have an extreme form of a trade-off between es and a goal for which there is no imme- complete and accurate knowledge of attending to displays and attending diately obvious path to attainment.12 The the possible outcomes for each possible to the outside world. Several studies ability to solve a problem is interrelated course of action, and that there is only have shown that a HUD improves with the previously discussed cognitive one outcome for each course of action. monitoring of altitude information in processes. Some problems are difficult This last condition is not always met. a simulated flight but at the expense of because their solution requires retaining Risk becomes a factor when there maintaining the flight path.8,9 more information than can be held by are multiple outcomes for one or more working memory, and others are difficult courses of action. Risk can be man- Memory because individuals lack the appropriate aged if a probability can be assigned to Memory interacts with attention and schemas to characterize and analyze the each outcome when a specific course of perception. Indeed, many failures of important issues of a problem. action is taken. Uncertainty is pres- attention are described as breakdowns One important aspect of problem ent when the probabilities cannot be in memory of recent events. Cognitive solving is to identify the differences be- assigned; such a decision situation is re- scientists have identified various com- tween expert and novice problem solv- ferred to as “decision under uncertainty.” ponents of memory, such as short-term ers. Pilots are specially trained for their Researchers at the U.S. National memory, working memory and long- duties and are thus experts at solving Aeronautics and Space Administra- term memory.10 some aviation-related problems. As a tion (NASA) Ames Research Center
20 | flight safety foundation | AeroSafetyWorld | July 2009 coverStory
examined decision-making errors in identified as a contributing factor in 7. Wickens, C.D.; Long, J. “Object Versus aviation13 and found most errors to 30 to 40 percent of commercial and Space-Based Models of Visual Attention: Implications for the Design of Head-Up be intentional — that is, they resulted general aviation accidents.17,18 Displays.” Journal of Experimental Psychol- from a positive selection of an incorrect Clarence E. Rash is a research physicist with 30 ogy: Applied Volume 1 (1995): 179–193. course of action (a mistake) and not years experience in military aviation research 8. Foyle, D.C.; Sanford, B.D.; McCann, R.S. from a failure to take action (a lapse) or and development and the author of more than “Attentional Issues in Superimposed Flight because an intended action was carried 200 papers on aviation display, human factors Symbology.” In Proceedings of the Sixth 14 and protection topics. His latest book is Helmet- out incorrectly (a slip). International Symposium on Aviation Psy- Mounted Displays: Sensation, Perception However, as has been described, the chology, edited by Jensen, R.S. Columbus, and Cognition Issues, U.S. Army Aeromedical Ohio, U.S.: Ohio State University, 1991. decision-making process is the culmi- Research Laboratory, 2009. nation of the other cognitive processes; 9. Neath, I.; Surprenant, A.M. Human Sharon D. Manning is a safety and occupational if the other processes are degraded Memory: An Introduction to Research, health specialist at the Aviation Branch Safety or go awry, then the decision-making Data, and Theory (2nd edition). Belmont, Office at Fort Rucker, Alabama, U.S., and has California, U.S.: Wadsworth, 2003. process and the resulting selected more than 20 years experience in aviation safety. course of action will be incorrect. The 10. Ibid. consequences can be disastrous. Notes 11. Baddeley, A.D. “Working Memory: Look- To assist pilots with their decision- 1. U.S. National Transportation Safety Board. ing Back and Looking Forward.” Nature making skills, the U.S. Federal Aviation Preliminary accident report DCA09MA026. Reviews Neuroscience Volume 4 (Sept. 30, Administration (FAA) developed a NTSB news releases, Feb. 19, 2009; June 4, 2003): 829–839. six-step model for use in teaching the 2009. Preliminary reports from the NTSB 12. Lovett, M.C. “Problem Solving.” In Steven’s attributed the loss of engine thrust to elements of decision making. Known Handbook of Experimental Psychology, 3rd multiple bird strikes on each of the A320’s by the acronym “DECIDE,” the six ele- edition (Medin, D.L., editor): 317–362. engines during initial climb. Five people in ments are:15,16 New York: Wiley, 2002. the airplane received serious injuries. The • Detect that a change has occurred; investigation is continuing. 13. Orasanu, Judith; Martin, Lynne. “Errors in Aviation Decision Making: A Factor in • Estimate the need to counter or 2. Narayan, S.M.; Corcoran-Perry, S. “Line of Accidents and Incidents.” Workshop on react to the change; Reasoning as a Representation of Nurses’ Human Error, Safety, and System Develop- Clinical Decision Making.” Research in Nurs- • Choose a desirable outcome; ment (HESSD): 100–107, 1998. ing & Health Volume 20 (1997): 353–364. • Identify actions that could suc- 14. Wickens, Christopher; Hollands, Justin. 3. Research has shown that several personal cessfully control the change; “Stress and Human Error.” In Engineering factors not in the direct control of an indi- • Do take the necessary action to Psychology and Human Performance, 3rd vidual, such as gender and age, can affect edition. London: Prentice Hall, 1999. adapt to the change; and, decision making. Sanz de Acedo Lizárraga, • Evaluate the effect(s) of the action. María L.; Sanz de Acedo Baquedano, 15. Jenson, R.S.; Adrion, J.; Lawton, R.S. Aero- Decision making is a skill. Pilots, like María T.; Cardelle-Elawar, María. “Factors nautical Decision Making for Instrument That Affect Decision Making: Gender and Pilots, DOT/FAA/PM-86/43, 1987. other professionals, must learn to become Age Differences.” International Journal 16. FAA. Advisory Circular 60-22, Aeronauti- better decision makers. The DECIDE of Psychology and Psychological Therapy cal Decision Making, 1991. model — one of many human factors Volume 7 (2007): 381–391. approaches to teaching decision-making 17. Shappell, S.A.; Wiegmann, D.A. Human 4. Dean, Allan; Pruchnicki, Shawn. “Deadly Error and General Aviation Accidents: A skills — has proved to be a successful Omission.” AeroSafety World Volume 3 Comprehensive Fine-Grained Analysis resource for learning the crucial compo- (December 2008): 10–16. nents of making more effective decisions. Using HFACS. 2005.
By Wayne Rosenkrans © Chris Photography Sorensen
22 | flight safety foundation | AeroSafetyWorld | July 2009 SAFETYOVERSIGHT
wo countries with high overall scores on effective implementation of critical elements of a safety oversight system1 lost points when teams of international auditorsT looked at how they regulate the trans- port of dangerous goods by air.2 Australia and the United States hosted auditors representing the International Civil Aviation Organization (ICAO) in February 2008 and November 2007, respectively, under ICAO’s Universal Safety Oversight Audit Program (USOAP).3,4 The results were released to the public this year.5 The audits were the first for each state con- ducted under the comprehensive systems approach in the 2005–2010 cycle of audits (ASW, 2/07, p. 39). ICAO agreed that each country’s resultant action plan fully addressed most of the findings and recommendations. Most corrective actions in response to dangerous goods–related findings had been completed by mid-2009; others were sched- uled to be completed by the end of 2010, the states said in the final reports. Around the time of the previous visits by USOAP auditors to Australia and the United States under the program’s initial approach, a passenger airliner was destroyed in Malaysia. Ac- cording to accident information compiled by the Aviation Safety Network, citing news media ac- counts in China and other sources, Malaysia Air- lines Flight 085, an Airbus A330, arrived at Kuala Lumpur International Airport after a flight from Beijing on March 15, 2000. At about 2340, five of © Chris Sorensen Photography 20 cargo handlers suddenly became ill when they encountered fumes while unloading 80 canisters weighing 2,000 kg (4,409 lb) from the cargo hold that the shipper had of the aircraft. None of the 252 passengers and 14 misidentified the can- crewmembers was injured.6 isters as a safe powder- Aircraft rescue and fire fighting personnel type chemical. identified the source of the fumes emitted by the canisters as oxalyl chloride, a liquid used in Australian laboratory chemical analysis that may be fatal if Improvements swallowed or inhaled, and releases toxic and cor- USOAP auditors rosive fumes in contact with water or moist air. found that regulations Several canisters had leaked inside the hold, of the Civil Avia- causing fuselage damage so severe that the insurer tion Safety Author- judged the five-year-old airplane to be damaged ity (CASA) had beyond economic repair. A Chinese court found prescribed Australian International Organization Civil Aviation www.flightsafety.org | AeroSafetyWorld | July 2009 | 23 SAFETYOVERSIGHT
requirements for the consignment and been provided with adequate dangerous The government said that CASA carriage of dangerous goods by air and goods training or technical guidance would introduce a layered approach to addressed training, documentation, materials.” The auditors noted that this dangerous goods inspection, beginning record keeping, incident reporting, contrasted with CASA’s practice of is- with surveillance and audit training of packaging, marking, labeling and load- suing advisory circulars to inform the existing flight operations inspectors, ing. “However, the regulations are not aviation industry about the regulatory cabin safety inspectors, air transport up to date with the latest amendments of requirements for dangerous goods. inspectors and airport inspectors. “Once ICAO’s Annex 18, The Safe Transport of The government agreed with the trained, these inspectors will provide ini- Dangerous Goods by Air, and its Techni- finding and responded that a new dan- tial safety oversight in conjunction with cal Instructions for the Safe Transport of gerous goods project, called DG Vision their other duties,” CASA said. “Recruit- Dangerous Goods by Air (Doc 9284),” 2010, would develop new approaches to ment and development of specialists will ICAO said. ensure that adequate numbers of trained be undertaken as necessary. … A core The government agreed to conduct inspectors are available. The government team of dangerous goods specialists will “a thorough review of the provisions of also agreed to establish clear standards be supported by the other inspectors (up Annex 18 … to determine if Australian and processes, including a program for to two per office) [who] have received legislation requires amendment. … surveillance and enforcement; develop enhanced dangerous goods oversight CASA will also develop and implement systems for reporting, capturing and training. … Australia will examine and processes to ensure future Annex 18 analyzing dangerous goods data; and re- consider instituting specific authoriza- amendments are considered and either vise and update CASA’s dangerous goods tions to carry dangerous goods … make appropriately incorporated into the training course. any necessary legislative amendments Australian safety system or differences Another finding was that CASA did and update supporting documentation are lodged with ICAO.” not have a finalized and approved “pro- including the advisory circular.” The auditors found that CASA had cess for granting specific authorizations The auditors found that CASA did two dangerous goods inspectors at the related to the transport of dangerous not have “a comprehensive surveillance time of the audit. “This number is not goods by air, including review of the air program of regular and random inspec- sufficient for the level of activity in operator’s acceptance checklists, load- tions of activities pertaining to the safe Australia as to ensure effective safety ing procedures, in-flight emergency transport of dangerous goods by air.” The oversight,” ICAO said. “In addition, the response procedures, and approval of government said, “Currently, inspections dangerous goods inspectors have not dangerous goods training programs.” by the dangerous goods inspectors are being undertaken on a risk-management basis with a particular focus on both random and scheduled audits occurring in areas that are of higher risk or have not been closely scrutinized in recent times. However, a specific surveillance program is not yet in place.”
U.S. Improvements In the United States, the USOAP audit team cited difficulty identifying lines of accountability because of the ways that oversight has been divided among the U.S. Federal Aviation Administration (FAA) and other agencies. Essentially, the Department of Transportation has
A prohibited corrosive liquid spilled in cargo left this Airbus A330 a constructive total loss. authority to issue dangerous goods–
© Alexander Kueh/Airliners.net related regulations but delegates overall
24 | flight safety foundation | AeroSafetyWorld | July 2009 SAFETYOVERSIGHT
rulemaking authority to another of its and to evaluate new operational tech- incorrect ICAO references and stan- agencies — the Pipeline and Hazard- niques that enhance safety and increase dards [in U.S. regulations]; take action ous Material Safety Administration productivity in support of U.S. interests. to update all incorrect ICAO references (PHMSA) — while delegating to the Individual technical safety evaluations and standards; identify and file any dif- FAA the enforcement of hazardous are conducted, and more stringent safety ferences as appropriate; initiate action to material regulations (HMRs) for the provisions than the standard applicable consider requiring mandatory compli- aviation sector, and involving the FAA provisions of the TI are often required as ance with the provisions of the ICAO in dangerous goods rulemaking related a condition of the [exemption].” Never TI, in addition to specifically identified to ICAO Annex 6, Operation of Aircraft. theless, the United States agreed to more restrictive requirements of the The auditors found a system of provide ICAO with a written description U.S. HMRs, for hazardous material exemptions from regulatory require- of the procedures followed by PHMSA shipments by air from the United States; ments that did not comply with ICAO for accepting, reviewing, approving or [and] identify the specific differences standards and an unclear division of denying applications for exemptions between the ICAO TI and the U.S. responsibilities. “Although the [federal from dangerous goods regulations. HMRs and consider the appropriate law] in general permits compliance The auditors found that, except means to address each difference.” with ICAO’s Technical Instructions [TI], for the FAA, agencies on the U.S. subsidiary regulations applicable to the Interagency Group on International Notes transport of dangerous goods are not in Aviation (IGIA) — including PHMSA 1. Australia scored 83.38 percent effective full compliance with ICAO Annex 18 — lacked formal procedures to amend implementation of ICAO’s critical elements … and the [TI],” ICAO said. U.S. regulations in concert with updates of a safety oversight system compared with The exemption-related discrepancy to ICAO standards and recommended a global average of 58.48 percent for 115 audited states in 2008. The United States was between ICAO’s basis for granting practices or to identify national differ- scored 91.13 percent compared with a exemptions from dangerous goods regu- ences and notify ICAO accordingly. global average of 57.77 percent for 108 lations to aircraft operators and findings They also found a lack of formal co- audited states in 2007. that PHMSA had issued exemptions ordination on dangerous goods issues 2. U.S. regulations and guidance material use without these conditions being met. The among the rulemaking departments of the term hazardous materials. TI essentially says that states may issue the Department of Transportation, the exemptions to dangerous goods regula- FAA and PHMSA, and no procedure or 3. ICAO. “Final Report on the Safety Oversight Audit of the Civil Aviation tions “in cases of extreme urgency, or practice for them to consult with each System of the United States of America: when other forms of transport are inap- other on harmonization of proposed 5 to 19 November 2007.” Universal Safety propriate, or full compliance with the U.S. amendments and ICAO standards Oversight Audit Program. August 2008. prescribed requirements is contrary to and recommended practices. 4. ICAO. “Final Report on the Safety public interest … provided that in such The government responded, “We will Oversight Audit of the Civil Aviation cases, every effort is made to achieve establish standard operating procedures System of Australia: 5 to 19 November an overall level of safety in transport, for IGIA members and include provisions 2007.” Universal Safety Oversight Audit which is equivalent to the level of safety for coordination with the appropriate Program. January 2009. provided by [the TI].” rulemaking departments in the U.S. gov- 5. Both governments — in the interest of The U.S. government replied, ernment. … FAA and PHMSA are ad- public confidence in air travel through “PHMSA concurs that we may issue a dressing the coordination concerns raised transparency of safety information (ASW, variance to the ICAO TI only provided in this finding in a new memorandum of 8/08, p. 30) — exceeded the typical prac- tice of the 190 states by authorizing public [that] an equivalent level of safety is understanding between the two agencies. posting of the final reports on the ICAO demonstrated, or is necessary to protect … We believe that [a written FAA process Flight Safety Information Exchange Web life or property. Such authorizations already] satisfies the recommendation to site,
ITALY Bari
Accident site Palermo
SICILY
Tunis TUNISIA Eric Gaba/Wikimedia Commons Positive
The gauges showed ‘fat on fuel’ when the tanks ran dry.
BY MARK LACAGNINA
he fuel quantity indicator (FQI) showed designed to be used in an ATR 42, not in the that there was plenty of fuel aboard larger ATR 72 in which it had been installed the ATR 72 when both engines flamed before the flight. out high above the Mediterranean Sea. The aircraft broke into three pieces when it Accordingly,T the flight crew spent precious was ditched in rough seas off the northern coast minutes trying to restart the previously fault- of Sicily. Fifteen passengers and the senior flight less engines rather than coaxing the maximum attendant were killed; 13 passengers, the captain, glide performance from the aircraft for a pos- the copilot and the assistant flight attendant sible landing at a coastal airport — a theoreti- were seriously injured; and seven passengers cal possibility. sustained minor injuries. The restart attempts were futile because In its recent report on the Aug. 6, 2005, ac- there actually was no fuel remaining in the cident, the Agenzia Nazionale per la Sicurezza tanks. The problem was not that the FQI was del Volo (ANSV, the Italian Air Safety Board)
malfunctioning, the problem was that it was said, “The ditching was primarily due to the Press © Associated False
26 | flight safety foundation | AeroSafetyWorld | July 2009 Causalfactors
[flameout of] both engines because of fuel capacitive sensors installed in the wing fuel exhaustion. The incorrect replacement of the tanks, based on an algorithm which is specific to [FQI] was one of the contributing factors which each type of aircraft, depending on the shape of led irremediably to the accident.” the tanks, their sizes and the number of probes,” the report said. “The wing fuel tanks of ATR Not Interchangeable 42 and ATR 72 aircraft are different in terms of The accident aircraft was operated by the Tuni- maximum capacity, shape, [and the] number sian airline Tuninter, which had two ATR 72s and positioning of the capacitive probes. There- and one ATR 42 in its fleet. Based in Tunis, the fore, ATR 42 and ATR 72 type FQIs use different airline conducted “domestic and international algorithms and cannot be interchanged.” scheduled service and charter flights, the latter The FQIs for the two ATR models are almost chiefly to and from Italy,” the report said. identical in appearance, the only difference be- The day before the accident, the aircraft ing the inscriptions on the gauge faces showing had been used for five flights, of which four the maximum fuel quantity for each wing tank: were conducted by the accident captain. He had 2,500 kg (5,512 lb) for the ATR 72 and 2,250 noticed that the FQI display was difficult to read kg (4,960 lb) for the ATR 42. The installation because of the failure of several light-emitting procedure is the same. diodes. The captain recorded the fault in the aircraft’s logbook after completing his last flight, Search for a Spare which terminated in Tunis. Following up on the captain’s malfunction The captain also recorded that 790 kg (1,742 report, a maintenance technician in Tunis had lb) of fuel remained in the aircraft after shutdown. used a video terminal to search the manufactur- The FQIs in the ATR models compute er’s illustrated parts catalog (IPC) for the correct the weight of fuel in the wing tanks based on part numbers for a replacement FQI. He found measurements of the electrical capacitance of three: 748-681-2 (the same part number as that metallic probes inside the tanks. “The FQI is of the faulty FQI that required replacement), an instrument processing the signal from the 749-160 and 749-759.
The ATR 72 broke into three pieces when it was ditched in rough seas. Some survivors climbed atop the center section to await rescue. www.flightsafety.org | AeroSafetyWorld | July 2009 | 27 Causalfactors
The spare parts management system showed that a PN 749-158 FQI was in stock. The techni- cian’s shift was nearly over when he retrieved the FQI from stock, so he prepared the gauge for installation and left it for the maintenance technician assigned to the next shift. The maintenance technician on the next shift replaced the FQI in the accident aircraft. “The technician replacing the part did not complete, however, an IPC check for the ap- plicability of PN 749-158 to the ATR 72 aircraft either before or after the replacement,” the report said. After it was installed, the FQI showed a total fuel quantity of 3,100 kg (6,834 lb), rather than 790 kg. No checks of the accuracy of this Agencia Nazionale per la Sicurezza del Volo indication were performed or were required to Though it looks The technician then searched Tuninter’s spare be performed. “The replacement procedure did almost identical and parts management system for FQIs bearing those not require any manual checks, using the so- fits perfectly, this part numbers but found none shown as either in called dripsticks, of the actual quantity of fuel ATR 42 fuel quantity stock or installed in one of the airline’s ATR 72s. present in each tank or the subsequent com- indicator will read “As this result was rather strange, considering that parison with the value shown by the FQI,” the 1 high when installed at least the FQIs already installed on the aircraft report said. The job instruction card required in the larger ATR 72. of the carrier should have shown on the informa- only a check that the displays were illuminating tion system, the technician tried to look for FQIs properly. recorded with a PN [part number] different from the one listed in the IPC,” the report said. Shuffled Schedule (FQIs suitable for the ATR 72 actually were The schedule for the accident aircraft, registra- available in stock at Tunis, but their part numbers tion TS-LBB, the morning of Aug. 6 began with had not been entered in the spare parts manage- a round-trip flight between Tunis and Djerba, ment system’s database exactly as they appeared a resort island off the southeast coast of Tu- in the IPC; the dashes in 748-681-2, for example, nisia. The flight crew assigned to these flights had been omitted. Thus, when the technician en- requested an initial fuel load that was about half tered the part numbers that he had derived from the 3,100 kg shown on the centralized refueling his search of the IPC, the spare parts manage- panel, which simply repeats the quantity shown ment system did not recognize them.) on the cockpit FQI. The technician continued his search by It was decided that TS-LBB would have to entering “748-” in the spare parts management be partially defueled. However, the defueling system. The system erroneously showed that tanker would not be available for two hours. PN 748-465-5AB was applicable for installa- Rather than delaying the flight, the assigned tion in both the ATR 72 and the ATR 42, and crew agreed to conduct the flight in the other was interchangeable with FQIs of two different ATR 72 operated by Tuninter. part numbers, one of them being 749-158. “The That aircraft, TS-LBC, had been scheduled information relating to the applicability was for a flight to Palermo later that morning. wrong, as PN 748-465-5AB identifies an FQI However, when the dispatcher told the crew only applicable to ATR 42 aircraft and not also assigned to that flight that TS-LBC had been to [the] ATR 72,” the report said. rescheduled and that they would have to take
28 | flight safety foundation | AeroSafetyWorld | July 2009 Causalfactors
TS-LBB instead, the captain refused. “He took quantity from 3,100 to 3,800 kg. No one noticed this decision because, during previous flights the discrepancy. using the same aircraft, a malfunctioning of Meanwhile, while reviewing the aircraft the nosewheel steering [system] had repeat- documents, the captain had noticed that there edly been notified,” the report said. “It was his was no fuel slip showing that the aircraft had opinion that this fault had not been correctly been refueled from the 790 kg he had recorded handled and resolved.” (The fault was excessive after his last flight the previous day to the 3,100 vibration and a loud noise when the nosewheel kg indicated before the refueling that morning. was fully deflected.) The dispatcher then of- The fuel slip could not be found; indeed, it did fered the ATR 42 for the Palermo flight, and not exist because the aircraft had not been refu- the captain accepted it. eled from 790 kg to 3,100 kg. However, the dispatcher told the captain ‘Missing’ Fuel Slip that “it was highly likely that one of the crews The captain who had reported the malfunc- planning to complete the previous routes, sub- tioning FQI in TS-LBB the previous day had sequently cancelled, might have mistakenly kept been scheduled to conduct subsequent flights the copy of this refueling slip,” the report said. The fuel slip could in the aircraft on Aug. 6, beginning with a The dispatcher said that he would find the slip positioning flight to Bari, which is on the and give it to the captain when he returned to not be found; southeastern coast of the Italian peninsula, Tunis later that day. and a charter flight to Djerba (ultimately, the The captain “trusted in the assurances given indeed, it did not accident flight). by the flight dispatcher” and agreed to depart exist because the The captain and the copilot assigned to the without the fuel slip, the report said. “A diligent flights were Tunisian nationals. The captain, 45, search for the aforementioned slip … mak- aircraft had not had 7,182 flight hours, including 5,582 hours in ing enquiries of the refueling company as well, type. He had been on duty more than nine hours would undoubtedly have led the crew to suspect been refueled. the previous day and had a rest period of nearly that the fuel reading was not entirely reliable 18 hours. The copilot, 28, had 2,431 flight hours, and, hence, to investigate further.” including 2,130 hours in type. The dispatcher asked the pilots if the ‘Technical Problem’ indicated fuel quantity, 3,100 kg, would be The ATR 72’s tanks actually contained a total of sufficient to complete the flights to Bari and 1,255 kg (2,767 lb) of fuel — about one-third of Djerba without refueling in Bari. The copi- the quantity indicated — when the engines were lot told the captain that he had calculated started (Figure 1, p. 30). The aircraft departed a departure fuel load of 4,200 kg (9,259 lb) from Tunis at 1005 coordinated universal time as sufficient to avoid refueling in Bari. “The (UTC; 1205 local time) and landed in Bari at flight captain, responsible for the final deci- 1146 UTC. sion, decided to request a block fuel value of The crew had planned to have 2,700 kg 3,800 kg [8,377 lb],” the report said. “During (5,952 lb) of fuel aboard for the flight from Bari [post-accident] interviews, the flight captain to Djerba, but the FQI indicated 2,300 kg (5,071 justified this decision with possible route lb). The captain therefore decided to upload shortenings, which are often allowed due to fuel. Again, no one noticed the discrepancy low volumes of traffic.” when the addition of 265 kg (584 lb) of fuel was Accordingly, the aircraft was refueled to an sufficient to increase the indicated fuel quantity indicated quantity of 3,800 kg. Because of the from 2,300 kg to 2,700 kg. FQI’s erroneously high readings, however, only The tanks actually held 570 kg (1,257 lb) 465 kg (1,025 lb) of fuel, rather than 700 kg of fuel when the ATR 72 departed from Bari at (1,543 lb), was required to bring the indicated 1232 UTC as Flight TUI 1153. www.flightsafety.org | AeroSafetyWorld | July 2009 | 29 Causalfactors
The aircraft was cruising at Flight Level ‘Send Us Helicopters’ (FL) 230 (approximately 23,000 ft) at 1320 UTC After establishing radio communication with when the right engine flamed out. The copilot the approach controller at 1325, the crew reported a “technical problem” to the Rome confirmed that they had lost both engines and Area Control Center and requested clearance asked three times in English for the distance to to descend to FL 170. “The [copilot] did not Palermo. The report said that the requests were specify to air traffic control the type of problem “not sufficiently clear” and that the controller occurring,” the report said. “had not perfectly understood” them but “finally Recorded flight data indicated that the left replied that the current distance [to] Palermo engine flamed out about 100 seconds later. The was 48 nm [89 km].” At this point, the aircraft copilot told the center controller that they want- was descending through 15,000 ft. ed to land in Palermo, which is on the northern The crew asked twice if there was a closer coast of Sicily. This radio transmission, however, airport: “Any nearest airport where we can was partially blocked by the controller’s trans- land?” The controller did not understand the mission of a clearance to descend to FL 170 and question until it was repeated by the crew of a question about the need for special assistance. another aircraft. The controller confirmed that Shortly thereafter, the copilot declared an emer- Palermo was the closest airport. gency, repeated the request to proceed directly At 1333 — after a series of radio commu- to Palermo and said, “We lose both engines.” nications in which the crew requested vectors The center controller decided to hand off direct to Palermo and the controller requested the flight to Palermo Approach Control, which information about passengers, fuel and could provide greater assistance to the crew. dangerous goods aboard the aircraft — the controller told the Indicated vs. Actual Fuel Quantity crew that they were 20 nm (37 km) from 4,000 3,800 3,800 Indicated fuel quantity Palermo. The crew Actual fuel quantity replied that they 3,500 were at 4,000 ft and would not be able 3,000 3,100 2,700 2,700 to reach the coast. “They also requested 2,500 that emergency ser- 2,300 2,000 vices be dispatched (‘Can you send us 1,800 1,800 helicopters or some-
Fuel quantity (kg) Fuel 1,500 1,255 1,255 thing like that?’),” 1,000 the report said. The aircraft was 790 570 570 500 at 2,200 ft when the crew radioed that 305 0 0 0 they were turning FQI Refueling at Flight TUI 152F Landing Refuelling at Flight TUI 1153 Engines Ditching replacement Tunis (465 kg) (Tunis–Bari) at Bari Bari (265 kg) Bari–Djerba ame out to a heading of 180 Events degrees to ditch the
FQI = fuel quantity indicator aircraft as close as
Source: Agencia Nazionale per la Sicurezza del Volo possible to two “big boats” they had spot- Figure 1 ted. The crew asked
30 | flight safety foundation | AeroSafetyWorld | July 2009 Causalfactors
the controller to advise the boats of the for collision,” the report said. Despite fuselage,” the report said. Rescue opera- situation shortly before radio commu- their instructions, however, some pas- tions by helicopters and patrol boats be- nication ended at 1337. sengers inflated their life vests inside gan about 30 minutes after the ditching. the aircraft. Recovered wreckage and the flight ‘Unable to Understand’ Meanwhile, the pilots had con- data and voice recorders were seques- When the right engine flamed out, tinued trying to restart the engines, tered by Italian judicial authorities. The the pilots had noticed a low fuel pres- and the captain had summoned the report said that the criminal investiga- sure warning and had initiated the maintenance technician assigned to tion impeded the technical investiga- associated checklist. However, when the flight to assist. “Both the flight tion of the accident by the ANSV and the left engine flamed out, the captain crew and the engineer were unable to accredited parties to the investigation told the copilot to stop reading the understand what type of fault had oc- (see editorial, p. 5). checklist. “For about a minute, the curred to the two engines,” the report Calculations and two flight simu- pilots tried to interpret the indica- said. The last restart attempt was made lator tests performed by the ANSV tions of the cockpit instrument shortly before the aircraft descended indicated that if the pilots had config- warnings and identify the reasons for through 4,000 ft. ured the ATR 72 for optimum glide the failure of both engines, but unsuc- The captain flew the aircraft and performance after the second flameout cessfully,” the report said. also handled radio communication occurred at 21,800 ft and about 60 nm The pilots did not conduct the while the copilot began to conduct the (111 km) from Palermo, and if they had checklist related to flameout of both ditching checklist. “The flight cap- maintained the appropriate drift-down engines and, thus, did not feather the tain, in view of the imminence of the speed, they theoretically could have propellers. They focused on trying to ditching, asked the copilot to assist reached the airport. restart the engines. The FQI showed him in the steering of the aircraft and However, the report noted that 1,800 kg (3,968 lb) of fuel remaining. to get ready for the impact,” the report maintaining drift-down speed while The low-fuel warning never appeared said. “The ditching checklist was not dealing with distractions and while because the indicated quantity had completed.” flying with reference to standby not fallen below the requisite 320 kg instruments providing no distance (705 lb). Among the recommenda- Violent Impact readout would have been very dif- tions generated by the ANSV’s inves- The sky was clear and visibility was ficult. One of the two experienced tigation was that all public transport good, but the sea conditions were de- ATR crews that participated in the aircraft have a low-fuel-quantity scribed by the report as “rough to very simulator tests was able to reach the warning system that is independent rough.” The aircraft struck the water runway; the other landed in the sea, of the FQI system. tail-first. The impact was described as about 1 nm (2 km) from the runway The aircraft was descending violent and as having caused most of threshold. through 12,000 ft when the captain told the fatalities. This article is based on the ANSV’s “Final the senior flight attendant to prepare “Although broken in three main Report: Accident Involving ATR 72 Aircraft, the passengers for a possible ditch- parts, the aircraft remained floating for Registration Marks TS-LBB,” available online at ing. The senior flight attendant used about 20 to 30 minutes after ditching,”
Procedural Disregard
Failure to comply with recommended arrival and communication procedures played a big part in the fatal midair collision of two EMS helicopters, the NTSB says.
BY LINDA WERFELMAN
ilots of two emergency medical services by Classic Helicopter Services of Page, Arizona. helicopters failed to see and avoid each Contributing factors were “the failure of [the Air other’s aircraft before the two Bell 407s Methods] pilot to follow arrival and noise abate- collided as they approached the Flagstaff ment guidelines and the failure of [the Classic] (Arizona,P U.S.) Medical Center helipad, each to pilot to follow communications guidelines.” drop off a patient, the U.S. National Transporta- Both helicopters were destroyed in the crash, tion Safety Board (NTSB) said. which occurred at 1547 local time in visual me- In its final report on the accident, the NTSB teorological conditions that included clear skies cited each pilot’s failure to see and avoid the oth- and at least 10 mi (16 km) visibility. er helicopter as the probable cause of the June The Air Methods pilot, operating under 29, 2008, crash that killed all seven people in the call sign Angel 1, had contacted Guardian the two aircraft — one operated by Air Methods Control, the operator’s communications center, Corp. of Englewood, Colorado, and the other, at 1516, saying that he was departing from Win- slow, Arizona, with two flight nurses and a pa- tient and that he might land at Flagstaff Pulliam Airport (FLG) if he calculated that the helicop- ter would be too heavy for a safe out-of-ground- effect hover at the hospital helipad (FMC). He estimated his flight would take 25 minutes. At 1517, he again contacted Guardian Control to request FLG weather conditions; within the next two minutes Guardian Control’s transportation coordinator contacted FMC to report that the helicopter would arrive at the he- lipad in about 23 minutes. About 1518, the pilot told Guardian Control he would first fly to FLG to allow one of the flight nurses to disembark before proceeding to FMC. The Classic helicopter pilot, with the call
sign Lifeguard 2, contacted Classic Control Board Safety Transportation National U.S.
32 | flight safety foundation | AeroSafetyWorld | July 2009 HelicopterSafety
Accident Flight Paths
U.S. Route 180 Lifeguard 2
Helipad H U.S. Route 66 and U.S. Route 180 Accident
Interstate 40
U.S. Route 66
Interstate 40
Arizona Route 89A The crash …
occurred at 1547
local time in visual
meteorological Angel 1 conditions that Interstate 17
included clear skies.
Flagsta Airport
Source: U..S. National Transportation Safety Board
Figure 1 at 1517 to report having departed from the The Classic dispatcher replied, “Oh, okay, South Rim of the Grand Canyon and esti- I’ll let them know when I talk to them next, mating that the flight to FMC would take 32 and I’ll tell them to be sure and get ahold of minutes. In addition to the pilot, the Classic y ou .” helicopter carried a flight nurse, a flight para- Guardian Control then called the FMC medic and a patient. emergency department and said that Classic’s At 1523, the Classic Control dispatcher Lifeguard 2 would land at the hospital helipad contacted Guardian Control to say that Life- “in about 28 minutes … and they know about guard 2 was en route to FMC and would arrive mine coming in.” The person who had answered from the north. Guardian Control responded the FMC telephone said, “All right,” and Guard- that Angel 1 also was en route and expected to ian Control then contacted the Angel 1 pilot land in 20 minutes. with the same information. www.flightsafety.org | AeroSafetyWorld | July 2009 | 33 HelicopterSafety
Bell 407
he Bell 407 is a single-engine light helicopter developed in the mid-1990s as a replacement for the JetRanger and LongRanger. The 407 has a four-blade main rotor, a wider cabin than the TLongRanger and a larger cabin window area. Designed for a pilot and six passengers, it also can be modified for emergency medical services use. The 407 has an Allison 250-C47 turboshaft engine rated at 813 shp (606 kW) for takeoff and 701 shp (523 kW) for continuous operation. Standard usable fuel capacity is 126 gal (477 L). Empty weight is 2,598 lb (1,178 kg), and maximum takeoff weight with an internal load is 5,000 lb (2,268 kg). Maximum cruising speed at sea level is 115 kt. Maximum range is 312 nm (577 km).
Source: Jane’s All the World’s Aircraft
The Angel 1 pilot replied, “Roger, will be recorded communication, “If you haven’t figured looking for ’em, thanks.” it out, we’ve, uh, landed at the … airport, departed At 1532, the Lifeguard 2 pilot, in his last and we’re about two minutes out of the hospital.” recorded communication, gave Classic Control At 1550, the Classic dispatcher telephoned a position report and said he planned to land at Guardian Control and asked if Guardian had FMC in 15 minutes. had contact with “my ship.” The Classic dis- About the same time, the Angel 1 pilot told patcher said, “Negative.” Guardian Control he would land at FLG in 10 Medical crewmembers on both helicop- At the time of the minutes to drop off the flight nurse. Two minutes ters had spoken with different personnel at crash, Classic later, he asked Guardian Control to contact FMC the hospital. The Classic crewmember said Helicopter Service for help in moving the patient from the helicopter. that Lifeguard 2 was expected to arrive at the operated three At 1543, having landed and dropped off the hospital helipad about 1546; the Air Methods aircraft, including flight nurse, Angel 1 departed from FLG. One crewmember estimated a 1549 arrival time for this Bell 407. minute later, he told Guardian Control in his last Angel 1. The hospital medical personnel said that neither conversation mentioned that an- other helicopter also was en route to the helipad. Hospital personnel were not required to provide this information. Video recorded on a hospital surveillance camera showed one of the helicopters approach- ing the helipad from the north, the other ap- proaching from the south and both descending. Witnesses said that Angel 1 approached the helipad on a “usual landing pattern,” from the southwest. The report quoted one witness as saying that she heard one helicopter approach- ing from the north and a second, from the south and “looked up just as the northbound helicop- ter apparently clipped the rotor of the south- bound [helicopter]. At that time, they both were in a turn to the hospital.” The wreckage was found about 0.25 nm (0.50 km) east of the helipad, in a wooded area.
The Classic helicopter, which showed no signs RotorImage/Airliners.net
34 | flight safety foundation | AeroSafetyWorld | July 2009 HelicopterSafety
of fire damage, was about 300 ft (91m) west of the Air Methods 407, which exploded in flames after striking the ground.
Full-Time EMS Pilots RotorImage/Airliners.net The Air Methods pilot, who had 5,241 flight hours, including 4,500 hours in helicopters, held a U.S. Federal Aviation Administration (FAA) commercial pilot certificate for single-engine land airplanes and helicopters and instrument ratings for both categories of aircraft. He also held a first-class medical certificate. He was hired by Air Methods in Octo- ber 2003 to fly Bell 407s from the operator’s Flagstaff base. He worked full-time as an EMS pilot and was qualified to fly with night vision goggles (NVGs). He satisfactorily completed all company initial, recurrent and NVG training courses, the operator said. He was the Air Meth- ods safety officer and safety coordinator. The Classic pilot had 14,500 flight hours, “The guidance states that helicopters operat- The pilot of Air including 9,780 hours in helicopters. He held a ing at FMC are advised to establish communi- Method’s Angel 1 commercial pilot certificate for single-engine land cations with Guardian Control at the earliest stopped at nearby airplanes and helicopters and instrument ratings opportunity,” the report said. “It is required that Flagstaff Pulliam for both categories, and he was NVG-qualified. all inbound aircraft will notify Guardian Con- Airport before He also held a second-class medical certificate. trol at the earliest convenience but not less than continuing to the He was hired by Classic in May 2007 as a … 5 miles out. The guidance stated, ‘Timely hospital helipad. full-time EMS pilot to fly Bell 407s from the communication with Guardian Air Control is Classic base in Page, and he satisfactorily com- especially paramount when multiple helicopters pleted U.S. Federal Aviation Regulations Part are inbound to the facility.’” 135 requalification training. He had worked for Classic said that, during approaches from Classic previously, flying Bell 206Ls and 407s the northwest, the Guardian Control signal is and serving as the EMS safety officer between obscured by mountain peaks but becomes clear 1998 and 2005, when he left to work for TriState within 10 mi (19 km) of the helipad. The signal CareFlight in Bullhead City, Arizona, where he problems do not prevent pilots from contacting flew Agusta A119s in EMS operations. He was Guardian Control, however. that operator’s safety and training manager. The guidelines also instruct pilots to avoid He also had “extensive” experience in heli- noise abatement areas when possible during copter operations in the Grand Canyon and had their approaches to the helipad and to main- been a U.S. Army and Army Reserve pilot. tain an altitude of 8,000 ft mean sea level over Flagstaff. The guidelines specify that simultane- Helipad Guidelines ous operations are not conducted, and that, if The FMC helipad, at an elevation of 7,016 ft, is two helicopters are approaching at about the on the roof of the hospital emergency depart- same time, the first should land on the southern ment, at the southeast corner of the hospital. In side of the helipad and move to the parking area 1999, the hospital implemented its Guidelines of on the north side to make room for the second. Practice for helipad operations. Alternative guidelines call for the first helicopter www.flightsafety.org | AeroSafetyWorld | July 2009 | 35 HelicopterSafety
to “hot drop” its patient — unload the patient TCAS was not required, the report said, “had without shutting off the engine — and then fly such a system been on board, it likely would to FLG to allow the second helicopter to land. have alerted the pilots to the traffic conflict so they could take evasive action before collision.” The First Time The transportation coordinator (TC) at Guard- No Contact ian Control said that the accident flight marked In addition, the report said, if the Classic pilot the first time in her 1 ½ years in that job that a had contacted the FMC communications center, Classic pilot failed to notify her that he was ap- the FMC transportation coordinator “likely proaching FMC. would have told him directly that another air- The Classic Control dispatcher, who had craft was expected at the helipad. If the pilot had worked for Classic since September 1997 and known to expect another aircraft in the area, had been a supervisor since 1999, told inves- he would have been more likely to look for the tigators that all three Classic aircraft had been other aircraft.” dispatched on the day of the accident and that The Classic pilot, approaching the helipad he had handled all three flights. from the northeast, likely was visually scanning the “At 1532, the pilot of Lifeguard 2 gave a … typical flight paths described in the FMC approach position report via the on-board radio,” the and noise abatement guidelines and did not see the report said. “The dispatcher acknowledged the Guardian helicopter, which was approaching from call but did not inform the pilot of the inbound the south — and not on a typical path. Air Methods helicopter. He said, ‘We normally “At the time of the collision, both pilots were would notify our aircraft about another heli- at a point in the approach where their visual at- copter that was inbound at the same time.’ At tention typically would have been more focused “If the pilot had that time, he said he was unconcerned because on the helipad in preparation for landing, rather the Guardian Control TC had told him that she than on scanning the surrounding area for other known to expect would notify the pilot of Lifeguard 2 of the other traffic,” the report said. “Nevertheless, the pilots inbound helicopter. In addition, he knew the were responsible for maintaining vigilance and another aircraft in Lifeguard 2 pilot was ‘so anal’ about contacting to see and avoid other aircraft at all times.” the area, he would Guardian Control prior to landing at FMC.” The report reiterated four NTSB safety recom- Investigators had the Classic dispatcher mendations issued to the FAA in 2006, including have been more listen to a recording of his 1523 telephone one that called on the agency to require operators conversation with the Guardian Control TC. Af- to install TAWS in all EMS aircraft and ensure that likely to look for terward, the Classic dispatcher said that he was crews are adequately trained in its use. the other aircraft.” “amazed” not only that he had not remembered The three other recommendations involved the Air Methods helicopter’s correct arrival actions that had been in place for the accident time at FMC but also that he had “incorrectly flights: requiring EMS operators to comply with remembered his conversation with the Guardian Part 135 requirements — instead of the more Control TC about who was supposed to advise lenient weather minimums for Part 91, “General Lifeguard 2” about the presence of the Air Operating and Flight Rules”; to implement flight Methods helicopter. risk evaluation programs; and to use formal The Classic 407 had a global positioning dispatch and flight-following procedures. system that included a terrain awareness and The NTSB has placed four related safety warning system (TAWS), the report said. The recommendations, all dealing with EMS opera- Air Methods 407 was not equipped with TAWS, tions at night, on its “Most Wanted List of Safety and TAWS was not required. Improvements.” Neither helicopter had a traffic-alert and This article is based on NTSB accident report collision avoidance system (TCAS). Although DEN08MA116A and supporting documents.
36 | flight safety foundation | AeroSafetyWorld | July 2009 infrastructure
By David Bjellos
Early adopters — including corporate operators — take an optimistic view of the near-term benefits of ADS-B. Practical Necessity
he next decade will bring move to a new air traffic management in countries and regions including profound changes in the way paradigm, ADS-B can deliver near- Australia, China, Europe, Fiji, India and corporate aircraft operators begin term safety benefits, and often cost Russia.1 to share a more scheduled and savings, in each phase of flight. In about 12 months, 340 ADS-B Tpredictable U.S. National Airspace In the United States, a major push ground stations — about half of the System (NAS) with air carriers, and all is under way for the ADS-B-based eventual U.S. system — will be in place, flight crews take on new responsibili- Next Generation Air Transportation FAA Administrator Randy Babbitt said ties. Although many operators have System (NextGen) to be fast-tracked, in June, emphasizing that NextGen yet to be persuaded that the time has much like the country’s Interstate must be accelerated through many suc- come to invest in automatic dependent Highway System in the 1950s. Urgency cessful flight demonstrations of ADS-B surveillance–broadcast (ADS-B) tech- about ADS-B equipage among opera- to build user confidence that major nology, the U.S. Federal Aviation Ad- tors would help make the transition to investments in avionics and training ministration (FAA) and many industry NextGen’s aircraft performance-based will have tangible returns for corporate leaders see voluntary aircraft equipage navigation infrastructure as seamless operators and other industry stake- as a major step to be accomplished as as possible. The global context includes holders. Data from flight operations
© Chris Photography Sorensen soon as possible. As part of a worldwide early adopter civil aviation authorities with ADS-B and required navigation
www.flightsafety.org | AeroSafetyWorld | July 2009 | 37 infrastructure
performance (RNP) area navigation specify ADS-B for their new aircraft National Transportation Safety Board’s (RNAV) will help make the NextGen and to retrofit existing aircraft. “most wanted” safety improvements results measurable.2 says, among measures to improve run- As of mid-July, the latest proposal Seeing Like ATC way safety, that aircraft systems should to fund the FAA’s activities during fiscal Essentially, ADS-B takes flight crew “give immediate warnings of probable year 2010 included significant direc- confidence to a higher level by provid- collisions/incursions directly to cockpit tives on ADS-B. If the bill is enacted ing unprecedented positioning accura- flight crews.” in its present form, Congress would cy in congested airspace, enabling clear UPS Airlines flight crews arriving require the FAA to develop a plan to and immediate recognition that a con- at the company’s Louisville, Kentucky, provide runway incursion information flicting aircraft is maintaining its flight U.S., hub routinely adhere to accurate directly to pilots in the cockpit and path, turning, climbing/descending or and predictable separation criteria accelerate implementation of NextGen accelerating/decelerating. The value of based on Mode S transponders upgrad- technologies — specifically, integration this information will become evident, ed to add ADS-B. Using merging and of ADS-B Out on all aircraft by 2015 especially for those operating in today’s spacing software functions on Class and ADS-B In on all aircraft by 2018, most challenging U.S. environments 3 EFBs, the crews track, capture and and of RNP RNAV at the 35 busiest — such as those in the Northeast, Los maintain precise in-trail spacing with U.S. airports by 2014 and throughout Angeles basin and Dallas/Fort Worth other company aircraft in all weather the NAS by 2018.3 metropolitan areas — and will continue conditions (ASW, 11/07, p. 44). Corporate aircraft could adapt quick- while further increases in air traffic Separation responsibility shifts dur- ly to ADS-B and assimilate into NextGen density occur as projected. ing these arrivals from FAA controllers airspace — and its Single European By 2020, adoption of NextGen to the UPS flight crews. When in- Sky Air Traffic Management Research technologies will support safe ground structed by air traffic control (ATC) to (SESAR) counterpart — but fewer than and airborne separation despite the merge with another aircraft, the flight 100 aircraft currently are equipped to do traffic growth in the United States and crew enters on the EFB the number of so. The corporate fleet lags behind com- many other countries. Even before the minutes or seconds to follow in-trail. mercial carriers in ADS-B equipage; cost FAA’s 2010–2013 completion of the Once the target ship has been acquired, of retrofit, implementation methods and ADS-B ground station infrastructure, the own-ship speed command continu- airline demand for avionics are key issues early adopters can expect significant risk ously indicates the fast/slow trailing for corporate aviation. reduction in parts of the NAS. speed trend for pilot monitoring. The Several ADS-B-equipped corporate Enhanced safety on airport surfaces functions work in conjunction with an jet aircraft already are operating, with ranks as the most compelling argument RNP RNAV continuous descent arrival, more U.S. corporate operators adding for rapid adoption. With ADS-B and and with a cockpit moving map display. ADS-B this year. By comparison, opera- cockpit display of traffic information As of mid-2009, another of several tors of Boeing Commercial Airplanes (CDTI), flight crews track the move- NextGen test programs was under and Airbus types have installed ADS-B ment of the own-ship, other aircraft way. US Airways began using Aviation on roughly 40 to 50 percent of the U.S. and vehicles, and electronic flight bag Communications and Surveillance Sys- airline fleet, and some data show the (EFB) software alerts the flight crew to tems’ SafeRoute software applications percentages for non-U.S.-registered potential conflicts with traffic, immi- for merging and spacing, surface area airliners to be higher. nent runway incursions and runway/ movement management, CDTI, CDTI- Avionics manufacturers have made taxiway misidentifications. assisted visual separation and continu- major investments developing equip- If a runway is occupied and a flight ous descent arrivals. Under a two-year ment with fleet-type commonality crew approaches a taxiway hold line, for contract, the airline will install ADS-B that provides airlines a reasonable example, the runway area on the EFB Out and ADS-B In upgrades/new return on investment from fuel savings display turns yellow. If they proceed avionics and Class 2 EFBs on as many and reduced block times. The largest past the hold line, the runway display as 20 Airbus A330s, develop standards corporate-aircraft manufacturers also turns red, accompanied by an aural and prototypes, conduct flight demon- currently see operators beginning to warning. The 2009 edition of the U.S. strations at Philadelphia International
38 | flight safety foundation | AeroSafetyWorld | July 2009 infrastructure
Airport (PHL) and provide data from line operations to the FAA. ATC facilities at PHL are scheduled to add ADS-B in February 2010.4 ADS-B in the United States emerged from validation trials in 2001–2007 during the FAA’s two-phase Capstone Project in Alaska and other research. The project confirmed for U.S. and European regulators that pilots safely could maintain 3 nm to 5 nm (5.6 km to 9.3 km) separation. In August 2007, the FAA agreed to accelerate the installation of 38 ADS-B ground stations if the government of Alaska and indus- try associations independently raised funds to help equip 4,091 Alaskan aircraft over a five- year period.5
Benefit Package Stand-alone ADS-B avionics, or an ADS-B Out upgrade to almost any Mode S transponder © Ian Schofield/Airliners.net made in the past 17 years, squitters data — that ADS-B–equipped aircraft. The second — traf- Among major FAA is, broadcasts messages without interrogation fic information system–broadcast (TIS-B) — is demonstration — to other aircraft and ADS-B ground stations a free FAA service providing a more complete projects, Airbus within 200 nm (370 km). This gives an ADS-B– traffic picture in situations where some nearby A330s at US Airways equipped flight crew an accurate, near-real-time aircraft lack ADS-B Out. TIS-B enables the are being equipped view of potential aircraft and vehicle conflicts display, nominally every three to 13 seconds, of with ADS-B avionics. — and more time to perceive them and respond any aircraft with an operating Mode S or Mode — before they are detected by a traffic-alert and A/C transponder that is also within ATC radar collision avoidance system (TCAS II). or multilateration coverage. Some corporate operators question what Achieving ADS-B In capability using a they stand to gain from ADS-B compared with 1090ES transceiver for the data link may involve existing avionics — especially TCAS II (ASW, spending $55,000 to $100,000 more per aircraft 4/09, p. 34). A key point is that ADS-B Out than ADS-B Out equipage, typically to retrofit using 1090 MHz extended squitter (1090ES) the 1090 MHz receiver of an existing TCAS II. — used above Flight Level 240 (approximately Operators of these aircraft will begin receiving 24,000 ft) — is about 10 times more accurate TIS-B data at a later stage of the FAA’s ADS-B than the transponder data used by TCAS II. implementation. The FAA has yet to propose a requirement Similarly, an operator that meets FAA cri- for ADS-B In, but operators that voluntarily teria to use the lower-cost 978-MHz universal install a transmitter/receiver or transceiver to access transceiver (UAT) technology for ADS-B receive ADS-B messages gain optimal situ- Out voluntarily can install a UAT transceiver ational awareness. Unlike TCAS II, no recom- and multi-function display to provide ADS-B In. mended avoidance maneuvers are provided or This allows flight crews to receive the messages authorized as a direct result of an ADS-B display from other ADS-B–equipped aircraft, TIS-B or an ADS-B alert. ADS-B In does provide service and the flight information system– two advisory aids to visual acquisition. The broadcast (FIS-B) service. The FIS-B service primary aid is once-per-second CDTI updates, — comprising aviation routine weather reports, based on the data received directly from other special aviation reports, terminal area forecasts www.flightsafety.org | AeroSafetyWorld | July 2009 | 39 infrastructure
and next-generation radar (NEXRAD) precipi- future operations at a major airport gives a sense tation maps — also operates at the nominal 200 of what is in store.7 nm line-of-sight distance from any ground- At the flight planning stage, the algorithms based transceiver in the FAA’s ADS-B network. built into NextGen and SESAR will be capable Eleven ADS-B ground-based transceivers in of customizing departure routes and down- Florida currently broadcast TIS-B and FIS-B loading them directly to a flight management data, for example. system based on the flight crew’s pre-departure clearance request, and communicating operator Electronic flight bags Flying With ADS-B flight path intent. or multi-function Consistent with safe practices and assimila- For airport surface movement, from engine displays typically tion into the NAS, the FAA plans to provide air start to takeoff, airport surface detection equip- are used for ADS-B– traffic services on a “best equipped, best served” ment, model X (ASDE-X), will remain the criti- based cockpit display basis during ADS-B implementation.6 A look at cal infrastructure for ATC to reduce risk while of traffic information. benefits by phase of flight during hypothetical controlling aircraft and ground vehicles. Small Mode S transponders on all ground vehicles will identify them for ready observation by flight crews and ATC. Tracking will be accomplished partly by surface radar and ADS-B backed up by multilateration systems using a network of ground sensors.8 Before the taxi phase, the flight crew typi- cally will receive electronically the entire ATC clearance for taxi, takeoff, a precise departure flight path and the assigned route, called the flight path trajectory route. The flight crew also will select the transponder “ON” to reply to Mode S interrogations and broadcast ADS-B messages during taxi, with those settings re- tained until engine shutdown at the destination airport. Just before takeoff, the ATC terminal flow management system will assign a calculated takeoff time for the most efficient spacing. During the en route phase, the flight crew will fly the RNP RNAV departure route that — based on the preflight departure clearance request — typically will have been tailored specifically to their preferred route and initial heading. The EFB also will tap NextGen’s four- dimensional weather data cube system to dis- play the latest available weather data, including continuous monitoring of physical dimensions and predicted times of weather activity. Also during en route operation, the FAA’s enhanced integrated traffic management adviser software automatically will help controllers re- route the flight crew around significant weather © Chris Sorensen Photography using ADS-B Out messages from each aircraft
40 | flight safety foundation | AeroSafetyWorld | July 2009 infrastructure
and controller-pilot data link commu- whether used as a runway incursion ACSS. “SafeRoute: ADS-B Solutions for nications. The newly assigned course, countermeasure or for accurate ATC Approach and Taxi.”
Thorough ditching training is not mandated for U.S. civilian airplane crews, but some specialists envision benefits from simulator exercises.
BY ROBERT W. MOORMAN
itching is the short term for training beyond what is now required Several training organizations an intentional and controlled by U.S. Federal Aviation Regulations provide post-ditching training, but emergency landing on water. (FARs). Basically, pilots of all large pre-ditching simulator training for U.S. Interest in what the flight crew and turbine-powered multi-engine commercial airline pilots appears to be andD cabin crew of an airliner should do airplanes currently must only be fa- nonexistent. Several air carriers con- before and after ditching resurfaced at miliar with the emergency equipment tacted said they practice elements of a the U.S. National Transportation Safety aboard the airplane such as life vests ditching scenario but not the ditching Board (NTSB) June 9–10 public hear- and life rafts; no specific ditching maneuver itself. “There are several rea- ing on the widely reported mid-January training is required. For crewmem- sons for this, the most relevant being 2009 ditching of US Airways Flight bers engaged in fractional ownership, that there is no commercial simula- 1549, in which all occupants of the on-demand, commuter and air carrier tion available for a realistic sea surface, Airbus A320 survived. operations, there must be instruc- particularly the swells and the firmness It remains to be seen whether tion on the use of ditching equipment of the water surface,” said Bill Johnson, NTSB will recommend that the U.S. and in the performance of ditching director of flight training for Alaska Federal Aviation Administration procedures, as well as ditching drills Airlines. “In other words, simulators 1 (FAA) mandate specific ditching or demonstrations. simulate ground contact, not water Airlines© Condor
42 | flight safety foundation | AeroSafetyWorld | July 2009 AircraftRescue
[contact], and any training to touchdown would what’s going on, and maintaining level flight as actually be negative training.” well as a low descent rate.” CAE, a provider of simulators and training Techniques and procedures are recom- solutions, offers “theoretical procedures” for mended. “You have to consider the direction ditching large commercial jets, but the simula- in which the swells are going,” said Jennifer tion software available only takes the flight crew Ewald, a first officer for American Airlines and to the “point of contact with the water,” said spokeswoman for the Allied Pilots Association. CAE spokesman Chris Stellwag. That point was emphasized in a 660-page special Alteon, a unit of The Boeing Co., does not report on overwater operations safety published offer specific ditching training for pilots but in 2004 by Flight Safety Foundation. The report provides emergency procedures training, the included a detailed discussion of ditching pro- company said. cedures and considerations, concluding that the Johnson said that Alaska Airlines trains its primary consideration is: Don’t land into the face pilots for specific emergencies that might force of a swell.2 them to ditch. For example, the airline’s recur- Another recommendation for ditching rent training updates for 2010, introduced in preparation, said Ewald, is to closely follow the January, involve losing thrust from both engines drift-down charts, which are unique to each because of volcanic ash and obtaining maxi- aircraft. The charts tell what power setting to mum glide performance while attempting to use to conserve fuel — if any power is still avail- relight the engines. able — as well as the correct angle-of-attack. Some airlines review ditching procedures Weight of the aircraft, altitude and outside air and the related flying techniques and principles temperature are all factored into extending the in the classroom. “Basically, it comes down to a glide path of the aircraft. few things pilots need to remember,” said Tom Hull, Alaska’s flight operations instructor, “such Unified Approach as 10-degree to 12-degree nose-up attitude Specific ditching training for airline flight at- before touchdown, notifying the cabin crew of tendants and cabin instructors in recent years has dealt with evacuation and survival. But Ditching training lately, pilots also have been participating in for Condor Airlines special programs independent of the initial and crewmembers recurrent training requirements for flight crew includes open water — sometimes participating in new-hire training (above) and simulator of flight attendants. experience. Condor Airlines, a German charter airline, for several years had offered post-ditching and survival training only for cabin crew in con- junction with the German navy. The training program now includes pilots. “We changed the program to add the pilots and to include aspects of handling the aircraft prior to ditching, as well as to improve communication among the crew,” said Condor’s Dietrich Langhof, a captain and flight safety and security standards man- ager who leads the three-day course. Condor inserted two chapters on ditching in its safety manuals, and the information is discussed dur- ing the course. www.flightsafety.org | AeroSafetyWorld | July 2009 | 43 AircraftRescue
The extended operations (ETOPS) Sea and to board the type of 46-person pilot training given every two years life raft carried on airliners used in by Condor’s training department also overwater operations. Afterward, they are simulates a double engine failure, but “rescued” by a boat or helicopter. the flight crew does not conduct a Since 2002, Condor has conducted simulated water landing. Neverthe- the ditching and survival course for its For added realism, less, the three-day course and the flight crews and those of several other Condor trainees are separate ETOPS training go a long way airlines, including British Airways and “rescued” from a to “changing the mindset of the pilots Hawaiian Airlines. As to flight simula- life raft by a to a belief that ditching a commercial tor training for ditching: “It’s hard to helicopter lift. airliner in the ocean is survivable,” find anything,” Langhof said. “Many Langhof said. airlines have a ditching checklist, but On the first day of Condor’s three- there is often no time set aside to prac- day course, students arrive in Cuxhaven tice in a simulator.” on the northern coast of Germany for Langhof said he is disappointed, an introduction and training materi- but not surprised, that there has not als. Day two consists of classroom and been an increase in ditching train- swimming pool training at the German ing for pilots over the years. If the Air the airline does not offer pre-ditching naval air wing in nearby Nordholtz. Transat A330 had been ditched in the simulator training for pilots. Classroom topics include a “cold can kill” ocean, rather than landed powerless Langhof and other trainers believe segment covering hypothermia, search at an island airbase, in August 2001, “I that pre- and post-ditching training and rescue (SAR) procedures, theory of guarantee we would have seen changes might have helped the flight crew of survival, and a presentation on leading in the regulations,” he said. Tuninter Flight 1153, an ATR 72 that and organizing SAR operations. Stu- The crew of Air Transat Flight 236 crashed in the ocean off the coast of dents learn to use survival equipment, glided 85 nm (157 km) to a land- Sicily after running out of fuel in Au- including how to fire flare guns. ing in the Azores after both engines gust 2005 (p. 26). Langhof said that the In the afternoon, students go to flamed out over the Atlantic. The cockpit voice recording indicated a lack the pool, where they learn the general A330, en route to Lisbon, Portugal, of coordination and ditching prepara- principles of egress from a submerged from Toronto, had developed a leak tion by the flight crew.3 aircraft. They are taught to maneuver in the fuel line of the right engine. in the water while wearing a cumber- When the pilots noticed a fuel imbal- Training Needed? some helicopter crewmember helmet ance, they opened a crossfeed valve to The rarity of a large commercial jet and life vest, as well as how to delay transfer fuel from the left tank to the ditching has been another reason the onset of hypothermia. This type right tank. The procedure compound- why flight crew simulator training for of survival training covers techniques ed the problem, however, and fuel such an event is not a high priority for such as the heat-escape-lessening exhaustion resulted. airlines. “One of the reasons there has posture (HELP). To assume the HELP The incident prompted the French been foot-dragging on this issue is that position, students wearing a life vest Direction Générale de l’Aviation Civile there has been only a handful of [air cross the inner sides of their arms and the FAA to issue an airworthiness carrier] aircraft in the last 50 years that against their chest, hold their thighs directive requiring operators of specific have actually ditched,” Alaska’s Hull together and raise their legs to protect Airbus models to revise their flight said. the groin area from the cold. manuals to direct flight crews to check During its research on overwater Early in the morning of day three, if a fuel imbalance is due to a leak be- operations safety, the Foundation students board a German navy ship near fore opening the crossfeed valve. identified from available data from Hamburg for open-sea training. They Air Transat said that it has of- Jan. 1, 1976, to July 8, 2003, nearly 500 wear immersion suits to enable them to fered post-ditching training since the ditching accidents worldwide involving safely experience immersion in the North company’s inception in 1987. However, airplanes ranging from small piston
44 | flight safety foundation | AeroSafetyWorld | July 2009 AircraftRescue
singles to large multi-engine transports.4 The several of FSI’s customers have asked about bottom line, according to the Foundation’s getting specific ditching training for fixed-wing special report, is: “Believing that a ditching can’t aircraft, Bedard said. happen or won’t happen is not supported by New requirements for ditching train- data.” ing might be adopted by the FAA, which has Had the ditching of US Airways Flight 1549 proposed revisions of FARs Part 121 training ended badly, there likely would be a clarion call requirements in Subparts N and O (ASW, 4/09, for ditching-related simulator training, said Hull p. 39). The notice of proposed rule making and other trainers. (NPRM) includes performance training on Nevertheless, ditching training is getting survival equipment, both wet and dry, and other renewed attention from academia as a result training events. It also proposes emergency of that event. “Many pilot training centers and procedures training and an observation drill on university aviation programs are rethinking how the deployment, inflation and detachment of they might add or improve ditching training in evacuation slide-rafts. their curricula,” said Richard Fanjoy, associate The proposed performance standards are © Condor Airlines© Condor head for graduate education in the Department appropriate to each crewmember’s task in the of Aviation Technology at Purdue University. ditching, and the frequency requirements for Fanjoy is among those who agree with recurrent training are different for pilots and Alaska’s Johnson that simulator limitations have flight attendants. The NPRM notably does not precluded such revisions. “Unfortunately, the propose flight simulator training on ditching; it visual and motion aspects of modern flight refers only to emergency procedures and pre- simulators just do not do a good job of realisti- paring the aircraft for ditching — training that cally presenting a ditching flight condition,” said already is offered by many airlines. Fanjoy. The NTSB investigation of the Flight 1549 The lack of software to adequately simulate accident may or may not contain specific new ditching in fixed-wing aircraft is the main prob- recommendations for ditching training of flight Passengers lem. “[Unlike] helicopter training for offshore crew and cabin crew. But the ditching of the await rescue operators, there is nothing [suitable] in the A320 on the Hudson River by Capt. Chesley after evacuating fixed-wing world,” said Rick Bedard, director of Sullenberger and First Officer Jeffrey Skiles, US Airways training operations for FlightSafety Internation- and the evacuation organized by the cabin crew, Flight 1549. al (FSI). Since the Flight 1549 accident, however, could yield new best practices. “We are looking at using as much as we can from US Airways Flight 1549 [for classroom training] because it was a great example for everyone,” said Alaska’s Hull.
Robert Moorman has written about various aspects of the aviation business for over 25 years.
Notes
1. U.S. FARs Part 91.505, 91.1083, 135.331 and 121.417.
2. FSF Editorial Staff. “Waterproof Flight Operations.” Flight Safety Digest Volume 22 and 23 (September 2003–February 2004).
3. A portion of the cockpit voice recorder recording has been published on the Internet by YouTube at
www.flightsafety.org | AeroSafetyWorld | July 2009 | 45 Corporate Flight Operational Quality Assurance C-FOQA
A cost-effective way to measure and improve training, procedures and safety
Using actual performance data to improve safety • Appropriate use of stabilized-approach by identifying: procedures; and • Ineffective or improper training; • Risks not previously recognized. • Inadequate SOPs; • Inappropriate published procedures; Likely reduces maintenance and repair costs.
• Trends in approach and landing operations; Accomplishes a critical Safety Management System For more information, contact: • Non-compliance with or divergence from SOPs; step and assists in achieving IS-BAO compliance.
Jim Burin Director of Technical Programs E-mail: [email protected] Tel: +1 703.739.6700, ext. 106 DataLink © draganm /Fotolia.com Route Causes For helicopters, the journey — not the destination — holds the greatest risk.
BY RICK DARBY
he largest percentage of European helicop- use in 2007.3 A total of 16 fatal civil helicopter ter accidents in 2000–2005 studied by the accidents occurred in 2007, compared with 14 European Helicopter Safety Analysis Team in 2006, the report says. (EHSAT) occurred in the en route phase EHSAT regional teams familiar with the Tof flight.1 That contrasts with fixed-wing com- languages of the accident reports and the local mercial air transport operations, where the most context analyzed the accidents. The teams’ judg- recent European Aviation Safety Agency (EASA) ments were based on, but not identical with, Regional teams annual safety review reported that approach the official reports by accident investigation and landing accidents represented the highest authorities. familiar with the percentage.2 The EHSAT preliminary report database languages of the EHSAT is a component of the International included accidents occurring within EASA
Helicopter Safety Team and part of the Europe- member states, and defined according to the accident reports an Strategic Safety Initiative, a 10-year program International Civil Aviation Authority (ICAO) involving EASA, some national civil aviation Annex 13, Aircraft Accident and Incident and the local authorities and many other aviation organiza- Investigation. Only accidents for which a final tions. “Analysis of occurrence data, coordination investigation report had been issued were context analyzed with other safety initiatives and implementation included. the accidents. of cost-effective action plans are carried out to The database included 186 accidents. Of achieve fixed safety goals,” the report says. those, 40, or 22 percent, involved commercial It was estimated that about 6,860 helicopters air transport. General aviation represented were registered in EASA member states for civil the largest percentage, 39 percent, followed www.flightsafety.org | AeroSafetyWorld | July 2009 | 47 DataLink
accidents and 9 percent of aerial work op- Injury Levels, European Helicopter Accidents, 2000–2005 erations accidents, the pilot-in-command had fewer than 100 hours in type, the report says. So that its work will be comparable to that None (43%) performed by other teams worldwide, EHSAT uses standardized codes for factors judged to Fatal (25%) have been involved in the accidents. The codes are derived from two models: Serious (17%) • The standard problem statements (SPS) taxonomy was inherited from the Inter- Minor (15%) national Helicopter Safety Team and the U.S. Joint Helicopter Safety Analysis Team. Note: Data are based on 186 civil aviation helicopter accidents analyzed by regional teams The report says, “The structure consists of the European Helicopter Safety Analysis Team. Accidents occurred in European Aviation Safety Agency member states. of three levels: The first level identifies the
Source: European Helicopter Safety Analysis Team main area of the SPS, and the second and third levels go into more detail.” Figure 1 • The Human Factors Analysis and Clas- sification System (HFACS), developed to European Helicopter Accidents, by Phase of Flight, 2000–2005 encourage cross-study compatibility, was developed from James Reason’s theories In hover s
t of latent and active failures. The report
n Not in hover e
d says, “The HFACS model describes human i c c
A 17 error at four levels: organizational influ-
f o
64 14
r ences, unsafe supervision, preconditions e b 11 for unsafe acts and the unsafe acts of m 30 u 24 N 3 17 operators.” 6 Standing Taxi Takeo En route Maneuvering Approach Level 1 SPS categories were tabulated for the and landing 186 accidents in the database (Figure 5, p. 50).
Note: Data are based on 186 civil aviation helicopter accidents. “Pilot judgment and actions” topped the list of
Source: European Helicopter Safety Analysis Team categories, identified in 68 percent of the ac- cidents. “Safety culture/management” was next Figure 2 most frequent, in 48 percent, followed by “pilot situation awareness” in 38 percent. by aerial work, 35 percent. Nearly a third of “Pilot judgment and actions” includes accidents resulted in some degree of injury, decision making, “unsafe flight profile,” and one in four involved at least one fatality procedure implementation, crew resource (Figure 1). management and human factors. “Safety cul- Most accidents — 64, or 34 percent — oc- ture/management” concerns safety manage- curred in the en route phase of flight (Figure 2). ment systems (SMSs), training, pilot disregard Among the fatal accidents, 68 percent occurred of a known safety risk, self-induced pressure in the en route phase (Figure 3). The helicopter and pilot experience. “Pilot situation aware- was hovering in 24 percent of accidents in all ness” covers in-flight factors such as reduced phases. visibility and external obstacle or hazard Pilot experience in the accident helicopter awareness. type was weighted toward low time (Figure “The highest level of SPS, Level 1, only pro- 4). In 14 percent of commercial air transport vides information on a general level,” the report
48 | flight safety foundation | AeroSafetyWorld | July 2009 DataLink
says. “To better understand what kind of factors These errors represent conscious and goal- played a role in the accident data set, one must intended behavior. look at a deeper level in the taxonomy” — Level “Skill-based errors, on the other hand, are 2 (Figure 6, p. 50). errors that occur with little or no conscious From Level 2 SPS, it appears that the main thought, such as inadvertent operation of factors identified lie in the human factors switches and forgotten items in a checklist. domain. “Pilot’s decision making,” “mission These errors were identified in 28 percent of the planning” and “external environment aware- errors. … Violations, willful disregard of rules ness” were identified most frequently by EHSAT and regulations, were identified in 16 percent of in the accident data set. unsafe acts.” The prevalence of human factors findings led EHSAT researchers to adopt the HFACS European Helicopter Fatal Accidents, by Phase of Flight, 2000–2005 model for further understanding, the report says. For the 186 accidents in the database, a Standing (1) total of 445 HFACS factors were counted, and in Takeo (2) 78 percent of the accidents, at least one HFACS Approach (2) factor was found. Landing (5) “In most accidents, unsafe acts or precondi- tions were identified,” the report says (Figure 7, Maneuvering (5) p. 51). “For the lowest level in the model [the En route (32) results of latent causal factors], the unsafe acts, 84 percent of the identified factors concerned errors: activities that failed to achieve their intended outcome. Most errors were identified as … judgment and decision making errors, Note: Data are based on 186 civil aviation helicopter accidents. such as poorly executed procedures, improper Source: European Helicopter Safety Analysis Team choices or misinterpretation of information. Figure 3
Pilot-in-Command Flight Experience, European Helicopter Accidents, 2000–2005
Experience in accident helicopter type in hours Experience in accident helicopter type in hours 0–1,000 ight hours only
120 45 40 100 s s t
t 35 n n e e d 80 d 30 i i c c c c a
a 25
f 60 f o o
r
r 20 e e b 40 b 15 m m u u N N 10 20 5 0 0 0–1,000 1,001–2,000 2,001–3,000 3,001–4,000 4,001–5,000 >5,000 0– 101– 201– 301– 401– 501– 601– 701– 801– 901– 100 200 300 400 500 600 700 800 900 1,000 Number of ight hours Number of ight hours
Note: Data are based on 155 civil aviation helicopter accidents, a subset of 186 such accidents.
Source: European Helicopter Safety Analysis Team
Figure 4 www.flightsafety.org | AeroSafetyWorld | July 2009 | 49 DataLink
Level 1 SPS Categories Identified in European Helicopter Accidents, 2000–2005
Percentage of accidents Pilot judgment and actions 68 Safety culture/management 48 Pilot situation awareness 38 Data issues 35 Ground duties 35 Mission risk 28 Part/system failure 24 Regulatory 20 Post-crash survival 16 Maintenance 15 Aircraft design, systems and equipment 13 Communications 8 Infrastructure 8 Ground personnel 2
SPS = standard problem statements, a taxonomy Note: SPS Level 1 is the most general level. Data are based on 186 civil aviation helicopter accidents.
Source: European Helicopter Safety Analysis Team
Figure 5
Level 2 SPS Categories Identified in European Helicopter Accidents, 2000–2005
Percentage of accidents
Human factors — pilot's decision making 31
Mission planning 29
External environment awareness 25
Flight pro le unsafe 20
Landing procedures 20
Inadequate pilot experience 19
Mission risk — terrain/obstacles 18
Procedure implementation 16
Visibility/weather 16
Human factors — other 15
SPS = standard problem statements, a taxonomy Note: Data show the top 10 SPS Level 2 categories. SPS Level 2 is more specific than Level 1. Data are based on 186 civil aviation helicopter accidents.
Source: European Helicopter Safety Analysis Team
Figure 6
50 | flight safety foundation | AeroSafetyWorld | July 2009 DataLink
“Preconditions for unsafe acts,” the next higher HFACS level, represent latent factors HFACS Levels Identified, European Helicopter Accidents, 2000–2005 that enable or encourage unsafe acts. The report says that 60 percent of the preconditions in the Organizational influences accident database were individual rather than 10% institutional. They included “overconfidence, channelized [narrowly focused] attention, Unsafe supervision ‘press-on-itis,’ inattention, distraction, misper- 17% ception of operational condition and excessive motivation.” Personnel-related factors, such as mission planning, accounted for 23 percent of Preconditions for unsafe acts preconditions. Environmental factors, such as 56% restricted visibility, represented 17 percent of preconditions. “Latent failures of middle management” Unsafe acts were found in 17 percent of the accidents in 53% the database — the next higher HFACS level, called “unsafe supervision.” Of these super- vision problems, 59 percent were labeled HFACS = Human factors analysis and classification system “planned inappropriate operations,” such as Notes: HFACS levels range from the most remote causal factors (top level) to the most immediate (bottom level). Percentages represent the proportion of accidents where the failure to adequately evaluate mission risks HFACS level was identified at least once. or inadequate risk assessment programs. The Data are based on 186 civil aviation helicopter accidents. other 41 percent came under the heading of Source: European Helicopter Safety Analysis Team “inadequate supervision,” consisting of factors Figure 7 such as inadequate oversight and lack of pol- icy or guidance. No cases were identified of specific missions — for example, mountain “failure to correct known problem” or “super- operations; better training for specific operat- visory violations,” which if they had occurred ing environments, such as inadvertent entry would have been categorized as “inadequate into instrument meteorological conditions; supervision.” risk assessment training; promoting safety In 10 percent of the accidents, “organiza- culture and introduction of [SMSs]; increase tional influences,” the top level, were identified. of obstacles awareness; requirements for flight Of these, 64 percent were classified as “organiza- data recording; [and] establishment of training tional process,” which included issues related to requirements for aerial work operational crew procedural guidelines and publications, as well other than flight crew.” as doctrine. A further 24 percent were classified Notes as “organizational climate,” and the remaining 12 percent came under the heading of “resource 1. EHSAT. “Preliminary Results of Helicopter Accident management.” Analysis.” April 20, 2009. Available via the Internet at EHSAT regional teams were asked to de-
www.flightsafety.org | AeroSafetyWorld | July 2009 | 51 InfoScan Erring on the Safe Side Organizations need to distinguish among inadvertent error, at-risk behavior and deliberate noncompliance.
BOOKS that might have ultimately contributed to the The Perfect Is the Enemy of the Best adverse outcome,” Marx says. No one wants to be punished. No one wants Whack-a-Mole: The Price We Pay for Expecting Perfection to contribute to an accident. So why do people Marx, David. Plano, Texas, U.S.: By Your Side Studios. 221 pp. References, index. keep violating rules they are aware of and com- mitting errors that someone has already been hack-a-Mole” is an arcade and elec- penalized for? tronic game. The mole, a burrowing Does a mistake mean, Marx asks, “that “Wanimal, pokes its head out of a hole we’re all unintelligent or unprofessional, or and the player tries to “whack” it with a paddle perhaps just too lazy to give it our full effort? before it disappears back into the ground, only No. It simply demonstrates our human fallibil- to reappear at another hole. ity — even in the face of a relatively simple Too much of the effort to improve safety task of little consequence. We are not perfect resembles the whack-a-mole game, says Marx, a machines.” systems engineer. We try to find a visible actor “To err is human” is an indisputable cliché, who made an error that contributed to the acci- but Marx says that there are additional, more- dent, and punish that individual. “Bad outcome subtle reasons that people act in ways that go must mean bad actor,” he says. “Whack that bad counter to safety. actor and the game is won.” But another person For one thing, the evaluation depends on committing the same, or a similar, error pops up whether you are the doer or the observer. If you at a different location. are the doer, you believe you can judge whether “While we’ve learned in the game to lie in wait the extra risk you take is serious or negligible. for the adverse event to pop up, ready to strike You can calculate whether the odds are with you when we see the harm occur, we have largely giv- when you continue driving through the inter- en up on accountability for our personal choices,” section as the traffic light changes from green he says. “The game has made our performance to yellow. You know that you should unplug an all about the outcome.” Not only does reacting electrical appliance by grasping the plug at the mainly to outcomes offer minimal benefits in socket, not from several feet away by yanking on the big picture, Marx says, but it contributes to the cord. But which of us could take an oath that complacency because less than optimal behavior we have never disconnected the vacuum cleaner usually doesn’t lead to harmful consequences; it by pulling on the cord? just worsens the odds slightly. But when those “Or we observe and decide that the in- odds are multiplied by many flights and flight creased risk is not worth the reward,” Marx says. hours, the accident rate increases. “While our friend engaged in the behavior may “We spend far too little time addressing the see it differently, we label it ‘at-risk,’ a label that system design that got us there and the behav- implies a difference of opinion on the trade ioral choices of the humans in those systems between risk and reward.”
52 | flight safety foundation | AEROSafetyWorld | JuLY 2009 InfoScan
Sometimes observers expect us to take on a “The question is whether this strategy gets us little extra risk and indicate their displeasure if where we want to be,” Marx says. “Throughout we do not. This can be easily demonstrated by this book, I make the argument that there are driving at exactly the speed limit in the fast lane really only two inputs impacting our ability to of the highway. We “should” drive at more or avoid adverse events. The first is the design of less the same pace as the other cars in the lane, the system in which we put ourselves … . The even if they are speeding … until we contribute second input is the behavioral choices of the Once there is to an accident, after which the other drivers will people within those systems. What we do not claim indignantly that we were going too fast. have such immediate control over are the hu- an accident or In addition, once there is an accident or man errors that we make, nor the adverse out- serious incident, serious incident, the tendency of most organiza- comes we produce, even when trying our best.” tions is to formulate a new rule prohibiting or There are two basic categories of system the tendency of restricting whatever behavior was involved. That design, Marx says: “We either take control and gets added to the list of rules, regulations, guide- ask others to comply, or we delegate an outcome most organizations lines, recommendations, best practices and help- and leave the system design to others. … In some is to formulate ful hints we are expected to know and practice. areas, particularly in high-risk industries, it’s criti- We can scarcely draw breath without consulting cal that personal preference not rule the day.” a new rule. a mental manual telling us what to do and not to He cites the crash on takeoff of American do. We aren’t even supposed to relax spontane- Airlines Flight 191 at Chicago O’Hare Interna- ously. We are told to sleep only at regular hours. tional Airport on May 25, 1979, killing all 271 Passengers on a long-haul flight should not passengers, the crewmembers and two people touch alcohol, the health experts warn. on the ground. “In the case of Flight 191, the “I have only known a few people in my life that plane’s left engine was changed 55 days before even give the impression of following all the rules,” the catastrophic loss of the aircraft,” Marx says. Marx says. “The rest of us are just trying to get by, “In their investigation, the [U.S. National Trans- just trying to get through the day without having a portation Safety Board] found that American catastrophic failure. We look at those never-ending Airlines maintenance technicians had developed requirements and recommendations, and we an alternative means for removing the engine, choose. Is it laziness? No. Is it an uncaring attitude based in part on perceived time constraints at for those around us? No. It is instead the recogni- the maintenance facility. Tragically, this al- tion that we cannot do it all. Sometimes, it’s the ternate method physically stressed the pylon recognition that the rules are inconsistent and that mounts on the wing, inadvertently fracturing to follow one requires violating another.” the attachment bolts. As the aircraft rolled down Marx believes that organizations should dif- the runway, the forces of engine thrust and the ferentiate among three categories: “Human error weight of the engine itself caused the engine to is the inadvertent action. At-risk behavior is, gen- separate from the aircraft.” erally, the knowingly non-compliant place where Marx says he has no doubt that in most there’s a difference of interpretation around the aspects of aviation operations, following the behavior, where the observed believes they are prescribed regulations, rules and procedures is still in a safe place but the observer judges other- the best way — in fact, the only way. We do not wise. The reckless behavior is the choice to con- want creative maintenance technicians design- sciously disregard a substantial and unjustifiable ing brilliant short cuts that work fine until one risk. These are three different behaviors arising day they don’t. Usually we do not want pilots to from three different causal mechanisms.” be creative in the cockpit. Emergencies might But many organizations, like many individu- sometimes be an exception, but even emer- als, have only two criteria when something bad gencies have checklists that were written by happens. How bad was it? Who was to blame? engineers and safety specialists who were able www.flightsafety.org | AEROSafetyWorld | JuLY 2009 | 53 InfoScan
to think the scenario through without hurry, make a mistake, you will be consoled. When consult with others and conduct tests. you drift into a risky place, believing that In a professional setting such as the aviation you are still safe, we will coach you. When industry, most errors do not involve conscious or you knowingly put others in harm’s way, we irresponsible violation of rules, regulations and will take appropriate disciplinary action. procedures. And Marx is skeptical of the value of — Rick Darby organizational codes of conduct that fail to make the necessary distinctions about causes of behavior. REPORTS He quotes from an actual, though de- identified, “progressive discipline policy” of one Putting TCAS to the Test major U.S. airline. While acknowledging that Illustrative Probabilities of Visual Acquisition with TCAS I: some provisions are reasonable and necessary, ACAS on VLJs and LJs — Assessment of Safety Level he sees others as promoting the whack-a-mole Eurocontrol. Edition 1.2. Feb. 9, 2009. 70 pp. Available via the approach. For example, “Any employee involved Internet at
EUROPEAN ORGANISATION ror but who notifies management in a timely he airborne collision avoidance system FOR THE SAFETY OF AIR NAVIGATION EUROCONTROL fashion (within 10 minutes of the mishap) will (ACAS) is the International Civil Aviation be disciplined as follows: For the first offense in TOrganization’s general term for on-board an 18-month period, a letter of discipline will be avionics that reduce the risk of midair collisions. Illustrative probabilities of visual acquisition with TCAS I retained in the employee’s personnel file for 18 In Europe, use of ACAS II is required for civil ACAS on VLJs and LJs – Assessment of safety Level AVAL Project months, and the employee will receive five days turbine engine airplanes with a maximum take-
CND/CoE/CNS/09-010 off without pay. Any employee involved in two off weight of 5,700 kg/12,500 lb or a passenger
Edition Number : 1.2 Edition Date : 09 February 2009 mishaps will be terminated.” seating capacity of more than 19. Status : Released Intended for : EATM Stakeholders
EUROCONTROL Mode S & ACAS Programme – Egis Avia & DSNA – AVAL Project The honest employee who would like to “The advent of very light jets (VLJs) and light confess and possibly help prevent the same kind jets (LJs), aircraft weighing less than 5,700 kg, of error from recurring in the organization will means that in the near future there may be a sig- be whacked for it. “It’s a provision that appears to nificant population of aircraft which fall outside make human error a very serious offense,” Marx the thresholds of the current ACAS II mandate to says. “Given the penalties, employees are unlikely include these aircraft,” the report says. to volunteer that they made a ‘judgment’ error.” Eurocontrol has been studying whether Alternatively, Marx says, “Surely we can cre- it would be appropriate to extend ACAS II ate a disciplinary policy that allows the station requirements to include VLJs and LJs. The manager to take action when he sees reckless project is called AVAL (ACAS on VLJs and LJs behavior, while also promoting an open learning — Assessment of Safety Level). culture around more basic human fallibility.” It has been suggested that the appropriate Many organizations where errors can have level of equipment for VLJs and LJs is traffic severe consequences are moving in the direction alert and collision avoidance system (TCAS) I, of a “just culture,” which encourages people to which provides traffic advisories on a cockpit report hazards but still maintains a reasonable ac- display, rather than TCAS II version 7.0, which countability. Marx says that such a policy — mi- provides resolution advisories (RAs) in addition nus the legal jargon — would tell the employee: to traffic advisories. TCAS I would warn of a You are a fallible human being, susceptible to collision hazard, but evasive action would de- human error and behavioral drift. As your pend on the traditional see-and-avoid principle. employer, we must design systems around The question is, how well does TCAS I work you in recognition of that fallibility. When for VLJs and LJs as a see-and-avoid aid? The errors do occur, you must raise your hand to AVAL project Work Package 8 used a compara- allow the organization to learn. When you tively simple model of visual acquisition in a
54 | flight safety foundation | AEROSafetyWorld | JuLY 2009 InfoScan
set of scenarios to quantify the probability of WEB SITES the pilot seeing a collision threat, both with and without TCAS I. Open Source The visual acquisition model described NTSB Electronic Reading Room,
includes contact information for the NTSB The first investigation led to the Chip- records management division, identification of pindale report, named after Ron Chippindale, accessibility technology for researchers with spe- chief investigator of air accidents. That report cial needs and the NTSB’s policy for submitting “determined the probable cause of the accident FOIA requests. was the decision of the captain to continue the — Patricia Setze flight at low level toward an area of poor surface and horizontal definition when the crew was One Accident, Two Interpretations not certain of their position and the subsequent The Erebus Story,
56 | flight safety foundation | AEROSafetyWorld | JuLY 2009 OnRecord Bangs and Flames Compressor stalls plague a DC-8 on initial climb.
BY MARK LACAGNINA
The following information provides an aware- controller initially gave the aircraft a heading ness of problems in the hope that they can be toward a left downwind leg for Runway 24 and avoided in the future. The information is based instructed it to climb to 3,000 ft. Although there on final reports by official investigative authori- is higher ground on a left-hand downwind, the ties on aircraft accidents and incidents. approach controller was not then aware that the aircraft had a problem climbing.” JETS Meanwhile, compressor stalls had begun to occur in the no. 2 engine. The PF initiated a Unexpected Ice Built Rapidly on Inlets rapid descent to increase airspeed above 208 kt, Douglas DC-8-60F. No damage. No injuries. the minimum control speed with two engines on the same wing inoperative. eople on the ground heard loud bangs, saw A minimum safe altitude warning was flames coming from the aircraft that was generated by the air traffic control (ATC) radar Ppassing a few miles above their heads and system as the freighter descended from 2,400 ft called the Gardaí, the Irish police. About the to 1,100 ft in 30 seconds — an average descent same time, the approach controller’s radar dis- rate of 2,600 fpm. “[The approach controller] was play showed the DC-8 entering a rapid descent. concerned that the aircraft might not make it to The 1960s-vintage freighter, of U.S. registry, the airport and gave it a heading directly toward was departing from Shannon Airport’s Runway Runway 06 at the airport, which would place it 24 the night of March 28, 2008, for a cargo flight in an obstacle-free area over the River Shannon to Qatar. The aircraft was near maximum takeoff estuary,” the report said. weight for the seven-hour flight, said the final re- Apparently anticipating that they would have port by the Irish Air Accident Investigation Unit. to shut down the no. 2 engine and that the other The DC-8 had reached 1,000 ft while climbing two engines might develop similar problems, through a cloud layer when the commander, the the crew declared an emergency and conducted pilot flying (PF), called for the flaps to be retract- the checklist for failure of all four engines. “This ed and for climb power to be set. As the flap lever entailed opening the fuel crossfeed valves [and] was being repositioned, compressor stalls began switching on all fuel booster pumps and engine to occur in the no. 1 engine. The flight crew shut anti-ice,” the report said. After the engine anti-ice down the engine and radioed the airport traffic systems were selected, the no. 2 engine stabilized, controller that they required a vector to return to and the crew restarted the no. 1 engine. All four Shannon Airport. No reason was given. engines then operated normally for the remainder “The aircraft was transferred to the ap- of the flight. proach controller’s frequency,” the report said. Apprised of the situation, the approach “At the time, the aircraft was approximately 4 controller advised the crew that they would have nm [7 km] south of the airport. The approach a 17-kt tail wind for a landing on Runway 06 and www.flightsafety.org | AEROSafetyWorld | JuLY 2009 | 57 OnRecord
offered vectors to establish the aircraft on a right The airport had a 700-ft ceiling, 7 km (4 downwind for Runway 24. The crew accepted the mi) visibility in rain and surface winds from 30 offer and conducted an uneventful instrument degrees at 16 kt. The flight crew was cleared to landing system (ILS) approach and an overweight conduct the ILS approach to Runway 34L, said landing on that runway. Postflight examinations a report issued in May by the Japan Transport revealed no damage to the airframe or engines. Safety Board. Investigators determined that ice likely had The crew established a target approach accumulated rapidly on the inlet cowlings and speed of 142 kt — 8 kt above Vref, the refer- guide vanes as the aircraft climbed through the ence landing speed. They saw the approach “As there was no cloud layer, disturbing airflow through the en- lights while descending through 1,000 ft. gines. The compressor stalls likely were the first The first officer called 500 ft above airport evidence of airframe sign of engine icing. “As there was no evidence elevation, and the captain responded that the of airframe icing, the crew were slow in recog- approach was stabilized. Recorded flight data icing, the crew were nizing the cause of the engine abnormality,” the showed that the airspeed was 142 kt and de- slow in recognizing report said. scent rate was 784 fpm. Visual meteorological conditions (VMC) At 315 ft, the captain called “minimum,” and the cause of the prevailed at the airport, with no precipitation. the first officer responded “landing.” As the 767 However, there was convective activity near the continued to descend, it encountered mechani- engine abnormality.” airport, with isolated heavy showers and hail. Sur- cal turbulence caused by a nearby hangar. The face temperature was 6˚ C (43˚ F), and dew point report said that the bank and pitch angles began was 3˚ C (37˚ F). Although the freezing level was to vary significantly because of flight control higher than 2,000 ft, the convective conditions en- inputs, and the main landing gear touched down abled the formation of supercooled water droplets hard on the runway. The aircraft bounced, and in clouds below 2,000 ft, the report said. the control column was pushed forward, causing The use of the anti-ice system causes a sig- the nosegear to strike the runway. nificant loss of power from the DC-8’s Pratt & The report said that the flight deck micro- Whitney JT3D-7 engines. “Consequently, engine phone recorded “a very loud breaking sound … anti-ice is only used operationally when needed,” and then noises that sounded as if the aircraft the report said, noting that after the incident, was running on the metal parts of the wheels.” the operator implemented a policy “to strongly The left nosewheel tire had burst, and the right encourage the use of engine anti-ice for departures tire had deflated and separated as the wheel rims when icing conditions are in any way suspect and were destroyed. the temperature is below 10˚ C [50˚ F].” The new The crew brought the aircraft to a stop on policy also stated that in situations involving take- the runway, shut down the engines and re- off performance limitations, engine anti-ice should quested a tow. However, a tow was not possible be selected upon completing second-segment because of the damage to the nosegear, and the climb at 400 ft above ground level (AGL). aircraft was evacuated on the runway. Seventeen passengers complained of neck Control Input Faulted in Bounced Landing and back pain. “One of them was examined at Boeing 767-300. Minor damage. 17 minor injuries. the airport clinic [and] was diagnosed as having he 767 was inbound to Tokyo Interna- suffered a whiplash injury and requiring one tional Airport with 210 passengers and 12 week for recovery,” the report said. Tcrewmembers the morning of June 15, 2005. Examination of the aircraft revealed damage A first officer scheduled to begin training as a to the nosegear axle, wheels and tires; a main captain was hand flying the aircraft from the landing gear tire; wing skins; slats; flaps; and left seat. The captain was in the right seat, and engine fan blades and compressor blades. The another first officer was in the observer’s seat. report characterized the damage as minor.
58 | flight safety foundation | AEROSafetyWorld | JuLY 2009 OnRecord
Over-Torqued Bolts Cause Fuel Leak his supervisor had been involved in other tasks Boeing 737-700. Minor damage. No injuries. when the engineer reconnected the components. hortly after reaching cruise altitude during a scheduled passenger flight from Brisbane, Smoke Traced to Overheated Capacitor SQueensland, Australia, to Hamilton Island Fokker F28-70. Minor damage. Two minor injuries. the afternoon of Aug. 13, 2007, the flight crew fter an uneventful flight from the Neth- noticed a fuel imbalance and determined that erlands on Sept. 29, 2008, the flight crew fuel was leaking from the no. 2 engine. Ataxied the aircraft to the stand at Man- The crew shut down the engine and “di- chester (England) Airport with the right engine verted to Rockhampton, where a single-engine and auxiliary power unit operating, and the approach and landing was completed without left engine shut down. When the right engine further incident,” said the report by the Austra- was shut down at the stand, the crew detected a lian Transport Safety Bureau. strong odor of an electrical component burning Examination of the engine revealed that fuel and saw smoke accumulating on the flight deck. was leaking from a partial separation between “The flight crew believed the smoke was com- the main fuel-return pipe and the oil/fuel heat ing from multiple sources including behind the exchanger. The components had been discon- copilot, various vents and behind the instrument nected two days before the incident, during un- panel,” said the report by the U.K. Air Accidents scheduled maintenance involving replacement Investigation Branch (AAIB). “The commander of the no. 2 engine’s fuel pump. Investigators firmly instructed the CSS [cabin service su- found that while reconnecting the components, pervisor] to get the passengers off as quickly as a maintenance engineer had applied excessive possible.” torque to the four bolts that are inserted through The CSS used the public-address system to tell the fuel pipe flange, gasket and rubber seal into the passengers to “get off the aircraft now.” Seeing threaded inserts in the heat exchanger body. very little response, the CSS said more assertively, The torque value used by the engineer was “Hurry. Evacuate the aircraft but leave your bag- applicable to key-lock inserts used in a modi- gage behind.” The 70 passengers evacuated quickly fied heat exchanger that was to be installed in through a cabin door and the right overwing exit. the 737’s engines during their next overhauls; “Two of the passengers were treated by the ambu- “The commander the applied torque was about 15 percent higher lance service for minor injuries sustained when firmly instructed the than the maximum torque value specified for the moving off the aircraft wing,” the report said. threaded inserts in the no. 2 engine’s original heat The source of the smoke was identified as an CSS [cabin service exchanger. overheated capacitor in the power supply circuit The excessive torque on the bolts had for the emergency inverter cooling fan. The supervisor] to get stripped the threads in all four inserts and report said that the capacitor was “completely had pulled the inserts partially out of the heat burned out [and] too badly damaged to allow the passengers off as exchanger body. The report said that the gasket any further analysis of why it had failed.” quickly as possible.” between the fuel pipe and the heat exchanger Noting that the Fokker 70 fleet had ac- had prevented fuel from leaking during the cumulated more than 1.2 million flight hours post-maintenance engine test run and during since the aircraft was introduced in 1994, the three subsequent flights. However, vibration of report said that maintenance records showed the fuel pipe during these flights and the inci- that only four inverters had been found to have dent flight eventually resulted in the complete overheated. The incidents were fairly recent, release of the inserts and the bolts from the heat however. “Given the time since manufacture of exchanger, causing the fuel leak. the capacitors, the failure mode may potentially The report noted that the engineer was not be a service-life-related issue,” the report said. aware of the different torque values and that “This event is the first recorded incident where www.flightsafety.org | AEROSafetyWorld | JuLY 2009 | 59 OnRecord
smoke in the flight deck has been reported as a the morning of June 25, 2008, but did not record consequence of this capacitor overheating.” that information on the automatic terminal information service. “He also failed to advise Thrust Control Lost on Approach the local approach controller when the approach Eclipse 500. Minor damage. No injuries. controller called him to advise that he had an MC prevailed with surface winds from 200 airplane inbound to land on Runway 19,” the degrees at 18 kt, gusting to 26 kt, as the very NTSB report said. “The tower controller subse- Vlight jet approached Runway 22L at Chicago quently cleared the approaching airplane to land Midway International Airport the afternoon of on the closed runway.” June 5, 2008. The airplane encountered wind The airplane was a Learjet that had departed shear at about 50 ft AGL, and the pilot increased from White Plains, New York, at 0520 local time thrust to arrest the resulting sink rate, said the to pick up passengers in Teterboro. “According report by the U.S. National Transportation Safety to the pilot-in-command, it was dark and the Board (NTSB). After touchdown, the pilot — who runway lights for Runway 19 were illuminated,” had 21,500 flight hours, including 300 hours in the report said. “About 400–500 ft above touch- type — realized that although the throttle levers down, the flight crew noticed that there were were at idle, the airplane was accelerating and men and equipment in the displaced threshold both engines were producing maximum thrust. area for Runway 19 but not on the runway itself. The pilot initiated a go-around and told the … The flight crew briefly discussed the situation copilot to declare an emergency. ATC cleared and verified with each other that they were in them to land on any runway. After finding that fact cleared to land on Runway 19.” the quick reference handbook (QRH) provided The report said that the Learjet passed with- no emergency procedures to address the situation, in 150 ft (46 m) of the workers while landing. the pilots decided to shut down the right engine “ATC did not advise the flight crew that they to reduce airspeed. However, airspeed decreased had landed on a closed runway, nor did the crew rapidly, and the stall-warning system activated. query the tower regarding the possibility that The pilot noticed that the left engine was produc- the runway had been closed,” the report said. ing idle power and was not responding to throttle “According to the pilot-in-command, there lever movement. He was able to land the airplane were no notices to airmen (NOTAMs) in effect on Runway 22R; the Eclipse came to a stop with [about] closing Runway 19 at Teterboro,” the both main landing gear tires deflated. The pilots report said. “According to Teterboro Airport and their two passengers were not injured. Operations, [a NOTAM] was in effect reflect- Investigators found that the loss of thrust con- ing Runway 01/19 closed from 5:00 a.m. to 2:00 trol had resulted from inadequate fault logic that p.m.” had caused the full authority digital electronic NTSB determined that the probable cause control system to fail. The U.S. Federal Aviation of the incident was the airport traffic control- Administration subsequently issued emergency ler’s “failure to follow published procedures and airworthiness directives requiring corrective directives.” actions and the incorporation of emergency procedures for dual engine control failure in the TURBOPROPS QRH and the airplane flight manual. Faulty Fuel Calculations Cleared to Land on a Closed Runway Beech King Air C90. Substantial damage. No injuries. Learjet 45. No damage. No injuries. efore the first of several flights the morning he airport traffic controller was aware that of Sept. 15, 2007, the pilot observed that Runway 01/19 at Teterboro (New Jersey, Bthe fuel gauges indicated a total quantity TU.S.) Airport was closed for maintenance of 2,611 lb (1,184 kg). He then conducted three
60 | flight safety foundation | AEROSafetyWorld | JuLY 2009 OnRecord
flights without refueling. Before departing on fuselage. “The aircraft made an immediate re- the fourth flight — from Blairsville, Georgia, turn to the airfield and carried out an unevent- U.S., to a location not specified in the NTSB ful downwind landing,” the AAIB report said. report — the pilot observed that the gauges The door usually remains closed but had indicated that 500 lb (227 kg) of fuel remained been opened to facilitate routine maintenance. in the King Air’s tanks. The pilot considered this The preflight checklist calls for a visual check as sufficient for the positioning flight. of the position of the door-locking handles. The door usually About an hour after takeoff, the airplane was “However, these handles are not conspicuous, remains closed but in instrument meteorological conditions and being painted the same color as the surrounding about 12 nm (22 km) from the destination when structure,” the report said. had been opened both engines flamed out. ATC provided radar A warning light illuminates if either the rear vectors to the nearest airport — a 2,700-ft (823- fuselage door or the cockpit door is unlocked. to facilitate routine m) grass strip in Bloomingdale, Georgia. “[The However, skydiving flights typically are con- pilot] spotted the airport through breaks in the ducted with the fuselage door locked open, and maintenance. cloud layer and landed on the wet grass,” the the warning light remains illuminated through- report said. “The airplane overran the runway out these flights. and impacted trees.” The King Air’s left wing The report noted that a month before the and engine nacelle were substantially damaged. accident, the European Aviation Safety Agency The pilot escaped injury. (EASA) had issued an airworthiness directive The pilot told investigators that, for flight requiring, in part, the installation of a separate planning, he used a fuel flow of 400 lb (181 warning light for the cockpit door. kg) per hour and a true airspeed of 230 kt. The report said, however, that the C90 pilot’s operat- Mechanic Killed While Opening Door ing manual indicated that for the conditions Raytheon King Air B200. Substantial damage. One fatality. representative of all four flights, average fuel he pilot departed from Taylor (Texas, U.S.) flow was 443 lb (201 kg) per hour and average Municipal Airport the morning of April true airspeed was 217 kt. T10, 2008, to conduct a post-maintenance NTSB concluded that the probable causes of test flight following replacement of the vertical the accident were fuel exhaustion and “the pilot’s speed indicator. He returned to the airport after improper preflight planning and preparation,” hearing a loud, high-pitched noise emanating and that a contributing factor was “the pilot’s from behind the instrument panel. He sum- reliance on inaccurate fuel gauges.” moned the maintenance technician by radio and left the engines running after landing. Unlocked Door Separates on Takeoff “The pilot reported turning the environ- Let 410. Substantial damage. No injuries. mental [system] controls off, which stopped he pilot was late, and a maintenance engi- the in-flow of cabin pressure,” the NTSB report neer volunteered to perform the preflight said. However, he did not check the pressuriza- Twalk-around inspection of the aircraft tion system gauges for an indication of zero before a skydiving flight the morning of June 20, pressure differential and, thus, did not notice 2008. The engineer, and the pilot, did not notice that the cabin was still pressurized. When that the door/emergency exit on the right side the maintenance technician opened the cabin of the cockpit was not locked before the aircraft door, which is hinged at the bottom, the door departed with five parachutists from Peterbor- blew open and struck the technician’s head, ough, England. killing him. The door, which hinges at the rear, opened Examination of the airplane revealed that just after liftoff, separated from the aircraft and a vacuum line had separated from the vacuum struck the right propeller, engine nacelle and controller at a “T” fitting. “The ‘T’ fitting was www.flightsafety.org | AEROSafetyWorld | JuLY 2009 | 61 OnRecord
located in the area that the mechanic had the global positioning system receiver showed worked in during installation of the vertical that after steep turns were performed, airspeed speed indicator,” the report said. “The discon- and altitude began to decrease. The NTSB nected line disabled the entire vacuum system report said that witnesses heard both engines and subsequently disabled the airplane’s pres- “sputter and quit” and saw the Aero Command- surization system outflow valve.” er pass low over a grove of trees, stall and strike The pressurization system safety valve also terrain near Linwood, Kansas. was disabled and remained closed. The safety “The landing gear was down, and the flaps valve, a backup to the primary outflow valve, were in the approach setting,” the report said. opens to relieve cabin pressure when the pres- “Both propellers were in the low-pitch/high- surization “dump” switch is manually selected rpm setting and bore little rotational signatures. or a squat switch on the main landing gear is Both engine fuel supply lines contained only closed on touchdown. residual fuel.” The King Air’s cabin door has a release The report said that the pilot-in-training, button adjacent to the exterior door handle who had seven flight hours in type, likely had that must be pressed while rotating the handle inadvertently selected the fuel shutoff valve to open the door. When the cabin is pres- switches to the “CLOSED” position when he surized, a diaphragm inside the door presses was instructed to turn off the boost pumps, against the release button. Although this causing both engines to lose power due to fuel resistance makes it more difficult to press the starvation. The shutoff valve switches are un- release button, it apparently does not pre- guarded and are adjacent to the boost pump vent the door from being opened. “Testing switches on the overhead panel. “Contributing confirmed that the airplane’s door could be to the accident was the chief pilot’s inadequate opened while the airplane was still pressur- supervision of the pilot-in-training,” the ized, but that action would require more force report said. to overcome the resistance [on the release but- ton],” the report said. Neglected Gear Ruins Water Landing De Havilland DHC-2. Substantial damage. Two fatalities, three minor injuries. PISTON AIRPLANES he amphibious-float-equipped Beaver Incorrect Switch Selection Silences Engines departed from a paved runway at one end of Lake Chelan, Washington, U.S., on May Aero Commander 500S. Destroyed. Two fatalities. T 17, 2008, for a 40-nm (74-km) charter flight to he chief pilot of a U.S. on-demand cargo Stehekin, which is at the other end of the lake. airline was performing a competency check The pilot neglected to retract the landing gear Tof a newly hired pilot the morning of June into the floats after takeoff and attributed the 24, 2008. During such flights, the chief pilot — subsequent lower-than-normal cruise airspeed who had 10,500 flight hours, including 7,550 to the prevailing high-density-altitude condi- hours in type — was known to require pilots-in- tions on the unusually warm afternoon, the training to select the fuel boost pump switches NTSB report said. to the “ON” position before performing steep The Beaver has two sets of lights indicating 360-degree turns and then to select the boost gear position: blue for retracted and green for pump switches to “OFF” before configuring the extended. The accident airplane also had been airplane for landing, in preparation for maneu- modified with an auxiliary gear advisory system vers at low airspeed. that illuminates an annunciator light when The accident check flight was performed be- airspeed decreases below a target value and gen- low a 2,600-ft broken ceiling. Data recorded by erates aural advisories either that the “gear is up
62 | flight safety foundation | AEROSafetyWorld | JuLY 2009 OnRecord
for water landing” or “gear is down for runway TIS had commanded an increase in power landing.” from the left engine. “During the flight, the air was bumpy and The freewheel unit disconnects the main turbulent, and this resulted in the gear advi- rotor from the engine if the engine fails or is sory system activating numerous times,” the shut down. Failure of the freewheel unit in report said. “The pilot disabled the system by the accident helicopter was traced to excessive pulling its circuit breaker because the alerts internal wear. were becoming a nuisance. He intended to Investigators found no record that tests were reset the breaker during descent but did not conducted during development or certification of do so.” the TIS to simulate failure of the operating engine A water landing was required at the destina- while the TIS is in use. Moreover, the report said tion, and the Beaver touched down on the lake that the flight manual supplement for the TIS with the landing gear extended. The airplane “does not appear to accurately reflect the behavior flipped over and came to rest inverted. The pilot of the helicopter or the technique to be employed and two passengers escaped with minor injuries; following a failure of the operating engine and two passengers drowned. may provide a false sense of security.” The report said that fatigue possibly was a Based on these findings, the AAIB recom- contributing factor in the accident. The pilot told mended that Eurocopter and EASA revise the investigators that he had been engaged in office information in the flight manual supplement duty and flight duty for 19 consecutive days. based on data gathered during flight tests of the system.
HELICOPTERS Control Lost in Downwind Takeoff Robinson R44 II. Destroyed. Four fatalities. Simulated Engine Failure Turns Real he helicopter was departing from a logging Eurocopter AS 332L2 Super Puma. Minor damage. No injuries. road in forested, mountainous terrain near uring a proficiency check the night of Nov. TEaston, Washington, U.S., the afternoon of 20, 2007, the training captain used the Aug. 2, 2007. Density altitude was 6,841 ft, and Dhelicopter’s training idle system (TIS) to the R44 was 77 lb (35 kg) over maximum gross simulate a failure of the left engine at 39 ft and weight for hovering out of ground effect, the 28 kt during takeoff from Aberdeen (Scotland) NTSB report said. Airport. The pilot-in-training rejected the take- Winds were from the west at 8 kt, gusting off and was raising the collective control about to 16 kt when the R44 lifted off. “A witness ob- 10 ft above the runway to cushion the landing served the helicopter lift off vertically, oriented when both pilots heard the sound of an engine in a southerly direction, to an altitude of about accelerating, a bang and the low rotor speed 40 ft before turning 90 degrees to the left and warning. The training captain took control and proceeding down the hillside to the east,” the raised the collective to its travel limit, but the report said. “The helicopter began to sway back helicopter continued to descend and touched and forth after traveling about 100 to 150 ft [30 down hard on the runway. to 46 m], then it impacted the ground in a nose- The AAIB report said that the right input low, left-bank attitude.” drive gearbox freewheel unit had failed, caus- Examination of the R44 revealed no sign ing the right engine to accelerate rapidly to of a pre-impact anomaly. NTSB determined
115 percent N1 (low-pressure rotor speed), that the probable cause of the accident was and the overspeed protection system had the pilot’s loss of control during an attempted automatically shut down the right engine. downwind takeoff in high density altitude Sensing a decrease in right engine speed, the conditions. www.flightsafety.org | AEROSafetyWorld | JuLY 2009 | 63 OnRecord
Preliminary Reports, May 2009
Date Location Aircraft Type Aircraft Damage Injuries
May 1 Cerro Chirripó, Costa Rica Bell 206 destroyed 2 fatal The helicopter was on an aerial photography flight when it crashed in the jungle. May 8 Riyadh, Saudi Arabia McDonnell Douglas MD-90-30 substantial 8 none The MD-90 veered off the runway while landing at Riyadh during a positioning flight from Jeddah. The right main landing gear collapsed. May 9 Minden, Nevada, U.S. Beech A55 Baron destroyed 5 fatal After a low pass over an outdoor party, the Baron entered a steep climbing left turn, stalled and descended to the ground. May 10 Utila, Honduras British Aerospace Jetstream 32 destroyed 1 fatal, 2 minor Night instrument meteorological conditions prevailed when the Jetstream crashed near the Utila airport after its fuel was exhausted. Authorities reportedly found 1,500 kg (3,307 lb) of cocaine aboard the airplane. May 10 Port Sudan, Sudan Piper Twin Comanche destroyed 2 fatal The airplane struck mountainous terrain about 26 nm (48 km) northwest of Port Sudan during a flight from Luxor, Egypt. May 11 Johannesburg, South Africa Boeing 747-400 none NA During takeoff, the thrust reverser unlock lights for the no. 2 and no. 3 engines illuminated at 124 kt and 163 kt, respectively, and the slats retracted just before rotation. Climb rate was 200 fpm. The flight crew dumped fuel, returned to the airport and landed the 747 without further incident. May 14 Guatemala City, Guatemala Piper Aztec C destroyed 6 fatal The Aztec crashed in a residential area shortly after departing for a flight to Belize. May 16 Kaktovic, Alaska, U.S. Helio H-295 Super Courier substantial 3 none The single-piston-engine airplane crashed while landing at 6,200 ft on a glacier during a charter flight. May 18 Long Beach, California, U.S. Cessna 310P, Cessna 172 destroyed 3 fatal The pilot of the 310 and the pilot and passenger in the 172 were killed when the airplanes collided about 5 mi (8 km) offshore. May 19 Miami, Florida, U.S. Boeing 777-200 none 1 fatal Heavy rain was falling when a baggage loader fell from the baggage-handling device onto the ramp. May 20 Madiun, Indonesia Lockheed C-130H destroyed 100 fatal, 14 NA The airplane was on approach when it struck four houses and crashed in a rice field. The fatalities included two people on the ground. May 22 Vitória da Conquista, Brazil Robinson R44 destroyed 2 fatal The helicopter was on a night flight from Montes Claros when it crashed on approach. May 22 Fallon, Nevada, U.S. Cessna 320D destroyed 4 fatal Strong, gusting winds prevailed when the airplane crashed while maneuvering to land. May 23 Puchkirchen, Austria Bell 206B destroyed 4 minor The JetRanger crashed in a field during an emergency landing. Part of a rotor blade was found 200 m (656 ft) from the accident site. May 23 Porto Seguro, Brazil Raytheon B350 King Air destroyed 14 fatal The King Air crashed 200 m from the runway threshold during a night approach. May 25 Daytona Beach, Florida, U.S. Rockwell Aero Commander 500S destroyed 1 fatal, 1 serious The pilot reported a problem during departure and attempted to return to the airport. The airplane stalled and crashed 200 ft (61 m) from the runway. May 26 Isiro, Democratic Republic of Congo Antonov An-26 destroyed 3 fatal, 1 serious The An-26 was on a cargo flight from Goma when it crashed on approach to Isiro. May 30 Lahore, Pakistan ATR 42-500 substantial 47 NA The airplane veered off Runway 36R while landing, struck a drainage ditch and came to a stop on the parallel runway. No fatalities were reported. May 31 Atlantic Ocean Airbus A330-203 destroyed 228 fatal The A330 crashed about four hours after departing from Rio de Janeiro, Brazil, the night of May 31 for a flight to Paris. Strong convective activity was reported in the area. NA = not available This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed.
64 | flight safety foundation | AEROSafetyWorld | JuLY 2009 “Me m b e r s h i p i n Fl i g h t Sa f e t y Fo u n d a t i o n i s a s o u n d i n v e s t m e n t , n o t a n e x p e n s e .” dave barger, ceo, jetblue airways
For Eurocontrol, FSF is a partner in safety. In these times of economic restraint, it makes excellent sense to combine scarce resources and share best practices.
— David McMillan, President
FSF membership has made a real difference for the Johnson Controls aviation team. Having access to the Foundation’s expert staff and its global research network has provided us with an in-depth understanding of contemporary safety issues and the ability to employ state-of-the-art safety management tools, such as C-FOQA and TEM. All of which has been vital to fostering a positive safety culture.
— Peter Stein, Chief Pilot
JetBlue Airways considers that membership in Flight Safety Foundation is a sound investment, not an expense. Membership brings value, not just to our organization, but to our industry as a whole.
— Dave Barger, Chief Executive Officer
Cessna has worked with FSF for a number of years on safety issues and we especially appreciate that it is a non-profit, non-aligned foundation. Its stellar reputation helps draw members and enlist the assistance of airlines, manufacturers, regulators and others. We supply the Aviation Department Toolkit to customers purchasing new Citations and it’s been very well received. Our association with FSF has been valuable to Cessna.
— Will Dirks, Vice President, Flight Operations
At Embry-Riddle Aeronautical University, we view FSF as a vital partner in safety education. Together, we share goals and ideals that help keep the environment safe for the entire flying public.
— John Johnson, President
Flight Safety Foundation is the foremost aviation safety organization committed to reducing accident rates, particularly in the developing economies. To all civil aviation authorities, aviation service providers, airlines and other stakeholders interested in promoting aviation safety, this is a club you must join.
— Dr. Harold Demuren, Director General, Nigerian Civil Aviation Authority
For membership information, contact Ann Hill, director of membership, +1 703.739.6700, ext. 105, or [email protected]. November 2–5, 2009 2–5, November To sponsoran event atthe seminar, contact Penny Young, ext.107; e-mail:[email protected]. contact Namratha Apparao, tel:+1703.739.6700, ext.101;e-mail:[email protected]. For seminarregistration and exhibitinformation, Beijing, China Joint meeting of the FSF 62nd annual International Air Safety Seminar IASS, IASS, Seminar Safety Air International annual 62nd FSF the of meeting Joint IFA 39th International Conference, and IATA and Conference, International 39th IFA IASS Hosted by
© iStockphoto