Proceedings 2008.Pmd

Home , AEA White Wing, Air France Flight 358, Air Moorea, Thomas Selfridge

VOLUME 12

Publisher ISASI (Frank Del Gandio, President) Editorial Advisor Air Safety Through Investigation Richard B. Stone Editorial Staff Susan Fager Esperison Martinez Design William A. Ford Proceedings of the ISASI Proceedings (ISSN 1562-8914) is published annually by the International Society of Air Safety Investigators. Opin-

39th Annual ISASI 2008 PROCEEDINGS ions expressed by authors are not necessarily endorsed or represent official ISASI position or policy. International Seminar Editorial Offices: 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA. Tele- phone: (703) 430-9668. Fax: (703) 450- 1745. E-mail address: [email protected]. Internet website: http://www.isasi.org. ‘Investigation: The Art and the Notice: The Proceedings of the ISASI 39th annual international seminar held in Science’ Halifax, Nova Scotia, Canada, features presentations on safety issues of interest to the aviation community. The papers are presented herein in the original editorial Sept. 8–11, 2008 content supplied by the authors. Halifax, Nova Scotia, Canada Copyright © 2009—International Soci- ety of Air Safety Investigators, all rights reserved. Publication in any form is pro- hibited without permission. Permission to reprint is available upon application to the editorial offices. Publisher’s Editorial Profile: ISASI Pro- ceedings is printed in the United States and published for professional air safety investigators who are members of the Interna- tional Society of Air Safety Investigators. Content emphasizes accident investigation findings, investigative techniques and experiences, and industry accident-prevention developments in concert with the seminar theme “Investigation: The Art and the Science.” Subscriptions: Active members in good standing and corporate members may acquire, on a no-fee basis, a copy of these Proceedings by downloading the material from the appropriate section of the ISASI website at www.isasi.org. Further, active and corporate members may purchase the Proceedings on a CD-ROM for the nomi- nal fee of $15, which covers postage and handling. Non-ISASI members may acquire the CD-ROM for a $75 fee. A limited number of paper copies of past Pro- ceedings and Proceedings 2008 is available at a cost of $150. Checks should accom- pany the request and be made payable to ISASI. Mail to ISASI, 107 E. Holly Ave., Suite 11, Sterling, VA 20164-5405 USA ISSN 1562-8914

ISASI 2008 Proceedings • 1

Proceedings 2008.pmd 1 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS Human Factors, Government AirSafety, General Aviation, 2 Flight Recorder, Corporate Affairs, Cabin Safety, Air Traffic Services, WORKING GROUPCHAIRMEN Seminar, Reachout, Nominatin Membership, Code ofEthic Bylaws, Board ofFellow Ballot Certification, Award, Audit, CHAIRMEN COMMITTEE Rocky Mountain, Pacific Northwest, Northeast, Mid-Atlantic, Los Angele Great Lakes, Dallas-Ft. Worth, Arizona, Alaska, CHAPTER PRESIDENTS UNITED STATES REGIONAL SESA-France Chapter, Russian New Zealand, American, Latin European Canadian, Australian, SOCIETY PRESIDENTS NATIONAL ANDREGIONAL United States, New Zealand, International, European Canadian, Australian, COUNCILLORS Treasurer, Secretary, Vice-President, Executive Advisor, President, OFFICERS Southeastern, San Francisco, United States, Ladislav Mika(Co-Chair)([email protected]) • ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) ([email protected]) Dr. MichaelK.Hynes ISASI 2008 ISASI GaleE.Braden([email protected]) Craig Bledsoe , VsvolodE.Overharov ([email protected]) Darren T. Gaines([email protected]) Bill Waldock ([email protected]) Barbara Dunn([email protected]) ChrisBaum([email protected]) , DavidKing([email protected]) , AnneEvans([email protected]) Tom McCarthy([email protected]) Frank DelGandio([email protected]) John Guselli([email protected]) g, JaymeE.Nichols([email protected]) s, Inactive David W. Graham([email protected]) Barbara M.Dunn([email protected]) Barbara Dunn([email protected]) Lindsay Naylor([email protected]) Lindsay Naylor([email protected]) s, JeffEdwards ([email protected]) Matthew Kenner ([email protected]) Tom McCarthy([email protected]) Robert Rendzio ([email protected]) Joann E.Matley([email protected]) Ron Schleede([email protected]) Curt Lewis([email protected]) Caj Frostell ([email protected]) Curt Lewis([email protected]) Peter Williams ([email protected]) Peter Williams ([email protected]) Ron Schleede([email protected]) Peter Axelrod s, Ludi Benner([email protected]) GuillermoJ.Palacia (Mexico) Michael R. Poole Michael R. Richard Stone([email protected])

David Harper Tim Logan([email protected]) John W. Purvis([email protected]) William (Buck) Welch Kevin Darcy ([email protected]) Richard Stone([email protected]) Tom McCarthy([email protected]) John A.Guselli(Chair) Proceedings Vincent Fave Willaim L.McNease 2 ISASI Information Unmanned Aerial Systems Investigators Training &Education, Finnair Oyj Federal Aviation Administration Exponent, Inc. EVA Corporation Airways European Aviation SafetyAgency Era Aviation, Inc. Emirates Airline Embry-Riddle Aeronautical University Embraer-Empresa BrasileiradeAeronautica S.A. EL ALIsraelAirlines Dutch Transport Safety Board Dutch AirlinePilots Association Dombroff Gilmore Jaques&French P.C. Directorate ofFlyingSafety—ADF Directorate of FlightSafety(CanadianForces) Directorate of Aircraft AccidentInvestigations—Namibia Delta AirLines,Inc. Defence ScienceandTechnology Organization (DSTO) DCI/Branch AIRCO Curt Lewis&Associates,LLC Cranfield Safety&AccidentInvestigationCentre COPAC/Colegio OficialdePilotos delaAviacion Comercial Continental Express Continental Airlines Comair, Inc. Colegio DePilotos Aviadores DeMexico, A.C. Civil Aviation SafetyAuthorityAustralia Design Cirrus China Airlines Charles Taylor Aviation, Singapore Centurion, Inc. Cavok Group, Inc. Cathay Pacific Limited Airways Bundesstelle furFlugunfalluntersuchung—BFU Bombardier Aerospace Regional Aircraft Boeing Commercial Airplanes Board ofAccidentInvestigation—Sweden BEA-Bureau D’EnquetesetD’Analyses Avions deTransport Regional (ATR) Aviation SafetyCouncil Australian Transport SafetyBureau Atlantic SoutheastAirlines—DeltaConnection Association ofProfessional FlightAttendants ASPA deMexico Aramco AssociatedCompany AmSafe Aviation SearchAmerican Underwater &Survey, Ltd. American EagleAirlines Allied Pilots Association CompanyLimited All NipponAirways Alitalia Airlines—FlightSafetyDept. Alaska Airlines AirTran Airways Airservices Australia Aircraft &RailwayAccidentInvestigationCommission Aircraft MechanicsFraternal Association Aircraft AccidentI Airclaims Limited Airbus S.A.S. Air NewZealand,Ltd. Air LinePilots Association Air CanadaPilots Association Air AccidentsInvestigationBranch—U.K. Air AccidentInvestigationUnit—Ireland Air AccidentInvestigationBureau ofSingapore Aerovias DeMexico, S.A.DeC.V. AeroVeritas Aviation SafetyConsulting,Ltd. Aeronautical &MaritimeResearch Laboratory Accident Investigation&Prevention Bureau Accident InvestigationBoard/Norway Accident InvestigationBoard, Finland AAIU MinistryofTransport Bulgaria CORPORATE MEMBERS ([email protected]) ([email protected]) Braithwaite Graham R. nvestigation Bureau—Switzerland , Tom Farrier 1/14/2009, 8:22 AM KLM Royal DutchAirlines Jones Day JetBlue Airways Jeppesen Japanese Aviation InsurancePool Japan AirlinesDomesticCo.,LTD Irish Aviation Authority Irish AirCorps Interstate Aviation Committee Int’l Assoc.ofMach.&Aerospace Workers Independent Pilots Association IFALPA Hong Kong Civil Aviation Department Hong Kong AirlinePilots Association Honeywell Hellenic AirAccidentInvestigation Hall &Associates,LLC Gulf FlightSafetyCommittee,Azaiba,Oman Global Aerospace, Inc. GE Transportation/Aircraft Engines General Aviation Manufacturers Association Galaxy ScientificCorporation Flightscape, Inc. Flight SafetyFoundation—Taiwan Flight SafetyFoundation Flight AttendantTraining InstituteatMelvilleCollege Finnish MilitaryAviation Authority WestJet Volvo Aero Corporation University ofSouthernCalifornia University ofNSWAviation UND Aerospace U.K. CivilAviation Authority Transportation SafetyBoard ofCanada Transport Canada State ofIsrael Star NavigationSystemsGroup, Ltd. Southwest AirlinesPilots’ Association Southwest AirlinesCompany Southern CaliforniaSafetyInstitute CivilAviation Authority South African Airways South African SNECMA Moteurs Singapore Airlines,Ltd. Skyservice Airlines,Ltd. Sikorsky Aircraft Corporation SICOFAA/SPS Saudi ArabianAirlines Braathens SAS Sandia NationalLaboratories RTI Group, LLC Royal NewZealandAirForce Royal NetherlandsAirForce Rolls-Royce, PLC Republic ofSingapore AirForce Raytheon Company Qwila Air(Pty),Ltd. Qatar Airways Limited Qantas Airways Pratt &Whitney Phoenix International,Inc. Parker Aerospace Northwest Airlines Nigerian MinistryofAviation andAccident NAV Canada National Transportation SafetyBoard National BusinessAviation Association National AirTraffic Controllers Assn. National Aerospace Laboratory, NLR MyTravel Airways Lufthansa GermanAirlines Lockheed MartinCorporation Learjet, Inc. CommunicationsAviation RecordersL-3 Kreindler &Kreindler, LLP Korea Aviation &RailwayAccidentInvestigationBoard Korea AirForce SafetyCtr. Investigation Bureau & Aviation SafetyBoard ◆ Table of Contents

2 ISASI Information 62 An Attempt at Applying HFACS to Major Aircraft 4 Preface: Welcome to Metro Halifax and And Railway Accidents During the Period to ISASI 2008 From 2001 to 2006 in Japan and Some Problems By Frank Del Gandio, President, ISASI Analyzing Results By Yukiko Kakimoto, Ph.D., NPO, Aviation and Railways Safety 6 Keynote Address: Advancing Aviation Safety One Promotion, Tokyo, Japan Investigation at a Time

By Wendy Tadros, Chair, Transportation Safety Board of Canada 67 Conversations in the Cockpit: Pilot Error or a ISASI 2008 PROCEEDINGS Failure to Communicate? 9 Lederer Award Recipient: C. Donald Bateman By Noelle Brunelle, H-53/S-61 Product Safety Lead, Sikorsky Aircraft Receives Lederer Award Corporation, Stratford, Conn., USA By Esperison Martinez, Editor 71 Cockpit Information Recorder for Helicopter Safety 11 Silver Dart Salute By Roy G. Fox (M03514), Chief, Flight Safety, Bell Helicopter Textron Inc., By John A.D. McCurdy aka Capt. Gerry Davis Fort Worth, Tex., USA 80 Use of Model Helicopter and Precise Differential TUESDAY, SEPTEMBER 9 GPS on the Occurrence Site Survey By Wen-Lin, Guan; Ming-Hao, Young; Tien-Fu, Yeh; and Hong T. Young, 13 DHC-6 Twin Otter Accident off the Coast of Moorea, Aviation Safety Council (ASC), Taiwan, ROC French Polynesia By Alain Bouillard, Investigator-in-Charge, Special Advisor to the BEA, 87 Gas Turbines and Ice—The Mysterious Culprit and Arnaud Desjardin, Safety Investigator, Engineering Department, BEA By Al Weaver (MO4465), Senior Fellow Emeritus, Pratt & Whitney, USA 17 SR 111—Why Did They Die? Why Do We Refuse 92 Turbine Engine Risk Management To Learn? The Swissair MD-11 ‘Modi-Plus’ In the U.S. Air Force Program in Today’s SFF Environment By Richard Greenwood, Flight Safety Investigator, Pratt & Whitney, USA By Capt. Timothy Crowch, Advanced System Safety Management, Switzerland THURSDAY, SEPTEMBER 11 21 Causation: What Is It and Does It Really Matter? By Michael B. Walker (MO4093), Senior Transport Safety Investigator, 97 A Review of Rapid Changes in General Aviation and Australian Transport Safety Bureau Their Likely Effect on GA Safety in Four Countries By Robert Matthews, Ph.D., Office of Accident Investigation, Federal 26 Approaches to Accident Investigation by Aviation Administration, USA Investigators from Different Cultures By Wen-Chin Li, Hong-Tsu Young, Thomas Wang, and Don Harris 103 Bringing the Worldwide Helicopter Accident Rate Down by 80% 32 International Support for Aircraft Accident By Jack Drake, Helicopter Association International, USA Investigation and Proposal to Enhance Aviation 108 SMS as an Investigation Tool Safety in States Where It Is in Developing Stage By Capt. John Gadzinski, Director of Safety, Southwest Airlines Pilots Association By Syed Naseem Ahmed, Technical Investigator, Safety Investigation Board, Civil Aviation Authority, Pakistan 111 Investigating Unmanned Aircraft System Accidents By Thomas A. Farrier (MO3763), Senior Analyst, Aerospace Safety and 37 What Can We Learn? Operations Analytic Services, Inc., Arlington, Va., USA By Graham Braithwaite (MO3644), Cranfield Safety and Accident Investigation Centre, Cranfield University, United Kingdom 120 Occupant Protection—A Case Study Bombardier 41 Accident Investigation—A Complete Service? Challenger CL-600, Teterboro, N.J., Feb. 2, 2005 By Phil Taylor, Senior Inspector of Air Accidents (Operations), UK AAIB By Nora C. Marshall (MO3036), Chief, Survival Factors Division, Office of Aviation Safety, National Transportation Safety Board (Presented by Frank Hilldrup) WEDNESDAY, SEPTEMBER 10 123 Problems in Operating Emergency Evacuation 46 Managing the Complexities of a Major Aviation Slides: Analysis of Accidents and Incidents with Accident Investigation Passenger Aircraft By Joseph M. Kolly, Bruce G. Coury, Vernon S. Ellingstad, and Aaron S. By Gerard van Es, Senior Consultant, NLR-Air Transport Safety Institute, Dietz, National Transportation Safety Board, Washington, D.C., USA Amsterdam, the Netherlands (Presented by Rombout Weaver) 53 Weather Risk Management Through a Systematic 128 ISASI 2008 Pictorial Review Approach to the Investigation of Weather Events By Esperison Martinez, Editor By John W. Dutcher, Dutcher Safety & Meteorology Services, and G. Mike Doiron, Cirrus Aviation Safety Services (M04646)

ISASI 2008 Proceedings • 3

Proceedings 2008.pmd 3 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 4 • G E. MARTINEZ the future. For starters,ifallelsefails,westillhavethemost is betterthanever, anditlikely willgetprogressively betterin people wouldagree thatthescienceofaccidentinvestigation onto theseminar. thanks aswell,butIwillasktheirforgiveness ifIsimplymove organize yesterday’s tutorials.Lotsofotherpeopledeserve the companions’program, andtoeveryonewhohelped nizing thetechnicalprogram, toGailStewartfororganizing member and,onceagain,Ithankherforallhard work. has organized more thananyother annualseminarsforISASI president oftheCanadianSociety, BarbaraDunn. ety ofAirSafetyInvestigators.Iespeciallywishtothankthe ISASI 2008 ISASI Our themeis“Investigation:TheArtandtheScience.”Most Special thanksalsotoJimStewartandNickStossfororga- ood morning,everyone. I willstartbythankingourhosts,theCanadianSoci- Welcome tometro 2008. HalifaxandtoISASI Welcome toMetroHalifaxand Proceedings 4 To ISASI2008 By Frank DelGandio,President PREFACE visually scansanaccidentsiteoranyonewhoconvertsthedigital tion continuestobeamixofartandscience.Justaskanyonewho tinue toplayarole? Theshortansweris,“yes.”Accidentinvestiga- when weexamine failure modesorfire damage. tific base,includingdifferences betweenmetalandcomposites areas inwhichaccidentinvestigationneedstoimprove itsscien- nar willaddress issueslike these.Some papersalsowilladdress FADEC andtrend monitors.Presentations throughout thesemi- humble GAaircraft mayoffersomeonboard data,GPSor onboard voicerecorders, FADECs, andsoon.Eventheonce- recorders, quickaccessrecorders, GPSandradaroverlays, world. air carrier lot byjustwatching.But“allelse”rarely fails,atleastnotinthe losopher, Yogi oncenotedcorrectly Berra, thatwecanobservea basic ofscientificmethods,observation.Agreat Americanphi- Given allthescienceavailabletoustoday, doesartreally con- Today weroutinely applyprecise datafrom digitalflightdata 1/14/2009, 8:22 AM data to an animated simulation; we know fairly precisely what the various parameters are, but we do not necessarily know what the I urge everyone, but especially any airplane was really doing, or what was happening during the frac- tions of seconds between recordings. Better yet, ask anyone who students or young aviation professionals has ever had to manage a major accident investigation, particu- who have joined us here today, to take larly one involving several national cultures, or ask someone who advantage of the wealth of knowledge analyzes multiple accidents to help to inform safety policy. You will hear several presentations that add more substance to these ideas. and experience that is in this room. At each of our annual seminars, I briefly review the major accidents of the preceding year in order to remind us that the avia- selves and set out to rescue any survivors. The accident, of course, tion safety community still has work to do. Though we indeed was non-survivable, but that does not diminish the heroism that had some major accidents in the 12 months since we met in many local people demonstrated that night. Singapore, the past year, in fact, has been a good year for avia- Air safety investigators also learned that the people of Peggys tion safety. By my count, we had 12 fatal accidents, and 8 major Cove would remain hospitable throughout the long investiga-

fatal passenger accidents. Once again, carriers from Africa and tion. If you talk to any ISASI members who were on site here, ISASI 2008 PROCEEDINGS Central Asia accounted for a disproportionate share of those ac- you will hear words like “decency” and “kindness” to describe cidents, but the good news is that we had just one major accident the local people throughout that long effort. in air carrier passenger operations in the 30 Organization for Finally, I want to acknowledge the anniversary this week of Economic Cooperation and Development (OECD) countries, plus another aviation tragedy, Sept. 11, 2001. In addition to the China and India. Those 32 countries account for about 90 per- trauma associated with those events, we Americans were again cent of all air carrier operations in the world, and they had just reminded of the skill and the generosity of the Canadian one major fatal accident in the past 12 months. people, particularly the people of eastern Canada. In fact, one of the most significant accidents of the past year in When the U.S. closed its airspace that day, 39 aircraft and those 32 countries was the non-fatal B-777 accident at Heathrow. 6,000 to 7,000 passengers and crew were diverted to Gander When I first heard that both engines had lost partial power at in Newfoundland. Nearly as many were diverted to Halifax essentially the same time after a long flight from Beijing to Lon- International Airport. In both communities, the local people don, I thought to myself, Let me guess, they were running out of showed incredible generosity. fuel.” Well, it turned out to be much more complex and more The story in Gander was especially impressive. A commu- instructive than I first guessed. The B-777 investigation is a good nity with perhaps 2,500 homes had to figure out—and example of the marriage between art and science, and of the quickly—what to do with 7,000 unexpected guests. Their an- international character of aviation accident investigation. The swer was wonderfully simple: local people opened their homes aircraft took off from China, flew a third of the way around the to shelter, feed and even entertain all 7,000 people for several world, and crashed in the air carrier’s home country in an air- days, and at no small expense to residents. The hospitality craft that was certified in a third county. was impressive in Halifax, as well. But, after what we saw at In short, our profession will always remain at the front line of Peggys Cove several years earlier, we really should not have accident prevention, whether we investigate well-understood ac- been surprised. Once again, words like decency and kindness cident scenarios or new and complex scenarios. come to mind. Before I close, I want to make a few comments about our hosts. Canada, of course, is one of many countries whose popula- Ten years ago last Tuesday, 229 people died just a few miles from tion has been built with people from around the world. Many here, near Peggys Cove, in the Swissair accident. That complex of those ancestors entered Canada through Pier 21, just down accident investigation taught us several important things about the street here. As Americans understand very well, particu- aviation safety, but it also demonstrated several important things larly those of us who are in aviation, those Canadian ancestors about Canada, about metro Halifax, and about the Maritime Prov- gave birth to a strong, competent, and generous country. While inces in general. you are here, I hope you will find the time to explore this part First, it reminded us about the skill and professionalism of the of Canada, including the city and the many beautiful seaside Transportation Safety Board of Canada in a very complex inves- villages like Peggys Cove. tigation. Accident investigators from the U.S. see this regularly, Finally, before I close, I will remind everyone that whatever because each year several U.S. GA operators have accidents in your particular interest may be in aviation safety or accident Canada, while several Canadian GA aircraft have accidents in investigation, one or more people in this room will know all the U.S. I personally have worked some of those cases and I can there is to know about the topic. I urge everyone, but espe- tell you sincerely that all Canadians should be proud of the TSB; cially any students or young aviation professionals who have it is a world-class organization. joined us here today, to take advantage of the wealth of knowl- The Swissair accident also taught us something about the people edge and experience that is in this room. I also urge everyone of Peggys Cove and of Nova Scotia. The accident occurred at 9:30 to participate actively in the seminar and to share your con- at night. Yet, in the darkness, scores of local fishermen and other siderable expertise with anyone who seeks it out. boat owners, one by one, voluntarily accepted real risk to them- Enjoy the seminar and enjoy metro Halifax. Thank you. ◆

ISASI 2008 Proceedings • 5

Proceedings 2008.pmd 5 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 6 • and secondlywithinspectionsforcompositematerials. national effortsontwofronts: firstlywithCessna208aircraft together wecouldmake airtravelevensafer. greater uptake ofourrecommendations. With yoursupport, These are three investigationswhere wewouldlike tosee in more detailaboutMKAirlines,AirFrance, andSwissair. prompt actionbyregulators andindustryin Canadaandabroad. sulted inpositivechange—thankstosolidinvestigativeworkand our MorningstarandAirTransat investigations,whichhavere- tion safetyworldwide.Inparticular, Iwanttotalkyouabout TSB investigationsandthecontributiontheyhavemadetoavia- Science.” Iwanttotalkyouaboutthesciencebehindsomekey lutely essentialtoadvancingtransportationsafety. and tofosterthestrong workingrelationships thatare abso- great opportunitytodiscussthelatestinvestigativetechniques opportunity toshare ourideasandexperiences. Itisalsoa dedication andyourattentiontodetail.Today, we havean come toadmire theworkyoudo.Iamimpressed bybothyour minimum speedinicingconditions and(2)immediatelyexiticing tives (ADs)statingCessna208 pilotsmust:(1)maintain120kts icing conditions.Action taken:theFAA direc- issuedairworthiness “light” icingconditionsand(2)maintain120ktsminimumspeed in wide: vance safetyforthemore than1,600Cessna208sflyingworld- and theNTSBmadefollowingrecommendations toad- our safetyrecommendations. InJanuary2006,boththeTSB to communicatewithourinternationalpartnersandmake crashed, killingthepilot. surfaces. Thesituationquicklyworsenedandtheaircraft mance oftheaircraft diminished asicebuiltuponitscritical aboard. Itclimbed normally, butwithinminutestheperfor- cargo planetookoffcleanfrom Winnipeg withonepilot In theearlymorninghoursonOct.6,2005,aCessna208 Morningstar—loss ofcontrolandcollisionwithterrain A (Remarks presented by Halifax, NovaScotia,Canada.—Editor) 2008 airaccidentinvestigationseminardelegatesonSept.9, ISASI 2008 ISASI I wanttostartbytellingyouaboutsomeverypositiveinter- I alsowanttopracticethegentleartofpersuasionandtalk theme is“Investigation:TheArtandthe This year’sISASI The TSBdidnotwaituntiltheinvestigationwascomplete Cessna 208pilots:(1)donottakeoffintoanythingmore than s chairoftheTransportation SafetyBoard ofCanada, safety investigators.Inmy12yearsattheTSB,Ihave it isapleasure formetospeaktheworld’sleading Advancing AviationSafetyOne Proceedings Chair Tadr 6 Investigation ataTime By Wendy Tadros, Chair, Transportation SafetyBoard ofCanada os inherkeynoteaddress totheISASI KEYNOTE ADDRESS 2008, in

E. MARTINEZ Wendy Tadros grams maynotalwaysfinddefectsincompositematerials. inspected worldwide.Thesefleetcheckssuggestedinspectionpro- rudders. Four hundred andeightAirbuswidebodyaircraft were for theinspectionofallaircraft equippedwiththesecomposite and fluidingress ledtoAirbusissuinganalloperatorstelex calling rudder’s compositematerialregarding disbands,hingedamage, crete actiontoadvanceaviationsafety. ample ofinternationalcooperationresulting inpositive andcon- ern aircraft. TheAirTransat investigationisanotherstellar ex- termined tofigure outwhatcausedtheruddertofalloff a mod- and nobodydied. all,theaircraftlot ofattentionwiththepublic.After landed safely vious: Therudderwasmissing.Thisoccurrence didnotgarnera Varadero. Onceontheground, theproblem quicklybecameob- aged todescend,stabilizetheaircraft, andreturn safelyto vibrations. Thentheaircraft startedtoDutchroll. Thecrew man- Seventeen minuteslater, thecrew heard aloudbang,followedby On March 6,2005,anAirbusA310tookofffrom Varadero, Cuba. Air Transat—Flight 861,lossofrudder they willmeannomore inflighticingaccidentswithCessna208s. facturer ondesign,training,andprocedures are positive.Ihope conditions exceeding“light.” When welearnedthis,theBoard urgently recommended that What waslearnedintheinitialdaysofinvestigationinto But itcertainlyintriguedTSBinvestigators,andtheywere de- The actionstaken byTransport Canada,theFAA, andthemanu- 1/14/2009, 8:22 AM Transport CanadaadoptedbothADs. with Airbus. isworking als, andEASA ures incompositemateri- techniques todetectfail- Council oninspection with theNationalResearch port Canadaisworking heardand EASA us.Trans- voices. Transport Canada portance ofinternational lar action,reflecting theim- States, theNTSBtooksimi- gresses. IntheUnited damage before itpro- tion program todetect try comeupwithaninspec- andindus- Agency (EASA), ropean Aviation Safety Transport Canada,theEu- What followed was the development of early, consistent, and along the 9,000-foot wet and slippery runway, it simply ran reliable detection programs for composite materials. This about of room. The aircraft came to a stop in a ravine; and while solutely could not have been accomplished without solid in- the evacuation was not without its difficulties, everyone got vestigative work and international cooperation. The imple- out before fire destroyed the aircraft. mentation of the Morningstar and Air Transat recommenda- The TSB is grateful to the people from the Bureau tions are two of our successes. d’Enquêtes et d’Analyses (BEA), EASA, Airbus, Air France, Now, let’s start by tackling a number of the hard issues in Transport Canada, and many other organizations for provid- aviation safety today by talking about some areas that need more ing information and invaluable assistance to our investigators. improvement. I would like to see greater uptake of the recom- Thanks to your participation, we developed a comprehensive mendations flowing from the MK Airlines, Air France, and analysis of the causes and contributing factors that led to seven Swissair investigations. These are not easy issues—if they were, recommendations to make air travel safer. they would have been fixed a long time ago. They are the tough So, what did we learn? We learned this crew was not alone. issues, and I would like to try to make the case for why I believe Since the Air France accident in Toronto, at least 10 large air- these recommendations are so important. Perhaps if I can do craft have gone off runways around the world in bad weather. that—if I can gain your support—we can get the ball rolling This tells us that the potential for landing accidents in bad

internationally and make aviation even safer. weather remains. To make air travel safer, the TSB made seven ISASI 2008 PROCEEDINGS recommendations. Five of them focus on crews and the need MK Airlines—reduced power at takeoff for mandatory standards, training, and procedures, and two and collision with terrain are aimed at reducing the risk of injury following an accident. Let’s look at the investigation of the MK Airlines crash on Oct. The Board made recommendations asking that Transport 14, 2004, at the airport right here in Halifax. A Boeing 747 cargo Canada and the world’s regulatory bodies limit landings in flight took off using speed and thrust settings that were too low thunderstorms and require enhanced pilot training. Our infor its weight. It hit a berm at the end of the runway, crashed into vestigation revealed that the Air France crew, like many oth- the forest, and burned. All seven crewmembers died. ers, did not calculate the landing distance required for the Major air investigations are often global in scope, and this one conditions at the destination. That is why we recommended was no exception. This accident involved an American-built air- that regulators require these always be calculated, so crews craft, registered in Ghana, operated by a Ghanaian-licensed crew will know their margin of error. The NTSB made a similar working for a U.K.-based airline. Equally international were the recommendation following an accident in which a B-737 left investigators. Investigators from the United Kingdom, Ghana, the runway at Chicago’s Midway Airport. and Iceland participated in this TSB investigation. We also made two recommendations aimed at reducing the What’s interesting about this investigation and the reason it’s risk of injury following an accident. worth talking about is it was not a “one off.” Indeed there were We took a good, hard look at the terrain at the end of 12 similar accidents worldwide in which four aircraft were de- Canada’s runways and found it can increase the risk of inju- stroyed and 297 lives lost. When you see one performance acci- ries to passengers and crews. To address this risk, the TSB dent, the inclination is to say, “Well, the pilot should have fol- recommended that Transport Canada require 300-meter run- lowed the SOPs.” When you see multiple accidents around the way-end safety areas or an alternate means of stopping air- world where actual takeoff performance differed from expected craft. This will bring all of Canada’s major airports in line performance, you come to the conclusion that additional de- with international benchmarks. fenses are needed in the system. Lastly, we examined the evacuation. As you know, successful That is why the TSB recommended that Canadian and inter- evacuations are measured in seconds. We found, despite direc- national regulatory authorities require a takeoff performance tions to the contrary, many passengers stopped during the monitoring system to ensure that crews of large aircraft will be emergency to take their carry-on baggage with them. To im- alerted in time when there is not enough power to take off safely. prove evacuations, the TSB asked Transport Canada to require Transport Canada committed to working with industry on the that passenger safety briefings include clear direction to leave development of a takeoff performance monitoring system. This all carry-on baggage behind. is a step in the right direction. The Board is hopeful that a solu- While the response to many of these recommendations has tion can be found to eliminate this safety deficiency. been positive, we are concerned about the response on our recommendation calling for runway end safety areas (RESAs) Air France—runway overrun and fire or EMAS (Engineered Materials Arresting System). Let’s not This accident took place at Canada’s busiest airport, beside forget that in the past 25 years, at least one aircraft a month Canada’s busiest highway at rush hour. It would be an under- overran a runway somewhere in the world. It is my conviction statement to say the overrun of an Air France A340 at Toronto that until this problem is faced squarely, the trend is bound to caught the world’s attention. continue. I believe this important issue deserves more atten- On Aug. 2, 2005, with 297 passengers and 12 crew on board, tion from the world’s regulators, including Transport Canada. Air France Flight 358 approached Toronto in a severe and rapidly changing thunderstorm with shifting winds and limited vis- Swissair—inflight fire leading to collision with water ibility. It came in too high and too fast. Touching down 3,800 feet Here in Nova Scotia, September 2 marked the 10th anniver-

ISASI 2008 Proceedings • 7

Proceedings 2008.pmd 7 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 8 • hardworking peoplelike national andinternationaleffortsthecontributionsofmany this investigationwithitsstrength andpurpose.Coordinated which somanypeople—from somanyplaces—helpedprovide taken bytheTSB.Icontinuetobeheartenedwayin the largest andmostcomplex safetyinvestigationeverunder- craft, thecrew couldnothavelandedtheplanesafely. based onthetimeavailablebefore thefire disabledtheair- We rananumberofdetailedscenariosandconcludedthat ing whattheyknew, wepiecedtogetherthesequenceofevents. into theoceanwithlossofall229soulsonboard. ing. Aboutfive-and-a-halfminutesafterthat,theaircraft crashed dar contactwere lost,andtheflightrecorders stoppedfunction- to land.Aboutoneminutelater, radiocommunicationsandra- failures. Thecrew declared anemergency andanimmediateneed thereafter, theaircraft’s FDRloggedarapidsuccessionofsystem aware thatafire wasspreading abovethecockpitceiling. Soon there wasdefinitelysmoke anddecidedtodivertHalifax. furthertroubleshooting,conditioning system.After theyassessed began toinvestigatethesource, whichtheythoughtwastheair tion wasdrawntothearea behindandabovethem,they the crew smelledanabnormalodorinthecockpit.Theiratten- board. to Geneva,Switzerland,with215passengersand14crew on departedNewYorkDouglas MD-11, Cityonascheduledflight It isonlyfittingthatIendwiththisinvestigation. sary ofthenightSwissairFlight111crashedoffPeggys Cove. for allexisting insulationmaterials. gate fires. We wouldalsolike toseemore stringent testing compliance willensure insulationmaterials willnotpropa- we wouldlike to know replaced bytheradiant paneltest. rials wasnotrigorous enough. We were pleasedtoseethistest at thetime,flammabilitytesttoapprove insulationmate- of MPETinsulationfrom manyaircraft. TheTSBlearnedthat, Canada, theUnitedStates,andFrance required theremoval insulation. Whenwediscovered thisweadvisedregulators. me talktoyouaboutthree ofthose. eas where wethinkthere stillneedstobemore progress. Let improvements thatmake flyingsafer. However, there are ar- inflight firefighting. mental typecertificationprocess, materialflammability, and onboard recorders, circuit breaker resetting procedures, supple- 9 inourfinalreport. made 23recommendations, 14duringtheinvestigationand potential tochangethefaceofaviationsafety. TheTSB ISASI 2008 ISASI The Swissairinvestigationtookfour-and-a-halfyears.Itwas The crew didwhatmadesensetothematthetime.Know- While theflightcrew waspreparing toland,they were un- About 53minuteslater, whilecruisingatFlightLevel330, On thateveningin1998,SwissairFlight111,aMcDonnell Since theSwissairaccident,crews routinely diverttoland We wouldlike itifMPETwasremoved from The firstmaterialtoigniteintheSwissairaccidentwasMPET We are pleasedtoseethattheSwissairinvestigationled These recommendations fallintofivebroad categories: This investigationledtoacomprehensive report withthe Proceedings 8 how you

were absolutelyinvaluable. the FAA’s alternativemeansof all

aircraft or 39th annualairaccidentinvestigation conference. make sure thathappens. cal toadvancingtransportationsafety. Let’sworktogether to tigations effectivelyimplemented. tions from theMKAirlines,AirFrance, andtheSwissairinves- more dramatically. Iwouldlike tosee I wouldlike toseethefaceofaviationsafetychangedeven dedication toaviationsafety. would nothavebeenpossiblewithoutyourcooperationand and Swissairinvestigations,there hasbeenmuch progress. This we havelooked athow, asaresult ofthe MK Airlines,AirFrance, Transat investigationschangedthefaceofaviationsafety. And recommendations asyourown. theflagforaviationsafetyandadoptTSB’syou tocarry ports, andwhere youfindsimilarsafetydeficiencies,Iurge taking a closerlookatthesere-ing theTSB’s 18years.After learn more abouttherecommendations wehavemadedur- invite youtogoourwebsite—www.tsb.gc.ca. There youcan used toadvancetransportationsafety. ings. We mustensure theywillnotbereleased andwillonlybe tional communityprotects theconfidentialityofallrecord- veillance. Thisresistance canbeovercome onlyiftheinterna- place andIunderstandwhytheywouldopposegreater sur- recommendation. Thatbeingsaid,thecockpitisapilot’swork- the cockpitandwithaircraft. TheNTSBalsomadethis will helpinvestigatorstobetterunderstandwhatwentonin about istheinstallationofimagerecorders. Theserecorders monize theserulesforallCanadian-registered aircraft. tional standard. We are lookingtoTransport Canadatohar- 2-hour CVRsandanindependentpowersupplyastheinterna- tant area, andtheFAA isleadingtheway. We wouldlike tosee recording time.There hasbeenprogress forsure inthisimpor- an independentpowersupplyproviding 10more minutesof By2012,theFAAand FDR. willalsorequire 2-hourCVRsand requires thatanysingleelectricalfailure notdisablebothCVR will beavailabletoinvestigators.TheupshotistheFAA now Swissair recommendations are aimedatensuringcrucialdata refine whatdataweneedtofigure outwhathappened.The requirements forFDRsandCVRs.With eachinvestigation,we and asystematicapproach toinflightfirefighting. cus attentionontwoareas: theneedfordesignatedfire zones the emergency checklisttemplate.We willalsocontinuetofo- manuals. Theseare positivesteps. manufacturers makingimprovements totheiraircraft flight for smoke andfire. Thisinturnresulted insomeaircraft industrywide guidanceonmore effectivechecklistprocedures Flight SafetyFoundation haveworked togethertodevelop and theInternationalAirTransport Associationandthe immediately atthefirsthintoffire orsmoke inanaircraft, Tadros’s keynote address 2008,theSociety’s openedISASI International cooperationandinformationsharingare criti- And whilemanyrecommendations havebeenimplemented, Earlier, Ispoke toyouabouthowtheMorningstarandAir Our successdependsonsupportingeachother’swork.I One otheroutstandingrecommendation wefeelstrongly In thetransportationworld,aviationhasledwaywith What wewouldreally like toseeisinternationaladoptionof 1/14/2009, 8:22 AM all

of therecommenda- ◆ LEDERER AWARD RECIPIENT C. Donald Bateman Receives Lederer Award By Esperison Martinez, Editor

uiet, unassuming, soft-spoken, mannerly, in demeanor (EGPWS). If Don never did anything else in his career, these very much like Jerry Lederer is how this year’s selectee tools alone might allow him to say that he has saved more Qfor the coveted ISASI Jerome F. Lederer Award is best lives in aviation than any other single person who has ever described. C. Donald Bateman, who prefers “Don,” worked in the field.

received the coveted award at the ISASI 2008 Awards Ban- “That is not an overstatement; Don’s work has saved lives, ISASI 2008 PROCEEDINGS quet held September 11 in Halifax, Nova Scotia, Canada. and lots of them. To give you a sense of scale, from 1945 All readers know the high esteem in which a person selected through 1974 the United States alone had 80 fatal CFIT acci- for the Award is held, so it might be expected that the person dents, which killed nearly 2,000 people. Since 1974, when receiving the Award might be a bit piqued by lack of special GPWS was finally required on air transport aircraft in the U.S., attention at the place of the presentation. In an incident that we have had just three such accidents, all of which occurred perfectly reveals Don’s nature, President Frank Del Gandio re- abroad in developing countries. Since enhanced GPWS was lated to the awards dinner attendees how Don, upon his arrival required some 13 years ago, we have had no fatal CFIT acci- at the seminar hotel after a tiring flight, was told that his room dents involving aircraft with an operating EGPWS unit on would not be ready for several hours—so without any complaints board. Don personally deserves much of the credit for virtu- or demands, he and his wife settled themselves in comfortable ally eliminating CFIT accidents in much of the world. lobby chairs to wait. “Which is where I stumbled onto them,” “But GPWS is not all that Don has accomplished. He also said Frank, “and profusely apologized for any mix-up that may was a pioneer in the development of angle-of-attack indicators, have caused the long delay. Don wouldn’t hear of it, and said he autothrottle systems, windshear detection, and altitude aware- ‘enjoyed the rest.’” As the reader can imagine, a proper room ness systems. was quickly made available for the Batemans. “So how did Don accomplish this impressive list? He did it President Del Gandio went on to introduce Don and make by becoming a real student of certain kinds of accidents. For the presentation of the Award. The president’s remarks very example, he is well known for having investigated scores of much illustrate the tremendous effort Don Bateman has put forth in fulfilling the requirement to receive the Jerome F. Lederer Award, which was created by the Soci- ety to honor its namesake for his leadership role in the world of aviation safety since its infancy: “outstanding lifetime contribution in the field of aircraft accident investigation and prevention.” President Del Gandio re- marked: “I am honored to present the annual Jerome Lederer Award to C. Donald Bateman. He has been a member of ISASI since 1992, and Don can fairly be described as the person who invented the ground proximity warning sys-

tem (GPWS) and, later, the for- PHOTOS: E. MARTINEZ ward-looking enhanced GPWS President Del Gandio, left, introduces Bateman to the assembly.

ISASI 2008 Proceedings • 9

Proceedings 2008.pmd 9 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 10 onstrates therespect thathispeershaveforcontributions. ety. Don’s current titleasCorporateFellow atHoneywelldem- Hall ofFame andheisaFellow attheRoyal Aeronautical Soci- Air SafetyAward. Foundation in2006whenhewontheLauraTaber Barbour in Seattle.Hewasrecognized yetagainbytheFlightSafety 2003, Donwasnameda“Pathfinder” attheMuseumofFlight the NewZealandAirSafetyFoundation Award in2002.In ognized asaLaureate by Admiral Luiz deFlorez Award (1975and1998).Hewasrec- tions tosafetyaround theworld. ganizations thathaverecognized hisunsurpassedcontribu- tiveness oftheequipment. databasetoensureupdates oftheterrain thecontinuedeffec- even convincedHoneywelltogivecustomersfree accessto became thebasisfor“forward looking”enhancedGPWS.Don able toincorporateveryaccuratetopographicalmapsthat computer andsatellitetechnologyimproved, Donlaterwas data andbegandevelopingthedownward-looking GPWS.As compared toLockheed’sfamousSkunk Works. Don operatedaunitatFlightSafetyTechnologies thatcanbe Safety Technologies, where heisthechiefengineer. Ineffect, could haveavertedeachaccident. collected originaldata,andnotedwhere andwhenwarnings accidents were brutallycommon.Hefilmedeveryflightpath, Mexico from thelate1940sthrough thelate1960swhenCFIT near-CFIT accidentsthatoccurred intheU.S., Canada,and estimated flightpathsofeverycivilianCFITaccidentandmany CFIT accidentsnotbykickingtinonsite,butflyingthe • 1993—Capt. Victor Hewes 1992—Paul Powers R. 1991—Eddie J.Trimble 1990—Olof Fritsch 1989—Aage A.Roed 1988—H. Vincent LaChapelle 1987—Dr. Carol A.Roberts 1986—Geoffrey C.Wilkinson 1985—Dr. JohnKenyon Mason 1984—George B.Parker 1983—C.O. Miller 1982—C.H. Prater Houge 1981—Dr. Robertson S.Harry 1980—John GilbertBoulding 1979—Gerard M.Bruggink McMahan 1978—Allen R. 1977—Samuel M.Phillips Past AwardWinners Lederer ISASI 2008 ISASI “It isalwaysanhonortointroduce agiantinhisfield.Itis “Don alsohasbeeninductedintotheNationalInventor’s “He isatwo-timewinneroftheFlightSafetyFoundation’s “By honoringDonhere today, joinsalonglistofor- ISASI “In the1970sDonbegantopublishhisfindingsand “Don didthisworkasanemployeeofHoneywell’sFlight Proceedings 10 Aviation Week in1994.Hereceived 2007—Thomas McCarthy 2006—Richard H.Wood 2005—John Rawson 2004—Ron Chippindale 2003—Caj Frostell 2002—Ronald L.Schleede Transpor- 2001—John PurvisandThe 2000—Nora Marshal 1999—Capt. JamesMcIntyre 1998—A. Frank Taylor 1997—Gus Economy 1996—Burt Chesterfield 1995—Dr. JohnK.Lauber 1994—U.K. Aircraft Accidents tation SafetyBoard ofCanada Investigation Branch LaCoursiere, center, andCatherineRickafort. Bateman spendstimewithscholarshipwinners,Melissa to doso. curious, theyeventuallywenttoseewhatitwas,skippingschool window andsawaverybrightflashoflight.Beingyoung 1940s, hetoldhowandacompanionwere lookingoutthe dent investigation.Intakinghisaudiencebacktotheearly telling ofhisfuture career andwashisintroduction toacci- story from hisdaysasayouth,about8,thathesayswasfore- lengthy discourseabouthisselection,ratherherecounted a dinner guestsarose inunisonandgaveathunderous applause. the other, were told.Ashewalked tothemicrophone, the250 observe Don’s discomfortashisaccomplishments,oneafter come DonBateman.” Ladiesandgentlemen,pleasewel- time memberofISASI. especially apleasure todosowhenthatgianthasbeenalong- The next daywhenhisteacherasked whyhehadn’t beenin In keeping withhischaracter, Donchosenottomake a Throughout thepresident’s remarks, theaudiencecould ◆ 1/14/2009, 8:22 AM great honorto behere.” are alltrueprofessionals, and itisa for theselflessworkthatyou do. You toallofyou closed bysaying:“Thanks you can’t spell.’” are goingtobeanengineerbecause read it,shesaidtome‘You know, you we did,andwhatsaw. Whenshe us writeatwo-pagereport onwhat some evidencefrom anaccident.” “You thing—youmoved didaterrible looked sternlyathimandscolded: teacher examined thefabric,then he hadpicked itupatthescene.The and handedittotheteacher, saying pulled apieceoffabricfrom hispocket ing theevents.To prove hisstory, he scene, lookingatthedebrisandwatch- he spentthetimeatplanecrash school, hewasveryforthrightandsaid When thelaughtersubsided,he “As punishment,”hesaid,“shehad ◆ Silver Dart Salute By John A.D. McCurdy aka Capt. Gerry Davis

(The ISASI 2008 Seminar Committee honored the 100th anniversary men recruited by Bell and his wife, Mabel Hubbard Bell, to of the construction of the Silver Dart at Baddeck, Nova Scotia, in late form the Aerial Experiment Association (AEA). As a boy, I 1908, by featuring the biplane in the seminar’s logo design. Made of had become interested in Bell’s work and assisted him in his steel tube, bamboo, friction tape, wire, and wood, the Dart was powered experiments. by a V-8 engine supplied by Glenn Curtis, which developed 35 horse- At that time he was assisted by Simon Newcomb, the emi- power at 1,000 rpm. John A.D. McCurdy piloted his design on its first nent mathematician, and Samuel P. Langley, secretary of the Canadian flight from the frozen expanse of the Bras d’Or Lake on Feb. Smithsonian Institution. During the course of my studies at 23, 1909. It logged more than 200 flights. The legacy of the Silver Toronto University, I used to return to Baddeck during my Dart continues to live on, and was certainly enhanced by a special vacations and continued at these times to work with Mr. Bell

presentation made at ISASI 2008. and his associates. ISASI 2008 PROCEEDINGS Capt. Gerry Davis, an ISASI and ALPA member, donned the per- The Aerial Experiment Association was formed in the sum- sona of John McCurdy and delighted the audience with a recap of the mer of 1907. The members were Dr. Bell, F.W. Baldwin, Lieu- aviation pioneer’s life and a “first person” account of the famous Sil- tenant Thomas Selfridge, U.S.A., Glenn H. Curtiss, and me. ver Dart flight described above and its many achievements. He has The United States Army was interested in the development of flown more than 18,000 hours in 28 aircraft types over 31 years and flight and therefore had Lt. Selfridge serve as its observer in has investigated or participated in three major fatal accidents includ- the Association. ing Swissair Flight 111 and a number of smaller non-fatal accidents. The AEA conducted experiments during the summer and For 5 years, he served as the vice-chairman of ALPA’s Accident Inves- fall of 1907 at Baddeck with tetrahedral kites, with motors, tigation Board.—Editor) and with serial propellers mounted on boats. The first experimental flight carried out by the group took place on Dec. 6, was born at Baddeck, Nova Scotia, where I spent the early 1907. The test aircraft, piloted by Selfridge, was a large, tetra- years of my life. In 1906 I graduated from the University hedral kite placed on pontoons called the Cygnet I. It was Iof Toronto with the degree of mechanical engineer. Early pulled by the steamboat Blue Hill on Bras d’Or Lake, Nova on I became interested in aviation and in the construction of a Scotia. Cygnet I reached a height of 51 meters and remained machine that would fly. Dr. Alexander Graham Bell also had a in the air for 7 minutes, but when it landed on the lake the home at Baddeck, Nova Scotia, where he carried on experi- towline was not released and the kite with Selfridge was pulled ments with flying machines. I grew up in the company of the below the water’s surface. The kite was destroyed, but Selfridge Bell family and was a familiar presence at Beinn Bhreagh, the was rescued. Bells’ summer estate. I was later among a group of four young In December 1907, we decided to move to Hammondsport,

LEFT: John A.D. McCurdy at the wheel of the Silver Dart at Hammondsport, New York. ABOVE: “McCurdy,” aka Gerry Davis, relates his story to ISASI delegates.

ISASI 2008 Proceedings • 11

Proceedings 2008.pmd 11 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 12 news centersoftheworld.These were thefirstpublicflights permanent record oftheeventbysendingtelegrams tothe have graspeditsfullsignificance andhetherefore preserved a Bell, beingofmature judgmentinthesematters,seemedto recognize thehistoricsignificanceofthisflight;however, Dr. at thecompletionofflight. event wasthegreat pleasure andanimationinDr. Bell’sface tors, butthethingthatstandsoutmostinmymindof the lookofabsoluteastonishmentonfacesspecta- back tothestartingpoint.Onethingthatimpressed mewas length ofBaddeckBay. the biplaneabout9metersoffice,andIflewentire arunofabout100feet,ittooktotheair.on skates.After Ilifted event. Havingtaken myseat,themachinewas released bymen couple ofhundred spectatorswhohadgathered towitnessthe on theshore amidsttheincredulous stares andremarks ofa completely free ofsnow. We wheeledtheaircraft outofitsshed day. It was abrilliantwinterdayandtheiceofBaddeck Baywas I remember thecircumstances ofthatflightasifitwere yester- d’Or Lake onFeb. 23,1909,thatdrew theattentionofworld. Dart’s firstCanadianflight,from thefrozen expanse oftheBras machine ImadeaflightonDec.12,1908;however, itwasthe tific AmericanTrophy. kilometer inthewesternhemisphere andreceived theScien- 4, 1908,itsettherecord forbeingthefirstaircraft toflyone more than3kilometers.WhenitwasflownbyCurtissonJuly tween June21andAugust31,withthelongestflightlasting next aircraft wastheJuneBug.Itflownmanytimesbe- structive crashinwhichIwasslightlyinjured. TheAssociation’s nally onMay23bymyselffor183meters,landingwithade- for 73meters;byCurtissonMay20,310andfi- Baldwin onMay18,for82meters;bySelfridge19, Hari soon calledailerons byanotherwell-knownavia the wings,whichimproved stability. Thesecontrol flapswere the membersofAssociationdevelopedcontrolled flapson were made.Thenext aircraft wasnamedtheWhiteWing, and control thatledtoitsdestruction. or pitch,ofanaircraft’s noseortail),anditwasthislackof an elevator(acontrol usedtoadjusttheupanddownmotion, damage totheaircraft. TheRed Wing hadnocontrols except His secondflighttookhim37meters,butendedwithheavy Baldwin successfullyflewitonMarch 12,1908,for97meters. signed specificallyforaircraft wasusedintheRed Wing. Casey Red Wing becauseofitscolor. ThefirstengineCurtissde- of thedesignamachine. worked together, althougheachoneinturnhadgeneralcharge machines thatwouldfly; themembersofAssociation Hammondsport toexperiment withglidersandthentobuild This movewasmadeonDecember24.We proceeded at New York, where Mr. Curtisshadafactory, tobuildaglider. • ISASI 2008 ISASI The youngermembersofourgroup didnotimmediately I landedontheiceaboutone-halfamileawayandtaxied The onecalledtheSilverDartwasdesignedbyme.Inthis W The White Following theconstructionofRed Wing, othermachines The firstmachinebuiltbytheAssociationwascalled Farman. Proceedings ing wasflownfourtimesin1908:firstby 12 tion pioneer, the entirelengthofBaddeckBay.” about 9metersofftheice,andIflew it tooktotheair. thebiplane Ilifted arunofabout100feet, on skates.After seat, themachinewasreleasedbymen to witnesstheevent.Havingtaken my hundred spectatorswhohadgathered lous staresandremarksofacouple shed ontheshoreamidstincredu- “We out ofits wheeledtheaircraft tory ofaviationinCanada. chanical, participatedinsome “watershed”eventsinthehis- of pure interest andchildhoodfascinationwithallthingsme- named lieutenantgovernorofNovaScotia. production fortheCanadiangovernment,andin1947Iwas During World War II,Ibecameassistantdirector ofaircraft during thattimenotasinglemanwashurt. factured onfor2yearsand byus.Thisschool wascarried Company, thestudentsusingmachinesthatwere manu- general manager, andrantheschool inconjunctionwiththis Aeroplanes andMotors,Limited,ofwhich I waspresident and nized asasubsidiaryoftheCurtissMotorCompany, the Curtiss in Canada,andwetrainedmore than600men.Ialsoorga- aviators forserviceinthewar. Thiswastheonlyaviationschool request ofthegovernmentorganized atrainingschoolfor the usestowhichaero planecouldbeput. messages andpassengersforthepurposeofdemonstrating distance of110miles.Duringthistime,Ifrequently carried of sightlandflyingfrom Key West, Fla.,toHavana,Cuba,a ing messages.In1910,Imadethefirstflightacross waterout ments inFloridaandsucceededbothsendingreceiv- first timesentfrom anaero planeawireless message. less experiments atSheepsheadBayRaceTrack andforthe opment oftheaero plane.In1909Iconductedthefirstwire- onthefurtherdevel- and toobtainfundswithwhichcarry purpose oftheseexhibitions wastoadvertiseCurtissmachines States eastoftheMississippiRiverandalsoinMexico. The gave exhibition flightsinpracticallyeverystateoftheUnited took partintheworkofthisCompany. For severalyears,I first flightsthathadeverbeenmadeintheBritishEmpire. The flightsthatImadewiththeSilverDartinCanadawere the making manyflightsandcoveringinallmore than1,000miles. flew theSilverDartinagraceful7-kilometercircle. that hadeverbeenmadeinaero planes.Thefollowingday, I Depending uponyourviewpoint,Isurmisethathave,out In lateryears,Iworked intheaviationsupplybusiness. In thefallof1914,ImovedbacktoCanadaandat ontheseexperi- thefirstofJanuary1910,Icarried After In 1909theCurtissExhibitionCompanywasformed,andI I continuedflyingthemachinethrough thewinterof1909, 1/14/2009, 8:22 AM ◆ DHC-6 Twin Otter Accident off the Coast of Moorea, French Polynesia By Alain Bouillard, Investigator-in-Charge, Special Advisor to the BEA (Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation civile) and Arnaud Desjardin, Safety Investigator, BEA Engineering Department

Alain Bouillard began his career as an air traffic the previously determined location. The BEA had had experience controller for the French Air Force in 1968. In 1975, in this field, the most recent being assisting in the recovery of the he joined the French Civil Aviation Authority working recorders from a B-737 off the coast of Egypt1 and later from an for the air Navigation Services at the Roissy Charles- Airbus A320 off the coast of Russia2. TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, de-Gaulle Airport. In his position as and engineer in aeronautical operations and air traffic management, 2. Signal triangulation Alain joined the BEA in 1992 and took part in The accident aircraft was equipped with a CVR. Pinger signals numerous investigations in France and abroad. He was the investigator- transmitted by the underwater locator beacon (ULB) on the re- in-charge for the Concorde accident in Gonesse (France). In 2003 Alain corder were set off on contact with water. A BEA directional hy- was appointed as regional and airport director in Rennes (France). In drophone was used to determine the signal’s bearing from sev- 2006 he came back to the BEA and became the special technical advisor eral positions. Coupled with a GPS receiver, this allowed the chart- to the director of the BEA. Alain is in charge of the investigation on the ing of numerous measurements. In theory, these would define Twin Otter accident in Tahiti. He is a pilot with multiengine and the zone from which the signal originated. instrument ratings. He holds the TBM700 and ATR 42 type ratings. In reality, acoustic wave propagation depends on various linked parameters, such as salinity and water temperature, which vary Arnaud Desjardin has a masters degree in aeronau- with depth. In addition, when an acoustic wave propagates in the tics from the French National Civil Aviation School sea, it is subject to refraction, which generates multiple trajecto- (ENAC). He joined the BEA Engineering Department ries, especially when the sea bed slope is around 40% as is the in 2005, after 6 years in the U.S. developing software case between Moorea and Tahiti. This meant that it was some- tools for the FAA’s air traffic control system. He is now times impossible to distinguish between a reflected wave and the the head of Flight Recorder and Performance Division direct wave signal. A total of about 40 measurements were made, of the BEA. He has participated in major international as shown in Chart 1. investigations, including the Air France Airbus A340 in Toronto, the Commonsense and sound judgment were then necessary to “fil- West MD-82 in Venezuela, and the Air Moorea Twin Otter in Tahiti. ter out” unrealistic bearing measurements. First, the ones that were obviously diverging from the others were eliminated. They were 1. Introduction probably pointing to a secondary echo and not the direct signal. On Aug. 9, 2007, the DHC-6 Twin Otter registered F-OIQI, mak- Secondly, knowing the actual conditions in which the measure- ing an inter-island flight from Moorea to nearby Papeete in Ta- ments had to be performed, it would not be reasonable to say that hiti, crashed into the sea shortly after takeoff. Nineteen passen- the precision on bearing measurements was less than 10°. gers and one pilot were on board this scheduled 7-minute flight, Indeed, bearing readings were made with a magnetic compass planned at a cruise altitude of 600 ft. There were no survivors. Apart from a few pieces of wreckage, most of the airplane sank within minutes to a depth of about 700 m. Because of its weight category and the date of its airworthiness certificate, the airplane was not required to have any flight recorders. How- ever, it was in fact equipped with a CVR, which proved to be extremely useful for the investigation. The BEA undertook two successive search missions: the first was aimed at assessing an area where the flight recorder might be. The second was to recover a maximum number of airplane parts from the sea floor, given Chart 1

ISASI 2008 Proceedings • 13

Proceedings 2008.pmd 13 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS door with a metal spear carried bytheROV.door withametalspearcarried Acableconnectedat the aircraft, wasspottedatadepthof666m. containingtheCVR, unfavourable meteorological conditionsandseacurrents. namic positioning(DPII)systemthatallowsittoworkevenwith tons ofsupportequipment.The 14 Figure 1.The ure aheavyROV 1).Itisadapted tocarry a 140-meter-longcable-layingshipwasusedforthismission(Fig- cover therecorder andwreckage from theseafloor. The The secondphaseofthemarineoperationsthenbegantore- 3. CVRrecovery m indiameter. initial search zone before “filtering”wouldhavebeenover4,000 and limitedthesearch zonetoacircle of260mindiameter. The (Chart 2). In theidealcase,allbearingsshouldintersectwitha90°angle criteria make therange ofpossibleintersectionsexpand rapidly. bearings thatwere offbylessthan30°,becausethe10°accuracy decided toignore theintersectionsofmeasurements with noise ofnearbyboatsmadethistaskevenharder. Itwasthen direction from whichthe perceived signalwastheloudest.The set, addingadegree ofsubjectivitywhenitcametofindingthe were determinedbylisteningtotheacousticsignalwithahead- made thisconditiondifficult,asdidthefactthatbearings that hadtoremain horizontaltobeaccurate.Six-foot-highwaves Chart 2 The planwastopierce thefuselagethrough therear baggage Within minutesofthefirstROV dive(Figure 2),thetailsectionof This methodenabledamore precise localizationtobedefined • ISASI 2008 ISASI Ile deRé Proceedings 14 , a140-meter-long cable-layingship. Ile deRé 3 onitsdeckwith50 has anadvanceddy- Ile deRé , Figure 3 Figure 2 the samelocation. the variousflightcontrol cables,wassubsequentlyrecovered from and brought tothesurface.Therest ofthetailsection,including moreAfter thansevenhoursofhard labor, theCVRwasextracted mountedtoolsandtojustriptheCVRfromthe ROV’s itsrack. covered, itwasdecidedtocutthrough thesideoffuselagewith 1/14/2009, 8:22 AM the CVRabsolutelyneededtobere- by theROV afewhourslater. Since lay. the bottom,causinga36-hourde- the weight.Thewholethingsankto head thatwasbeingusedtosupport tachment cablecutthrough thebulk- the surface.Atthatmoment,at- the tailsectionreached 50mfrom seemed tobegoingasplanneduntil thing outofthewater(Figure 3).All ship’s cranewasusedtoliftthewhole around afuselagebulkhead. The through thetailsectionandknotted the speartipwasthenpassed The tailsectionwasspottedagain 4. EGPWS The CVR was sent immediately to the BEA for readout. The aircraft was also equipped with an EGPWS4, which generated alerts in case of • excessive rate of descent close to terrain (mode 1) • loss of altitude after takeoff (mode 3) Aural alerts from these two modes were recorded on the CVR. A partial vertical profile of the aircraft trajectory was later calculated based on the data obtained relating to the recorded alerts.

4.1 Base data and assumptions • The EGPWS installed on the aircraft was assumed to have been functioning according to Honeywell’s product specification5 at the time of the accident. Figure 4 • The CVR events used as input for the calculations are shown TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, in Table 1. • At relative time t=0 s, it was assumed that the aircraft was still climbing at a vertical speed of 600 ft/min. • The mode 3 “Don’t Sink” alert envelope for turboprop aircraft is based on altitude loss and radio altitude6: • Mode 1 “Sink rate” alert (Figure 4) and mode 1 “Pull up” warning envelopes for turboprop aircraft (Figure 5A and B) are based on minimum terrain clearance and altitude rate: • The aircraft was over the water from just after takeoff to the end of the flight. Therefore, for the purpose of this calculation, altitude and radio altitude are the same.

4.2 Method Figure 5A (above) and Figure 5B (below) Altitude as function of time (t) was modelled by a 4th degree polynomial equation: Alt(t) = k0 + k1t + k2t² +k3t3 + k4t4 (in ft) Vertical speed is the mathematical derivative of altitude: Vz(t) = d Alt(t) / dt Vz(t) = k1+ 2 k2t +3 k3t² + 4 k4t3 (in ft/s) Altitude rate in FPM in descent (for mode 1 envelope equations) can be deduced from vertical speed in ft/s: Altitude Rate (t) = -60 * Vz(t)(in FPM, or ft/min) The equations (Table 2) are based on the base data and assumed conditions of paragraph 4.1. Relative time t1 is the time at which the altitude was the highest. Since the aircraft was assumed to still be climbing at t=0, we can say that t1 is greater than 0. Furthermore, since a “Don’t sink” alert was recorded at t=4.1s, the aircraft was already descending at that time, which means that t1 is less than 4.1 s. There- fore 0

4.3 Results In Table 2 the equations (1) to (6) only have one solution7 that

Table 1 Table 2

ISASI 2008 Proceedings • 15

Proceedings 2008.pmd 15 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 16 of theelevatorcableduringflapretraction. signed tovalidatethecalculatedflightpathincaseofarupture warnings, aseriesofflighttestswere scheduled.Thesewere de- nesses andreconstituted onthebasisofGPWSalertsand To understandtheairplane’sfinalpath,asdescribedbywit- 5. Further tests airplane’s CVR(Chart3). tor matchedthesequenceofthoserecorded ontheaccident ft/min. min 08.8s.Theverticalspeedwhenitstruckthewaterwas6,500 the aircraft reached a maximumaltitudeof350ftat22h01 complies withthecondition0

ISASI 2008 Proceedings • 17

Proceedings 2008.pmd 17 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 18 TSB, theFAA, theSwissFOCA, failure. improving cockpitinstrumentationincaseoftotalelectrical • before andsince, wastheirinabilityto standard fortheentire industrytoemulate—especiallytoday. bone oftheaircraft’s transformationand,inmyopinion,setsa be completedonallremaining byFebruary 19MD-11s 2002. scheduled formodificationinJuly2001,andtheprogram would subsequent heavymaintenancevisit(HMV).Thefirstaircraft was kets intherest oftheaircraft wascompletedduringeachaircraft’s blanketing inaeroplanes. Thereplacement oftheremaining blan- ant heatanddirect exposure toflamequalifythermalacoustic test) developedbytheU.S.FAA involvingacombinationofradi- uct passesthemore rigorous test(thanthesimpleverticalflame was replaced withmore fire resistant metalizedTedlar. Thisprod- critically significantareas duringtheModi-Plus modificationsand tially, allMylarinsulationmaterialwasremoved from themost ing. Swissair, ontheotherhand,responded expeditiously. Ini- were highlyflammable,yetwe,asanindustry, didlittletonoth- them servicebulletinsorADs. Theytotallyrejectedoperators ofMD-11s. theideaofmaking implement thesemodificationsormake themavailabletoother tioned criteria. atapprovedsiderable timetoarrive solutionsfortheabove-men- site evenlessso.Thebottles are usuallyofthetotal discharge the fire. Accessisneverensured andeffectivesmotheringofthe sumed thatseveralwillbewasted duringinitialattemptstofight ber ofbottlesare scattered throughout thecabin,itmustbeas- cessible locationwithinthecabin.Whereas aconsiderablenum- adequate toconfront andovercome apersistentfire inaninac- minutes. Thestandard 2-pound-sizedHalonbottle istotallyin- this couldbefoughtformore thanaperiodofapproximately 15 if he/shewere abletolocatethesource, there islittlechancethat this structure, hasnoknowledgeofwhatliesbehindit.And,even member) andlacksthetoolsknowledgefordismantling behind decorativepaneling.Thehuman(evenatrained crew- of smoke andfire sources willbeinvisibletothehuman,hidden lation fans,thisdifficultyoflocationisexacerbated. Themajority pressure. With thepowerofairconditioning systemsandrecircu- cannot locateasource withanyaccuracy, especiallyundertime however senseonlythepresence ofasmell.Itisnotdirectional, it the humannoseasonlyfire andsmoke sensor. Thenosecan, aft pressure bulkhead,inthe21stcenturyweare stillrelying upon started inanafttoiletarea. by smoke duringthe evacuation.Thefire wasdeemedtohave 123 personsoutofatotal134diedwhentheywere overcome smoke accident,aVarig inParis B-707 inJuly1973.Atotalof why dowehavethese?Astheresult ofanotherfatalfire and sensing Halonextinguishers inthelavatorywastecontainers!And and here—can youbelieveit—westillhavenothing,except heat- but thelargest volumeofanaircraft consistsoftheaircraft’s cabin our enginecowlings.We havesimilardevicesinourcargo holds, their aircraft. For yearswehavehadfire and overheat sensingin As Swissairhadtocoordinate suchactionswithinBoeing,the The greatest obstaclefacedbyourcrew, andbycountlesscrews Then camethecleverengineering,whichformedback- We hadalready knownforyearsthatMylarinsulationblankets Maybe itoughttobenotedthatBoeingwasnotatalleager For theremainder ofanyaircraft, from theflightdeckto • ISASI 2008 ISASI Proceedings 18 2 andinternally, ittooksomecon- see whatwashappeningto sion, orsomethingmore drastic.In2003,Ihadmyown personal correct courseofaction—continuetheflight, immediatediver- ing theriskpresented bysucha situation andindecidingthe monitored indetail.This becameaninvaluabletoolforanalyz- status oftheelectricalcomponentsbehindpanelingcould be event oftheirnosessensingoverheat, burning,or smoke, the most intensepartoftheiraircraft’s electricalsystem,andinthe report wasproduced inMarch 2003. were madeduringtheinvestigation andlongbefore thefinal sponse totheCanadianTSBrecommendations, many ofwhich mately US$750,000toUS$1millionperaircraft. This entire modificationtooklessthan3weeksandcostapproxi- tion wouldbestrippedoutoftheaircraft andreplaced withTedlar. installation oftheModi-Plus systems,allMylarthermalinsula- the sameferocity everagain,itwasalsodecidedthatduringthe have solittleofinsuchsituations—TIME. fied, consumedcopiousamountsofthecommoditywe,aspilots, fully) thesource ofthesmoke. Thisprocedure, evenwhenmodi- cal systemandoneairatatimeinorder tolocate(hope- all designoftheaircraft andtheconceptofisolatingone electri- cameras couldbeselectedinturnbyarotary switch. in thecenterpedestalbetweentwopilots.Eachofeight both focusanddetailwere presented onascreen mounted compartment below. and ladderthatledthrough theflightdeckfloortoavionics AportableHalonbottlewaspositionedadjacent tothedoor • mounted inthepilots’wardrobe. third A large 5-poundbottlefortheflightdeckoverhead was • protect thegalleyceilingarea. ley, discretely covered andmountedontheforward bulkhead,to Two large 10-poundbottles were installedintheforward gal- • same monitored areas. livery System,HDS)thatwouldductHalonextinguishant tothe iature Primary FlightDisplay. theinstallationofanewstandbyinstrumentresembling amin- • head area, and rerouting andseparationofthecablingincockpitover- • avionics compartment, head area, twointheflightdeck overhead area, andthree inthe frared illuminators)—three intheforward first-class galleyover- nofewerthaneightinfrared video cameras(inadditiontoin- • miscellaneous smoke panel, MISCSMOKElightpush buttonsontheglare shieldanda • miscellaneoussmoke a alarmpanel, • control electronics units, • the Cockpitandfirst-classgalley, seriesofdual-loopsmoke a detectorsintheoverhead areas of • made upof tion ofaMiscellaneousSmoke DetectionSystem(MSDS).Thisis within veryfewminutesandcrew trainingreflects this. fighting; forsomereason wealwaysexpect fires tobeextinguished variety, noton-demand.Theywillsufficefor2–3hoursoffire For thefirst time,commercial pilotswere abletoseeintothe The Modi-Plus Program wasnothingotherthanadirect re- In order toreduce theriskofanelectricalfire spreading with We were, nevertheless,stillgoingtobehampered bytheover- The pictures generatedbythecameraswere intenselysharpin These were augmentedbyasystemofpiping(theHalonDe- The Swissair MD-11 Modi-PlusThe SwissairMD-11 Program includedtheinstalla- 1/14/2009, 8:22 AM 3 experience of an overheating relay in the galley overhead area At no time, though, are the crews ever expected to deal with over the South Atlantic at night, approximately 580 nautical miles the suppression of SFF in the cabin area for any period resem- southwest of Sal. Whereas I admit not being able to sleep thereaf- bling the time/distance away from an intermediate alternate. No ter during my rest period, it was most comforting to be able to additional fire extinguishant is mandated, nor have any addi- see behind the panels—to see around corners, so to speak. tional firefighting procedures been developed. It is simply and Having experienced using such a system in earnest, I cannot optimistically assumed that we will never be confronted by such a believe that 10 years after this horrifying accident we, as an in- situation. dustry, from the lawmakers to the manufacturers to the opera- However, how often have I heard my late colleagues criticized tors, are deliberately continuing to keep our flight crews in the for not having brought a seriously overweight MD-11 into a short dark. runway of less than 2,700 m? We who know how the fire devel- Let us have a brief look at the status of smoke, fire, and fumes oped that fateful night all now know what they should have done— (SFF). so we believe. Please, let us not forget that the SR111 fire went from a wisp of smoke to a raging inferno within 72 seconds. They 3. The continuing situation today trusted the manufacturer’s checklists and procedures—after all, • SFF is the 4th leading cause of passenger fatalities preceded what reason did they have to doubt them? The manufacturer TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, by loss of control, CFIT and specific component failure. must surely have run through every known scenario during its • There are more than 1,000 smoke events annually in the United more-than-75-year history. We pilots were led to believe that the States, 350 resulting in precautionary landings; 2,500 events system would solve the problem for us. worldwide. Now, we, who now know better, say that they should have • There is a 1:10,000 chance of an occupant experiencing an “landed” (now that’s an interesting word when discussing ETOPS!) SFF event. within 15 minutes because we all know that we only have 15 min- • Doors and/or cockpit windows should never be opened in flight. utes available before we risk losing control of a fire outbreak. • Halon is still regarded as being the best extinguishing agent. History proves this. Or does it? • AC 25-9: smoke testing in a cockpit is switched off after 3 mins. And yet, ETOPS is designed to take us up to 207 minutes away It assumes this will happen in real life.4 from a “landing” possibility. That is the thinking behind the con- • 60% of aircraft fires are electrical. cept so that we can operate all over the planet without any gaps • Insulation materials do burn, especially when contaminated in the mid-Atlantic or mid-Pacific route structure. And yet, we are with maintenance fluids. told again and again to “get it down.” • Pilot and cabin crew training is still woefully inadequate—avail- I can remember the slightly amusing training semester in able extinguishant is, too. Swissair following SR111. The simulator refresher exercises were • There is still no fire detection and suppression in unprotected geared to getting the MD-11 down to 1,000 ft in the shortest areas (outside engines, APU compartments, and cargo holds). possible time. This vision was most commendable, especially when • There are wiring anomalies in 100% of the world’s fleet. considering the feat of the Air Canada DC-9 crew in Cincinnati Following TWA Flight 800, a survey found 24 of 25 B-737s in in 1983. However, the cynic in me started to laugh. Down to 1,000 line service had evidence of metal shavings in wiring bundles. ft as quickly as possible? But doesn’t a ditching or forced landing The 25th did, too, but was still on the manufacturer’s ramp at only begin at 1,000 ft? You certainly have not mastered the emer- Renton and had never been flown!5 gency with a level off at 1,000 ft. Without listing the sad chronology of FAA/JAA/EASA procras- So, I was forced to enquire “then what?” And there was silence. tination, we still have no internationally accepted and enforced Had SR111 been at 30° west when the fire broke out—what programs for upgrading an aircraft’s resistance to fire. In the would have been expected of the crew then? This could be termed same 10-year period, we still only offer our crews the ability to the third injustice a pilot faces in the SFF scenario. Firstly, the fight a cabin fire for 15 minutes. Why do we continue to assume pilot is blind to the source. Secondly, firefighting capabilities are that all fires will extinguish in that time? Is that because we as- limited. And thirdly, he/she has no training in the ultimate res- sume that a well-trained crew will manage to have their aircraft cue procedure of his/her aircraft. We have never taught a mod- safely back on the planet within that mythical 15 minutes? ern commercial pilot how to ditch his/her aircraft. This must be No. And why am I so sure? ETOPS6! the only emergency that a simulator cannot replicate. We inform Since the early 1980s with the advent of the A310 and B-767 passengers every day on how to get out of the aircraft on water twins, we have been continually extending the ETOPS limits from but have never spent a minute teaching a pilot actually how to 60 minutes single-engine cruise distance from an intermediate get onto the water. This is made all the more incomprehensible alternate up to 180+ minutes today. For those not familiar with when the statistics above are considered for their implications on ETOPS, these flights include those not only over oceans but also modern air transports. over deserts—be they hot and sandy or frozen wastelands with a Data exist everywhere on the ditching characteristics of air- total absence of infrastructure. craft. The manufacturers have data, the various military services The main criteria for qualifying an aircraft for ETOPS have possess data—often based upon firsthand experience. Why can traditionally been powerplant reliability, electrical power genera- this not be shared with operating crews? Why does the subject, to tion redundancy, and fire suppression within the aircraft’s cargo this day, remain taboo? holds. The pilots additionally have to undergo special ETOPS At a seminar a year ago at the Royal Aeronautical Society in training, making them familiar with operating rules and the com- London on the subject of smoke, fire, and fumes, a debate ensued plexities of enroute fuel calculations, weather minima, etc. following several quality presentations including one by Capt. John

ISASI 2008 Proceedings • 19

Proceedings 2008.pmd 19 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 20 for alongtime. are already inourpossessionandhave,allprobability, been require tomake aircraft saferfrom thethreat offire inthefuture aspect ofaviation.However, Iamcertainthatallthefactswe commercial decisionshavedictatedtheexpenditure on every not thecase. kicked outofourlethargy atthelatestin1998.Sadly, thisisclearly from ourslumbersandnonchalantattitude.We shouldhavebeen fires inourhistorytoimaginewewouldhavebeenshaken up good anindustrytorely onthe“luck”factor. We havehadenough issue ofSFFwecanonlyhangourheadsinshame.We are too one proclaiming aviation’s admirablesafetyrecord, butonthe “burning” issueunderthecarpet.Notadaygoesbywithoutsome- As anindustry, weare doingourselvesnofavorsbybrushingthis 4. Wherenow? an actualenginefailure ina40-year career. becomes almostinstinctive.Yet, thepilotmayneverexperience various phasesofflighttothepointthathis/herreaction tosuch pilot experiences anynumberofenginefailures inasimulator tion astowhytheyare. To countermostproffered arguments, a syllabus—inexplicable, asno-onehasawell-researched explana- ing andforced landingsare stillexcluded from thepilottraining were itinmid-oceanrather thanbelow1,000ftonfinalapproach. eventinJanuarythisyear, B-777 2001 ortheBritishAirways there beasimilarrepetition oftheAirTransat eventinAugust that pilotsmayfindthemselveswithlittlechoicetobemadeshould nity. We choosetoignore thisdebateatourperil. of theretired captainprevails withinmuchoftheflyingcommu- and equippedtohandlethisreal danger, asIamsure theopinion sis. Pilots inthe21stcentury should,onthecontrary, bewell-trained being inapositiontodebatethisquestiononwell-informedba- and lackofemergency landingtraining,pilotsare stillfarfrom becomes unflyable?Baseduponestablishedchecklists,procedures, untiltheaircraftsystem afteranotherasoccurred onourMD-11 still haveitundercontrol ordoyouwaituntilloseonecritical namely, doyouflyaserviceableaircraft ontothesurfacewhileyou suming youdoknowhowtoit,facethesecondnightmare— This stridentopinionforces ustoask,whatisthealternative?As- forcefully thathewouldneverputaflyabletwindownonwater. ber. Oneretired captain,formerlyflyingheavytwins,saidmost Cox, president mem- ofSafety OperatingSystemsandanISASI Commercial considerationshavedriventheETOPSdebate; For somequiteinexplicable reason, theprocedures forditch- While consideringthismatter, wemightalsoreflect onthefact • ISASI 2008 ISASI Proceedings 20 tranquil siteofPeggys Cove. This shouldbeapointworthreflecting uponduringavisittothe ask honestly, forhowmuchlongercanweallow thistopersist? vestigation process stalls.Inthearea ofsmoke, fire, andfumes,I beach.” time Iamcalledouttoacrashsite,mightjustaswellgothe mendations arisingoutofanin-depthaccidentreport, thenext actly 10yearsago,hesaid,“Ifwefailtoimplementtherecom- tor, EddieTrimble. seminarinBarcelona AttheISASI alsoex- same courseofaction. tions—there isnoexcuse fortheentire industrynottofollowthe not well-known. the threat. Itiscertainlynottheonlymethodbutanyothersare has alsodemonstratedonegoodexample ofameanstomitigate 3 2 1 Endnotes 6 5 4 Inmanyrespects, thecamerainstallationreflects theneedcitedby SwissFederal OfficeofCivilAviation. ExtendedRangeTwin Operations. Source ofstatistics:WiththankstoCapt.JohnM.CoxFRAeS—president, departedfrom InOctober1993,aSwissairMD-80 MunichtoZürich.Within Thisprogram wasmanagedanddriventhroughout byCapt.Ruedi zine, October2001 and diverttoLondon’s Heathrow Airport.—DavidEvans, thatforced thecrewB-767 toabandonitswestboundtransatlanticflight investigation ofa1998arcing eventintheavionicsbayofaUnitedAirlines inaccessible areas oftheaircraft. Thisfindingstemmedfrom theAAIB’s UK’s AirAccidentsInvestigationBranch(AAIB)forbetterfire detectionin Bornhauser. eral oftheaccompanyingPowerPoint slides are courtesyofCapt. achieved. Muchoftheinformationcontainedwithinthispaperandsev- less efforts,therealization ofSwissair’sModi-Plus wouldneverhavebeen Bornhauser, chieftechnicalpilotforSwissair. theMD-11 Without histire- Safety OperatingSystems. – EX003-0/93) of anairportwithexcellent airtrafficcontrol andfacilities.(BFU Germany save theaircraft. Oncemore, anaircraft wassaved thankstotheproximity on theoverhead panel—theswitchtobeusedinthelast-ditchattempt The electricalfailure wassubsequentlytracedtotheemergency powerswitch aircraft landedsafelybackinMunichwithinminutesandwasevacuated. trol changes.Thewindowbecamecoatedinsootalmostimmediately. The flight from timetobecameimpossible,necessitatingnumerous con- cockpit totheextent thattheinstrumentswere barely visibleandvisual ing offtherightandthenleftgenerator. Smoke builtuprapidly inthe panel. Thechecklistcalledforreducing theelectricalsystem byfirstswitch- crewmember asshestoodinthedoorway. Itoriginatedfrom theoverhead difficult tolocatethesource, butthiswaseventually discovered byacabin minutes oftakeoff, smoke developedinthecockpit.Again,itwasinitially SR111—“Why didtheydie?Whydowerefuse tolearn?” SR111—“Why Implementation isthepointatwhichaircraft accidentin- In closing,Irecall therenowned formerUKAAIBinvestiga- Swissair’s reaction wastoactupontheTSB’s recommenda- Swissair’s reaction toSR111proves thataction 1/14/2009, 8:22 AM is Avionics possible;it maga- ◆ Causation: What Is It and Does It Really Matter? By Michael B. Walker (MO4093), Senior Transport Safety Investigator, Australian Transport Safety Bureau

Michael B. Walker is a senior transport safety legal proceedings of interest to this paper are civil proceedings investigator with the Australian Transport Safety that arise from an accident. The purpose of such proceedings is Bureau (ATSB) and has been with the Bureau since the allocation of responsibility for the accident, or at least for the 1995. His primary role is to investigate human and damage or loss resulting from the accident. This purpose is di- organizational factors, and he has also been actively rectly achieved when the findings of the proceedings are made TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, involved in developing investigation methodology at (i.e., the findings state who or what is responsible). the ATSB. Mike has a Ph.D., masters, and honors As outlined by ICAO (2001) and others, the purpose of a safety degrees in psychology and human factors, and a diploma of transport investigation is to enhance safety (or prevent accidents), and it is not safety investigation. the purpose to apportion blame or liability. Safety investigations do not directly achieve their purpose, but information obtained from Introduction investigations can be used to enhance safety in many ways: Given recent interest in replacing or augmenting the term “causes” • Identifying safety issues that could adversely affect the safety with “contributing factors” in ICAO Annex 13 (ICAO, 2008), it is of future operations, and encouraging or facilitating safety ac- timely to have another look at the concept of causation. The pa- tion by relevant organizations to address these issues through per approaches the topic by examining several aspects of legal recommendations or other forms of communication. This is gen- proceedings and safety investigations: the purpose of an investi- erally the most effective way investigations can enhance safety. gation, the role of causation in an investigation, terminology, • Providing information about the circumstances of the occur- definitions, linking approach, standard of proof, and level of rence, and the factors involved in the development of the occur- guidance for making judgments. The key point of the paper is rence, to the transportation industry. Communicating such inthat, because legal proceedings and safety investigations have formation provides valuable learning opportunities. different purposes, they should have different approaches to cau- • Providing information for an occurrence database, which can sation; unfortunately, the approaches are often similar. then be combined with information from other occurrences and The paper also discusses how the ATSB has approached cau- used proactively for research and trend analysis purposes and sation as part of its enhanced investigation analysis framework. any necessary safety recommendations. An overview of this framework was provided by Walker (2007), and a more detailed discussion of how concepts such as causa- The role of causation in investigations tion and standard of proof were addressed was provided in a In legal proceedings, determining causation is essential for achiev- recent ATSB research report (Walker & Bills, 2008). This paper is ing the purpose of allocating responsibility. An individual or or- a short summary of the latter report, and the interested reader is ganization cannot be held legally responsible for an accident referred to the full report for further details. unless their conduct has been shown to be a cause. In safety in- The subject of causation has been a matter of significant con- vestigations, determining causation is obviously relevant but not troversy in the aviation safety field (e.g., Rimson, 1998; Wood & essential for the purpose of enhancing safety. To explain this point, Sweginnis, 2006). The paper does not attempt to review previous it is worth looking at the ATSB concept of “safety factors.” discussions, but hopes to offer a few new ideas that may be of use The ATSB defines a safety factor as an event or condition that to organizations interested in revisiting this challenging concept. increases safety risk. As shown in Figure 1 (next page), a safety factor can be categorized in terms of whether it contributed to the Purpose of investigations development of the occurrence (or was a “contributing safety fac- The definition of cause in fields such as philosophy and law has tor” using ATSB terminology). A safety factor can also be catego- been a matter of significant debate and disagreement. However, rized in terms of whether it was a safety issue or a safety indicator. there does appear to be a widely held view that what is determined A safety issue is an organizational or systemic condition that can be as being a cause of a particular event depends on the purpose of reasonably regarded as having the potential to adversely affect the the inquiry or investigation (Doyle, 2002; Wright, 1988). safety of future operations (e.g., problems with procedures, train- A variety of legally based investigations may follow an occur- ing, safety management processes, regulatory surveillance). In con- rence (accident or incident). These include regulatory or admin- trast, a safety indicator is any other type of safety factor (e.g., tech- istrative investigations whose purpose is to determine whether nical failures, individual actions, or local conditions such as any requirements have been breached or to assess the suitability workload), which may indicate the existence of a safety issue. of an individual or organization for ongoing operations. For such Each safety factor identified by an investigation fits into one of investigations, determining if the individual’s or organization’s the boxes in Figure 1. Legal proceedings are interested in con- actions played a causal role in the occurrence is not relevant. The tributing or causal factors. However, for safety enhancement pur-

ISASI 2008 Proceedings • 21

Proceedings 2008.pmd 21 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 22 or “causes.”Inthesafetyinvestigation field,organizations usea Legal proceedings are concernedwithdetermining the“cause” Terminology as ameanstoachievethisratherthantheendpointitself. should beidentifyingsafetyissues,andcausationviewed investigations. However, theprimaryinterest ofsafetyinvestigations searching forpotentialsafetyfactors. should notstraytoofarfrom thepathsofcontributionwhen In otherwords, tobeefficientandtimely, safetyinvestigations the contributingsafetyfactorsthathavealready beenidentified. areas thatare related tothecircumstances oftheoccurrence, and for potentialsafetyfactorsneedstobepragmaticallyfocussed in report, regardless ofwhethertheycontributedornot,thesearch fied duringaninvestigationshouldberaisedin unlimited resources. Althoughanysafetyfactorsthatare identi- dits orexaminations ofanorganization orsafetysystemwith ciple foraninvestigation.Safetyinvestigationsare notbroad au- Theconceptofcontributionprovides acentralorganizing prin- • actually beeninvolvedinthedevelopmentofanoccurrence. tance ofaparticularsafetyissueonlyifitcanbeshowntohave Some organizations willunfortunatelyappreciate theimpor- • opment ofanoccurrence. reports toidentifyanddiscussthefactorsinvolvedindevel- Thepublicandotherstakeholders expect safetyinvestigation • tors (e.g.,ICAOAnnex 13). islation andstandards todeterminecausesorcontributingfac- Investigation organizations havevariousrequirements inleg- • ety ofreasons: tory ornot.However, topurely dothisisnotpossibleforavari- tifying safetyissues,regardless ofwhethertheywere contribu- contributing safetyfactors. will beidentifiedduringanoccurrence investigationasbeing the safetyissuesassociatedwithmostrisk,andnotallofthese ture operations.Therefore, themostimportantsafetyfactorsare poses, importanceshouldreflect thedegree ofsafetyriskforfu- Figure 1.Overview oftypessafetyfactors. In summary, forpragmaticreasons causation doesmatterforsafety Accordingly, safety investigationsshouldideallyfocusoniden- • ISASI 2008 ISASI Proceedings 22 with muchconfusionintheuse ofcausallanguage(Wright, 1988). ing policyjudgments)hasoften notbeenreflected inpractice, out policyjudgments)andthen determiningresponsibility (us- as thenotionofextent towhichthedamage wasforeseeable. (after thecauseofinterest) break the“chainofcausation,”aswell cepts suchas“remoteness,” andwhetheranyinterveningacts 2001; Wright, 1988).Thelatterpartoftheinquiryinvolvescon- any) shouldbeheldtolegallyresponsible orliable(Stapleton, and judgmentalaspectsofdeterminingwhichthecauses (if causes inlegalproceedings shouldbeseparatedfrom thepolicy Many legaltheoristshaveproposed thatthedeterminationof Definitions size thesafetyfocusofitsinvestigations. tributing safetyfactor.” Theword “safety”wasaddedtoempha- provide aricherpicture ofthefactorsinvolvedinoccurrence. term “contributingfactor”ismore inclusive,andcantherefore (e.g., U.S.DepartmentofEnergy, 1997).Thismeansthatthe degree ofrelationship totheactualoccurrence thanthecauses the contributingfactorsare generallydescribedashavingalower some analogoustermtogetherwith“causes:orsimilarterm, of legalproceedings. of asafetyinvestigation’s findingsasbeingsynonymouswiththose The useofadifferent termcanhelpminimizemisinterpretation fore iscommonlyassociatedwiththeallocationofresponsibility. term “cause”iscommonlyusedinlegalproceedings andthere- “contributing factor”insteadofonebasedon“cause.”Firstly, the an occurrence. There are alsoadvantagesinusingaterm suchas one termtodescribethefactorsinvolvedindevelopmentof issues thatmaybeidentifieddidnotcontribute. occurrence, andit doesnotclearlydealwithimportantsafety cus ofattentiontofactorsinvolvedinthedevelopment addressing theunderlyingfactors.However, italsolimitsthefo- sus root cause).Thisapproach emphasizestheimportanceof their potentialforpreventing recurrence (e.g.,direct causever- ceptions interfere withthepurposeofsafetyenhancement. ures andindividualactionsratherthansafetyissues,suchper- other factors.Asthesefactorswillgenerallyinvolvetechnicalfail- associated withmore responsibility fortheoccurrence thanthe tions thatthefactorsinclosergroup are more importantor tors inthiswayhasthesignificantpotentialtoleadpercep- tionship (e.g.,contributingfactor).Differentiating groups offac- other termsare usedforfactorsthathavealowerdegree ofrela- degree ofrelationship (e.g.,direct cause,proximate cause)whereas they usesometermstodescribefactorsthathaveacloserorhigher degree ofrelationship totheactualoccurrence. Inotherwords, terms. Someorganizations differentiate termsonthebasisoftheir tributing factor, significantfactor). explanatory cause),thoughothertermsare alsoused(e.g.,con- proximate cause,root cause,contributingdescriptive “cause” (e.g.,cause,causalfactor, direct cause,probable cause, ment ofanoccurrence. Thesetermsare commonlybasedon variety oftermstodescribethefactorsinvolvedindevelop- However, thisdistinction betweendeterminingcauses(with- For thesereasons, theATSB haschosentousetheterm“con- Secondly, whenorganizations use“contributingfactors”or Given theseobservations,there are advantagesinjustusing Sometimes organizations differentiate termsonthebasisof It isrelatively commonforanorganization tousemultiple 1/14/2009, 8:22 AM Many also hold the view that policy and judgment issues are nec- Linking approach essary for the determination of causation as well as the determi- There can be significant differences in but-for definitions depend- nation of responsibility. Part of this view appears to be associated ing on what is the effect or subject being explained. In other with the lack of agreement on the appropriate test to determine words, what does the proposed cause or contributing factor link causes. to? There are two basic approaches: the relative-to-occurrence Many different tests or approaches have been proposed and approach and the link-by-link approach (see Figure 2). used for legal proceedings. The most common approach is the In the relative-to-occurrence approach, the subject is the oc- use of the “but-for” test, which states that an event or condition currence itself. In other words, if the safety factor did not hap- (usually an individual’s or organization’s conduct) is a cause of pen, then the occurrence would not have happened. This is the the damage of interest (for example, injury, death or other loss) approach used in legal proceedings, with the subject being the if, but for the act or condition, the damage would not have oc- accident or the damage resulting from the accident. It is also curred. In other words, if the cause had not occurred, the acci- often used in safety investigations, with the subject being the oc- dent (or the damage) would not have occurred. currence, or in some cases also the severity of the consequences The but-for test (also known as the counterfactual conditional) arising from the occurrence (e.g., Australian Standard 4292.7- is widely acknowledged to be simple and work well in most situa- 2006; ICAO, 2003). TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, tions (Honore, 2001). There are some limitations with the test, In the link-by-link approach, the subject can either be the oc- such as “overdetermination,” although these problems are more currence itself or another “cause” or contributing factor. In other salient when using the test for legal purposes and are less critical words, judgments about contribution are made about the strength to other fields such as science (Stapleton, 2002). Various solu- of links between factors, rather than made in terms of the overall tions have been proposed to overcome the limitations, though relationship between each potential factor and the occurrence none appear to solve all the problems and none have been widely itself. The ATSB definition incorporates a link-by-link approach. agreed in the legal field. Consequently, the but-for test is often Others have also advocated a link-by-link approach for safety supplemented by the use of “commonsense” and policy judg- investigations (e.g., Hopkins, 2000), and the International Mari- ments when determining causes in legal proceedings, and the time Organization has also recently adopted a similar definition concepts of causation and responsibility are very closely related to the ATSB, using the term “causal factor.” in such proceedings. In the safety investigation field, ICAO Annex 13 defines “causes” as “actions, omissions, events, conditions, or a combination thereof, which led to the accident or incident.” Such statements describe what types of things causes can be but provide minimal indication of their meaning. Some organizations have adopted the Annex 13 definition, whereas some others appear to have no clear definition. Nonetheless, the but-for test has gained widespread acceptance in the safety field as a means of defining cause-related terms (e.g., Hopkins, 2000; ICAO, 2003; NASA, 2006; USAF, 2006). The term “contributing factor” is often used without any definition. When it is defined, the definitions can vary widely. For example, it has been described as something that increases the likelihood of an accident (U.S. DOE, 1997), or something that may have contributed to an occurrence (NASA, 2006). It has also been defined in terms of the but-for test (Australian Standard Figure 2. Comparison of linking approaches. 4292.7-2006). The but-for test, also known as the counterfactual conditional, The relative-to-occurrence approach has merit when the purpose is therefore a common part of legal proceedings and safety in- is to determine responsibility for an occurrence. However, there is a vestigations. It is also widely used in other fields. Accordingly, the significant dilemma associated with the approach that fundamen- ATSB used the test as the basis for its definition of a “contribut- tally constrains its potential for enhancing safety; the most effective ing safety factor.” More specifically, it defined a contributing safety findings for safety enhancement (safety issues) are the most difficult factor to an occurrence as a safety factor that, if it had not oc- to justify. As discussed above, for pragmatic reasons an investigation curred or existed at the relevant time, then either cannot stray too far from the paths of contribution when searching • the occurrence would probably not have occurred or for potential factors. The more remote the investigation proceeds • adverse consequences associated with the occurrence would away from the occurrence when identifying potential factors, the probably not have occurred or have been as serious or more difficult it becomes to meet the relevant standard of proof for • another contributing safety factor would probably not have contribution or causation. As safety issues are generally quite re- occurred or existed. mote from the occurrence, they are generally going to be less likely However, there are two important aspects of the ATSB defini- to be looked for or found to be contributing or causal. tion that are different to how the but-for test is generally used. In contrast, by making judgments about each link separately, These include the linking approach and the standard of proof the link-by-link approach has more scope to proceed more re- included in the definition. motely from the occurrence. The approach therefore has the

ISASI 2008 Proceedings • 23

Proceedings 2008.pmd 23 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 24 required, orvarythestandard ofevidence(orquantity orquality 1999). Asaresult, decision-makers mayvarythestandard ofproof minor matters(Anderson,Schum, &Twining, 2005;Redmayne, to makingfindingsformore seriousmattersasitisforrelatively is ageneralviewthatitunreasonable totake thesameapproach However,occurred. thestandard isnotthatstraightforward. There matter ofinterest hastobefoundhave“more likely thannot” only onepartywillhavethe“burden ofproof.” should bethesameforbothpartiesincivilproceedings, although with thegeneralviewbeingthatriskofanerroneous decision than thatusedincriminalproceedings (beyondreasonable doubt), ponderance oftheevidence”inU.S.Thisisalowerstandard beyond thebalanceofprobabilities” insomecountriesor“pre- sion forthepartiesinvolved. pending ontheimplicationsassociatedwithanerroneous deci- cepted orproven. Different standards ofproof are appliedde- determination ofacause)mustbeestablishedinorder tobeac- to thedegree ofcertaintywithwhichacontestedfact(suchas ”isusedtorefer In thelegalsystem,term“standard ofproof Standard ofproof considering thestandard ofproof thatisusedforthelinks. approach ATSB (see“The experience”). Itcanalsobeminimizedby rectly compared withfindingsproduced byarelative-to-occurrence findings produced withthelink-by-link approach shouldnotbedi- approach beingusedbythe investigation,andemphasizingthat can beminimizedbyclearlydefiningthetypesoffindingsand the riskoffuture accidents. the importanceofaddressing thesafetyissuesinorder toreduce Such misinterpretation caninterfere withanunderstandingof may beperceived bythesepartiestobeweakorpoorlysupported. result, someofthefindingsaboutcontributing andcausalfactors parties asbeingbasedonarelative-to-occurrence approach. Asa using alink-by-link approach canbemisinterpreted bysome concept ofpracticabilitywhenidentifyingpotentialfactors. with acleardefinitionof“stoprule”andconsiderationthe bly addressed byanyorganization. Thisproblem canbeminimised from theoccurrence andidentifyfactorsthatcannotbepractica- Firstly, there maybeagreater tendencytoproceed tooremotely compensation consequencesinmind. respond tosafetyinvestigationfindingswithfuture liabilityand tion withlegalproceedings hasthepotentialforsomepartiesto readily interpreted intermsofalegalperspective.Thisassocia- investigations conductedusingthisapproach cantherefore be approach isusedinlegalproceedings, andthefindingsofsafety tellectually rigorous. Inaddition,arelative-to-occurrence tion andbetterenableaninvestigationtobemore openandin- by-link approach canleadtosimplerjudgmentsaboutcontribu- proach compared witharelative-to-occurrence approach. Alink- ture ofthefactorsinvolved. providing more learningopportunitiesbyproviding aricherpic- sufficient evidencetobetermedcontributingornot),aswell potential toidentifymore safetyissues(whetherultimatelywith The civilstandard isgenerallyinterpreted tomeanthat the In civilproceedings, thestandard ofproof istermed“proof The potentialformisinterpretation ofthelink-by-link approach A secondproblem isthatfindingsaboutsafetyissuesproduced There are alsopotentialproblems withalink-by-link approach. There are otheradvantagesassociatedwithalink-by-link ap- • ISASI 2008 ISASI Proceedings 24 tensively ontheexpertise of the decision-maker. ing determinationsisusually notformallydefinedandrelies ex- investigations, themeansof examining theevidenceandmak- clear definitions.However, for both legalproceedings andsafety assist inmakingthesejudgments,investigatorsneedmore than found tobecontributingorcausalfactorscandifficult. To Making decisionsaboutwhateventsandconditionsshould be ofguidance Level tor hadnotexisted, thentheoccurrence “may”nothaveoccurred. can besaidinsuchsituationsisthat,ifthecontributingsafety fac- ship totheoccurrence itselfmaynotbemet.Asaresult, allthat issues, thebalanceofprobabilities standard foradirect relation- 66%. Nevertheless,forcontributingsafetyfactorsthatare safety link willbehigherthantheminimumrequired levelofmore than tial inpractice.Inmanysituations,thelikelihood levelforeach and theoccurrence itselfovermultiple linksmaynotbesubstan- (highest-level) factorandtheoccurrence. chain, thenthelowerlikelihood couldbebetweenthe first the crew’s actioncouldbeaslow45%.Themore linksinthe the resulting likelihood ofarelationship betweentheroster and crew’s actionwasassessedasbeingatleast67%likelihood, then ing atleast67%likelihood, andthelinkbetweenfatigue link betweentheroster problems andfatiguewasassessedasbe- occurrence itselfwillgenerallydecrease usingtheATSB approach. the occurrence, thedegree ofrelationship ofthefactorsto ceeds toidentifycontributingsafetyfactorsmore remote from sus more than50%).ButasanATSB safetyinvestigationpro- close inproximity totheoccurrence (thatis,more than66%ver- proach willuseahigherstandard ofproof forfactorsrelatively approach andabalanceofprobabilities standard, theATSB ap- tal Panel onClimateChangeinearly2007. the high-profile usageofthatdefinitionbytheIntergovernmen- likelihood ofmore than66%(or two-in-three chance)following probability expressions tomean.However, thiswaschangedtoa research intowhatdifferent partiesconsidered different verbal hood of75%ormore, basedonaconservativeinterpretation of able” or“likely.” Initiallythiswasdefinedasmeaningalikeli- of contributingsafetyfactorwasalignedwithastandard of“prob- tively weakrole intheoveralldevelopmentofanoccurrence. factors thatwouldbeperceived bymanypartiesashavingarela- link-by-link approach, couldproduce more contributingsafety standard (suchas“balanceofprobabilities”), combinedwitha sues. TheATSB wasalsoaware thattheuseofarelatively low factors inmostinvestigations,particularlytermsofsafetyis- “almost certain,”orsimilar)wouldproduce fewcontributingsafety high orconservativestandard (suchas“beyondreasonable doubt,” standard foritspurposes,theATSB wasaware thattheuseofa ing contributingorcausalfactors.Inselectinganappropriate (or standard ofevidence)theyusewhenmakingfindingsregard- safety investigationsdonotclearlyspecifythestandard ofproof tions are notwellspecified. dard ofproof hasbeenmet. Manyaspectsofthesedetermina- of evidence)theywillacceptbefore determiningthatthestan- The reduction inthelikelihood betweenahigher-levelfactor For example, considerthesituationoutlinedinFigure 2.Ifthe Compared withlegalproceedings usingarelative-to-occurrence To achieveanappropriate compromise, theATSB definition As farastheATSB isaware, mostorganizations thatconduct 1/14/2009, 8:22 AM This does not mean to imply that some investigation approaches an investigation organization needs to consider many aspects. do not conduct a detailed, thorough, or high-quality examination The ATSB has examined these aspects and developed an ap- of the available evidence when determining contributing or causal proach to causation that is tailored to the purpose of safety factors. However, to improve the consistency and rigor of the deci- investigation. sion-making, a more systematic approach is warranted. In other Different organizations have different contexts, and not all as- words, there needs to be more science and less art. pects of the ATSB approach will be appropriate for other organi- To address this need, the ATSB analysis framework includes zations. However, based on the ATSB experience, the following several elements to assist in the determination of findings. These principles can be offered for those interested in reviewing or de- elements include veloping their own approach: • a structured and defined process for identifying potential safety • Terms and definitions should be clearly distinguished from factors. those used in legal proceedings. • a process for testing a potential safety factor in terms of its • Contributing or causal factors should not be differentiated in existence, influence, and importance. terms of their degree of involvement with the occurrence. • a tool known as an “evidence table” for conducting a struc- • The importance of factors should be based on their future risk tured examination of the available evidence when doing the tests. rather than degree of involvement with the occurrence. TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, • lists of criteria to consider when evaluating items of evidence, • The definition of cause-related terms should have a broad scope evaluating sets of evidence, and making judgments on existence, for inclusion, and readily permit investigators to identify poten- influence, and importance. tial safety issues that are remote from the occurrence. • general guidance on critical reasoning principles. Terms and definitions need to be supported by a comprehensive investigation analysis framework to assist investigators in mak- The ATSB experience ing judgments. ◆ The ATSB has been using its new terminology (including “contributing safety factor”) in investigations reports since 2006. The References most high profile example was the ATSB investigation into the Anderson, T., Schum, & Twining, W. (2005). Analysis of evidence (2nd ed.). Cambridge UK: Cambridge University Press. (Chapter 8.) fatal Metro 23 accident near Lockhart River on May 7, 2005, Australian Standard 4292.7-2006. (2006). Rail Safety Management Part 7: (ATSB, 2007). In a recent coronial inquest into this accident, as- Railway safety investigation. Sydney: Standards Australia. pects of its definitions were queried by one party and the coro- ATSB (2007). Collision with Terrain, 11 km NW Lockhart River Aerodrome, May 7, 2005, VH-TFU, SA227-DC (Metro 23). Transport Safety Investigation ner. These queries related to the standard of proof aspect rather Report, Aviation Occurrence Report 200501977. Canberra, Australia: than the definition itself, and they have been discussed and ad- ATSB. dressed in detail by Walker and Bills (2008). Doyle, J. (2002). Causation in the context of medical practitioners’ liability for negligent advice. In I. Freckelton & D. Mendelson (Eds.), Causation in However, during the investigation and inquest, it was appar- Law and Medicine (pp. 379-398). Aldershot, UK: Ashgate. ent that there was some misinterpretation of the ATSB findings Honore, A.M. (2001). Causation in law. In E.N. Zalta (Ed.), Stanford Encyclo- and its use of the link-by-link approach. For example, the Civil pedia of Philosophy. Stanford University. Hopkins, A. (2000). Lessons from Longford: The Esso Gas Plant Explosion. Sydney: Aviation Safety Authority (CASA) chief executive officer made a CCH Australia. news media statement on April 4, 2007, that he did not accept ICAO. (2001). Annex 13 to the Convention on International Civil Aviation: Air- that CASA “caused the errors on the flight deck that resulted in craft Accident and Incident Investigation (9th ed.). (Including Amendment 11 and supplement, Nov. 23, 2006). the accident,” and that although there was “room for improve- ICAO (2003). Manual of Aircraft Accident and Incident Investigation: Part IV— ment” in CASA’s oversight processes, these problems could not Reporting. Doc. 9786 (1st ed.). be linked “directly” to the failures that occurred on the flight ICAO (2008). Accident Investigation and Prevention (AIG) Divisional Meet- ing Working Paper 8: Conclusions in final reports. deck. However, the ATSB report did not state that CASA directly NASA. (2006). NASA Procedural Requirements for Mishap and Close Call Report- contributed to the crew’s actions or the occurrence itself. The ing, Investigating, and Recordkeeping. NPR9621.1B. ATSB report concluded that limitations with the design of CASA’s Redmayne, M. (1999). Standards of proof in civil litigation. The Modern Law Review, 62, 167-195. regulatory oversight processes contributed to it not being able to Rimson, I. (1998). Investigating “Causes.” Paper presented at the 29th Annual detect fundamental problems with the operator’s safety manage- Seminar of the International Society of Air Safety Investigators Annual ment processes. Using a link-by-link approach, these safety man- Symposium, Barcelona, October 1998. Stapleton, J. (2001). Unpacking causation, In P. Cane & J. Gardner (Eds.), agement problems were in turn linked through various risk con- Relating to Responsibility (pp. 145-185). Oxford, UK: Hart Publishing. trols and local conditions with the crew actions involved in the Stapleton, J. (2002). Scientific and legal approaches to causation. In I. occurrence. Freckelton & D. Mendelson (Eds.), Causation in Law and Medicine (pp. 14- 37). Aldershot, UK: Ashgate. To minimize the potential for such misinterpretations in the USAF (1999). Safety Investigations and Reports. Air Force Instruction 91-204. future, future ATSB investigation reports will include clear state- (Chapter 5) ments to explain that ATSB investigations use a different meth- U.S. Department of Energy (1997). Implementation Guide for Use with DOE Order 225.1A, Accident investigations. odology and will often produce different findings compared with Walker, M.B. (2007). Improving the Quality of Investigation Analysis. ISASI legal proceedings or other types of investigation, and that the Forum, January-March 2007. use of the term “contributing safety factor” should not be consid- Walker, M.B., & Bills, K.M. (2008). Analysis, Causality, and Proof in Safety Inves- tigations. ATSB Aviation Research and Analysis Report AR-2007-053. ered as being equivalent to “causes” in a legal sense, or reflect Canberra, Australia: Australian Transport Safety Bureau. what the findings of a legal proceedings would produce. Wood, R.H., & Sweginnis, R.W. (2006). Aircraft Accident Investigation (2nd ed.). Casper, WY: Endeavor Books. (Chapter 1.) Wright, R. W. (1988). Causation, Responsibility, Risk, Probability, Naked Sta- Conclusions tistics, and Proof: Pruning the Bramble Bush by Clarifying the Concepts. Causation is a complex concept, and to effectively address it Iowa Law Review, 73, 1001-1077.

ISASI 2008 Proceedings • 25

Proceedings 2008.pmd 25 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS of research monographs factors inaviation.HeisalsocommissioningeditorfortheAshgate series or authored 13booksonthetopicsofcognitiveergonomics andhuman than 120bookchapters,journalandconference papers,andhasedited Human Factors Group chairman. [email protected]. prize forthebestpaperof2007ISASIseminar. Contacte-mail: Ergonomics Society(MErgS). Heandhisfollowingco-authorswonthe 26 factors. Ontheotherhand, individualisticnature ofWestern belief thateventsare highlycomplex anddeterminedbymany sistent withitsbroad, contextual viewoftheworldandChinese 1998).Thecollectivenature& Merritt, ofChinese societyiscon- Cultural characteristicsplayasignificantpartinaviation(Helmreich Introduction • ISASI 2008 ISASI Investigation byInvestigatorsfrom of Aviation Psychology andaregistered memberofthe human factorsspecialistoftheEuropean Association University, UnitedKingdom.Heisanaviation Engineering andHumanFactors, Cranfield a Visiting Fellow intheDepartmentofSystems National DefenseUniversity, RepublicofChina,and Dr. Wen-ChinLi and achartered psychologist.Heistheauthorofmore Society, aFellow oftheHigherEducation Academy, Army Aviation. DonisaFellow oftheErgonomics human factors)oncalltotheBritishArmyDivisionof an aircraft accidentinvestigator(specializingin Aviation SafetyGroup atCranfieldUniversity. Hewas Dr. DonHarris Singapore AirlineSQ006accidentinvestigation Airlines CI611accidentinvestigationandthe 2000. Hewastheinvestigator-in-charge oftheChina joined ASCasanaviationsafetyinvestigatorin former ChinaAirlinesAirbusA300pilot.Thomas Safety Division,Aviation SafetyCouncil.Heisa Thomas Wang Engineering, NationalTaiwan University. and deputychairmanoftheDepartmentMechanical ing Program bytheCivilAviation Authority (CAA), National Taiwan UniversityCommercial Pilot Train- ofChina.HewasthecoordinatorRepublic ofthe of theExecutiveYuan, Aviation SafetyCouncil, Professor Hong-Tsu Young Proceedings Human Factors inDefense 26 Approaches toAccident By Wen-Chin Li,Hong-Tsu Young, ThomasWang, andDonHarris iscurrently thedirector ofFlight isdirector ofFlightDeckDesignand isanassistantprofessor atthe Different Cultures isthemanagingdirector . CRM implementationandcrew performance. There isadiffer- 2006). ence ofpoorCRM(Li&Harris, to fortyfoldincrease intheirlikelihood ofoccurrence inthepres- procedures. Thesesubsequent error categoriesshowedathirty- errors indecision-making,perceptual errors andviolationsin Shappell, 2003)foundthatpoorCRMwasrelated tosubsequent man Factors AnalysisandClassificationSystem(Wiegmann & craft from Asia(Taiwan) &Yu byLi,Harris (2008)usingtheHu- stantial factorinaccidents.Ananalysisofaccidentsinvolving aircrew resource management(CRM) are themostfrequent circum- also showdifferences betweentheregions. InAsia,failures in 1.5 accidents/milliondepartures). Theunderlyingcausalfactors accidents/million departures) thaneitherAmericaorEurope (1- gions (CAA,1998).Asiahasahigheraccidentrate(5.1and 8.0 ture andcontext are really &Maurino,2004). inseparable (Merritt evolves inresponse tochangesinthatenvironment, therefore, cul- Lu, &Peng, 2001).Aculture isformedbyitsenvironment and things, itbecomesaconstituentcomponentofthatculture (Jing, the majorityofpeopleinasocietyhavesamewaydoing sists oftraditionalideasandespeciallytheirattachedvalues.”If their embodimentsinartifacts;theessentialcore ofculture con- tuting thedistinctiveachievementsofhumangroups, including and reacting, acquired andtransmittedmainlybysymbols,consti- culture: “Culture consistsinpatternedwaysofthinking,feeling, 2001). Kluckhohm(1951)proposed onewell-knowndefinitionfor the developmentofscience(Nisbett,Peng, Choi,&Norenzayan, absence ofaconceptnature wouldalsohaveservedtoinhibit develop sciencecanbeattributedtoalackofcuriosity, butthe harmonious waytoliveintheworld.Inpart,Chinesefailure to nese are lessconcernedwithfindingthetruththana suddenly becomesthevicious;goodbad.” orhappiness?Therewhether itismisery isnocertainty. Therighteous ishidinginit.Whoknows ness isleaningagainstit;forhappiness,misery Ching ate inrelation tooneanotherinacomplex manner. From the ing eventsalwaysrequires considerationofmanyfactorsthatoper- more complex totheChinesethanWesterners, andunderstand- nese attendtoobjectswithintheirbroad context. Theworldseems and formallogicplaysamajorrole inproblem solving.TheChi- egorization, whichhelpsthemknowwhatrulestoapplyobjects, behavior (Nisbett,2003).Westerners haveastrong interest incat- the rulesgoverningobjectsandtherefore cancontrol thatobjects’ from theircontext andwithWesterners’ beliefthattheycanknow society isconsistentwithafocusonparticularobjectsinisolation Regional differences ofaccidentrateshaveamajorimpacton Commercial aviationaccidentratesdifferamongglobalre- (theancientChinesebookofphilosophy): 1/14/2009, 8:22 AM “For misery, happi- Chi- I- ence in how CRM training is perceived across the world. In the Method U.S., CRM is normally seen as the primary vehicle to address hu- Participants man factors issues. Other countries perceive human factors and The participants in the study were 16 Chinese (Taiwanese) acci- CRM as overlapping concepts, viewing them as close but distinct dent investigators and 16 British accident investigators. As far as relatives (Johnston, 1993). However, cultural issues in aviation op- was possible, the participants were matched for experience. They erations run deeper than simply issues in CRM. They pervade all had a background as pilots, air traffic controllers, airline safety aspects of operations (including standard operating procedures) officers, and maintenance staff. and ultimately stem from issues in design (Harris & Li, 2008). For example, Westerners tend to adopt a function-oriented model Data (where stimuli are grouped in terms of their purpose) connected The research data were based on the narrative descriptions from to a task-oriented operating concept (where specific actions are the Ueberlingen accident report (BFU: AX001-1-2/02) occurring performed to achieve well-defined results) resulting in a prefer- on July 1, 2002. ence for a sequential approach to undertaking tasks (inherent in checklists and SOPs). The Asian preference is for an integrated, Analytical tool thematic approach (where stimuli are grouped in terms of com- The Human Factors Analysis and Classification System (HFACS, TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, mon, generic interrelationships); hence a task-oriented operating Wiegmann & Shappell, 2003) was used as a basis upon which to concept contradicts their preferred method of working (Rau, classify the factors in the accident. HFACS is based upon Reason’s Choong, & Salvendy, 2004). There are also fundamental differ- (1990) model of human error in which active failures are associ- ences in the mental models of people in these cultures. As men- ated with the performance of front-line operators in complex tioned previously, Westerners have a strong interest in categoriza- systems. Latent failures are characterized as inadequacies or mis- tion, which helps them know what rules to apply to the objects. specifications that lie dormant within a system for a long time In contrast, the Chinese believe in constantly changing cir- and are only triggered when combined with other factors to breach cumstances; they pay attention to a wide range of events and the system’s defenses. The first (operational) level of HFACS clas- search for relationships between things. The Chinese think you sifies events under the general heading of “unsafe acts of opera- can’t understand the part without understanding the whole. In tors.” The second level of HFACS concerns “preconditions for contrast, Westerners apply a logical and scientific approach and unsafe acts.” The third level is “unsafe supervision,” and the fourth occupy a simpler, more deterministic world. Westerners focus on (and highest) organizational level of HFACS is “organizational salient objects instead of the larger picture, and they think they influences.” can control events because they know the rules that govern the behavior of objects. The Chinese are disinclined to use precisely Research design defined terms or categories in many areas but instead use ex- All participants were trained for 2 hours by an aviation human pressive, metaphoric language, e.g., “painting a dragon and dot- factors specialist in the use of the HFACS. This was followed by a ting its eyes” (means hit the point) (Nisbett, 2003). From the Ta o debriefing session then a summary of the events in the Ueberlingen Te Ching, “The heavy is the root of the light; the unmoved is the source of mid-air-crash was presented. All the participants then received a all movement; to shrink something, you need to expand it first; to weaken blank form to code their HFACS data to classify the contributing something, you need to strengthen it first; to abolish something, you need factors underlying this accident. This study used the version of the to flourish first.” The dialectical thought of the Chinese Yin-Yang HFACS framework described in Wiegmann & Shappell (2003). principle is in some ways the opposite of Western-style logical The presence (coded 1) or absence (coded 0) of accident factors thought. It seeks not to decontextualize but to see things in their falling within each HFACS category was assessed by the investiga- appropriate contexts. Chinese believe what seems to be true may tors. To avoid over representation from any single accident, each be the opposite of what it seems to be. However, from a Western HFACS category was counted a maximum of only once per acci- viewpoint, the Chinese seem to not only lack logic but to even dent. Thus, this count acted simply as an indicator of presence or deliberately apply principles of contradiction. absence of each of the 18 categories in the Ueberlingen accident. There is an interesting issue that results from these differences Differences in the frequency of use of each HFACS category by between cultures and regions. Culture is not just about the superfi- Chinese and British investigators were examined using a chi- cial, observable differences between counties, their food, their style square (χ2) test of association. Further analyses examining the of clothes, and even their languages. There are some fundamental association between the categories in higher and lower levels of cognitive differences in reasoning, organization of knowledge, struc- the HFACS framework were also performed. As there is no iden- tures of causal inference, and attention and perception between tifiable dependent or independent variable in a χ2 test of asso- Eastern and Western cultures (Nisbett, 2003). These issues mani- ciation, these analyses were supplemented with further analyses fest themselves in the following manner. Westerners are likely to using Guttmann and Kruskal’s tau (τ), which was used to calcu- overlook the influence of the wider context on the behavior of late the proportional reduction in error (PRE)—see Li & Harris objects and even of people. However, Asian cultures are more sus- (2006) and Li, Harris, & Yu (2008). ceptible to ‘hindsight bias’. Westerners are more likely to apply formal logic when reasoning about events but Easterners are more Results and discussion willing to entertain apparently contradictory propositions. The aim The results of frequencies and percentages of HFACS categories of this research is to establish if the different cognitive styles of used by Chinese and British investigators when analyzing the European and Chinese accident investigators have an effect on Ueberlingen accident are shown in Table 1. In general, there the conclusions drawn when conducting an accident investigation. were few significant difference in the frequency of use of the

ISASI 2008 Proceedings • 27

Proceedings 2008.pmd 27 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 28 thy categoryof“perceptual error.” Chinese investigatorsmayhave optedtousethelessblamewor- state” asitpossiblyhasadegree ofstigmaattachedtoit. Instead, Eastern participantstoutilize thecategoryof“adversemental to a“perceptual error.” Thismayreflect reluctance onthepartof participants were more predisposed toattributingtheaccident as apsychologicalprecursor totheaccidentandTaiwanese investigators were more likely toattribute“adversementalstate” been notedpreviously (Li,Young, Wang, 2007)UK &Harris, state” (HFACS Level-2)and “perceptual error” (Level-1).Ashas quency ofusethecategoriesconcernedwith“adversemental gators. Theonlysignificantdifferences were related tothefre- HFACS categoriesbetweenBritishandChineseaccidentinvesti- Categories ofHFACS Framework forChineseInvestigators And OddsRatiosSummarizingSignificantAssociationsBetween Table 2.Chi-square Test ofAssociation,GoodmanandKruskal’sTau Down byEasternandWestern Investigators Being Present intheUeberlingenAccident intheHFACS Framework Broken Table 1.Frequency andPercentage CountsofCausalFactors Deemedas • ISASI 2008 ISASI Proceedings 28 pervision” (seeTable 2). in theaccidentsequencewhen associatedwith“inadequatesu- for “personalreadiness,” whichwas49timesmore likely tooccur mate.” For theChineseinvestigators, thehighestoddsratiowas when associatedwithpoorhigherlevelsof“organizational cli- tional practices”were more than21timesmore likely tooccur that hadahighoddsratio.Thesesuggested“pooropera- 1). There are alsofivepairsofassociationsbetweencategories sociations betweencategoriesatLevel-2andLevel-1(seeFigure tween categoriesatLevel-3andLevel-2,foursignificant as- egories atLevel-4andLevel-3,fivesignificantassociations be- Kruskal’s taushowedfivesignificantassociationsbetween cat- by Chineseinvestigators.Further examination ofGoodmanand 1/14/2009, 8:22 AM χ egories, whichisthebasisofsimple simple testofco-occurrence betweencat- going beyondwhatmaybedeemeda at thelowerorganizational levels,thus ing deemedtoinfluence(cause)changes with thehigherlevelsinHFACS be- indicates thestrength oftherelationship, HFACS. Thevaluefortauinthesetables theoretical assumptionsunderlying framework, whichiscongruentwiththe the immediatelyhigherlevelin upon prioractionsinthecategoriesat were designatedasbeingdependent the lower-levelcategoriesinHFACS Tables IIandIII(andFigures 1and2), statistic. Intheanalysesdescribedin has theadvantageofbeingadirectional and China.GoodmanKruskal’stau between theinvestigatorsfrom Britain scribed byGoodmanandKruskal’stau differences inthepatternofresults de- cally inFigures 1and2,respectively. These results are alsodepictedgraphi- ish investigatorsare giveninTable3. given inTable theresults 2; fortheBrit- ratios fortheChineseinvestigatorsare Goodman andKruskal’stauodds rately. Theresults oftheChi-square, ish investigatorswere analyzedsepa- the datasetsfrom theChineseandBrit- tionships betweenHFACS categories, &YuHarris (2008)toanalyzetherela- (2006)andLi, described inLi&Harris tors. Usingtheanalyticalmethodology nese investigatorsandBritishinvestiga- of theHFACS analysesbetweentheChi- of causalitybetweenthedifferent levels ings withregard tothedifferent patterns accident basedontheanalysisprovided tween causalfactorsintheUeberlingen els thathadsignificantassociationsbe- egories inadjacentorganizational lev- 2 testofassociation. What isnoticeablethatthere are However, there are interesting find- There were 14pairsofHFACS cat- for a holistic understanding of the events in their wider context. However, the British (Western) accident investigators preferred patterns of explanation that ultimately lead directly to the accident event. Focus was on specific objects (categories). The decontextualization and object emphasis favored by West- NC: Not computed due to a zero frequency in one cell of the contingency table erners and the integration and focus on many complex relationships by Eastern- Table 3. Chi-square Test of Association, Goodman and Kruskal’s Tau and Odds ratios ers resulted in very different ways of Summarizing Significant Associations Between Categories of HFACS Framework for making inferences about the accident, British Investigators as was evident in the patterns of associations depicted in Figures 1 and 2. These may reflect the fundamental dif- TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, ferences between Chinese and Western minds. In terms of patterns of attention and perception, Eastern cultures attend more to the environment; people from Western cultures attend more to objects (Nisbett, 2003). In science and technology, Western truth stimulated analytic thinking, whereas Eastern virtue led to synthetic thinking (Hofstede, 2001). Through these different logics, Eastern and Western people followed different paths in developing government and in developing their respective science and technology. This analysis further demonstrates that people from different cultures differ in cognition in ways that result in different perceptions, judgments, and decisions concerning the factors at play in the sequence of events in an accident. As a result, it is argued that Chinese investigators will be predisposed to ap- Figure 1. Significant association of causal factors for the Ueberlingen accident at proaching accident investigation in a the four levels of the HFACS framework as categorized by Eastern (Taiwanese) holistic manner, attempting to under- aircraft accident investigators. stand the complex relationship of causal factors leading to an accident. The Chi- There were five pairs of HFACS categories in adjacent organi- nese conviction about the fundamental relatedness of all things zational levels that had significant associations between causal made it obvious to them that objects are altered by context. Try- factors in the Ueberlingen accident based upon the data pro- ing to categorize objects with exactness would not have seemed vided by British investigators. There were no significant associa- to be of much help in comprehending events. The world was tions of categories between HFACS Level-4 and Level-3, one sig- simply too complex for categories for understanding objects or nificant association between categories at Level-3 and Level-2, controlling them. The Chinese might be right about the impor- and four significant associations between categories at Level-2 tance of the field to understanding the behavior of the object and Level-1 (see Figure 2). Furthermore, from the analyses per- and they might be right about complexity, but their lack of inter- formed by the British investigators, there was only one pair of est in categories prevented them from discovering laws that re- association between categories that had a high odds ratio. This ally were capable of explaining classes of events. As Nakamura suggested that the problem of “technology environment” more (2003) noted that the Chinese advances reflected a genius for than 15 times more likely to occur when associated with “planned practicality, not a penchant for scientific theory and investiga- inadequate operations” (see Table 3). tion. The process of accident investigation is almost akin to a This pattern of associations described diagrammatically in Fig- Western notion of art. British (Western) investigators are more ures 1 and 2 may reflect the different cognitive styles of Eastern predisposed to approaching accident investigation (and human and Western accident investigators, who are in turn products of behavior) using rules of logic. Accident investigation is almost a their respective cultures. For Eastern investigators, many catego- scientific process. ries were associated with each other reflecting a predisposition When Western engineers develop flight operation systems,

ISASI 2008 Proceedings • 29

Proceedings 2008.pmd 29 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 30 the underlyingcausesofaccidents. However, itcould evenbe better aviationsafetyrecords whenusingtheHFACS toanalyze ence. Soitisnottoosurprising thataWestern countrycomesout the nature ofsafetyregulation allhaveastrong Western influ- 2007). superior (Li&Harris, on theindividual,andindividualdecisionsare regarded asbeing nates expect tobeconsulted.Self-orientationandidentityisbased a relatively smallproportion ofsupervisorypersonnel.Subordi- on individualism.Flatorganizational structures are preferred with ment oftheUKexhibits lowpower-distanceandisaculture high resistance tochange.Ontheotherhand,workingenviron- tion isconstrainedandcontrolled bythehierarchy andthere is overload. Ingeneral,group decisionsare preferred butinforma- bers ofthesecultures frequently experience role ambiguityand tures, subordinates expect tobetoldwhatdo.However, mem- have alarge proportion ofsupervisorypersonnel.Inthesecul- organizational pyramidswithcentralizeddecisionstructures and tional culture, theworkingenvironments ofTaiwan prefer tall their opinionsmaycontradictcaptain. (China) highpowerdistancecountriesdare nottospeakoutwhen the actionsoftheircaptains.However, copilotsfrom Eastern ish) from alowpowerdistanceculture are more likely toquestion processes. Afrequently usedexample isthatWestern copilots(Brit- basis foragroup member’sbehavior, socialroles, andcognitive and decision-making.Nationalculture provides afundamental cognition inwaysthatresult indissimilarperceptions, judgments, (2004) observedthatpeoplefrom different nationsdifferintheir users around theworldshare theirreasoning andvalues.Klein enced bytheirculturalnorms.Theyimplicitlyassumethatall grate theirownvisionoftheworld,whichitselfisheavilyinflu- training manuals,andstandard operationprocedures, theyinte- HFACS frameworkascategorizedbyWestern (British)aircraft accidentinvestigators. Figure 2.SignificantassociationofcausalfactorsfortheUeberlingenaccidentat The designoftheaircraft, themanagementprocedures, and According toHofstede’s(1984&1991)classificationof na- • ISASI 2008 ISASI Proceedings 30 ences itseemshighlylikely that theycanonlyservetocomple- posed. However, bybetterunderstandingthesecultural differ- chance thatculturallycongruent remedial actionscanbepro- viewpoint oftheinvestigator. Thiswaythere mightbeabetter pilots/airline involvedintheaccidentandnotfrom thecultural events intheaccidentfrom theviewpointofculture ofthe cerned. Thebestapproach maybetotryunderstandthe this case),especiallyinthecasewhere humanfactorsare con- completely different inferences from thesamesetofdata(asin and Western cultures are sufficientlydifferent thattheymaydraw gether. ThecognitiveorientationandmechanismsofEastern phies, e.g.,whenEuropean andAsianculture collaborateto- differences inculture-influenced accidentinvestigation philoso- ners. Itisimportanttoknowmore aboutthesimilaritiesand between different cultures involvessharingthevaluesofallpart- stood inthewaytheywere meanttobe.Theglobalinteraction different approaches toaccidentinvestigation willbeunder- the otherprofessional investigatorsfrom different cultures with communication skillstoguaranteethatthemessagessent fective internationalinvestigationsalsodemandlanguageand ness oftheinvestigator’sownculturallydeterminedvalues.Ef- among partnersfrom othercountries,inadditiontoanaware- mands insightintotherangeofculturalvaluestobeexpected tion foraviationaccidentswithindifferent culturalcontexts de- tasks, thisisanalmostimpossibledemand.Effectiveinvestiga- tion. Incollectivistcultures, where relationships prevail over alist valuesetunderlyingtheWestern approach toinvestiga- Separating thepeoplefrom the problem assumesanindividu- Conclusion pursued inmanycases. congruent solutions,nottheuniversalsolutionscurrently being strategies around theworld.Thismayrequire local,culturally 1/14/2009, 8:22 AM best approach foraccidentprevention of accidentinvestigationistofindthe they maypresent. Theultimatepurpose safety buttomanagethepotentialrisks these cross-cultural issuesinfluencing the challengeforsafetyisnottoignore enced byWestern mindsets;however, ent. Globalaviationisstrongly influ- may onlyconcludethattheyare differ- these viewsiseitherrightorwrong. You tors. Itisdifficulttosaythateitherof tween EasternandWestern investiga- pletely different patternemerges be- ent levelsofHFACS isanalyzed,acom- causality betweencategoriesatdiffer- cultures. However, whentheunderlying ence betweeninvestigatorsfrom thetwo seem tosuggestthatthere isnodiffer- ries usedbyaccidentinvestigatorswould simple frequency countofthecatego- seems tobecompletelydifferent. A factors atplayinthesameaccident British investigatorsattributethecausal it. ThewayChineseinvestigatorsand itself hasanimplicitculturalbiaswithin argued thattheaccidentanalysissystem ment and enrich each other. There is no one “objective” truth The Policy Sciences. Stanford, CA: Stanford University Press, 86-101. Li, W-C. & Harris, D. (2006). Pilot Error and Its Relationship with Higher to any accident investigation. Whether we realize it or not, all Organizational Levels: HFACS analysis of 523 accidents. Aviation, Space conclusions draw (and the process by which we reach them) are and Environmental Medicine, 77(10), 1056-1061. deeply influenced by our culture. ◆ Li, W-C., Harris, D. & Chen, A. (2007). Eastern Minds in Western Cockpits: Meta-analysis of Human Factors in Mishaps from Three Nations. Aviation Space and Environmental Medicine, 78 (4), 420-425. References Li, W-C., Harris, D. & Yu, C-S. (2008). Routes to Failure: Analysis of 41 CAA (1998). CAP 681 Global Fatal Accident Review 1980-1996. London, UK: Civil Aviation Accidents from the Republic of China using the Human Civil Aviation Authority. Factors Analysis and Classification System. Accident Analysis and Harris, D. & Li, W-C. (2008). Cockpit Design and Cross-Cultural Issues Prevention, 40(2) 426-434. Underlying Failures in Crew Resource Management. Aviation Space and Li, W-C., Young, H-T., Wang, T. & Harris, D. (2007). International Environmental Medicine, 79(5), 537-538. Cooperation and Challenges: Understanding Cross-cultural Issues in Helmreich, R.L. & Merritt, A.C. (1998). Culture at Work in Aviation and the Processes of Accident Investigation. ISASI Forum, 40(4), 16-21. Medicine. Aldershot: Ashgate, 1998. Merritt, A. & Maurino, D. (2004). Cross-Cultural Factors in Aviation Safety. Hofstede, G. (1984). Culture’s Consequences: International Differences in Work- In, M. Kaplan (Ed) Advances in Human Performance and Cognitive Related Values. Beverly Hills: Sage Publications. Engineering Research. San Diego, CA; Elsevier Science, 147-181. Hofstede, G. (1991). Cultures and Organizations: Software of the Mind. Nakamura, H. (2003). Ways of Thinking of Eastern Peoples: India, China, London: McGraw-Hill Book Company. Tibet, Japan. London: Trubner & Corporation. Hofstede, G. (2001). Culture’s Consequences: Comparing Values, Behaviors, Nisbett R.E. (2003). The Geography of Thought: How Asians and Westerners Institutions, and Organizations Across Nations. California: Sage Publications. Think Differently and Why. New York: The Free Press. 9, 2008 SEPT. TUESDAY, Jing, H.S., Lu, C.J. & Peng, S.J. (2001). Culture, Authoritarianism and Nisbett R.E., Peng, K., Choi, I. & Norenzayan, A. (2001). Culture and Commercial Aircraft Accidents. Human Factors and Aerospace Safety, 1, Systems of Thought: Holistic vs Analytic Cognition. Psychological Review, 108, 341-359. 291-310. Johnston, N. (1993). CRM: Cross-Cultural Perspectives. E. L. Wiener, B.G. Rau, P-LP, Choong, Y-Y &, Salvendy G. (2004). A Cross-cultural Study on Kanki, & R.L. Helmreich (Editor), Cockpit Resource Management (pp. Knowledge Representation and Structure in Human Computer 367-398). San Diego: Academic Press. Interfaces. International Journal of Industrial Ergonomics, 34, 117-129. Klein, H.A. (2004). “Cognition in Natural Settings: The Cultural Lens Model,” Wiegmann, D.A. & Shappell, S.A. (2003). A Human Error Approach to in Kaplan, M. (Editor), Cultural Ergonomics, Elsevier, San Diego, 249-280. Aviation Accident Analysis: The Human Factors Analysis and Classification Kluckhohm C. (1951). “The Study of Culture.” Lerner D., Lasswell H.D., Editor. System, Ashgate, Aldershot, England.

ISASI 2008 Proceedings • 31

Proceedings 2008.pmd 31 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS bringing anumberofISASIReachoutworkshopstoPakistan. investigator. Recently, Syed Naseem Ahmedhasbeeninstrumentalin has workedattheSafetyandInvestigationBoard asatechnical the Pakistan andsince2004 surveyor asaseniorairworthiness CAA investigated more than20 majoraircraft accidents.In2000,hejoined 1990 andgraduatedfrom theAirWar Collegein1992.Hehas 32 I based onmyevaluationofthe statusofaviationsafetythrough dent investigationisstillin the developingstage.Inend, crew. Thesetwoaccounts are useful forthosestateswhere acci- airfield, killingall45persons thatwere on board, includingthe the Fokker F-27, whichcrashedjust aftertakeoff nearMultan in theArabianSea,2003andsecond,investigation into stan—first theinvestigationintoaCessna402B,whichcrashed support ininvestigations. will share afewlessonslearnedtoensure optimuminternational contributed tounderstandingtheprocess; andbased onthat,I seminaras“Investigation:TheArtandtheScience.” year ISASI really admire theintellectualswho selectedthethemeforthis investigation. Whetheritisanart,science,oracombination, I this science—maybetoexploit scienceforone’sinterests inthe incidents investigations,Ihavebeguntoseetheartofapplying ducting more than30majoraircraft accidents andaround 200 sonnel skillswhileconductinginvestigations.Buttoday, aftercon- tific principles.Icouldnotthinkofapplyinganyideasorper- tions. Itappeared tomeacomplicatedprocess basedonscien- of PAF. Atthattime,Ididnothavetheslightestideaofinvestiga- in 1978toinvestigateaninflightwingseparationofasabre fighter investigation since1978.Myfirstassignmentwas have beenassociatedwithsafetyeducationandaircraft accident forthat.I people from theaviationworld.IamgratefultoISASI Accident InvestigationandProposal to Let merefer totheinvestigationsoftwofatalaccidentsinPaki- I willtake youthrough someinvestigationexperiences that • before thisgatheringofhighlyeducatedandexperienced and asslam-u-alekum. Itisindeedapleasure formetospeak SASI presidentSASI andladiesgentlemen—goodmorning ISASI 2008 ISASI Where ItIsintheDevelopingStage Enhance AviationSafetyinStates International SupportforAircraft Aircraft Accident InvestigationBoard from 1988- Safety from 1982to1988.Hewasamemberof the levels andwasaninstructorattheInstituteofAir atthe1stand2ndoverhaul maintenance served engineer (aerospace). From thenuntil1982,he Pakistan AirForce in1976asamaintenance Syed NaseemAhmed Proceedings By SyedNaseemAhmed,Technical Investigator, SafetyandInvestigationBoard, 32 wascommissionedinthe Civil Aviation Authority, Pakistan fatal injuries,andtheaircraft wascompletelyburned. km northeastoftherunway. Allsoulsonboard theaircraft had dent wasreceived statingthatanaircraft hadcrashedatabout 2 no contactwasestablished.Subsequently, acallfrom alocalresi- The control towertriedtoestablishcontactwiththeaircraft, but to bemaintainingverylowaltitudeanddriftingrightina bank. takeoff, theaircraft wasobservedbyATC andothereyewitnesses stan Standard Time (PST)from MultanRunway36.Soonafter crewmembers. Theaircraft tookoffforLahore at1205hrsPaki- to Lahore. Theaircraft had45soulsonboard, including4 F-27 Fokker, registration No.AP-BAL, wasonflight from Multan deteriorate andultimatelyfailedduringtheeventfulflight. SIDs were notcompliedwithandthetailsectioncontinuedto The operatorwasstillusingmanualsissuedin1982.Hence,the cracks. However, theseSIDswere notreceived bytheoperator. had asked theoperatorstoconductspecialinspectionsdetect strength. Cessna,through specialinspectiondocuments(SIDs), tail sectionwere subjecttohighfatigueandhadlostmaterial craft. Theresearch foundthatcertainstructuralcomponentsin 1988 onthestructuralintegrityofoneitsmoststressed air- learned thattheCessnaCorporationhadconductedresearch in vided bythemanufacturer. Andthentomyluck,Ifoundaclue. fore startedreading theoperationalandtechnicalmanualspro- literature. However, Iwasstill insearch ofsomeanswersandthere- manufacturer didnotprovide anyhelp,otherthanacartonof the report as cause undetermined—withanobservationthatthe due topressure from thegovernmentwewere goingtofinalize manufacturer. Theinvestigationcontinuedfor6months,and and maintenancemanuals.Ididnotgetanyotherhelpfrom the receiving thenotification,hadsentacartonfullofoperational air, acaseofinflightstructuralfailure. Themanufacturer, after wreckage analysiswasthatthetailsectionhadseparatedin It wasreconstructed inahangar. Theonlyconclusionfrom the aircraft wreckage wasrecovered search. after17daysofunderwater on board, except oneofaChineseminister, were recovered. The by Pakistan Navysearch andrescue team,within2hrs.Allbodies from radarafter8minutesofflying.Thewreckage waslocated from at0811hrsonNovember2003andwasmissing Karachi for enhancingtheaviationsafetyinsouthAsia. investigations, Iwillmake somesuggestionstothestakeholders The crashshocked the whole nation.Thetragicdeathofall The secondaccidenttookplaceonJuly10,2006,whena PIA The firstinvestigationisthatofaCessna402B,whichtookoff 1/14/2009, 8:22 AM passengers and crew at the crash site by ground fire not only ignited the passions of public against the operator and regulator but also strength- ened their ill-conceived ideas and perceptions regarding the deterio- rated condition of the aging Fokker fleet. This aircraft was manufactured in 1964 and had completed 84,000 hrs. Hence the news media, general public, and even the few aviation experts, including pilots, hurriedly concluded that the crash was due to the old age of the aircraft. The heated debates at various levels and TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, news media reporting influenced the cabinet to ground the Fokker fleet in the public interest. The ground- ing, in fact, caused more inconve- nience to the general public as there was no alternate aircraft to connect INDEX OF AIRCRAFT PARTS AS SHOWN IN WRECKAGE DIAGRAM remote locations served by Fokker. 1. Outer most portion of right-hand wing 19. Right-hand engine (S. No. 8273, feathered) and aileron 20. Right-hand engine upper cowlings (all three This was the unfortunate and non- 2. Right-hand wing outer portion sides intact) ceremonial exit for an aircraft such 3. Right-hand aileron (along with tab) 21. Right-hand engine fire extinguisher bottle as the Fokker, which had served the 4. Inner portion of outer right-hand flap 22. Center wing upper portion 5. Outer portion of outer right-hand flap 23. Center wing along with right-hand inner flap nation for decades with ease of op- oxygen bottle 24. Left-hand engine (unfeathered along with eration and economy. 6. Cockpit window cowls [S. No. 13009]) The investigators were faced with 6A. Upper portion right-hand landing gear along 25. Aft cargo section (portion of fuselage) with ram (extended) 26. Center wing and right-hand wing inboard a challenging task to investigate the 7. Portion of nose radom of engine causes and convince the affected par- 8. Right wing outer portion (upside down) 27. Exhaust pipe right-hand engine ties accordingly. While the investiga- 9. Right wing lower portion (along with flaps) 28. Left-hand wing along with nacelle (with flap) 10. Emergency fire extinguisher bottle (plug and 29. Left-hand landing gear tion was at the initial stage, a num- pin intact) 30. Left-hand wing outer portion upside down ber of lawyers associations issued le- 11. Oxygen bottle along with aileron gal notices to the regulator and the 12. Fuselage (front portion) 31. Rudder + vertical fin 13. Cockpit 32. Horizontal stabilizer (left-hand side along operator. The director general of the 14. Nose landing gear (ram extended) with elevator) CAA, realizing the importance of this 15. Right-hand landing gear (ram extended) 33. Fuselage rear portion particular investigation and ex- 16. Inverter 34. Horizontal stabilizer (right-hand) 17. Left-hand engine exhaust pipe 35. Right-hand engine tail cone pected critical scrutiny of the inves- 18. Accessories gear box (right-hand) tigation report at the national as well as international levels, made ar- rangements to ensure participation from international investiga- investigations, the obligation to explain all technical aspects in tion organizations. PCAA notified the UK AAIB, the FAA, and such a manner that these interested parties would face mini- the BEA France, in addition to the manufacturer of the aircraft mum difficulties in understanding the report was realized. I and engine, i.e., Rolls-Royce and Fokker Services. This resulted consulted the famous book on aircraft investigation by Barnes in the available services of the Accident Investigation Branch W. McCormick and M.P. Papadak, which proved extremely use- (AAIB) UK, the BEA of France, the DSB of the Netherlands, the ful for report writing. FAA, Stork Fokker Services B.V. Netherlands, and the FBA of Germany. The UK AAIB also coordinated with Dowty Propellers Objectives and Goodrich Engine Control Systems for investigation support The technical investigation was focused to determine the follow- to PCAA. ing three primary questions: 1. Were the engines capable of producing required power and Report writing producing it at the time of impact? Under normal circumstances in such cases where the aircraft 2. Was the aircraft intact and its control surfaces operable without appeared to have stalled after initial climb, failed to recover, any difficulty till it departed from its intended flight path? and caught fire after impact, the investigations would have been 3. Was there any other cause of the accident, such as sabotage, easily written only in technical language. However, under these fire, bird hit, or multiple system failures? difficult conditions, where aviators as well as non-aviators from the general public, the news media, public representatives, hon- Initial appraisal at the scene of accident orable lawyers, and judges were involved in the proceedings of It is our common experience that the wreckage is extensively dis-

ISASI 2008 Proceedings • 33

Proceedings 2008.pmd 33 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 34 equipment thatwouldhavecontributed totheaccident. sure. There were nountoward features foundinthepropeller peller hadfeathered asintended intheeventoflowtorque pres- operating attakeoff powerasdesignedandtheright-handpro- At thepointofimpact,left-handpropeller equipmentwas to theevent,propeller equipmentwasoperating normally. Royce representatives inattendance.Theyconcludedthatprior control unitsatTurner Aviation, Glasgow, withAAIBandRolls- strip examination andtest facilitiesofthefeatheringpumpsand returned toDowtyPropellers thefor UK,whicharranged The propellers, pitchcontrol units,andfeatheringpumps were Propeller investigationbyDowtyPropellers have contributedtoanyrestriction inengineperformance. were functioningproperly atthetimeofcrashandwouldnot from Goodrich(X-ray picture). Theyconcludedthattheseunits Mike Webber, aRolls-Royce investigator;andNormanWiddop ence ofAnneEvans,theseniorinspectorfrom theUKAAIB; ham, UK.Thesewere X-rayed, thengivenatestruninthepres- engines were senttoGoodrichEngineControl SystemsBirming- The high-pressure fuelpumpsandpitchcontrol unitsofboth units ofbothengines Investigation ofenginefuelpumpsandcombinedcontrol nature offractures observedonthebearing. turbines tobereturned forlaboratoryanalysistodeterminethe parts, rear bearinghousing,plainbearing,mainand engine turbine.Hence,itwasconsidered crucialfortheengine The stripexamination revealed abnormaldamagetotheright PIA EngineeringinKarachi Strip-up examination ofenginesat Theleftengineappeared toberotating athighspeed. • Therightengineappeared tobeatlowRPMs. • There wasnoinflightstructuralfailure. • There wasnoevidenceofsabotageorinflightfire. • position. Thenoseandmainlandinggearswere foundinextended • Theflapswere found inzero position. • debris from theenginefellonrunway. Theaircraft crashedasonepiece.Onlyafewpiecesofmetallic • significant findingsfrom thewreckage were treme rightsideoffuselage(seewreckage diagramabove).The the mainfuselageandtailsection.Theleftwingwasonex- part wastheleftengine,butitonrightsidefollowedby the right,andrightenginewasonleft.Thenext major part ontheleftsideground. Themainfuselagewason final impactwiththeground. Therightwingwasthefirstmajor the mudwall,whichwassweptawaybyaircraft bodyduring craft entered thesoftground area from themangofarmthrough Some quantityoffuelhadspilled/pooledinthefarm.Theair- mango farm,andfewtrees were broken andaffectedbytheheat. soft ground. Afewsmallaircraft partswere foundwithinthe not taken awaybypeopleandwasconfinedtoamangofarmon and toinvestigatewithspeedcertainty. Thewreckage was Fokker crashsiteanditswreckage were relatively easytoreach investigation adifficulttaskduethelossofvitalevidence.The turbed andtaken awaybypeopleinourregion, thusmaking • ISASI 2008 ISASI Proceedings 34 the dataforPCAA. took thecard totheU.S.andwere successfulindownloading memory card tothemanufacturer intheU.S.BEAengineers ever, theresults were thesame.We decidedtotake theFDR us tousetheCTSsoftware developedinFrance forBEA.How- zeros. Theproblem wasreported to Honeywell,whichadvised could notretrieve anyfilebutonecontainingonlybitsequalto did notrecognize theconfigurationofmemorycard and load therawfilefrom thememory. Neverthelessthesoftware FDR chassis.TheHoneywellATU software wasusedtodown- cut andadedicatedconnectorwasusedtoplugthecard intoan module wastaken toBEA,where theoriginalconnectorwas The FDRwasbadlyburntinthecrashfire. Onlytheprotected FDR readoutatBEA proximately 1500Hz. trum analysis,anditsfundamentalfrequency appearstobeap- alarm wasrecorded ontheCAMchannel.Itisvisiblespec- seconds aftertheenginespooldown,analarmsimilartofire 29mins18.8secondsofrecording,945 Hz.After i.e.,about2.8 ible forabout12.7seconds,anditsmaximumfrequency isaround tions andflightcrew headsets).Thiselectricalinterference isvis- corded onchannel3oftheCVR(dedicatedtoVHFcommunica- ning oftheenginespooldown,anelectricinterference wasre- by theengineoritspropeller. About1secondafterthebegin- an enginespooldown,i.e.,windingofrevolutions, canbeheard. ofrecording,Their conclusionwasthatafter29mins16seconds Fokker Services;andHolgerLitzenberg, Rolls-Royce Germany. Michiel Schuurman,DSB;Wim Furster, DSB;ArtherReekers, outinthepresenceChristophe Menez,theanalysiswascarried of The CVRwasfoundburnedextensively; howeverwiththehelpof CVR analysisbyBEAFrance However, thefrequencies ofEngine1 throughout theaccident of 10,000,thepumpfrequencies are expected ataround 166Hz. With enginetakeoff RPMsof15,000andfeatheringpump RPMs analyze thesefrequencies todeterminetheRPMsofspindle. at aconstantfrequency. Ifweknowthenumberofblades,can constant speed,thiswillleadtothegenerationofpressure waves time abladerotates, itgeneratesapressure wave. If rotating at a lyzer plotssoundfrequency vs.timewithcolorasenergy. Every erational status30minutesbefore thecrash.Thespectrumana- recorded duringCVRoperation,wecoulddeterminetheirop- pump orfuelisknown,thenwiththehelpoffrequencies Working onthesameprinciple,ifRPMsoffeathering 1,200 RPMs,wecouldsayitwasinaccordance withrequirements. larly, if wecoulddeterminethatthepropeller wasrotating at we couldsaythattheleftenginewasworkingasdesigned. Simi- engine wasrunningat15,000RPMsthetimeofimpact,then nents aspossible.For instance,ifwecoulddeterminethattheleft whether theleftenginewasproducing therequired power. cies andtofindoutwhattheproblem waswithrightengineand engine andpropeller RPMswiththehelpofrecorded frequen- analysis. Thepurposewastoindependentlydetermineagainthe data, theCVRwastaken totheUKAAIBfordetailedfrequency successfuldownloadingandlimitedanalysisoftheCVR After Accident InvestigationBranch CVR analysisatUKAircraft A spectrumanalysisshowschangesinthefrequencies produced We triedtodeterminetheRPMsofasmanyenginecompo- 1/14/2009, 8:22 AM flight are not as clear as Engine 2, except after Engine 2’s failure. outer track retaining assembly, resulting in the cyclic loading and We could see from Engine 1 is that the frequency increases at the fatigue fracture of these bolts. same rate as Engine 2 but does not appear to exhibit the over- (c) Examination of the rear location bearing revealed that it had shoot and hunting for maximum RPMs that Engine 2 does. En- sustained inner track distress and the clamping load on the bear- gine 2 has clear harmonics and it is 7th harmonic, which tells us ing assembly had been lost. that there was a drop in RPMs after takeoff power was selected. (d) Due to the extensive damage to the inner track, it was not possible to conclusively identify the primary cause of the bearing dis- Behavior of feathering pumps tress; however it had initiated some time before the subject flight. The first feathering pump frequency was recorded at 00:29:17, (e ) Loss of clamping load and subsequent axial displacement of coinciding with the decay in Engine 2 propeller frequency. There the bearing assembly led to axial movement of the turbine rotor are several discontinuities in the recording of the feathering pump assembly. This axial displacement resulted in rubbing contact frequencies, so it is not clear the duration that the pump is run- between the rear of the HPT blade/disc roots with the front inner ning. However, there are two distinct frequencies indicating when platforms of the IPT NGVs leading to localized overheating of it was autofeathered and when it was operated by the aircrew. the blade root neck sections, the loss of mechanical properties, and the subsequent blade release. A similar rub occurred between TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, Fire bell the IPT rotor and the LPT NGVs with one IPT blade fracturing The BEA report identified the presence of a bell, which was heard in fatigue as a result of excitation due to the axial rub. by the investigating team, too. It sounded like a fire bell. Analysis (e) The reason for the final rundown of the engine is considered of the cockpit area mike frequencies revealed a frequency around to be the result of the release of the HPT and IPT rotor blades, 1,500 Hz coinciding with the point of RPM decay of Engine 2 leading to a significant loss of engine performance, combined and runs continuously until the end of the recording. The design with loss of axial and radial location of the rotor causing consid- and operations principles of the fire bell were examined with the erable mechanical distress and resistance to rotation. help of Fokker Services. We learned that the bell would ring only if there was any fire around the engine, enough to activate the Lessons learned circuit. However, there was no fire around the engine. The dam- Let me summarize the lessons learned. The first lesson is to issue age to the turbine blades was contained within the engine. Hence, a prompt notification as per Annex 13 and send it to as many the reason for the bell to “ring” could not be established. organizations as you may think. It will bring a lot of information and organizational support to your doorsteps. As you proceed, Analysis by Stork A.B. Services, the Netherlands analyze critically the requirements and pay special attention to Fokker Services provided an analysis based on CVR and FDR your expectations from international organizations, which means data in the light of aircraft expected performance. The analysis prepare well and plan well. In the process, keep examining your confirmed the conclusions by the BEA and the UK AAIB regard- needs—keeping in view the obligations in Annex 13. It will help ing engine performance. It also analyzed the performance of the you maintain good relations with international investigation oraircraft and aircrew actions with the help of airspeed, altitude, ganizations. Most importantly, do not hesitate to explain your and heading data retrieved from the FDR. According to Fokker position and difficulties, such as administrative, financial, and Services, the aircraft should reach screen height (35 feet) within traveling—including visa difficulties. Keep all the stake holders 38 seconds. The take off roll until screen height took 45 seconds. in the loop while communicating with one agency. Wherever re- The difference may be explained due to engine failure. The air- quired, delegate investigation activities to other experts as we craft should obtain a climb gradient of 3.3% when an engine did with the FDR and engines. BEA took the FDR to the U.S. failure occurs at V1 under the prevailing conditions provided land- and was successful in downloading it, whereas it was difficult for ing gears are retracted. With the landing gears out, the gradient us due to financial constraints. Learn to write the report in non- angle is reduced to 1.7%. In this case, after lift off the crew did technical as well as technical terms as it will be read by many non- not sufficiently correct the heading and roll deviations. Some parts aviation experts. Finally, share the final draft with all those who in the recording show that the crew was able to recover the head- have helped you in the investigation before submitting the final ing and roll deviations momentarily. Therefore, we concluded report in your state, as some times it is difficult to release the that the aircraft was controllable at that moment. final report depending on state rules.

Engine investigation by Rolls-Royce, Bristol, UK Investigation: art and science Rolls-Royce analysis conclude that the plain location bearing was The total lesson learned was that in the states where the aircraft under some distressed condition at the time of last assembly as a accident investigation maturity level is 4, i.e., highly developed sequence of events leading up to the final rundown had origi- as per the maturity matrix given in the Global Aviation Safety nated in the area of the rear turbine location bearing. The se- Roadmap, aircraft accident investigation is carried out in a scien- quence led to final failure is as follows: tific manner. In states where national legislation is not in accor- (a) Laboratory examination revealed that two of the bolts retain- dance with the ICAO SARPS, investigation procedures are not in ing the rear turbine location bearing had fractured as a result of place, the government and industry do not share incident data, reverse bending fatigue development. the investigation bodies are not independent, acute shortage of (b) A third bolt had cracked also as a result of the same mecha- technical personnel exist, and inconsistent implementation of nism. It was determined that distress to the inner track of the international standards is at large, the investigation is an art. If location bearing resulted in a cyclic load acting on the bearing the major stakeholders of aviation safety want to improve avia-

ISASI 2008 Proceedings • 35

Proceedings 2008.pmd 35 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 36 used orwastedduetoinefficiencies.However, ontheotherhand, fruitful through stateorgans. The fundshaveeitherbeenmis- systems, itisevidentthateffortsofdonoragencieshavenotbeen drug addiction,health,infrastructure development,andjudicial ness ofsimilarplansinthefieldeducation,povertyreduction, invested large sumsasdonors.Similarly, ifweseetheeffective- this Roadmap withadesire toimprove aviationsafetyandhave is sadthatthere hasbeennoprogress onthisroadmap. the FSF, theIATA, andIFALPA forICAO, states,andindustry. It aviation safetydevelopedjointlybyACI,Airbus,Boeing,CANSO, tion SafetyRoadmap, whichisastrategicactionplanforfuture while workinginPakistan forimplementationoftheGlobalAvia- I wouldtake thisopportunitytoconveytheexperience Ihad Proposal tointernationalaviationstakeholders traditional ones,whichare normallythrough ICAOandstates. tion safety, theyneedtolookfornewapproaches otherthanthe It isdiscouragingforthoseorganizations thathaveworked for • ISASI 2008 ISASI Proceedings 36 information forinternationalbodiesaswell. ernment organizations. Theycanbeanindependent source of cation andmotivationforsafetyintheindustryaswellgov- least thesegroups cantake theleadinpromoting awareness, edu- possible through NGOssupportedbyinternationaldonors.At dividual efforts.Theireffortsneedtobeorganized andthatis tions. Theyare stilltryingtoimprove aviationsafetythrough in- oppressive andauthoritativecultures ofgovernmentorganiza- civil aviationbutcouldnotcontributemuchwhileservingunder engineers, andairtrafficcontrollers whohavevastexperience in spent theirlivesforthecauseofaviationsafety. There are pilots, south Asiahavealarge numberofaviation experts whohave tion ofhumanresource inthisfieldthrough NGOs.Countriesin pose totheglobalaviationstakeholders toconsiderthemobiliza- infrastructure, etc.through non-governmentalorganizations. significant progress isvisibleinthefieldsofeducation,health, NGOs canbethebesttoolforimproving globalaviationsafety. Aviation safetyisnoexception tothisreality; therefore, Ipro- 1/14/2009, 8:22 AM ◆ What Can We Learn? By Graham Braithwaite (MO3644), Cranfield Safety and Accident Investigation Centre, Cranfield University, Beds, MK43 0AL, UK

Graham Braithwaite is head of the Department of biases of the original specialism can pervade the new role. A few Air Transport at Cranfield University, UK. He was examples include the following: appointed as director of the Safety and Accident Inves- tigation Centre in 2003 and awarded a chair in Safety Let me through, I’m an accident investigator! and Accident Investigation in 2006. Prior to this, he Former AAIB Principal Inspector Eddie Trimble always reminded worked as a lecturer at the University of New South new investigators that the first thing to do at an accident site was Wales, Sydney. Graham holds a Ph.D. in aviation place their hands firmly in their pockets and think before doing TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, safety management from Loughborough University and his research has anything else. The temptation to avoid such sage advice is consid- focused on issues of safety, culture, and investigator training. erable, even for experienced safety professionals. This is partly understandable as emergency services are likely to be actively in- “For the things we have to learn before we can do them, we learn volved before investigators turn up on site. Influenced by the heavy by doing them.”—Aristotle weight of expectations, the perceived pressure for the investigator to be seen doing something straight away is significant. Numerous Abstract simulations have demonstrated this behavior, with examples in- Each year, dozens of new investigators begin their training in air- cluding investigators walking on the wreckage trail, matching up craft accident investigation. Before them lay numerous traps and fracture surfaces, and ignoring basic personal protective equip- pitfalls to frustrate their transition from their first specialism as a ment needs. Experience is a partial fix for this, but the investiga- pilot, engineer, air traffic controller, human factors specialist, etc., tion community should be aware that the natural temptation for to that of “specialist generalist” investigator. The temptation to anyone on-site is to “get on with it,” which may have an effect on “revert to type,” especially when facing an unfamiliar situation and the preservation of evidence or the safety of the individual. with the heavy weight of expectations, is a real challenge. Yet as Even when it is appropriate to get on with the site phase, there major accidents become thankfully less frequent, the firsthand ex- remains the temptation to focus on certain aspects and miss perish- perience of long-serving investigators is becoming limited and as able, or more important, evidence. Faced with a scene of chaos, it is such, some of the same traps lie in wait, only arguably with more a normal reaction to start to tunnel or focus in on a small number of significant consequences. This paper highlights the role of higher cues as a coping mechanism. Believing that the investigation au- fidelity simulation and continued self-assessment as two ways to thority has unlimited powers to keep the site unaltered for as long as assist even experienced aircraft accident investigators to continue it wishes forgets the need for cooperation that lies at the heart of to take a scientific approach to their art. successful investigation. Generally, the art is of diplomacy regardless of what the documented procedures say should happen. Introduction The experience of an accident investigator is hard earned, yet many The temptation to still be a regulator new investigators find themselves placed on duty immediately after It is easy to pick on the regulator when discussing no-blame inves- their basic training, sometimes only to receive their first call-out tigation, but such criticism is sometimes warranted. However, many within days. For a majority of those, their prior experience as a pilot, will have at least heard of the stereotypical regulator who cites regu- engineer, air traffic controller, or other specialist will provide the lations and tends to assume those who have failed to follow them reason for them to be appointed as investigator. However, the tran- are violators who should be punished. The temptation for investi- sition from operator to investigator is not always an easy one. This gators to become the identifiers of failure, the spotters of error, is paper reflects on some of the challenges facing new investigators great, especially when nervous and inexperienced. While identify- to ask the question, what can we learn from their experience? ing what went wrong is an important step, it can be all too tempt- ing to stop at the first “eureka moment.” Indeed in one example Old habits die hard (during simulation), it was a non-contributory paperwork error Each year, dozens of new investigators are recruited by govern- that became the focus of a regulator/investigator. Having found a ment agencies, regulators, operators, insurers, and manufactur- problem, the individual then proceeded to aggressively interview ers. Whilst they are recruited primarily for their experience, there an engineer who had actually acted appropriately. The discussion are also certain personality traits that allow them to adopt a fair became increasingly heated and the engineer became uncoopera- investigative approach. One of the key challenges is making the tive, leading the investigator to conclude he had definitely found transition from their original specialism to that of an investiga- the problem. Upon debrief, it was established that the error was tor. However, there is some debate as to whether an investigator minor—the sort of inconsequential error that any system is de- must remain a specialist or will in fact become a generalist (former signed to tolerate—and in no way connected to the accident. The AAIB Chief Ken Smart argues the correct description is a “spe- engineer explained that he had taken great exception to the accu- cialist generalist”). What seems clear is that many of the habits or satory style and had responded accordingly.

ISASI 2008 Proceedings • 37

Proceedings 2008.pmd 37 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS of anyhumanactbefore beingtemptedtopassjudgment. with badairmanship.Theinvestigatormustestablishthecontext lieve theypersonallywouldmake, thisdoesnotnecessarilyequate Where apilotmakes anerror thattheinvestigatordoesnotbe- rect—sometimes itwillbe,butfarlessoftenthan somemaythink. the challengeistoquestionwhetherinterpretation iscor- Simply put,ifitseemsthatsomeonehasdonesomethingstupid, while feelingthesamewaythatthoseinvolvedinaccidentsdid. tors rarely facethesamesetofcues/inputsat timeor they wouldhavedoneinasimilarsituationistrap.Investiga- Comparing whatwasdonewiththeinvestigatorbelieves tion, butitremains aparticularchallengefornewinvestigators. while remaining invisibletothoseimmersedinit. their culture, overtothenewenvironment andassuchiscarried lers, engineers,andsoon—oftenbecauseithasbecomepartof type. Similarchallengespresent themselvesforairtrafficcontrol- In suchcircumstances, thenewinvestigatorcanquicklyrevert to rarely abletocopewiththecomplexities ofaparticularaccident. be helpful,achecklist-basedapproach totheinvestigationtaskis 38 been removed onscene.Hisfirstinvestigation priortohisarrival was notamajorissueinhis industry, thedeceasedwould have deal directly withdeadbodies,assumingthatascrashworthiness up. For example, one(marine)investigatorhad notexpected to not alwaysexperience whattheywere expecting whenthey signed moving from classroom theorytoapplication. ing attitudesandexperience hashighlightedthedifficultyin Similarly theuseofemotionalwitnessesorthosewithchalleng- though theywere fullyaware they were involved inasimulation. strong effect.Severalinvestigators were noticeablyshocked even recently usedtheatricalbloodasaprop duringsimulation,with their reactions? For example, simulationsatCranfieldhavemore new investigatorsforthisexperience, andwhatcanwelearnfrom thing anyonecouldeverexperience.” Howdowebestprepare atanaccidentsiteisprobablytual arrival the most traumatic investigator Greg Feith whodescribeshisexperience: ac- “The for whathefindsonsite.”Faith goesontociteformerNTSB rience orcareful preparation…can everprepare aninvestigator others. Faith (1996)observes“Norehearsal, noamountof expe- for mostinvestigators,andsomeare betterprepared foritthan The experience ofbeingonsiteforthefirsttimeisavividmemory Nobody toldmeitwouldbelike this…. tigator needstobeablethinkcreatively. While specifics ofaparticularaccidentand,more importantly, theinves- generally checklistbased.Processes needtobeadaptablethe some investigatorsistobetoldthataccidentinvestigationnot dard operatingprocedures andchecklists.Anearlyfrustrationfor For pilotsinparticular, theworldisoftenordered intermsofstan- The temptationtostillbeapilot that are designedtoallowasystemfunction. sideration theredundancies, margins, processes, andprocedures investigator istocomprehend howfailures occur, takingintocon- armed withanunderstandingofwhysystemsfail,therole ofthe their assessmentsandactionsmadesenseatthetime.”Further, not tofindoutwhere peoplewentwrong, itistounderstandwhy Hindsight biasisoftencitedasathreat toimpartialinvestiga- When aninvestigatorisdeployedintotheirnewrole, theydo As Dekker (2002)reminds pointofaninvestigationis us,“The • ISASI 2008 ISASI Proceedings 38 aide memoires can investigations are conducted,forthegeneral populationitseems While withintheindustry, itispartlybasedonthewayinwhich try isabletounderstandand learn from itsfailures. crashes.” Inotherwords, itisthetrustthatairtransportindus- according Primo (2003)isthe“absenceofunsolved toCobb and protect usinthefuture.” Indeed,partofsociety’svaluation ofsafety, pinpoint thecause(s)ofaccidentanddeliverlessonsthat will large, Bibel(2008)remarks, “We trustthataninvestigation will correct. Intermsoftheexpectation oftheindustryandsocietyat more fundamentally, thattheinvestigationwillbeaccurateand blame; trustthatconfidentialityordignitywillberespected; or evidence collectedbytheinvestigationwillnotbeusedtoallocate dent ontrust.Suchtrusttakes manyforms:whetheritbetrustthat Accident investigation,asdefinedbyICAOAnnex 13,isdepen- The trustedinvestigator tion in haps itistimethatweconsidered more carefully theuseofsimula- regular publictransportaircraft than,say, theirBritishequivalents. are more likely tobeinvolvedwitheventsinvolving high-capacity rapidly, there isminimalgeneralaviation,soinvestigatorsfindthey tion. InChina,forexample, where theaviationindustryisgrowing nity topracticetheirskillsbefore needingtotackleamajorinves challenge. Simplyput,manyinvestigatorshaveminimalopportu- the generalimprovement inaviationsafetyprovides aparticular Although commonskillspervademanydifferent typesofaccident, gained inthefieldisprimarilydictatedbyaccidentsthatoccur. would notbenamedinthefinalreport. to beverydifficultexplain totheparents thattheirdaughters while rushingacross acrossing, theinvestigatorfeltitwasgoing an investigationwhere twoyounggirlshadbeenhitbyatrain a logicalapproach duringtraining.However, onparticipatingin found theconceptofnotusingnamesinanaccidentreport tobe unexpected problem. For example, arailaccidentinvestigator this role, andsomenewinvestigatorshavefoundthistobean already multitaskinginvestigator. Noteveryoneexpects toplay vors, friends,andrelatives hasaddedanincreased loadtothe example, liaisingwiththoseaffectedbyanaccidentsuchassurvi- tions ofwhattheinvestigationshoulddeliverhavegrown. For something hefoundverytraumatic. onto thedock,allotherserviceslooked tohimbefirstonboard, proved thisnottobethecase.Asaccidentvesselwaswinched hard wonand,itisargued, becomingharder forsometo gain. harder-to-define role ofaccidentinvestigator. Thisexperience is not intheiroriginalspecialism,butnewone,themuch- else standsinthewayofnewinvestigator?Itisexperience, undergoing accidentatHeathrow? followingtheB-777 the NTSB,Boeing,andRolls-Royce investigatorsare currently it take tobeabledeliverthesortofexperience thattheAAIB, duration forwhichitcanrun.Howsubstantialasimulationwould presently limitedbythesizeof eventthatcanbestagedandthe lenge ofeverythinghappeningatonce.However, simulationsare trate thesortsofthingsthatwillhappenon-site,suchaschal- their experience. Evenrelatively small-scalesimulationscanillus- Where does thetrustinaccidentinvestigationactuallycomefrom? The improvement insafetyis,ofcourse,agood thing,butper- This eventalsohighlightsthefactthattypeofexperience Other challengeshavecomeaboutbecausesociety’sexpecta- Avoiding thesetrapsandpitfallsisaworthwhilegoal,butwhat ab initio andrecurrent trainingtohelpinvestigatorsbuild 1/14/2009, 8:22 AM tiga- more to do with the way in which investigators are apparently able to In other words, inductive logic depends on the investigator mak- make sense from chaos. Weir (1999) describes investigators as fol- ing inductive “leaps” on the basis of the weight of available evi- lows; “Of all the insiders in the aviation business, the air-crash inves- dence. Such evidence may be of variable form and quality e.g. tigators are the airline passenger’s best allies. Their job is to attempt physical evidence, witness statements, digital data, and so on. As to prevent the things we fear the most.” Reason observes, “Like the the Australian Transport Safety Bureau (ATSB) analysis review rest of the modern world, I owe an enormous debt to the skills of reported “safety investigations require analysis of complex sets professional accident investigators. As a traveler and a consumer, I of data and situations where the available data can be vague, in- am extremely grateful for what they have done to make complex complete, and misleading.” (Bills and Walker, 2008) technologies significantly safer.” (Strauch, 2002) Similar to the work of social scientists, the investigator is look- During training, it is the building of trust and credibility that ing for convergence of evidence while also maintaining vigilance many new investigators identify as their priority. So how is this for their own biases. This is often a difficult transition for investi- best achieved? This is one aspect where the science is arguably gators to make, especially if they are used to precision and order rather easier than the art. Understanding the legislation, the in their prior aviation career. Witness evidence is a particular case theory of interviewing, different modes of failure, and so on seems in point where “expert” witnesses may seem more compelling more achievable than understanding how to combine these mul- than those who perhaps look or sound less credible. Similarly, it TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, tiple inputs and deliver an answer that is accurate and will actu- is known that unlikely explanations are much harder to accept ally help to make the industry safer. The art lies in exhibiting the than likely ones even when the strength of evidence may actually difficult to quantify concept that is “investigative judgment.” be the same. Learning this skill is perhaps the hardest of all, especially when even experienced investigators struggle to ar- Scientist or artist? ticulate their own approach. A scientist may be described as “a person who is studying or has For example, myriad analysis tools abound, but the majority are expert knowledge of one or more of the natural or physical sci- suitable only for certain elements of the overall analysis. For ex- ences.” (Concise Oxford English Dictionary, 2006) Scientists main- ample, fault trees may be a logical way of dealing with component tain their skill levels through practice and through maintaining or physical system failures, but will struggle to handle less tangible their knowledge of the research literature. By doing the job, the factors such as the influence of, say, culture or training. Even where scientist can maintain their currency, but such a vast topic cannot investigation approaches have been defined, such as the Integrated be covered by one scientist and is therefore dependent on being Investigation Process or indeed some of the applications of Reason’s able to cite and link to the work of others. organizational accident model, they tend to provide a framework, An artist may be described as “ a person skilled at a particular rather than the rigid methodology that some expect. There is cer- task or occupation, for example, a surgeon who is an artist with tainly scope for improvement, even among the leaders in this area. the scalpel.” More commonly, the term artist is used to describe The Queensland state coroner complimented the ATSB’s work to “a performer, such as a singer, actor, or dancer.” (Apple, 2008) It refine the way in which it approaches accident investigation. “The is arguable that for many artists, their talent lies way beyond their Bureau is to be commended for attempting to adopt a scientific training. This notwithstanding, even great artists need practice approach to what has been, in many instances treated as an art to become, and remain, successful. Expectations of their ability form.” (Bills and Walker, 2008) However, this did not stop the coro- can place considerable pressure upon them and few artists re- ner from then voicing concerns over the standard of proof that main at the top of their game throughout their career. was considered to be acceptable. Mike Walker will speak of this So which best describes the accident investigator? important work during this conference and it is to be applauded Investigation, like scientific research, requires disinterest, im- as a major step forward. Putting it into practice, however, shows partiality, and a desire to reach the truth, whether it fits your some of the depth of the challenge, especially when many new previous model, first guess, last 6 months work, or not. However, investigators start with great optimism about the clarity of evidence like art, accident investigation also requires creativity, understand- that will be presented to them. ing, passion, commitment, and emotion. New recruits cite traits from both categories (see Braithwaite, 2004) as being important Maintaining competency qualities of an investigator, yet it is rare for all of the best traits to While gaining enough experience to start investigating is one exist in just one category. It is clear that neither the pure scientist task, how to nurture and preserve some of the skills is another nor the pure artist will succeed and for many, this means the problem. In other words, how do investigators maintain their need to blend together two quite different approaches. competency in what they do? There is a distinction between being competent (being able to demonstrate abilities upon recruit- Scientist and artist? ment) and maintaining competency throughout an investigator’s Perhaps, just as the “specialist generalist” describes the investiga- career (maintaining currency in their skills). As mentioned above, tor, so does the description of “artistic scientist” (or “scientific the nature of investigation is such that it is often the accidents artist” for that matter)? The investigation of events within a com- themselves or the position of the investigator on the call-out list plex socio-technical system such as aviation depends on a mix- that will determine what skills are exercised at any one time. ture of deductive and inductive logic. The former, where particu- Writing more than 20 years ago about the impossibility of guar- lar instances are explained in terms of a general law, depends anteeing personal experience of a particular aircraft type for each upon absolute confidence in the data. Is it more likely then that investigator, former UK AIB Chief Bill Tench (1985) observed, an investigator would be dependent on inductive logic, where a “What you can and must do, however, is ensure that all the inves- particular instance is used to infer the presence of a general law. tigators are expert in every sense in the techniques of investiga-

ISASI 2008 Proceedings • 39

Proceedings 2008.pmd 39 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 40 entirely filledbysmallerinvestigations.Time andspaceinan the lackoflarge accidents(beit real orvirtual) shouldnotbe catastrophe? an A380orB-787 many ofushavedetailed,testedplansinplacetorespond to,say, pens, manyofthesechallengescanbeanticipated.However, how challenges beingfacedbyallinvolvedwhensuchanevent hap- While alackofexperience withlarge accidentswillleadtonew How canwebettereducateinvestigators? ily believethem,buttheydolistentothem.” investigators “listentootherinvestigators.Theydon’t necessar- in from theindustry. AsWood andSweginnisnoted(1995),good can dowelltolistentheperspectivesofnewinvestigators, fresh ommendations remain anarea where experienced investigators tions intotheseareas are stillcomparativelyrare. Similarly, rec- cepted andevencitedbyICAO(1993),really goodinvestiga- Reason’s organizational accidentmodelare generally widelyac- of developingreliable analysisprocesses. Whilsttheoriessuchas even theywouldadmitthatwestillhavealongwaytogointerms Transportation SafetyBoard ofCanada(TSB)andtheATSB, validate existing techniquesthatare alwaysopentoimprovement. questions canbeanopportunitytoconstantlyreassess andre- be thequestion“becausewouldn’t thiswaybebetter?”These times, underlyingaquestionof“whyisitdonethatway?”might ing questions,inpartbecausetheyhaven’t yetlearnednotto.At process asoftentheinexperienced asksomeofthemostsearch- that are appliedtovaryingstandards bydifferent investigators. ora ofanalysismethods,withtheirrelative strengths andweaknesses, making issomethingthatneedsperiodicreview? There are apleth- proach taken toevidencecollection,analysis,orrecommendation- stant challengeofthemeaningevidence,perhaps ap- theoverall Although theverynature ofaccident challenge themselvesastowhethertheyare doingtherightthing? with direct experience ofdealingwithanaircraft accident? experience. For example, howmanymodernairlineshavestaff cies thatmayalsohaveaninterest willbestartingwithminimal able tosendsuitablyexperienced staff,manyofthoseotheragen- quences maybegreater. Eveniftheleadinvestigationagencyis for eventheexperienced investigator, except thattheirconse- up withcanstillbechallenged!Manyofthetrapsremain ahazard now, andthelegalindustry’sexpectation thatwhateveritcomes find theanswer, thenewsmedia’sexpectation thatitwillbefound This isagainstthebackdrop ofsociety’sexpectations thattheywill vestigators willfindthemselveshavingtodealwithlarge accidents. scale aircraft accidents,soagreater numberofinexperienced in- Firstly, weshouldacknowledgethatwiththereduction inlarge- What canexperienced investigatorslearn? (1989) are dwindlinginnumberwithintheAAIB. two majoraircraft accidentsatLockerbie (1988)andKegworth tired. For example, thoseinvestigatorswhowere involvedinthe specialists are headingtoward retirement, orhaverecently re- ists inthetypeofaircraft concerned.”Unfortunately, someofthe but theymustalsohaveaccesstoreliable andimpartialspecial- tion and There isanargument tobemade thatthe“void”created by While recognizing thatthere are someexceptions, suchasthe The newinvestigatoralsohasacontributiontomake tothis Even fortheexperienced airsafetyinvestigators,howoftendothey • ISASI 2008 ISASI au fait withallaspectsofoperatingmodernaircraft…, Proceedings 40 investigation requi res con- Wood, andSweginnis,R.W. R.H. (1995)Aircraft AccidentInvestigation. Weir, A.(1999)TheTombstone Imperative:TheTruth AboutAirSafety. The ConciseOxford EnglishDictionary(2006)Eleventheditionrevised. Ed. Tench, W.H. (1985)Safetyis NoAccident.CollinsProfessional andTechni- Strauch, B.(2002)InvestigatingHumanError: Incidents,Accidents, and ICAO (1993)HumanFactors DigestNo.10:HumanFactors, Management, Faith, N.(1996)BlackBox:WhyAirSafetyisNoAccident.Boxtree, London. Dekker, S.W.A. (2002)TheField Guide toHumanError Investigations. (2004)Re-InventingBraithwaite, G.R. (With Wheels,Wings, andSails)—A Bibel, G.(2008)BeyondtheBlackBox:TheForensics ofAirplaneCrashes. Bills K.M.andWalker, M.B.(2007)Analysis,Causality, andProof inSafety References people tomake itclick.”(citedinFaith, 1996) its outcomes;orasRon Schleedeputit,“Ittakes allkindsof and forthatreason allinvolvedcancontributetotheprocess and thinking, anapproach, asitisspecificknowledgeorexperience important toremember thatinvestigation,isasmuchawayof myriad. However, regardless ofbackground andexperience itis turing strongly andhencethetypesofpeopleinvolvedare also qualities are required withthoseofbothartistandscientistfea- alities required outasuccessfulinvestigation.Myriad tocarry is thevarietyofdisciplines,approaches, knowledge,andperson- (CRM) andthreat anderror management(TEM). adding non-technicalskillssuchascrew resource management nal simulationsfocusingontechnicalskills,andlaterrefinements (the art).Theparallelwithflightdecksimulationisclearorigi- aspects suchasanalysis,criticalthinking,group dynamics,etc., the fieldinvestigations(thescience),butalsolesstangible these simulationsincorporatenotonlythetechnicalaspectsof nothavehadachancetoacquire.may otherwise Increasingly, environment inwhichtopracticeanddevelopskillsthatthey vide ahighleveloffidelity, thereby allowinginvestigatorsa“safe” tinuing development.Carefully developedsimulationscanpro- tions, whetheritbein at learningnewthingsorupdatingexisting thinking. know orunderstand,andoftenthosesamepeopleare theworst teachers are thosewhocannotremember whatitislike notto mind themore experienced ofwhentheywere new. Theworst leads toimprovement ofthoseprocedures butalsohelpstore- for bothparties.Reassessing procedures (whatandwhy?)notonly that continualmonitoringofone’sownpracticescanleadtogains gator totake someresponsibility foreducatingothers.Itishere tors willbe“onthejob,”itbefallsmore experienced investi- tabletop sessions. investigation, andanalysissimulationstomuchshorter“whatif?” tion, skillreview, etc.Thiscould rangefrom full-blownresponse, investigator’s workloadshouldalsobemadefortraining,simula- Endeavor Books,Casper. Simon andSchuster, London. Catherine SoanesandAngusStevenson. Oxford UniversityPress, 2006. cal Books,London. Complex Systems.Ashgate,Aldershot. Montreal. and Organization. Circular 247.InternationalCivilAviation Organization, Ashgate, Aldershot. ference, 2004.GoldCoast,Australia. 2004,InternationalSocietyofAirSafetyInvestigatorsAnnualCon- ISASI New LookatTransport AccidentInvestigatorTraining. Paper Presented at The JohnHopkinsUniversityPress, Baltimore. reau, Canberra. Investigations Report No.AR-2007-053. AustralianTransport SafetyBu- The difficulty, andalsopartoftheattraction,investigation There isalsoalarge role tobeplayedbytrainingorganiza- In addition,sincethemajorityoftrainingformostinvestiga- 1/14/2009, 8:22 AM ab initio trainingorinmore advancedcon- ◆ Accident Investigation— A Complete Service? By Phil Taylor, Senior Inspector of Air Accidents (Operations), UK AAIB Phil Taylor trained as an aeronautical engineer and One of my brothers who is a dental surgeon once told me that one helicopter pilot with the Royal Navy. He served on of the things that attracted him to the profession was the fact that frontline squadrons and as a helicopter maintenance when a patient comes to him with a dental problem, he can follow test pilot and also achieved chartered engineer status. their treatment all the way through to the end (Figure 1). Does this After 17 years’ service, he retired from the Royal Navy also apply to air accident investigation? Who are our patients or, and joined a regional airline, where he flew turbo- more appropriately, stakeholders? At face value, it might seem TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, prop and regional jet aircraft and became the obvious; they are the operators, the manufacturers, and regula- company’s chief pilot. Phil joined the AAIB as an operations investigators, the bodies to whom we make our recommendations. How- tor in 2002 and has investigated accidents and incidents to most ever, those affected by our work also include passengers, bereaved classes of aircraft, both fixed and rotary wing, in the UK and overseas. relatives and friends, and, in some instances, the public at large. He holds ATLP licenses for aeroplanes and helicopters and maintains Do we provide all of them with a complete service? his fixed-wing currency by flying online operations with a commercial In searching for a suitable definition of complete service, I operator. He has recently converted to the Boeing 757 and Boeing 767 came across many companies that claim to provide what they and continues to fly helicopters. term a complete service.

Introduction While attending ISASI 2007 in Singapore last year I scribbled a note to myself. It simply said “Air Accident Investigation—A Com- plete Service.” What prompted me to write it, I am not sure. However, when the title of this year’s ISASI international seminar was announced, it triggered the same thought but with a question mark at the end. I would like to consider what the expression “complete service” might mean. Then, taking the theme “Accident Investiga- tion—The Art and the Science,” the paper will briefly review the ingredients involved in the process, from notification to safety recommendation action, and consider those who benefit, in whatever sphere of interest, from the final report. Examples from investigations will be used to illustrate the content of the paper, and some that confirm or challenge the notion of completeness will be referred to. The paper will discuss improvements that could be made to enhance the process, includ- Figure 2: A more ing advances in technology. complete service. Finally, the paper will consider an aspect of accident investigation that seems fundamental to its success and the integrity of the process. It will sum up by proposing that the completeness of investigations could be improved with the introduction of lightweight flight data and voice recorders on smaller aircraft.

A complete service

Figure 1

ISASI 2008 Proceedings • 41

Proceedings 2008.pmd 41 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS Figure 4 42 are abletoprovide comprehensive findingsandcausesfrom which dence, witnessstatementsand dataoftenproduces reports that Emergency locatortransmitters.Thereafter, theanalysisofevi- very remote accidentsites,assisted inthelocationprocess by teams tobeformedquicklyand,withmodern-daytransport, reach this notificationisoftenveryspeedy. Thisenablesinvestigation rapid meansofcommunication,thetransmissionandreceipt of incidents isclearlylaidoutintheappropriate manualsand,with cally, “Perfection isthechildoftime.” are lumpsinit.”However, anEnglishclericsaid,more optimisti- “Finality isdeath,perfectionfinality; nothingisperfect,there finished, butisitperfectinquality. OneIrishpoetoncewrote, prevention ofaccidents andincidents,ourworkisclearlynot apply here! periodic overhaul onanautomobileormachine.”Butthatdoesn’t mobile ormachine”—makinga“completeservice”’“finished ished,” andfor“service,”“aperiodicoverhaul madeonanauto- Combined thisgives“work,perfectinquality, foranother.” kind.” For “service”itgives “performanceorworkforanother.” One dictionarydefinitionof“complete”is“perfectinqualityor The procedure forthenotificationof accidents andserious Insofar asthesoleobjectiveofaccidentinvestigationis the There were otherdefinitionsfor“complete,”including “fin- • ISASI 2008 ISASI Proceedings 42 Figure 5 Figure 3 Figure 7 morning (Figure 7).Thepilotofanother aircraft thatfollowed it hadencountered flyingintheopposite direction earlierthat it flewinorbetweencloudlayers inmuchthesameconditionsas with onlythepilotonboard. to theOrkneysandShetlandIslandswasreturning empty return toInvernessonthemainland(Figure 6). Stornoway, intheOuterHebrides,towestofScotland, there are fewwitnesses. ment fortheaircraft tobeequippedwith anFDRorCVRand that isnotalwaysthecase—particularlywhere there isnorequire- ness evidencewere availabletotheinvestigationteam.However, ommendations totheregulator, operators,andmanufacturers. and thecomprehensive finalreport ontheaccidentmade31rec- statements. Theinvestigationincludedmuchtestingandresearch corded data,medicalandpathologicalinformation,witness craft wasdestroyed (Figures 4and5). 137 passengersandcrew onboard losttheirlives,andtheair- off wasrejected. access panelwaspunctured andleakingfuelignitedasthe take- Runway 24atManchesterintheUK(Figure 3).Awingfueltank an uncontainedfailure oftheleftengineduringitstakeoff from appropriate safetyrecommendations canbemade. The aircraft climbedtoitscruiselevelofFlight Level95where The aircraft hadearlierdelivered newspapersandmagazines In October2004,aReims CessnaF406,G-TWIG, tookofffrom In thatinvestigation,asinmanyothers,alotofdataand wit- The investigationteamhadaccesstothedamagedaircraft, re- Tragically, duringthesubsequentfire andevacuation55ofthe In August1985,aBoeing737,registration suffered G-BGJL, 1/14/2009, 8:22 AM Figure 6 Figure 8

Figure 10 (above) and Figure 11 (left) TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY,

Figure 9 recorder. Had it been, we would have stood a better chance of determining what had occurred, although the why may still have eluded us. In July 2002, a Robinson R22 helicopter, registration G-VFSI, took off from an airfield in the middle of England for a sightseeing flight around the town of Warwick. On board were the pilot and his girlfriend’s father. The pilot had already completed three flights earlier that day with a friend and, separately, his girlfriend’s mother. The the same route about 20 minutes later stated that there was no weather was good and the aircraft followed the same route as it icing or turbulence at his level, FL75. Shortly after G-TWIG be- had on the previous flight. We established this from data that gan its descent for the approach to Inverness Airport, it disap- were later retrieved from GPS equipment recovered from the peared from radar at FL78 and contact with the pilot was lost. wrecked aircraft. A day later, the remains of the aircraft and the pilot were found Abeam the western edge of Warwick, with the aircraft flying in a remote location on the Scottish highlands within a few hun- level at a height of about 1,500 feet and cruising at about 70 kts, it dred meters of the position of the final radar return (Figure 8). was seen to break up in flight and descend into a field. Evidence The aircraft was very badly fragmented, so much so that from also included various eyewitness accounts and photographs that the air it was difficult to distinguish from the surrounding rocks had been taken by a camera that was recovered from the helicop- and vegetation and was ultimately discovered by a mountain res- ter (Figure 12). The data from the GPS equipment and the photo- cue team that had joined the search (Figure 9). graphs gave us information on the aircraft’s altitude and ground- It was established that the aircraft was structurally intact when speed shortly before the accident and an indication of what the it struck the ground in an estimated 70° nose-down attitude with its longitudinal axis at an angle of 68° to the ground at impact, i.e., left wing low (Figures 10 and 11). The extreme fragmenta- tion of the wreckage suggested a high impact speed, probably in the region of 350 kts. Evidence suggested that the engines were producing a significant amount of power and that the elevator trim actuators were near to their full nose-down position. What caused the aircraft to carry out an apparently dramatic maneuver could not be established, and there was nothing to indicate that the pilot contributed to the aircraft’s departure from its flight path. This was an unusual accident. Those with a close interest in the final report were the airline, other F406 operators, the manufacturer and, also the pilot’s family, friends, and his fiancée. Ulti- mately we were unable to determine what had happened or why. We considered it possible that the pilot may have become inca- pacitated. Internationally agreed standards did not require G- TWIG to carry either a flight data recorder or a cockpit voice Figure 12

ISASI 2008 Proceedings • 43

Proceedings 2008.pmd 43 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS in theaircraft. Anumberofpossibleexplanations were explored conscious, shouldcrashinthis fashioninsuchbenignconditions. aircraft, pilotedbysomeonewhowas,allaccounts, verysafety frequency mayhavebeenaningredient, itwasunclearwhythe While itwaspossiblethatthetimetookpilottochange nications andnavigationfrequencies whilemakingsuchachange. equipment, onwhichitwaspossibletotogglebetweencommu- frequency onthecombinedcommunicationsandnavigation nized RTF. Thisestablishedthatthepilothadsuccessfullychanged the pilot.Itwasabriefdistressed utterance rather thanrecog- ment theaircraft crashed,wasconsidered tohavebeenmadeby sion onthenewfrequency, whichwastimedjustbefore themo- ing thefirstcallorthatthere wasanyproblem. Abrieftransmis- ATC andgavenoindicationwhathaddistractedhimfrom hear- repeated byATC. Thepilotacknowledgedthesecondcallby structed tochangeradiofrequency, aninstructionthathad tobe ATC were analyzed.Shortlybefore theaccident thepilotwasin- corded someoftheflight.Also,radiocallsbetweenpilotand mately 80kts(Figures 14and15). mated 30°nose-downattitudeandataforward speedofapproxi- through approximately 130°,andcrashedintoafieldinanesti- craft haddescendedfrom aheightofabout400ft,turnedleft their 4-year-old son.Within 2minutesofitsdeparture, theair- was accompaniedbyhiswife,who3months’pregnant, and for aflightinthelocalarea. Theweatherwasgoodandthepilot took offfrom BigginHillairfield,anaerodrome nearLondon establish someelementsofthehistoryflight. investigations inwhichwehavebeenabletouseGPSdata pilot andhispassenger. Notably, thiswasoneofanumber manufacturer, andthetwofamiliesfriendsofdeceased ticular interest toownersandoperatorsofR22helicopters,the caused theaccidentandanswerquestionsthatwere ofpar- yaw pedals,orboth. result ofanunintentionalinputoneitherthecycliccontrol or in thiscaseitwasconsidered possiblethatthisoccurred asthe 44 Figure 13 The investigationrevealed noevidenceofanypre-impact faults Witness statements were compared withradardatathatre- In July2003,aHughes500Chelicopter, registration G-CSPJ, Again, wewere unabletoestablishwithcertaintywhathad • ISASI 2008 ISASI Proceedings 44 abrupt control inputsand, This canbecausedby the mainrotor blades. the aircraft wasstruckby bumping, thetailconeof that, asaresult ofmast been (Figure 13). was considered nottohave lence hadbeenafactor. It ing whetherwake turbu- of assistanceindetermin- craft inthearea, whichwas flight pathsofotherair- track andshowedthe roborated theaircraft’s ered radardatathatcor- broke up.We alsorecov- seconds before theaircraft passenger hadbeendoing Evidence suggested sist investigationteams.GPSequipment andcameras,whichsur- lightweight recorders forflightdataandvoicewouldgreatly as- many otheraccidentsinvolving lightaircraft, datafrom suitable accidents by80%inthe10-year period upto2016.Intheseand Helicopter SafetyTeam, asthey endeavortoreduce helicopter copter SafetyTeam anditsEuropean partner, theEuropean the accidentsthatattractattentionofInternational Heli- the report ontheaccidentinvolvingF406,G-TWIG. can bepracticallyimplementedonsmallaircraft were reiterated in recommendation relating toappropriate recording equipmentthat data andvoicerecording equipment.Theseandanothersimilar design anddevelopmentofinexpensive, lightweight,airborneflight or ageand,secondly, urging thepromotion ofresearch intothe ness inthecommercial airtransportcategory, regardless ofweight equipment toallaircraft operatingwithacertificateofairworthi- safety benefitsoffitting,asaminimum,cockpitvoicerecording had avestedinterest inthefindings. population inthearea, where there havebeenotheraccidents, interested intheoutcomeofinvestigation.Also, thelocal two familiesandthefriendsofdeceasedwere particularly ment wasrequired orfittedonthisaircraft. data recorder orcockpitvoicerecorder orboth.Nosuchequip- not havebeenthecaseifaircraft hadbeenfittedwithaflight terest mayneverknowwhytheaccidentoccurred. Thismight from happening againand,secondly, thosewithapersonal in- measure ormeasures wouldprevent suchan unusualaccident factory from twoperspectives.Itwasnotpossibletostatewhat from BigginHillAirport, remain unresolved. Thiswas unsatis- which happenedingoodweatherandshortlyafterdeparture The helicopteraccidentsIhavereferred towillbeamongst Two recommendations were madeurging thepromotion ofthe Once more, aswellotheroperatorsandthemanufacturer, 1/14/2009, 8:22 AM this accident, or causesof tion, thecause cient informa- sult ofinsuffi- flawed. Asare- but eachwas (left) (above) and15 Figures 14 affairs and the independence of an accident inves- Figure 16 tigation authority is important in being able to provide a complete service in which all stakeholders can have confidence. I would briefly like to mention a third aspect of our global efforts to improve aviation safety, and it is a subject that could be a point of discussion on its own. It is the matter of mutual assistance. States have different strengths, and sharing them seems the best way to tackle aviation safety on a global scale. As technology and skills develop, strengths vary and fluctuate. That seems logical. There is the provision for assistance between states, and outreach programs provide helpful training. However, when assistance is requested, perhaps there is more that TUESDAY, SEPT. 9, 2008 SEPT. TUESDAY, could be done. The speed with which a suitable response can be delivered raises the question as to whether more cannot be done before the perceived need is challenged. So, who benefits from our work? Operators, manu- vive an accident sufficiently to provide an incomplete record of facturers, regulators, passengers, families and friends of the de- the flight, give a glimpse of how useful such recorders could be. ceased and injured, and the public at large. Do we provide a com- This would not only assist the investigation teams but would also plete service? There are many examples of excellent investigations provide greater closure for those with a personal interest in an that have brought about significant improvements in aviation safety. accident and present independent evidence for a concerned gen- Instances in recent years where aircraft have crashed and caught eral public, whose fears can be fuelled if there is an absence of fire or crashed and not caught fire and all the passengers and crew proven facts. have successfully evacuated are indications of an improvement in In March 2006, a Hawker Siddeley HS748, G-BVOV, overran survivability, although the avoidance of the accident in the first the runway at Guernsey Airport, in the Channel Islands, while place is clearly the objective. However, the introduction of light- landing in poor weather (Figure 16). weight recorders would be of great assistance in those investiga- The aircraft suffered damage to two tires but was otherwise tions involving aircraft that are not currently required to carry them unscathed. The operator had been involved in previous serious so that the cause, or causes, can be establish and suitable recom- incidents that had been investigated by the AAIB and had a his- mendations for prevention can be made. If we want to reduce the tory of non-conformities being raised during audits by the regu- rate of accidents among helicopters, I would suggest that this could lator and had been closely monitored for at least 2 years. Con- be significant step in that endeavor. I would also suggest that our cerns included the operator’s management structure and com- global effort can be enhanced by increasing the speed of response petencies, and its ability to maintain standards of safety. Shortly to requests for assistance so that we are better prepared globally. after this incident, the operator’s AOC was suspended by the The independence of an investigation authority seems funda- regulator and the company subsequently ceased trading. mental to the completeness of the service we provide, while also The investigation revealed a trend of shortcomings that were acknowledging that working closely with our various stakehold- not addressed by the operator despite assurances to the regula- ers, be they operators, manufacturers, regulators or members of tor. The regulator had expended much effort in encouraging the the public, all of whom can provide us with information that en- operator to meet the required standard but this had not been able us to carry out our investigations, is also important. The fact achieved. In the final report, it was considered that a contribu- that we do not apportion blame or liability can only assist us in tory factor to the incident was that close monitoring by the regu- that aspect. The independence of an investigation surely enhances lator had not revealed the depth of the lack of knowledge of the integrity of the process and provides the beneficiaries of the standard operating procedures within the operator’s Flight Op- results with confidence in the outcome. erations Department until after the overrun incident. As a result, In conclusion, do we perform “work, perfect in quality, for a recommendation was made to the regulator regarding its over- another”? It would be arrogant to suggest that we do, and I have sight of AOC holders in order to ensure that AOC holders meet indicated where there are some “lumps” in our endeavors to sup- and maintain the required standard. This recommendation was ply a complete service, although there are also many investiga- made only after very constructive and positive discussions be- tions that I suspect come very close to that ideal. Many investiga- tween the AAIB and the regulator. While underlining the impor- tions could be enhanced with the introduction of lightweight flight tance of good working relations between all those involved in data and voice recorders on aircraft which are currently not re- ensuring aviation safety, it also exemplified the value of an inde- quired to be fitted with them. Also greater mutual assistance and pendent investigation. support between states could help to achieve a more complete Examination of the recommendations that are made in acci- service globally. Not the least, maintaining the independence of dent and incident reports reveals that many are made to regula- the investigating authority is surely the basis of ensuring that the tors. I would suggest that this is a thoroughly healthy state of perception and reality of a complete investigation is realized. ◆

ISASI 2008 Proceedings • 45

Proceedings 2008.pmd 45 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS of MassachusettsatAmherstbefore joining professor in theDepartmentofIndustrialEngineeringatUniversity andassociate at JohnsHopkinsUniversityAppliedPhysicsLaboratory joining theBoard in1998. at Calspan/UniversityBuffaloResearch Center(CUBRC)before Buffalo, NewYork, USA,in1996,andwasaseniorresearch scientist Dakota, where hereceived hisdoctoratein1969. and director oftheHumanFactors attheUniversityofSouth Laboratory the NTSBin1990,hewaschairmanofPsychology Department, positions ontechnicalissuestogovernmentandindustry. Prior tojoining Seattle, before joiningtheBoard in2007. 46 the NTSBisusingitsbroad rangeofexperience andtechnical gation process. Asaleader intransportationsafetyinvestigation, is engagedinastrategicproject toexamine its accident investi- The UnitedStatesNationalTransportation SafetyBoard (NTSB) Introduction • Major AviationAccident Investigation ISASI 2008 ISASI Managing theComplexities ofa mechanical engineeringfrom theUniversityof HereceivedLaboratory. hisdoctoraldegree in Recorders andtheVehicle Laboratory, Performance divisions—theMaterialsLaboratory, theVehicletory responsible foroversightoftheBoard’s three labora- Office ofResearch andEngineeringwhere heis Joseph M.Kolly of Buffalo,NewYork, USA,andwasaseniorscientist trial engineeringandoperationsresearch attheUniversity policy andpractice.Heearnedhisdoctorateinindus- work attheBoard hasfocusedontransportationsafety Safety StudiesandStatisticalAnalysisDivision.His in theNTSB’sOfficeofResearch andEngineering, Bruce G.Coury other majorproducts, andrepresents theBoard’s review oftheBoard’s accidentreports, and studies, is alsoresponsible scientificandtechnical forprimary He engineering supportforinvestigationsinallmodes. the Board’sprovide laboratoriesthat of Research andEngineeringwhere allof hesupervises Vernon S.Ellingstad Aaron S.Dietz and ineconomicsfrom theUniversityofWashington, tions. Heearnedhisbachelor’sdegree inpsychology critical accidenteventstosupportinvestiga- working onthedevelopmentofrepresentation of and StatisticalAnalysisDivision.Hehasbeen Office ofResearch andEngineering, SafetyStudies Proceedings By JosephM.Kolly, BruceG.Coury, Vernon S. Ellingstad,andAaron S.Dietz 46 National Transportation SafetyBoard, Washington, D.C.,USA isanprogram analystintheNTSB’s isatransportationresearch analyst isdeputydirector oftheNTSB’s isdirector oftheNTSB’sOffice the NTSB in2002. scientific and the accidentinvestigationprocess was modeledandamethod- Provide ablueprint forreport development. • Increase participationby entire core investigative team,and • Enhancecommunicationsandinformationaccess, • issues, Increase efficiencyininvestigationsbyfocusingonprincipal • end, theproject has establishedthefollowingobjectives: tices related tospecificoperational ortechnicalareas. To this ing issues,notthepursuitofinvestigativeprocedures andprac- Accordingly, theemphasisisonidentifying,refining, andresolv- treatment ofissuesandinformationfoundintheon-scenephase. tivities thekindsofinvestigatorinteraction,communication, and is todevelopandimplementinpost-onsceneinvestigative ac- mation are managedintheinvestigation.Thegoalofproject to post-onsceneishelpingusrestructure howissuesandinfor- diminish. eficial characteristicsofon-scenecommunicationandinteraction cusing ontheirownareas ofconcerninaspecificarea. Theben- change whileonscenegiveswaytoindividualinvestigatorsfo- ferent character. Thefrequent interaction andinformationex- have returned toheadquarters,theinvestigationtakes onadif- rapidly formulated. quickly identified,andtheactionsrequired toresolve themare mation toallotherinvestigativeefforts.Issuesofimportanceare quickly andequallyinformedabletoeasilycontributeinfor- tion sharingindailyprogress meetings.Mostparticipantsare are direct communicationamongallparticipantsandinforma- information. Two ofthemajoradvantageson-scenephase nical areas to quicklyanalyzethesituationandcollectperishable rience andexpertise inrelatively focusedoperationalandtech- reactivity ofthework.Investigatorsrely ontheirwealthofexpe- gation. Thisphaseischaracterizedbytheurgency, intensity, and activities—is regarded asahighlysuccessfulphaseoftheinvesti- scene phase—whichincludesboththeinitiallaunchandon-scene development ofinvestigativemethodsandapproaches. Theon- investigation—on sceneandpost-onscene—thatare guiding vealed commonalitiesrelated totwoverydistinctphasesofthe marine, highway, andpipeline.Theinitialexamination hasre- tion modesundertheSafetyBoard’s purview—aviation,rail, political andsocialpressures. ture investigationswillfaceincreasing technicalcomplexity and current andpastinvestigations,byanexpectation thatfu- processes. Theproject ismotivatedbothbylessonslearnedfrom expertise toanalyzeandthereby improve itsowninvestigative In thispaper, wedescribe theinitialstagesofproject where Our understandingofthischangeincharacterfrom onscene Once theon-scenephaseiscompletedandinvestigators The project istakingacomprehensive lookatalltransporta- 1/14/2009, 8:22 AM dents in the United States. A major accident investigation that involves a large commercial airliner can be complex, fraught with uncertainties about cause, and can result in outcomes of concern to multiple public and private stakeholders. For example, the investigation of the American Airlines Flight 587 accident, where the vertical stabilizer separated from the airplane’s fuselage due to the “pilot’s excessive and unneces- sary rudder inputs” (NTSB, 2004), required 3 years to complete. It produced more than 8,000 pages of documentation and involved 16 investigative groups and numerous representatives from other federal agencies, the airline, the airplane manufacturer, and the aviation community. The investigation re- 10, 2008 SEPT. WEDNESDAY, sulted in 15 safety recommendations. The highly complex and unique nature of a major aviation accident investigation requires multiple sources Figure 1. Major aviation accident investigation management structure. of expertise. As a result, the NTSB uses a party system where relevant stakeholders are part of the investigative team. These participants are usually drawn from the Federal Avia- tion Administration (FAA), the airline involved in the accident, the manufacturers of the aircraft and aircraft systems, and organizations representing specific entities such as airline pilots or cabin attendants. The management structure of a major aviation accident is shown in Figure 1. The investigative team is organized into groups, headed by NTSB group chairs, who examine each of the accident areas. As one might expect, the areas are typically divided into topics related to the aircraft, the people (including crew and, when appropriate, air traffic control and maintenance), and the environment. An investigator-in- charge (IIC) is responsible for manag- Table 1. Investigative Elements ing the investigation, and all investigative groups report to the IIC. Parties to ological framework for managing investigations was developed. the investigation provide valuable investigative support and in- The paper begins by briefly describing the NTSB accident inves- formation through the group chairs, but typically reside outside tigation process then presents the Principal Issue Management the core investigation team and do not participate in NTSB de- Model (PIMM), which has been developed to provide the meth- liberations about findings, conclusions, causes, contributing fac- odological framework for managing investigations. The project tors, and safety recommendations. Division chiefs provide man- is being applied to investigations in all transportation modes, agement support in each of the operational and technical areas, but for the purposes of this paper we are confining the discus- and senior office management oversees investigative resource sion to aviation. requirements and schedules. Major aviation investigations may take a year or longer, de- Major aviation accident investigations pending upon their complexity. During this time, investigative The NTSB is required by law to investigate all civil aviation acci- groups gather and analyze evidence that is used to develop fac-

ISASI 2008 Proceedings • 47

Proceedings 2008.pmd 47 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 48 explain theaccidentintermsof Principal issues investigative tasks,anddatainformation. three importantelements(showninTable 1):principalissues, during thecourseofinvestigation. ommendations intendedtoaddress safetyconcernsidentified findings, theprobable causeoftheaccident,andanysafetyrec- mendations. Theaccidentreport includestheanalysis,alistof gators analyzethefactsandproduce findingsandsafetyrecom- tegrated intoafinalSafetyBoard accidentreport. NTSBinvesti- mately, thefactualinformationgeneratedbythesegroups isin- tual reports abouttheirinvestigativeareas ofresponsibility. Ulti- Table 2.Types ofPrincipal Issues the utilityoftraditionalstructured approaches isnotobvious. on theaircrew), suchconstraints are noteasilyquantified,and investigative tasks(forexample, evaluating theeffectoffatigue ods tobeused.For othermore open-ended(andmore common) mined, thereby allowingtraditionalstructured investigativemeth- teardown), specifictimeandresource constraintscanbedeter- through investigation.For sometasks(forexample, anengine ing ofthescopeandmagnitudeanissuehasbeenobtained not occurinalinearfashion,butonlyaftersufficientunderstand- bring timelyclosure tothatissue.Unfortunately, closure does termines thegoalsforthesetasksandevidencerequired to issue. Thetypeofissue(asshowninTable 1previous page)de- tor togatherevidenceanswerquestionsraisedbyaprincipal Investigative tasks work willbediscussedinsubsequentsections. accident investigationmodelframework.Detailsoftheframe- cordingly, effectivemanagementofprincipalissuesiscentraltoour resolution ofaprincipalissueresults inananalyticconclusion.Ac- tasks andevidencegatheringrequirements. Mostimportantly, the tions thatrequire answers,andthesequestionsdriveinvestigative marized inTable 2.Inaddition,aprincipal issuecomprisesques- safety recommendations. Thefourtypesofprincipalissuesare sum- causal orcontributingfactors,andleadtosafetyissuesthatresult in factual information,helptoresolve conflictingtheories,establish pened. Theseissuesare criticalbecausetheycanverifyimportant We havefoundthatevery accidentinvestigationismadeupof • ISASI 2008 ISASI are definedascriticalaspectsoftheaccidentthatcan Proceedings are definedastheactionstaken byaninvestiga- 48 what happenedand why ithap- gators findanswerstowhytheaccident occurred andwhatactioncanbe 2. Importantissuesinanaccident maynotbecomeevidentuntilinvesti- investigated ineverymajoraccident. information. For thatreason, principalissuesmustbeextensively explanations thatcaninvolveunquantifiable,andcontradictory of eachaccidentmaybeaccompaniedbymultiple,competing appear, onthesurface,tobesimilar. Theuniquecharacteristics No twoaviationaccidentsare exactly alike, evenwhen accidents majoraviationaccidentisessentiallyuniqueandnovel 1. Every discussed below. age. Theimportantonesare summarizedinTable 3andare briefly vestigations make themespeciallydifficultandcomplex toman- that exhaustively explores allconceivableavenuesofinquiry. the timeandresources ofaninflexible, “bruteforce” approach ciency inallaspectsoftheinvestigation.TheNTSBcannotafford need foraquick,accurate,anddefensibleresolution, demandeffi- the localmanagementofinvestigativetasksandactivities. management approach focusedonprincipalissues,separatefrom identify actionstoprevent itsreoccurrence. Thisgoalrequires a why theaccidenthappened,determineprobable cause,and the iterativegatheringofevidencetoanswerspecificquestions. toothed cyclicpatterndescribedbyConklin(2006)thatinvolves formulating asolution.Theprocess actuallyfollowsthesaw- fall” process that movesfrom gatheringdatatoanalyzing cident investigationsdonotfollowthetraditionallinear“water- sible, itwouldbeundesirableforthefollowingreasons. First, ac- all facetsofaninvestigation.Evenifsuchapproach were pos- be nosingleapproach thatcaneffectivelyandefficientlymanage and informationmanagement.Consequently, there appearsto consuming, andcreate specificdifficultiesininvestigativetask holders. fluid andinterdependent investigativetasks,andmultiplestake- planations, unquantifiableandoftencontradictoryinformation, investigators are frequently facedwithmultiple,competingex- involving uniqueandunprecedented circumstances. Inaddition, Furthermore, severalimportantcharacteristicsofaccidentin- Third, limitedstaffingandresources, coupledwiththepublic’s Second, theoverallgoalofinvestigationistounderstand These factorsmake investigationsresource intensiveandtime 1/14/2009, 8:22 AM major accidentsare rare events,often These challengesarise,inpart,because NTSB aviationaccidentinvestigation. mation canbeachallengeinmajor investigative tasks,anddatainfor- The managementofprincipalissues, Management oftheinvestigation volved intheaccidentinvestigation. dence mustbereadily accessibletoallin- position onanissue.Inaddition,theevi- enough tosupportanddefendNTSB’s need toensure thattheevidenceisstrong cal tothesuccessofaninvestigationis must berelated toprincipalissues.Criti- enormous amountsofinformationthat gative tasks.Investigativetasksgenerate evidence gathered asaresult ofinvesti- Data andinformation are defined asthe . mendations can only be characterized in terms of the strength of the facts and data gathered in the investigation. Con- clusions about causes, contributing factors, and safety issues are the best that can be supported by the evidence. State- ments unsupported by facts are merely opinion.

Table 3. Characteristics of a Major Accident Investigation Related to Wicked Problems 5. Recommendations for actions on safety issues are based on investigators’ judgment, expertise, and effective use of evidence. Recommendations for action emerging from an investigation are based on investigators’ judgment, expertise, and effective use of evidence to support conclusions about principal issues. No a priori set of recommendations exists that can be associated with a particular type 10, 2008 SEPT. WEDNESDAY, of accident.

6. Recommendations may remove a specific hazard, but the overall effect on aviation safety policy will only become clear over time. Recommendations to solve a specific problem uncovered in an accident investigation may provide immediate re- lief from a specific hazard. However, the overall effect of a recommendation, especially one related to systemic problems, may become clear only after sufficient time has passed to evaluate its effects. Given the ever-chang- Figure 2: Principal Issue Management Model (PIMM). ing aviation environment, a recommendation may need to be updated taken to prevent such accidents. for future applicability. During the process of determining how to take action to resolve a Note how these characteristics of a major accident investiga- principal issue uncovered in an accident, new aspects of the prob- tion focus on in-depth investigation and the role of analysis and lem, and the potential unexpected effects of a solution, become consideration of potential solutions in determining the scope and evident. In the early stages of a major aviation accident investi- magnitude of an issue. These characteristics imply that solving gation, the scope and magnitude of a principal issue may not be problems and making decisions are important elements in the entirely clear. Significant investigative effort may occur before investigation, and that analysis begins very early and is crucial to the entire extent of the issue, and the resolution of it, becomes effective progress. In fact, accident investigations have many of clear. In fact, investigation of one issue may lead to new issues the characteristics of a wicked problem (Rittel & Webber, 1973; that had not previously been considered in the investigation. Conklin, 2006; Ritchey, 2006). In contrast to structured problems, wicked problems are characterized by their complexity, rarity, 3. There are no a priori criteria or “stopping rules” for determining and uncertain solutions. when sufficient evidence has been accumulated. The characteristics of a wicked problem are shown in the sec- The unpredictability of what is required to define an issue and ond column of Table 3. Wicked problems were originally con- generate solutions precludes the use of standard criteria or pro- ceived in the context of systems analysis, social policy, and the cedures that set limits to the amount of evidence needed to re- realization that large-scale problems are not always amenable to solve an issue. This characteristic relates to the previous charac- classic operations research techniques (Rittel & Webber, 1973). teristic, and together highlight why the extent of investigative What makes these kinds of problems especially wicked is their tasks and evidence-gathering activities, and the resources required resistance to linear, structured solution methods. As Conklin to support them, cannot be accurately predicted beforehand. (2006) points out, by “failing to recognize the ‘wicked dynamics’ in problems, we persist in applying inappropriate methods and 4. Conclusions about causes, contributing factors, and safety issues are tools to them.” the best that can be supported by the evidence. As a result, our approach recognizes that management of prin- The quality of the arguments leading to conclusions and recom- cipal issues, which is at the core of accident investigation, is best

ISASI 2008 Proceedings • 49

Proceedings 2008.pmd 49 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 50 meetings. electronic bulletinboards, andfacilitatedteamfocused graphical presentation ofprincipal issuesandtheirevolution, tion including,representations ofcriticaleventsandsequences, We are pursuinganumberofpotential solutionstothisfunc- evidence atanypointintheinvestigativeprocess iscritical. erative nature ofprincipalissuedevelopment,rapidaccessto form thatcansupportdecisionsaboutanissue.Given the it- pal issues.Theevidencemustbereadily accessibleandin a mation generatedbyinvestigativetasksandrelated toprinci- munications mechanismfortheenormousamountsof infor- pletely understandanissue. effort maybeneededtogathertheevidence com- tude ofanissuehasbeenobtained.Considerableinvestigative but onlyaftersufficientunderstandingofthescopeandmagni- previously discussed,closure doesnotoccurinalinearfashion, dence necessarytobringtimelyclosure toaprincipalissue.As to gatherevidence.Thegoalofthesetasksisobtaintheevi- resolution shouldbereadily apparent. issues are definedcorrectly, thentheevidencerequired toachieve best totreat theissuesinfinalanalysisandreport. Ifprincipal with identifyingissues,resolving issues,anddetermininghow management ment approach showninFigure 2(previous page). PIMM isaconstructdesignedtoprovide thestructured manage- The Principal IssuesManagementModel(PIMM) becomes thefoundationforPIMM. cipal issues,ratherthanmanagingindividualinvestigativetasks, ment, andresolution oftheseissues.Accordingly, managingprin- served byanapproach thatfocusesontheidentification,refine- and resolution through thecourseofinvestigation. Figure 3:Theiterativeprocess ofprincipalissueidentification,refinement, Information accessandcontrol Task management • ISASI 2008 ISASI encompassesalltheinvestigativeactivitiesconcerned Proceedings isconcernedwiththeinvestigativetasksused 50 provides therepository andcom- Principal issues decisions, are mappeddirectly toprincipalissues. repository where facts,aswelltheanalysesandrationalefor are expected tooffertheinvestigativeteamadataandanalysis tive teamthrough thisinterface.Theseinformationcapabilities gathered atthelocallevelismadeavailabletocore investiga- terface betweenthetwolevelsofmanagement.Theevidence conducted withlittleornocollaborationbeyondthelocallevel. team, andsotheirdocumentationanalysis,ifrequired, are tails oftheseeffortsmaynotberelevant tothecore investigation (with appropriate seniorofficemanagementguidance).Thede- source demands are evidentanddealtwithbylocalmanagement documentation ofresults. Atthislevel,thefamiliartimeandre- termines theinvestigativetechniquestoemploy, andprovides group, andtheappropriate divisionchiefs.Thegroup chairde- Figure 3showingdifferent groups relating tothesameissue. ciated withmore thanonegroup, asindicatedbythearrows in specific investigativegroup. Someprincipalissuesmay beasso- sues. Theresponsibility foreachprincipalissueisassignedtoa investigation beginstorefine apreliminary setofprincipal is- formed andlaunchedtotheaccidentsite.Onceonscene, the initial assessmentdictateswhichinvestigativegroups willbe NTSB managementidentifiespotentialprincipalissues. This cess beginswiththeinitialnotificationofanaccident where tinct phases:identification,refinement, andresolution. Thepro- airliner ranofftheendofawetorsnow-covered runway. from accidentswhere acommercial anumberofsimilaroverrun example isnotrepresentative of anysingleaccident,butisdrawn more detailusingasampleaccidentinvestigationscenario.The This sectiondescribesthestructure andfunctionofPIMMin PIMM structureandfunction Information accessandcontrol becomesaveryimportantin- Figure 3showstheevolutionofprincipalissuesinthree dis- 1/14/2009, 8:22 AM of thegroup chair, themembersof vestigative group. Thisgroup consists evidence gatheringactivitiesbyeachin- ment ofspecificinvestigativetasksand documenting pilotcertificates). issues, islocallymanaged(forexample, not ofdirect concerntotheprincipal for investigationcompleteness,butis that mustbegathered anddocumented principal issues.Detailedinformation and quantityofinformationrelated to scheme isdirectly related tothequality ing. Thesuccessofacentrallymanaged involved ininvestigationdecision-mak- are expected tocontribute,andallare trally managedscheme,allparticipants vestigators, andtheIIC.Underacen- team consistsofthegroup chairs,in- the investigation.Thecore investigative of principalissuesduringthecourse agement, bythecore investigationteam, model. and locallymanagedelementsofthe Locally managed Centrally managed Note thedivisionbetweencentrally refers tothemanage- refers totheman- evidence. And it is at this that level traditional project management techniques may be used, if appropriate. Upon completing a task, the investigator provides principal issue management with a concise analytic discussion of the investigative outcome, along with the necessary factual information, for their consideration. This is a significant departure from current policy and practice, where analysis was assumed to occur only after all the facts had been gathered. At this point, the core investigative team determines if the principal issue has been resolved. An issue can be resolved in a number of ways, including decomposing a single issue into new, more specific issues, consolidation with other issues, completion and integration 10, 2008 SEPT. WEDNESDAY, into the final report, or determination Figure 4. Decomposition of principal issues into that the issue is not a concern (and, investigative tasks, evidence requirements, hence, is not part of the final report). evidence, findings, and answers. The iterative nature of principal issue refinement and resolution, as shown in Figure 3, is critical to understanding the Progression from left-to-right also indicates the relative passage accident investigation process. In this process, issues generate spe- of time during the investigation. cific questions about the accident, and it is these questions that Each principal issue prompts the posing of a few focused ques- determine the requirements for evidence gathering. tions that define the scope or extent of the issue. Each question has a sufficiency requirement attached to it, which determines Additional PIMM benefits what evidence the investigative team believes is required to an- PIMM can also help organize the final accident report. Report swer the question. These steps are conducted centrally by the development at NTSB is a major, and very time consuming, part core investigative team for several reasons. First, it is necessary to of the investigation. In the past, a dedicated writer was assigned allow management and investigators to collectively envision and to the investigation near its conclusion. The writer had to gather ultimately agree upon the direction of the investigation. Second, all of the factual and analytical information from the accident developing sufficiency criteria helps ensure that investigative ac- docket and work with the IIC to construct the final report. In tivities are properly balanced with time and effort. As previously some cases, gaps in the investigation came to light as the report discussed, there are no a priori stopping rules for determining was being written. Such situations highlight the need for early when sufficient evidence has been accumulated, but criteria must identification and documentation of principal issues and the use be established to match the level of effort to the burden of proof. of a PIMM-like management structure to minimize forgotten is- Only through deliberation by the core investigative team can suf- sues and incomplete evidence. In PIMM, early involvement of a ficiency be determined. Third, the centrally located effort facili- dedicated writer is important to help ensure that important is- tates interaction among the entire investigative team, maximiz- sues are adequately resolved, and the evidence needed to sup- ing input and leveraging collective experience. Finally, priorities port conclusions and positions on safety issues is provided. The can be established and interdependencies among investigative diagram in Figure 3 shows one of the ways in which the writer groups can be identified and acknowledged. and the IIC can monitor progress and see clearly the principal Once the principal issues and their associated questions and suf- issues under consideration. ficiency requirements are in place, individual investigators are charged PIMM also enables the core investigative team to trace its deci- with using their investigative skills and resources to best provide sion-making process and document the resolution of principal appropriate information, data, or evidence. For example, Figure 4 issues. Such documentation is especially important when deal- shows the breakdown of a principal issue—aircrew configuration of ing with sensitive political and public interests that may conflict the airplane—into its component investigative tasks, evidence, and with the direction and scope of an investigation. Under certain answers. At this level, the effort is conducted locally by an individual circumstances, especially when an investigation is being chal- investigator who conducts the tasks and gathers evidence. The em- lenged, investigators must be able to explain, in detail, the ratio- phasis on locally managing these tasks recognizes that investigators nale for positions on conclusions and safety issues. are experts in their fields and know best how to gather evidence to Finally, PIMM is a progress-oriented model intended to mini- resolve an issue. Consequently, the centrally managed goals estab- mize investigative backtracking and repetitive decision-making. Too lished for evidence requirements are not proscriptive, but allow in- often, issues are repeatedly defined without significant progress. dividual investigators to determine how best to obtain the necessary Sufficiency requirements and issue resolution are distinct decision

ISASI 2008 Proceedings • 51

Proceedings 2008.pmd 51 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 52 emphasis onaflexible, nonlinearproblem-solving approach. stood. Asaresult, managingprincipalissuesplacessubstantial lem comeafterthescopeandmagnitudeofanissueisunder- essary forsuccessfulresolution. Effectivesolutionstoasafetyprob- effectively useinvestigativeresources togathertheevidencenec- vestigators focusonunderstandingprincipalissuesinorder to dence requirements forinvestigativetasks.Inourapproach, in- and formulationforalltypesofissuessettinggoalsevi- In contrast,ouremphasisisontheupfront problem definition solving anissuebydevelopingasolutiontothesafetyproblem. discussed byATSB. Initsapproach, emphasisisplacedonre- sues andcausal/contributingfactors—are similartotheissues Two ofthetypesprincipalissuesshowninTable 2—safetyis- analysis atthecenterofitsapproach (ATSB, 2008;Walker, 2007). tigation. TheAustralianTransport SafetyBureau (ATSB) places to resolve them,iscentraltootherapproaches toaccidentinves- investigation andexpert technicalinputtoresolve. tigation maybeslowtoemerge, andrequire considerableiterative edges thatsolutionstoissuesuncovered duringtheaccidentinves- multiple stakeholders. Suchafocusonprincipalissuesacknowl- competing explanations, fluidandinterdependent tasks,and unquantifiable andoftencontradictoryinformation,multiple agement canalsohelpovercome manyoftheproblems created by or contributingfactors,andidentifyingsafetyissues.Effectiveman- factual evidence,resolving conflictingtheories,establishingcausal tive managementoftheseissuesare criticaltoverifyingimportant drive investigativetasksandevidencegatheringactivities.Effec- Principal issuesare centraltoNTSBaccidentinvestigationsand Conclusions can bemade,especiallyiffurtherrefinement isrequired. points where apositiononanissuecanbeestablished,andprogress Such anapproach alsoemphasizesaninvestigator’sproblem- A focusonprincipalissues,andtheanalyticthoughtrequired • ISASI 2008 ISASI Proceedings 52 tion, whilepreserving investigators’freedom toexplore. sion-making atalllevels,andtotherapidexchange ofinforma- flat managementstructure thatisconducivetoparticipatorydeci- and evidencerequirements. Suchanapproach isamenableto a ties anddependencies,forestablishingsufficiencyintasking of theinvestigation,formakingvisibleinvestigativeresponsibili- early intheinvestigation,forclearlycommunicatingdirection pal issues.Bydoingso,PIMMprovides thebasisforanalyticthought making byfocusingonidentifying,refining, andresolving princi- work thatenhancesinvestigatorproblem solvinganddecision- across alltechnicalareas. use ofasingleaccidentmodelbecauseitmaynotbeapplicable nature ofamodernmajoraccidentinvestigationprecludes the pended tounderstandtheissue.Inaddition,multidisciplinary evident untilafterconsiderableinvestigativeefforthasbeenex- dent, theutilityofasingularmodelormethoddoesnotbecome sis ofaspecificprincipalissue,orperhaps aspecifictypeofacci- method. Althoughsuchaccidentmodelscanbeusefulintheanaly- solving skillsratherthanontheuseofasingleaccidentmodelor Walker, M.B.(2007).Improving thequalityofinvestigationanalysis. Rittel, H.&Webber, M.(1973).Dilemmasinageneraltheoryofplanning. Ritchey, T. (2006).Problem structuringusingcomputer-aidedmorphologi- National Transportation SafetyBoard (2004),Aircraft AccidentReport Conklin, J.(2006).Wicked problems andsocialcomplexity. In References Australian Transport SafetyBureau, ATSB Transport SafetyReport, Forum Policy Science cal analysis. York, Nov. 12,2001 N14053,BelleHarbor,Airlines Flight587,AirbusIndustrieA300-605R, New NTSB/AAR-04/04. John Wiley &Sons). Mapping: BuildingShared UnderstandingofWicked Problems Proof inSafetyInvestigations Aviation Research DiscussionPaper AR-2007-053 In conclusion,webelievethatPIMMprovides amodelframe- , January-March 2007,10-13&29. Journal oftheOperationalSociety , 4,155-169. 1/14/2009, 8:22 AM In-flight SeparationofVerticalIn-flight Stabilizer, American (Washington, DC:NTSB,2004). (Canberra city, (Canberra Australia:NTSB,2008). , 57,792-801. Analysis, Causalityand (NewYork: Dialogue ◆ ISASI Weather Risk Management Through a Systematic Approach to the Investigation of Weather Events By John W. Dutcher, Dutcher Safety & Meteorology Services Halifax, Nova Scotia, Canada, and G. Mike Doiron, Cirrus Aviation Safety Services, Halifax, Nova Scotia, Canada (M04646)

John Dutcher heads Dutcher Safety & Meteorology numerous injuries to flight crews and passengers every year. Just Services based in Halifax, Canada. He has a BSc as humans will always make mistakes, weather will always be a (aviation) from the University of Newcastle (Austra- contributing factor to aviation occurrences. The question is—to lia). John has a Canadian flight dispatcher license, what extent? Can we minimize the number of weather-related glider, and private pilot licenses. In Australia he has a occurrences? Can we manage the risk and impact of weather on 10, 2008 SEPT. WEDNESDAY, commercial pilot license (frozen), and has completed safety and operations? This paper will advocate the concept of a Australian ATPL studies. John has taught and guest “weather management system” (WMS) to manage the impact of lectured in meteorology, human factors, risk management, and accident weather in the operational environment. WMSs represent a more investigation for airlines, insurance companies, maintenance organiza- “holistic” approach and are comprised of a series of “weather tions, and governments around the world. In addition to consulting, risk control systems” (Wx-RCSs) designed to manage the impact John teaches a course in applied aviation meteorology in the Master of of weather hazards (e.g., thunderstorms, turbulence, reduced vis- Aviation Management Program at the University of Newcastle. He also ibility, LLWS) on safety and operations. Wx-RCSs are essentially worked as a researcher in the Department of Psychology at Saint Mary’s “mini” Safety Management Systems (SMSs) with all the same com- University in Halifax for a number of years on projects in OH&S, safety ponents designed to manage weather risks, and enable the culture, health care, and decision-making of expert weather forecasters. broader WMS to be integrated into an operator’s overall safety management program (i.e., SMS) as well as influence fuel man- Mike Doiron heads Cirrus Aviation Safety Services agement policies. A keystone to supporting WMS, and safety based in Halifax, Canada. Mike graduated from the improvement in general, is a systematic approach to weather in- Transport Canada Air Services Training Centre in vestigations, which produces knowledge derived from informa- Ottawa in 1972. For more than 30 years, he worked tion and data gathered during the investigation. By using this for Transport Canada in various roles including the knowledge and insight into meteorological conditions, human manager of the Halifax Flight Information Centre. factors and organizational influences, and technical issues related In 1996 Mike accepted a position with System Safety, to weather, investigators will be able to identify risks and vulner- Transport Canada. During this time Mike served as the minister’s abilities of systems that might cause future occurrences or con- observer on a number of high profile aircraft accidents, most notable tribute to their severity. By producing findings of risks and using being the Swissair 111 in 1998 and the MK B-747 cargo accident in an WMS framework, weather risks can be analyzed and man- 2004. Mike also completed a 14-month assignment as an accident aged by using various Wx-RCSs in the form of equipment, deci- investigator with the Transportation Safety Board of Canada. Mike sion aids, briefing strategies, training, awareness campaigns and has taught human factors, risk management, and Safety Management materials, proactive forecasting systems, recovery procedures, and Systems around the world including regular commitments for the clear policies and operational procedures relating to weather and Southern California Safety Institute (SCSI) and ISASI. information exchange. Active management involvement, informed working groups, and effective monitoring of outcomes ilots face many weather-related dangers, enroute and in combined with multifaceted approaches that incorporate recent the airport environment, such as low level wind shear scientific findings and developments in technology can assist the P(LLWS), icing, and turbulence. Despite technological ad- aviation industry reduce weather-related occurrences, improve vances in weather forecasting, dissemination and presentation of safety and productivity in flight operations and air traffic man- weather-related data, weather continues to be identified, at all agement, and reduce its environmental impact through improved levels of the industry, as a contributing factor in aviation occur- fuel management. rences worldwide. Though accidents in the commercial aviation industry (i.e., transport and commuter categories) are rare, an Introduction April 2007 report by the International Air Transport Association Weather has a major impact on the safety, efficiency, and capacity indicated that 43% of accidents in 2006 occurred during opera- of aviation operations. A 1995 study by the U.S. National Re- tions in adverse weather (Malaysian National News Agency, 2007). search Council showed 40-65% of delays experienced by U.S. In addition to accidents, weather has a massive impact on the air domestic airlines were attributable to adverse weather, at an an- traffic system, an operator’s bottom line, and is responsible for nual cost estimated at $4-5 billion per year (NRC, 1995). A more

ISASI 2008 Proceedings • 53

Proceedings 2008.pmd 53 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 54 in weatherforecasting, dissemination andpresentation ofweather- enroute andairportenvironment. Despite technologicaladvances shear (LLWS), icing,thunderstorms, andturbulenceinthe Pilots facemanyweather-related dangers,suchas low levelwind Weather hazards Background part ofeverydaycompanyoperatingphilosophiesandpractices. company managementsystems,improvements can bebecome systems intooverallsafetymanagementprogram andgoverning development oftoolsandprocesses. Through integratingthese deficiencies andfurtherimprove performanceandsupportthe risk andpracticalrecommendations canbemadetocorrect safety situation. Armedwiththisimproved understanding,findingsof mishap, butalsothedecisionsmadeinlightofsurrounding stand themeteorological phenomenonpresent atthetimeof prehensive approach shouldbepositionednotonlytounder- approach toweather mishapinvestigationisneeded.Suchacom- a mechanismtosupportcontinuousimprovements, asystematic at minimizingtheimpactofweatheronoperationsandsafety. As directing resources usingariskbased,systematicapproach aimed decision-making, andcoordinating activitiesthrough strategically for impactinthefuture isinintegratingweatherforecasts into these seeminglyvastlydifferent sciencesthegreatest potential ments insafetyandoperations.Bycombiningmeteorology with to supportandenhancedecision-making,leadingimprove- dous impactindistillingweatherinformationintovaluabletools management andhumanfactorscommunitiestohaveatremen- ther? Theseimprovements havecreated thepotentialforrisk on theiroperationsandenhanceperformanceevenfur- of theseadvancementstominimizethenegativeimpactweather ter andemergency managementorganizations), take advantage others (e.g.,powerutilities,marineoperations,vineyards, disas- 2005; Regnier, 2008).Cantheaviationcommunity, alongwith as towhetherweatheris“justthecostofdoingbusiness”(Dutcher, tower, anddevelopmentsinweatherforecasting, questionsarise of aircraft andtrafficflowthrough theairspacesystem. placing increased workloadoncontrollers tomanagethesafety with closedairroutes forcing costlyreroutes (Qualley, 1997)and icing, thunderstorms,andvolcanicashalsoimpactingoperations flightsandmilitaryoperations(i.e.,refueling),ger carrying with time performance.Turbulence isalsoamajorconcerntopassen- and temperatures haveasignificantimpactonfuelburnandon- flight, upperlevelwinds(e.g.,thoseassociatedwiththejetstream) burns duetoincreased weight.Inregards totheenroute phaseof ofextrathe carriage fuel—whichinturnresults inhigherfuel 75-50% ofnormal(Qualley, 1997).Thesedelaysmaynecessitate profound impactonrunwayacceptancerates,oftenlowered to ing aircraft are slowedbyairtrafficcontrol (ATC) thushavinga ods oflowceilingsandreduced visibilitiesdepartingandarriv- blowing ground servicingequipmentintoaircraft. Duringperi- Strong surfacewindsandwindgustscancauserampdamageby vents ground handlersandfuelersfrom outtheirwork. carrying runways havetobeplowed.Lightningintheterminalarea pre- ground, aircraft mayhavetobedeicedbefore departure, and Research, 2005).Weather affectsallphasesofflight.Onthe traffic delaysin2004(UniversityCorporationforAtmospheric recent studyshowedweatheraccountedfor76%ofallU.S.air Given recent technologicaladvances inthecockpit,ATC • ISASI 2008 ISASI Proceedings 54 have comeintheformofsuch technologiesashighresolution ing domain,particularlyover thelast20years.Thesechanges improvements havebeenrelatively rapidintheweatherforecast- increased levelsofautomation)intothe weatheroffice.These introduction ofcomplex andadvancedtechnologies(including provements inaviationweatherforecasting havecomefrom the to improve safetyandair trafficmanagement.Manyoftheim- precision, andreliability ofaviation weatherforecasts inefforts work, worldwide,hasbeendirected atincreasing theaccuracy, of weatherforecasts agreat dealofresearch anddevelopment information (tobediscussedlater)andanintrinsicuncertainty ous weatherare magnifiedbythelack ofunderstandingweather Given accidentsanddisruptionsinairtrafficcausedbyhazard- Technological improvements an airoperator’sandairport’sbottomline. These typesofeventscanhaveaswiftandgraveimpactonboth idly exposed theenormousimpactofweatheronoperations. and theU.S.inDecember2006,tonameafewevents,haveviv- Heathrow fog event,andthecripplingwinterstormsinCanada US$750,000 (CollaborativeDecision-Making,n.d.). ing thateachencounterofsevere turbulencecostsanaverage of US$100 millionayear(Adams,2001),withoneairlineestimat- to theairlinesfrom encounterswithturbulencerunsmore than with litigation,NASA’s Aviation Safetyprogram estimatesthecost the real costofanencounter. Consideringthesefactors,along mention badpublicity, are allrub-offfactorstobefactored into viations, mealsandhotels,passengerinconvenience,notto aircraft requiring expensive inspectionsandrepairs. Flightde- with severe turbulencemayresult insignificantdamage tothe also becostlyinoperationalandfinancialterms.Anencounter per year(Sharmanetal.,2006).Encounterswithturbulencecan receive hundreds ofinjuryclaimsandpayout“tensmillions” estimating they (Adams, 2001),withmajorU.S.-basedcarriers times amonth,resulting inanaverageof24injuriespermonth estimatesthatairlinesencountersevereNASA turbulencenine (Sharman, Tebaldi, Wiener, &Wolff, 2006).Further, research at in theU.S.,65%canbeattributedtoturbulenceencounters For instance,ofallweather-related commercial aircraft incidents crews andpassengersduetoweather-related mishapseachyear. in adverseweather(MalaysianNationalNewsAgency, 2007). cated that43%ofaccidentsin2006occurred during operations (i.e., transportandcommutercategories)are rare, IATA indi- airlines. Thoughaccidentsinthecommercial aviationindustry or oneaccidentforeverytwomillionflightsIATA’s member global averagehull-lossratewas0.48accidentspermillionflights, International AirTravel Association(IATA) showedthatthe2006 2005). Inthecommercial airlineindustry, a2007studybythe GA annually(NationalTransportation SafetyBoard [NTSB], but theyaccountformore thanoneinfourfatalitiesthatoccur aviation fatalities—only6%ofGAaccidentsare weather-related accidents are notfrequent, theyaccountforalarge numberof conditions (IMC)are fatal.Moreover, thoughweather-related aviation (GA)accidentsthatoccurininstrumentmeteorological dustry. IntheU.S.,historically, about two-thirds ofallgeneral factor inaviationoccurrences worldwide;atall levelsofthein- related data,weathercontinuestobeidentifiedasacontributing Besides turbulence,weathereventssuchastheLondon In additiontoaccidents,there are numerous injuriestoflight 1/14/2009, 8:22 AM satellite imagery, doppler radar, Automated Weather Observing weather regulations questions. Only 44.7% of all pilots were able Systems (AWOS), and improved atmospheric computer model- to correctly identify marginal VFR visibility and ceiling levels, ing (i.e., numerical weather prediction [NWP] models). and 45.9% of all pilots actually incorrectly identified IFR visibil- In addition to the improvements in technology in the weather ity and ceiling levels as those that constitute marginal VFR. office, improvements in the observation, analysis, and dissemina- This lack of pilot understanding is not surprising when con- tion of weather-related information has allowed for improvements sidering the state of weather training. Most civilian primary in aviation safety and performance. Improvements in aircraft ra- ground schools in America include a mere 9 hours of weather dar, the development of the Low Level Wind Shear Alert System instruction. U.S. Air Force pilot training consists of 15 hours of (LLWAS), and other technology for the observation of weather can formal weather instruction, as compared to 50 or 60 hours in the be used to support decision-making and evade hazardous weather. past, while U.S. Army aviator weather training consists of about Technologies in the U.S. like the Integrated Terminal Weather 30 hours. (Lankford, 2000). Student aviators and Naval flight System (ITWS) to observe and forecast local thunderstorms using officers in the U.S. Navy receive a little more than 2 weeks of Doppler radar data out to one hour in advance, and the Collabo- meteorology training in their first year of flying, followed by about rative Convective Forecast Product (CCFP) to forecast thunder- half an hour of training each year during instrument refresher storms 2/4/6 hours in advance, have been used to improve safety (Cantu, 2001). Lankford (2000) argues regulations perpetuate and air traffic flow management. Similarly, improvements in the this trend. In most countries, regulations only required pilots, dissemination and display of weather information will also con- from student to commercial pilots, to obtain and use weather tinue to improve safety. Many national weather services provide a reports and forecasts, recognize critical weather situations, and great deal of aviation weather data for pilots and other users via estimate ground and flight visibility. For the most part, only the 10, 2008 SEPT. WEDNESDAY, the Internet with more and more pilots using it as their primary, airline transport pilot certificate requires the applicant to have however some their only, source of weather data for flight plan- any serious meteorological knowledge (Lankford, 2000). ning. Aircraft weather radar, the Aircraft Communications Address- In addition to deficiencies in basic meteorology training, de- ing and Reporting System (ACARS) provides crews with weather spite the many advances in the use of NWP, doppler radar, and data on the flight deck. With technologies such as electronic flight satellite imagery over the last 15 years, training in these areas, bag (EFB), and NASA’s Aviation Weather Information (AWIN) even at the highest levels and in the most progressive company, Graphical Weather Information System (GWIS) transmitting is largely absent—though practical and operations-orientated graphical weather products to the cockpit will further improve safety training with these tools would greatly improve safety and effi- and efficacy of operations. cacy with improved flight planning and decision-making. Simi- larly, a recent study by Honeywell (Goold, 2008) uncovered defi- Pilot weather training ciencies in weather radar training and understanding, and re- The most common factor contributing to weather-related acci- vealed almost 70% of pilots were dissatisfied with weather radar dents is pilot error, which can be directly coupled to the lack of training. Pointing out that current radars are concerned prima- pilot understanding of the details of their flying environment rily with weather analysis and avoidance, the study highlighted (Sand & Biter, 1997). A 2002 NASA study (Burian, 2002) involv- that proper interpretation depends on a pilot’s adequate under- ing over a thousand pilots, from students to airline pilots to in- standing of weather radar and meteorology. That said, the re- structors, revealed a number of alarming findings in relation to searchers concluded most operators do not provide initial or re- pilot’s comprehension of weather. The participants, who had an current weather-radar training. It was found that most available average of 2,140 total flight hours logged (median = 650 hours), training takes place on the job with many pilots describing a “trial- were asked to complete a short weather knowledge test. Analysis and-error experience” and learning from information obtained of results showed participants, in general, performed quite poorly from other pilots. Such practices may lead to improper radar on the weather test. Many pilots apparently lacked operationally operating procedures and techniques and further perpetuate a relevant weather knowledge and/or had difficulty recalling what poor understanding of fundamental weather radar concepts, in- was once learned. The study also found that many pilots did not cluding its limitations. Once again, regulations seem to perpetu- have an accurate perception of their level of weather knowledge, ate this trend, with the study also revealing there is little incentive with many rating their mastery of weather better than their ac- for operators to provide such training since regulators do not tual performance. Pilots at all levels of formal training, but par- require it. This is also true of the advances in NWP and other ticularly those who were certificated to fly only in visual meteoro- technologies available. logical conditions (VMC), also generally had difficulty in integrating weather knowledge from across different weather Weather-related pilot decision-making categories (e.g., weather hazards, weather services, weather in- Decision-making is a complex process of gathering and process- terpretation, and weather-related decision-making). All partici- ing information in working memory and formulating and imple- pants, visual flight rules (VFR) only pilots in particular, also had menting a plan of action. Decision-making is fundamental to all difficulty in demonstrating an understanding of the implications aspects of flying operations, including weather. Most research weather information has for real flight operations. In addition, examining weather-related decision-making has focused particu- pilots at all levels of formal training also had difficulty on items larly on understanding why VFR pilots risk flying into deterio- that required them to “decode” information in various weather rating weather. products (i.e., forecasts and observations) or to read various One key reason why pilots may decide to continue a VFR weather charts. The study also found that all pilots, including flight into adverse weather is that they make errors when as- many instructors, were unable to select correct answers for VFR sessing the situation. That is, pilots are seen to engage in VFR

ISASI 2008 Proceedings • 55

Proceedings 2008.pmd 55 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 56 decisions. Couplethiswiththe oftenlackofadequatetrainingin diagnose andassessweatherfeatures andmake soundandtimely discussed, pilotsmaylackthe confidenceandskillstoaccurately of theflightandthereby take appropriate action.However, as ognize changesintheweatherconditionsatarelatively earlystage prove weather-related decision-makingbyenablingpilotstorec- that theprovision ofthis informationhasthepotentialtoim- ray ofweather-related information inreal time.Itisassumed now haveavailableweatherradarsystemsthatdisplayavast ar- ports andforecasts, thepilotsofadvanced-technologyaircraft the conditionsreported. Moreover, inadditiontoweather re- an accurateandexpeditious decisionconcerningtheimpactof efficiency ofaflightremains dependentuponthepilotmaking prediction andreporting ofweatherconditions,thesafetyand spite thesignificantadvancesintechnologyrelated tothe tions. the mechanicalreading (decoding)offorecasts andobserva- diagnostic skillsare essentialtheyare largely not taught besides teorology, thisisnotsurprising—especiallyinlightthat though (Burian, 2002).Giventhediscussionofpilot’straininginme- weather interpretation, andweather-related decision-making) weather categories(e.g.,hazards, weatherservices, culty inintegratingweatherknowledgefrom across different who were certificatedtoflyonlyinVMC,generallyhaddiffi- that pilotsatalllevelsofformaltraining,butparticularlythose lendssupporttothisshowing 2001). A2002studybyNASA accomplish thistaskasitrelated toweather(GohandWiegmann, confidenceintheirabilitiesto did nothaveanoverwhelming Results oftheresearch indicatedthatevenexperienced pilots own abilitiestodiagnosetheproblem quicklyandaccurately. tering adverseweather),thepilotwillneedtorely onhisorher defined inemergency procedures (e.g.,inadvertentlyencoun- the eventthatapilotencounterssituationsare noteasily turning totheorigin),are highlyimportant.Consequently, in situation (e.g.,theweatherchangeprecludes theoptionofre- change isandtheoptionsavailablegivenconstraintsof deal withit.Beingabletodiagnosehowseriousthisweather does notimplyapilotwillgeneratethemostoptimalplanto important. Therefore, recognizing thattheweatherhaschanged problems, otherproblems suchaschangesinweatherare still cedures maybereduced oreveneliminatedforsomeinflight point outthatthoughthenecessitytoperformdiagnosticpro- ply require anemergency landing.GohandWiegmann (2001) procedures evenbypassthediagnosticstagealtogetherandsim- diagnose andresolve theproblems. Inaddition,somechecklist rely onchecklistsanddocumented emergency procedures to trained todetectproblems, suchasenginefailures, buttothen cesses asare experts inotherdomains.Yes, pilotsare generally being trainedasthoroughly indiagnosticdecision-makingpro- The researchers argued that thismaybetheresult ofpilotsnot confident intheirabilitytodiagnoseflight-related problems. that pilotswithmore experience didnotnecessarilyfeelmore contrary toprevious research onexpertise, results suggested problems andtogenerateimplementsolutions.However, ence were generallymore confidentoftheirabilitytorecognize and Wiegmann (2001)indicatedthatpilotswithmore experi- ard (i.e.,thedeterioratingweatherconditions).AstudybyGoh flight intoIMCbecausetheydonotaccuratelyassessthehaz- With respects totechnology, Wiggins (2005)argues thatde- • ISASI 2008 ISASI Proceedings 56 not tension—goodfits,bad. ogy, operations,humanfactors,etc.,thatwillleadtoharmony, philosophy toweather, wecandesign relationships withtechnol- tremendous difference (Vincente, 2003).Byapplyingthissame or similarparts,becausesmallchangestothepartscanmake a by buildingdifferent relationships, sometimesusingtheverysame action forbetterresults. Different system outcomescanbehad nology, humanfactors,andoperations,wecandesignourinter- tolerant.” Bylookingattherelationships amongweather, tech- and makingourorganizations andoperationsmore “weather change weather;howeverwecanhowinteract with it in accidentrates.Borrowing from Reason (2000),wecannot ogy, tools,etcwehavebeenabletorealize significantreductions the relationships betweenhumans,tasks,environment, technol- trol MotherNature. Butthrough studyinghumanbehavior and different systemsinteract.Like humanbehavior, wecannotcon- fuel managementisinamore unifiedeffortformanagingweather. provement insafety, airtrafficmanagement,aircraft operations,and quo willhaveonlylimitedresults. Thegreatest potentialforim- certed effortinsteadofhavingsilosworkinginisolation.Thestatus common thread. Thiscommon thread willallowforaunified,con- silo andthepotentialinterplaybetweenthem,wecandevelopa Through identifyingthestrengths andweaknessesofworkineach looking atthebiggerpicture wecanseepotentialforoverlap. see thewholepicture—from 35,000feet.Thesystems’view. By has madeushalf-blind.Itistimetostepbackfrom thepuzzleand ponents orsilos,butinsomerespects itappearsthisreductionism we havereduced theweatherproblem downtoanumberofcom- as wellinassessingtheimpactofweatheronflight.Itseems nesses, atalllevels,inpilotweatheranalysisanddiagnosticskills, standing ofkey conceptsinmeteorology. There are majorweak- lence everymonth.There are majorweaknessesinpilots’under- thunderstorms. There are stillnumerous injuriesduetoturbu- ing andtakingoffaircraft whentheterminalarea isblanketed with adequately, insomecasesatall,onhowtouseit?We are stillland- nology toimprove efficiencyandsafety, butnottrainingpeople them? Are wejust“spinningourwheels”ifare designingtech- cant improvements toaviation,butare wegettingthemostfrom be “are wedoingenough?” Sure theseadvanceshavemadesignifi- anything? Theanswerisyes,butamore pertinentquestionmight niques, andsafetymanagement. areas like cognitiveengineering,expertise, instructionaltech- to the“weatherproblem” isthenumberofdevelopmentsinother IMC appearstodominatetheseresearch activities.Alsorelevant making andwaystoimprove it—thoughstudyingVFRflightinto ing amountofresearch lookingatpilotweather-related decision- America. Besidesadvancementsintechnology, there isagrow- weather forecasts andsuchprojects astheCCFPandITWSin information, improvements inobservations,andtheaccuracyof technology forthedisplayanddisseminationofweather-related safety andairtrafficmanagementthrough thedevelopmentof It canbeseenthatvariousinitiativesexist toimprove aviation Can wemanagetheweather? porting decision-makingbecomesclearer. and effortspentondevelopingthesetechnologiesaimedatsup- many ofthesenewtechnologiesandthetruevalueallmoney Another advantageofasystemsviewistheabilitytoseehow However, despitetheseimprovements are weactuallydoing 1/14/2009, 8:22 AM Weather management system IFR flight minimums), a WMS does not focus solely on compli- The systems’ view is useful for identifying components of a large ance with regulations; it takes a broader perspective and aims for system of activity and for seeing the interplay between them. continuous improvement. A WMS is a risk-based approach aimed Though this will allow for improvements in products, procedures, at managing risks effectively through systematically identifying and technology while having affinity with humans and opera- hazards (e.g., winter weather, LLWS, thunderstorms, fog), assess- tions, a mechanism to direct these activities is needed. Staying ing and controlling risks (i.e., disruption to operations, fuel wast- within the realm of systems-thinking, we must develop a mecha- age, death, injuries), and evaluating and reviewing risk control nism to strategically direct management strategies to manage measures to ensure that they are effectively implemented and weather. From a different view we can further break the weather maintained. A WMS strives for continuous improvement, which problem down into system components and examine the inter- can be achieved by monitoring system effectiveness and taking play between them. Using a risk-based approach we can identify action to improve the system where required. This active moni- deficiencies and areas of risk and then direct activities to manage toring means that organizations can address weather issues and these risks by prescribing help from the various products and system failures even before an accident occurs. programs developed as a result of a greater cooperation between Borrowing again from guidance on OHSMS by the ILO (2001), silos (e.g., weather displays that are built upon governing prin- a WMS has five main elements (see Figure 1) that follow Deming’s ciples of human-computer interaction [HCI]). By using a risk- (1986) internationally accepted Plan-Do-Check-Act (PDCA) cycle. based approach, these systems can be integrated into other man- These five elements are policy, organizing, planning and imple- agement activities (e.g., company management, safety manage- mentation, evaluation, and action for improvement. “Policy” con- ment, air traffic management, fuel management) as well as allow tains the elements of “weather policy” and employee participa- 10, 2008 SEPT. WEDNESDAY, for everyday use and industry implementation using a common tion. It is the basis of the WMS as it sets the direction for the framework. Borrowing from occupational health and safety man- organization to follow. “Organizing” contains the elements of agement systems (OHSMS) theory (International Labour Office responsibility and accountability, competence and training, docu- [ILO], 2001) and recognizing that like fatigue, ramp damage, mentation and communication. It makes sure that the manage- maintenance error, etc., weather is a source of risk that also needs ment structure is in place, as well as the necessary responsibilities to be managed using a “weather management system” (WMS), allocated for delivering the weather policy. “Planning and imple- which focuses activities to maximize results. In essence, coordi- mentation” contains the elements of initial review, system plan- nating and focusing activities using a WMS is working at the in- ning, development and implementation, weather-related objec- tersection of meteorology and the science of risk management to tives and hazard prevention. Through the initial review, it shows improve relationships and consequently safety and performance. where the organization stands concerning weather, and uses this A WMS, like an OHSMS and Safety Management System, is a as the baseline to implement the weather policy. “Evaluation” systematic approach to managing weather. It applies techniques contains the elements of performance monitoring and measure- used to manage other aspects of business performance such as ment, investigation of injuries, damage to aircraft, and disrup- quality and safety. This approach is based in General Systems tion of services as a result of weather, audit, and management Theory (input, process, output, and feedback). Unlike a prescrip- review. A WMS shows how the larger management system func- tive program (e.g., federal regulations on pilot training, VFR and tions and identifies any weaknesses that need improvement. It includes the very important element of auditing, which should be undertaken for each stage. “Action for improvement” includes the elements of preventive and corrective action and continual improvement. It implements the necessary preventive and corrective actions identified by the evaluation and audits carried out. It also emphasizes the need for continual improvement, of weather-related performance through the constant development of policies, systems and techniques to prevent and control weather- related occurrences, injuries, and negative impact on the efficacy of operations.

Weather risk control systems The broader WMS contains a number of smaller “weather risk control systems” (Wx-RCSs) designed to manage the impact of a weather hazard (e.g., thunderstorms, turbulence, reduced visibility, LLWS) on safety and operations (Dutcher, 2005). A Wx-RCS is essentially a “mini” SMS with all the same components designed to manage weather risks, and enable the broader WMS to be integrated into an operator’s overall safety management program (i.e., SMS) as well as influence other areas connected to weather, like fuel management policies and air traffic management. Part of the output of a Wx-RCS is risk controls or types of Figure 1. Main elements of a weather management system. defenses that prevents a hazard from creating harm (i.e., preven-

ISASI 2008 Proceedings • 57

Proceedings 2008.pmd 57 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS Figure 2.Bow-tie Model 58 down inthepreceding layer. Reason (1997) layer ofriskcontrols provides assuranceagainstthepossiblebreak- trols providing layersofprotection inatransportoperation.Each refer tothenotionthatthere are generallyanumberofriskcon- The terms“defenses-in-depth”or“linesofdefense”are usedto “Defenses-in-depth” 2) (Reason, 1997). ful toolforthistypeofanalysisisthe‘Bow-tie model’(seeFigure both typesofcontrols are importantformaximizingsafetyause- trols) (AustralianTransport SafetyBureau [ATSB], 2008).Given the consequencesofundesirableevent(thatis,recovery con- controls), andriskcontrols thatcanbeputinplace tominimize likelihood (that is, preventive ofanundesirable eventoccurring risk controls thatcanbeputinplacetoprevent orreduce the vents planesfrom flyingintothunderstorms. agnosis echoesonweatherradarisahumandefensethatpre- the firstplace.For example, apilot’sabilitytorecognize anddi- required byindividualstoprevent hazards from beingrealized in Humandefenses • thunderstorms, LLWS recovery procedures. followed, suchasacompanypolicyregarding operationsnear Systemdefenses • fitting aircraft withweatherradar. harm suchasdeicingfluidorother“engineeringfixes” like out- Engineering • different types— (i.e., recovery controls). Defensescanbecategorizedintothree tive controls) ormitigatestheharmonceaneventhasoccurred in badweather)require multipleredundant systems,forexample posed byaspecifichazard. Highhazard activities(e.g.,landing The numberofdefensesinplace willdependonthelevelofrisk still maynotcauseharmbecause otherdefensesare inplace. sitating severallayersofdefenses.Ifonedefensefailsthehazard page 41).Like humans,defensesare notperfect,thereby neces- casionally align,leadingtoseriousconsequences(ATSB, 2008, nesses willchangeovertime.Theseholesorweaknessescan oc- there willbeweaknessesinsomeriskcontrols, andtheseweak- in thefirstplace).Atanyparticulartimesafetysystem, tions ortosystemicproblems (forexample, beingpoorlydesigned cies indefensesorriskcontrols canoccurduetoindividual ac- As partofprescribing riskcontrols. itisimportanttoidentify • ISASI 2008 ISASI

defenses Proceedings . Control hazards byspecifyingprocedures tobe .

Actions, competence,andexpertise thatare . Physicallyprevent ahazard from causing 58

noted thatdeficien- gradually workingdownscaleand inward toward thesmallestscale. downscale from theplanetaryscale,analysisshouldbeginthere, Figure 3).Given mostenergy transfer intheatmosphere is est): planetary(orhemispheric), synoptic,andmesoscale(see weather investigation,there are three sizescales(largest tosmall- ous processes intheatmosphere. Primarily, forthepurposeof scaling, whichisessentialtoestablishingtheimportanceof vari- The “analysisfunnel”isbuiltuponOrlanski’s(1975)notion of Analysis funnel 250 millibarlevels)andthehorizontal(discussiontofollow). examination ofdatainthevertical(i.e.,surface,850/700/500/ investigator mustutilizeamethodologicalapproach, allowing To allowforacomprehensive examination ofweatherdata,the Meteorological perspective risks posingsignificantaccidentpotential. making. Theseunsafeconditionsmaybeindicativeofsystemic conditions thatmayhaveaffectedtheirbehavioranddecision- isfundamentaltounderstandingtheunsafe which humanserr and organizational perspective.Understandingthecontext in role inthemishapbutalsofrom atechnicalandhumanfactors conditions andphenomenathatmayhaveplayedacontributing obviously, ameteorological perspectiveidentifyingtheweather proach toweatherinvestigationsmustlookatthemishapfrom, the behavior(Dekker, 2002).To facilitatethis,asystematicap- ior tookplace,investigatorswillbebettersuitedtounderstand understanding oftheevolvingsituationinwhichpeople’sbehav- outtheirwork.Bygainingacomprehensivewhich theycarried with, andoftheoperationalorganizational environment in havior andfeatures ofthetasksandtoolsthatpeopleworked understanding ofthesystemicconnectionsbetweenhumanbe- time?” Through “reverse engineering”investigatorscangain an to explain why. Akey diditmake questionis“Why sense atthe ing limitations. tion ofweatherdata,orincompletedataduetoreport- knowledge duetotrainingdeficiencies,and/orpoordissemina- light issueswithpilotordispatcherincorrect and/orincomplete dispatchers inrelation totheweather.Such ananalysismayhigh- important tounderstanddecisionsmadebypilots,controllers, cal conditionsandphenomenainfluencedtheaircraft, itisalso rence. Thoughitisimportanttounderstandwhatmeteorologi- lightning, turbulence)thatmayhaveplayedarole intheoccur- That said,tosimplysayapilotflewintobadweatherdoeslittle 1/14/2009, 8:22 AM tify weatherhazards (e.g.,icing,LLWS, time oftheoccurrence, aswelliden- lish thestateofatmosphere at the and plottingatmosphericdatatoestab- Investigations mustincludegathering contributing factortotheoccurrence. tigated todetermineifweatherwasa rences mustbecomprehensively inves- To allowforlessonslearned,occur- occurrences Investigation ofweather-related duce theriskofanaccident. tem (ILS),andILSprocedures, tore- weather radar, instrumentlandingsys- aircraft performance. In addition, thunderstorms can also cause erroneous altimeter readings. In addition to a structured framework for analysis, the WAC is also useful as a tool to provide for a clear summary of conditions at each scale, allowing others to follow the logic of the investigator. Following the comprehensive analysis of all scales (as per the analysis funnel) with regard to the weather analysis checklist, the four-dimensional understanding of the atmosphere must be related to each phase of flight to determine if, and what, weather hazards were present during (a) taxi, takeoff, to top of climb; (b) enroute; and (c) top of descent, approach, landing, and taxi. By combining the analysis funnel with the WAC, an investigator can systematically identify weather hazards at every phase of flight and be able to explain “meteorologically” why the weather behaved in such a manner. In other words, this identifies the Figure 3. Analysis “what,” “where,” “when,” “how,” and “why” of the weather. funnel (above). Figure 4. Weather analysis Technical factors checklist, (left). In addition to examining the weather-related occurrence from a 10, 2008 SEPT. WEDNESDAY, meteorological perspective, investigators must also consider tech- This framework essentially nical factors that may have restricted the accuracy and compre- forms an analysis funnel hensiveness of meteorological data provided to aircrews, ATC, providing an investigator and operators. In some cases investigators may breakdown and with a comprehensive un- test meteorological instrumentation if the accuracy of weather derstanding of the state of data is suspect. In cold climates, during winter, ice can form on the atmosphere and inter- meteorological instrumentation and is thus a possible consider- relation of scales (Dutcher, ation during an investigation. For instance, during periods of 2004). In other words, this freezing precipitation, ice accretion may reduce the efficiency or will provide an under- cause complete failure of anemometers, restricting the validity of standing of why the wind data. These same considerations may be applied to aircraft weather did what it did at instrumentation as well as the affect of temperature and density the local level as a result changes on altimeters. of the interplay between Technology for gathering and displaying weather information local factors (i.e., topogra- must also be examined to understand the capabilities and limita- phy, bodies of water, local stability, water, and air temperatures) tions of such tools (i.e., radar technology, high-resolution zoom and the larger scale dynamics (i.e., highs, lows, frontal systems, satellite imagery). Consideration must also be given to possible jetstreams, upper level troughs, ridges, and vorticity, thermal limitations of technology as a result of atmospheric phenomena— advection). Essentially, this provides the “why” of the weather. for instance, aircrews flying into thunderstorms and areas of hail as a result of false radar returns caused by radar attenuation due Weather analysis checklist to absorption. From analysis of research and various aircraft accidents and events Dutcher (2003, 2004) developed the “weather analysis checklist” Human factors and organizational issues (WAC) to provide a sound analytical framework to assist in iden- Comparison of forecast conditions, aircrew actions, and the tifying flight conditions and possible weather hazards present investigator’s identification of possible hazards may suggest pos- (see Figure 4). The WAC is structured to allow a logical flow for sible issues with aircrew judgment. However, simply stating that analysis, moving downward from stability—since stability deter- the pilots flew into adverse weather conditions does little to ex- mines virtually every subsequent factor. Moreover, many of the plain why. Investigators must endeavor to identify why the aircrew’s items in the checklist are influenced by the proceeding item. For decisions made sense to them at the time. Were there human- instance, an unstable atmosphere will allow for the formation of factors-related barriers to effective aircrew weather decision-mak- towering cumulus and cumulonimbus clouds resulting in thun- ing—for instance, lack of knowledge due to inadequate training derstorms and rain and consequently reduced visibility. Addi- or poor provision of weather data, and operating norms? tionally, the unstable conditions can cause surface winds to be- The overall process of occurrence investigation within the hu- come variable and gusty. With thunderstorms comes the presents man factors field is similar across many methodologies. How- of windshear associated with downbursts (e.g., microburst) as well ever, differences arise in their particular emphasis of the tech- as turbulence. The strong vertical currents inside the towering niques. While some focus on management and organizational cumulus and cumulonimbus clouds combined allow for the rapid oversights and omissions, others consider human performance/ growth of large water droplets representing a significant icing error problems (on the frontline) in more depth (Livingston, Jack- threat above the freezing level. Warm temperatures can create son, & Priestley, 2001). With that said, both levels must be exam- high-density altitude conditions that can have a major impact on ined to gain a comprehensive understanding of how such things

ISASI 2008 Proceedings • 59

Proceedings 2008.pmd 59 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 60 (Rhoda &Pawlak, 1999). try norms,e.g.,penetrationof thunderstormsinterminalareas lyzed fordisparity. Suchanalysismayalsobeapplied toindus- weather conditionsandthe operational reality shouldbeana- operator’s operationalpoliciesregarding flightinhazardous weather briefingsprovided. Inaddition, federalregulations and only certaindatamayhaverestricted thecomprehensiveness of entirety duetotheirconsiderablelength.Thisnormofseeking possible normofpilotsfailingtoread dispatchreports intheir semination ofinformationandanalysisdata.For instance,a tion shouldbepaidtonormsandpoliciesrelating tothedis- groups, andnorms oftheaircrew (ifpossible).Particular atten- weather, aninvestigatormustanalyzethevariousorganizations, nificantly influencebehaviorandoperations.Inrelation to Norms, whetherorganizational, group, orindividual,maysig- Operating normsandpolicies tion issubjective(e.g.,Bass,Kvam,&Campbell,2002). evant toreports oficingandturbulencegiventheirinterpreta- must alsobeconsidered. Theselimitationsare particularlyrel- sible limitationsofreports suchaswithpilotreports (PIREPs) and messages(e.g.,HCIconsiderations).Inaddition,thepos- may alsoincludethe“cognitiveergonomics” ofweatherdisplays standing anduseofmessagesgivenconditionsflight.This ined forclarityandbrevity andwhethertheyfacilitatedunder- cal information(SIGMET)messages.Suchdatashouldbeexam- in flightmustalsobegiven,forinstancesignificantmeteorologi- thus non-useofsuchdocumentseveninVMC. use oftheseparticularaerodromes maybreed complacencyand tion, investigatorsmustalsoconsiderthepossibilitythatfrequent warning maybesilentinapproach platesusedinIMC.Inaddi- certain conditions(i.e.,winddirection andspeed).However, this strong winds maywarnofpossiblemechanicalturbulencegiven for anaerodrome surrounded byrough withfrequently terrain highlight possibledisparities.Asanexample, aflightsupplement fore, comparisonofsuchdocumentsshouldbemadesoasto ments relating toflightinIMCforthesameaerodrome. There- in VMC.However, thesesamewarningsmaybesilentindocu- ing toaircraft. Theseflightsupplementsare oftenusedforflight an aerodrome maybelistedinfightsupplementsdataasawarn- In somecountries,frequently observed localweathereffectsat Adequacy of flightdocumentationandmessages lay andinaccordance withprescribed procedures. the relevant aeronautical personnel wasaccomplishedwithoutde- and relevant information;andcommunicationofinformationto and briefingswere accurateandmadeeffectiveuseofallknown dures were satisfactory, available,andadhered to;thatforecasts whether suchthingsaspertinentregulations andproce- services provided should beexamined withaviewtodetermining The observing,forecasting, andbriefingfacilitiesinvolvedthe was adequatelyinformedregarding hazardous weatherconditions. Emphasis shouldbeplacedupondeterminingwhetherthecrew Adequacy ofservice munication ofweatherinformationandconsequentlydecisions. behaviors, andhoworganizational structures influencedthecom- as organizational normsandpoliciesimpacteddecisions Aside from flightdocumentation,considerationtomessages • ISASI 2008 ISASI Proceedings 60 for continuousimprovement. weather investigationcanbeusedasinputintoaWMStoallow age theserisks(i.e.,riskcontrols). Therefore, theresults ofa findings ofriskandmake recommendations astohowman- gator canidentifydeficienciesandsystemsfailures andproduce 1987). Havingassessedtheinterplaybetweenfactors,aninvesti- model (1990)andtheSHEL(Edwards, 1972;Hawkins, various modelsofsystemsthinkinglike Reason’s “Swisscheese” step backtoseethebiggerpicture andmake senseofitusing to transpire. In order togainthisunderstanding,wemust again tween thevariousfactorsandconditionsthatallowedevents event. However, itofferslittleaboutthedynamicinterplaybe- identify variousconditionsandfactorsthatplayedarole inthe nical, andhumanfactorsperspectiveallowsaninvestigatorto to investigatingaweatheroccurrence from ameteorological, tech- work toaccomplishacommongoal.Usingsystematicapproach ties, procedures, software, andworkenvironment andhowthey interaction ofpeople,theirtools,equipment,materials,facili- tions thatresult inanaccident.Systemstheoryisthestudyof in combinationtheycanresult inasequenceofeventsandcondi- vidual factorswhenviewedinisolationmayseeminsignificant, currences are seldomtheresult ofasinglecause.Althoughindi- The mostimportantquestioninaninvestigationis“why?”Oc- The roleofsystemstheoryinaccidentinterpretation and decision-makingofindividualscrews. ences ofworkloadandpressure (eitherreal orperceived) onerrors thermore, aninvestigatorshouldalsoconsiderthepossibleinflu- cies theresult ofinadequate traininganddatedknowledge?Fur- tant touncoverwhytheyexist. Inotherwords, are thesedeficien- of data.Inadditiontoidentifyingdeficiencies,itisequallyimpor- in skillofpersonnelinterpretation ofproducts andapplication the aircraft andtechnology. Inaddition,there maybedeficiencies tional knowledgeofmeteorology andperhaps thelimitationsof Rasmussen (1982),there maybeissueswithacademicandopera- dividuals (i.e.,pilots,dispatchers,controllers). Borrowing from Investigators mustalsogiveconsiderationtotheproficiency ofin- Individual proficiency ing. Itappearsaunified,concerted efforttofocusingeffortsis weaknesses inpilots’understanding ofmeteorology andtrain- injuries duetoturbulenceevery month.Andthere are major area isblanketed withthunderstorms.There are stillnumerous We are stilllandingandtakingoffaircraft whentheterminal training peopleadequately, insome casesatall,onhowtouseit. designing technologytoimprove efficiencyandsafety, butnot contributing factorinmanyaccidents.Insomeinstances we are However, despitetheseimprovements, weathercontinuestobe a expertise, instructionaltechniques,andsafetymanagement. pilot weather-related decision-making,cognitiveengineering, sides technologicaladvancements,research continuestogrow into racy ofweatherforecasts andspecializedforecast products. Be- lated information,improvements inobservationsand theaccu- of technologyforthedisplayanddisseminationweather-re- tion safetyandairtrafficmanagementthrough thedevelopment for improvement, severalinitiativesnowexist toimprove avia- ment, fuelburn,andon-timeperformance.Inresponse tocalls Weather hasasignificantimpactonsafety, airtrafficmanage- Conclusion 1/14/2009, 8:22 AM needed as the status quo will have only limited results. The great- June 10, 2008, from http://www.ainonline.com/news/single-news-page/ article/honeywell-better-wx-training-needed/. est potential for improvement in safety, air traffic management, Hawkins, F.H. (1987). Human Factors in Flight. Aldershot, UK: Gower aircraft operations, and fuel management is in a more unified Technical Press. effort for managing weather using a systems view. By using a International Civil Aviation Organization (2006). Safety Management Manual (SMM). Montreal, Canada: ICAO. WMS, we can strategically direct management strategies to man- International Labor Office (2001). Guidelines on Occupational Health age the risk and impact of weather hazards (e.g., thunderstorms, and Safety and Health Management Systems. Geneva, Switzerland: turbulence, reduced visibility, LLWS) on safety and operations. ILO. Lankford, T.T. (2001). Aviation Weather Handbook. New York, USA: It can be seen that though we cannot control or change weather, McGraw-Hill. we can actually do something about it. Weather is not “just the Livingston, A.D., Jackson, G., and Priestley, K. (2001). Root Causes Analysis: cost of doing business.” By studying the relationships among Literature Review. Suffolk, UK: HSE Books. Malaysian National News Agency (2007, April 17). IATA Calls for Further weather, technology, human factors, and operations we can change Improvement in Air Travel Safety Record. Retrieved April 17, 2007, how we interact with weather thus improving safety and perfor- from http://www.bernama.com.my/bernama/v3/news.php?id=257166. mance and making our organizations and operations more National Research Council. (1995). Aviation Weather Services: A Call for ◆ Federal leadership and Action. Washington, DC: National Academy Press. weather tolerant. National Transportation Safety Board. (2005). Risk Factors Associated with Weather-Related General Aviation Accidents. (Safety Study: NTSB/SS-05/01). References Washington, DC: NTSB. Australian Transport Safety Bureau. (2008). Analysis, causality and proof in Orlanski, I. (1975). A Rational Subdivision of Scales for Atmospheric safety investigations. (Aviation Research and Analysis Report AR-2007- Processes. Bull. Amer. Meteor. Soc., 56, 527-530. 053). Canberra, ACT: Author. Qualley, W.L. (1997). Impact of Weather on and Use of Weather Informa- Adams, C. (2001, August). Tackling Turbulence. Defense Daily Network. tion by Commercial Airline Operations. Paper presented at the Workshop 10, 2008 SEPT. WEDNESDAY, Retrieved March 24, 2005, from http://www.defensedaily.com/cgi/av/ on the Social and Economic Impacts of Weather. Boulder, Colo. April 2-4 show_mag.cgi?pub=av&mon=0801&file=0801cat.htm. Retrieved June 12, 2008, from http://sciencepolicy.colorado.edu/socasp/ Bass, E.J., Kvam, P., & Campbell, R.H. (2002). Measuring the Seat of the weather1/qualley.html. Pants: Commercial Airline Pilot Turbulence Assessments in a Full-Motion Rasmussen, J. (1982). Human Errors: A Taxonomy for Describing Human Simulator. International Journal of Aviation Psychology, 12, 123-136. Malfunction in Industrial Installations. Journal of Occupational Accidents, Burian, B.K. (2002). General Aviation Pilot Weather Knowledge. (FAA Grant 4, 311-333. #00-G-020). Moffett Field, California: NASA Ames Research Center. Reason, J. (2000). Human Error: Models and Management. British Medical Cantu, R.A. (2001). The Role of Weather in Class A Naval Aviation Mishaps, Journal, 320, 768-770. FY90-98. Unpublished Master of Science in Meteorology and Physical Reason, J. (1997). Managing the Risks of Organizational Accidents. Aldershot: Oceanography thesis. Monterey, CA: Naval Postgraduate School. Ashgate. Collaborative Decision-Making (CDM). (n.d). Severe Turbulence and Reason, J. (1990). Human Error. Cambridge Univ. Press: Cambridge, UK. Severe Icing. NAS Status Information Subgroup Memo. Unknown, Regnier, E. (2008). Doing Something about the Weather. International United States of America: CDM. Retrieved March 24, 2005, from http:// Journal of Management Science, 36, 22-32. cdm.metronaviation.com/de/nasdocs/nasdata/Turbulen.rtf. Rhoda, D. A., & Pawlak, M.L. (1999). An Assessment of Thunderstorm Dekker, S. (2002). The Field Guide to Human Error Investigations. Penetrations and Deviations by Commercial Aircraft in the Terminal Cranfield, UK: Cranfield University Press, Ashgate. Area. (Project Report NASA/A-2). Springfield, VA: NTIS. Deming, W.E. (1986). Out of the Crisis. Cambridge, MA: MIT Press. Sand, W. R., & C. J. Biter. (1997). Pilot Response to Icing: It Depends! Dutcher, J.W. (2005, November-December). Heavy Weather. Civil Aviation Paper Presented at the 7th Conference on Aviation, Range, and Aerospace Safety Authority, Australia, Flight Safety Australia, 9 (6), 40-41. Meteorology. Long Beach, CA. Feb 2-7. American Meteorological. Society, Dutcher, J.W. (2004). Weather Investigation. In Aircraft Accident Investigation Boston, MA. Manual-Part 3, Chapter 5—Aircraft Operating Environment Investiga- Sharman, R., Tebaldi, C., Wiener, G., & Wolff, J. (2006). An Integrated tion. Montreal, Canada: International Civil Aviation Organization. (pp. Approach to Mid- and Upper-Level Turbulence Forecasting. Weather and III-5-1 – III-5-11) (in press). Forecasting, 21, 268-287. Dutcher, J.W. (2003). Weather Analysis Checklist for Aircraft Accident Investiga- University Corporation for Atmospheric Research (2005). Impact of tion. Retrieved June 15, 2008, from, http://www.johndutcher.com/ Weather on Air Traffic Management-Section 3: How Weather Impacts wxinvestigation.html. the NAS. Retrieved January 24, 2006, from http://meted.ucar.edu/nas/ Edwards, E. (1972). Man and Machine: Systems for Safety. In Proceedings print3.htm. of the BALPA Technical Symposium, London. Vincente, K. (2003). The Human Factor: Revolutionizing the Way We Live with Goh, J., & Wiegmann, D.A. (2001). Visual Flight Rules Flight into Instru- Technology. Toronto, Canada: Random House of Canada. ment Meteorological Conditions: An Empirical Investigation of the Wiggins, M. (2005). The Interpretation and Use of Weather Radar Displays in Possible Causes. International Journal of Aviation Psychology, 11, 359-379. Aviation. (Aviation Research Investigation Report). Canberra, ACT: Goold, I. (May 1, 2008). Honeywell: Better wx training needed. Retrieved Australian Transport Safety Bureau.

ISASI 2008 Proceedings • 61

Proceedings 2008.pmd 61 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS member oftheAerospace MedicalAssociationintheU.S.since1987. Railways SafetyPromotion, Tokyo, Japan.Dr. hasbeenaFellow Kakimoto 62 bution rateofaircraft accidentsduring2001–2006hadasimilar helicopters hadhighincidents ofaccidents(Table 1).Thedistri- ers 14.2%,andairships0.2%. Amongthese,generalaviationand ultralight planes12.1%,helicopters 32.8%,gyroplanes 1.9%, glid- dents wascommercial airliners 11.3%,generalaviation27.70%, aircraft accidentsoccurred. Thedistributionratioofaircraft acci- mation. Duringtheperiodfrom 1974to2007,atotalof1,215 Aircraft accidentsstatisticwere reviewed forbackground infor- accidents Background ofaircraft models basedonreleased accidentinvestigationreports. (Human Factors AnalysisandClassification System)andSHEL 600 passengersinjured. way accidenthashadmore than100passengerskilledandnearly more than100personsinjured. Ithadbeen43yearssincearail- not afatalaccident,butithasbeen16yearssincethere has been of fatalaccidentssince1985.Innearmidaircollision,thiswas sons were killed,and562personswere seriouslyinjured. slightly injured. Intherailwaysderailmentandcrash, 107per- sion, ninepersonswere seriouslyinjured, and91personswere Fukuchiyama Line,onApril25,2005).Inthenearmidaircolli- the otherwasrailway’sderailedandcrashaccident(JRWest, onJan.31,2001)and vs.MD-10, a nearmidaircollision(B-747 Railways AccidentInvestigationCommissioninJapan.Onewas where theauthorworked asoneofmemberstheAircraft and jured orkilledoccurred duringtheperiodfrom 2001to2006 Two majoraccidentsinwhichmore than100personswere in- Introduction Why didtheseaccidentsoccur?AtrialwasdoneusingHFACS In Japan,commercial airlineshavemaintainedthezero record Major Aircraft and Railway Accidents andRailway Major Aircraft During thePeriod from2001to2006 • ISASI 2008 ISASI An Attempt atApplyingHFACSAn Attempt to By Yukiko Ph.D.,NPOAviation Kakimoto, andRailwaysSafetyPromotion, Tokyo, Japan In JapanandSomeProblems Dr. NPOAviation isnowworkingat and Kakimoto Accident InvestigationCommission(2001-2007), (2000-2007). AmemberoftheAircraft andRailways College (1997-2000)andJissenWomen’s University She then became the Aeromedical JASDF, Laboratory, DefenseAgency. Yukiko Kakimoto Proceedings 62 a professor Prefectural atKagoshima workedasaresearch psychologistat Analyzing Results 2006, HFACS wasused fortwopreviously describedmajoracci- Based onreleased accidentreports betweentheperiod2001and Methods pare withmajoraccidents. ing HFACS togeneralaviation andhelicopteraccidentstocom- to majoraccidents(includingonerailwaysaccident)and apply- pilots. Inthisstudy, outtoapplyHFACS anattemptwascarried and theorganizational factorsusing523Republic ChinaAirForce (2006)revealedDon Harris therelationship betweenpiloterrors ing oftheAerospace Medical Association.Dr. Wen-Chin Liand presentation papersinsafety session attheannualscientificmeet- Wiegmann, D.A.,2001),andFRAM(Hollnagel,E.,2006). (revised Reason’s Swisscheesemodel (Shappell,S.A.,and proaches bytheU.S.Army; SHEL,mSHEL,FTA, VTA, HFACS been discussed—4M4E,5P, or6Papproaches; FTA, 3Wap- human factorshasexisted. Sincethat,manyapproaches have why theaccidentoccurred. From theearly70sera,word of human factorsmodelswere notused,butwealwaysdiscussed railways derailmentandcrashmanyotheraccidents,special When ourCommissionmetaboutnearmidaircollisions—the Models forhumanfactorsapproaches lower contributionbypiloterrors. Commercial rateofaccidentsanda airlinershadalowoccurring 81.3%, helicopters53.8%,gyroplanes 100%,andgliders78.6%. lows—airliners 18.8%,generalaviation80.5%,ultralightplanes tion ofpiloterrors asaccidentscauses(2001-2006)were asfol- ters 69.8%,gyroplanes 82.6%,andgliders83.3%.Thedistribu- 25.0%, generalaviation75.0%,ultralightplanes76.9%,helicop- different by type ofaircraft asfollows—incommercial airliners controllers were included.Distributionofpiloterrors were quite (Table 3).Among“others,”communicationerrors byairtraffic materials 9.7%,weather0.8%,others17.3%,andunknown0.4% attributed topiloterrors 69.3%,inadequatemaintenance2.4%, of aircraft accidentsduringtheperiodsfrom 1974to2006were 27.5%, gyroplanes 1.4%,andgliders19.7%were shown.Causes general aviation28.9%,ultralightplanes11.3%,helicopters trend, except forgliders(Table 2).Commercial airliners11.36%, The HFACS modelhasbeenusedfrequently since2001in 1/14/2009, 8:22 AM dents and HFACS was applied to general aviation and helicopter made a mistake regarding B’s call sign. accidents, picking up some accidents caused by human errors. • The supervisor instructed to use a call sign that any aircraft in The distribution ratio of accident occurrence was nearly 30% in flight had not used at that time. both general aviation and helicopter accidents. These are high • ATC coordinator noticed the ATCt’s initial call sign mistake ratios compared with other types of accidents. regarding aircraft A, but he didn’t advise the ATCt. Simultaneously, the SHEL model was used to consider pre- • Precondition (Level 2): Until CNF symbol was indicated, the ventive actions. Concerning the SHEL model, a management trainee and his supervisor might have momentarily forgotten the factor was added to the main four factors and became mSHEL. presence of aircraft B. They were shock and tried to correct the The reason the mSHEL model was used was because it was mistake in a hurry. difficult to develop preventive measures from the results of the • Psychological factor: Just before the CNF was displayed, the error classification. ATCs explained the traffic flow to the trainee. Before this explanation, the trainee concentrated on contacting aircraft C because Results it was cruising at the altitude of 39,000 ft he that he assigned to 1. Near midair collision aircraft A. However, he could not contact aircraft C even though Outline of the accident he tried for several times. Psychologically, it is supposed that they On Wednesday, Jan. 31, 2001, a Japan Airlines (JAL) B-747-400 were upset because of forgetting momentarily the presence of departed Tokyo International Airport as scheduled passenger aircraft B and became panicked. Flight 907 to Naha Airport. The aircraft was climbing through • Supervisory problems (Level 3): Was it a suitable time during an altitude of approximately 37,000 ft per climb instructions from the trainee’s on-the-job training to explain the traffic flow? Did 10, 2008 SEPT. WEDNESDAY, the Tokyo Area Control Center (ACC) when it began descending the supervisor have enough education as a supervisor? When the to an altitude of 35,000 ft in response to an instruction from CNF was displayed, why did the supervisor change the trainee Tokyo ACC. On the same day, a JAL Douglas DC-10 departed position? Pusan International Airport in South Korea as scheduled pas- • Organizational problems (Level 4): There weren’t any educa- senger Flight 958 to New Tokyo International Airport. In accor- tion programs for ATC supervisors during on-the-job training. dance with its flight plan, the aircraft was cruising at an altitude • On the ATC radar scope, it is requested to display the TCAS of 37,000 ft over the Shima peninsula, Aichi prefecture, heading TA and TCAS RA together with the cockpit display. toward the Oshima VORTAC navigational fix having cross the • In this accident, the CNF was displayed 56 seconds before the Kowa VORTAC navigational fix. near midair collision occurred because the aircraft was turning. Around 15:55, the two aircraft experienced a near midair col- It was requested to display the CNF on the radar although the lision and took evasive actions at an altitude between approxi- aircraft was turning or performing attitude changes. mately 35,500 ft and 35,700 ft over the sea about 7 nautical miles • Kanto South C sector in this accident is the busiest area in (about 13 km) south of Yaizu NDB, Shizuoka prefecture. Passen- Japan. It is requested to reconsider distributing the airspace. gers and flight attendants on board Flight 907 sustained injuries as the result of the evasive maneuvers. Preventive actions using mSHEL model Of the 427 persons aboard Flight 907—411passengers, the L: ATC trainee needs to continuously brush up on his skills and captain, and 15 other crew members—7 passengers and 2 cabin to reevaluate the situation. attendants were seriously injured, and 81 passengers and 10 cabin The trainee and the supervisor needed to understand how attendants sustained minor injuries. The interior of the passen- TCAS works. ger cabin of Flight 907 was slightly damaged due to the upset, The ATC supervisor needs to master teaching techniques for but no fire occurred. OJT trainees. There were 250 persons on board Flight 958—237 passen- L-H: On the ATC radar scope, it is requested that TCAS infor- gers, the captain, and 12 other crew members--but there were no mation is displayed simultaneously with cockpit. (Under the cur- injuries. There was no damage to Flight 958. rent system, the radar scope was improved.) This accident was triggered because a trainee air traffic con- Concerning CNF, it is requested that it be displayed on the troller instructed Aircraft A to descend to 35,000 ft. The trainee radar 3 minutes before the near midair collision even if the air- intended to instruct Aircraft B to descend to 35,000 ft but made craft is turning or performing an attitude change. a mistake in B’s call sign and instructed Aircraft A. L-H-L: When there is a contradiction between an air traffic Controller’s instruction and TCAS RA instructions, pilots need HFACS analysis to follow TCAS RA instruction. (As a recommendation, the Com- • Unsafe act (Level 1): An ATC trainee (ATCt) instructed air- mission of Aircraft and Railways Accident Investigation, Japan craft A to descend to 35,000 ft. Instead of aircraft B’s call sign, he proposed this to ICAO in 2002. This recommendation was communicated aircraft A’s call sign. Skill-based error. adopted in 2004). • From aircraft A, the readback came immediately; however, the ATCt and his supervisor (ATCs) did not notice ATCt’s mistake of 2. Major railways accident— the call sign. JR West Fukuchiyama Line derailment accident • ATCs instructed aircraft A to climb to Flight Level 350, but Outline of the accident this instruction was too late because aircraft A had already began On Monday, April 25, 2005, the rapid up train 5418M for to descend per the ATCt’s instruction. Doshisha departed from Itami station at 09:16:10 and passed • ATCs intended to instruct aircraft B to descend, but the ATCs Tsukaguchi station at 09:22. The train was running on the radius

ISASI 2008 Proceedings • 63

Proceedings 2008.pmd 63 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 64 ler instructedtothepilotextend downwindandwaitbyturn- gear downonthedownwind of RunwayB,theairtrafficcontrol- During atraineetraining,when theinstructorpilotwantedtodo (1) Nov. 19,2002,10:24,Nagasakiairport, Beechcrafttype Outline ofaccident 1. Nogearlandingbecauseofforgetfulness accident dataregarding humanerrors. for thefollowinggeneralaviationandhelicopteraccidents using accidents. enough. Humanfactorseducationisrecommended toprevent Educationforthepersonwhomadeahumanerror wasnot L-m: Itisnecessarytohave preventiveL-S: procedures foroverrun. prevented. Asthenew ATSL-H: wasnotsettled,theoverspeed skill ofbraking. L: Ifthedriverwasalive,itwouldbesuggestedhemaster Preventive actionsusingmSHELmodel new ATS systemswere notcompletelybuilt. benefit ofthecompany, notonsafety. OnthisFukuchiyama line, culture hadnotgrown. Top managersmadethefirstpriority Organizational factors (Level4):Intheorganization, asafety • was notinvolved,butunrelated punishment. punished. Regarding education,enhancementofperformance Supervisoryfactors:Underthenameofeducation, driversare • instructor. totheupper to knowhowtheconductorinformedhisoverrun posal astheconductorwasverybusywithwork.Thedriverwanted cause hehadnotyetgottentheconductor’sresponse forhispro- tate punishment. months ago.Usuallyanoverrununder50mdoesnotnecessi- received somepunishmentforhisoverrunnear100mafew was afraidtobepunishedbythedirector forhisoverrunashe lessthan50m.Thedriver upper instructorthatthedriveroverran the stoppoint.Thedriverasked theconductortoreport tothe Itami stationthedrivermadeanoverrunabout72mbeyond tween theconductorandanupperinstructor. Attheprevious have beenconcentratedonlisteningtothecommunicationbe- Precondition (psychologicalcondition):Hisattentionmight • 304 mrightcurve.Skill-basedanddecisionerror. speed untilthedecelerationpointatbeginningofradius Unsafeact(Level1):Thedriverdidnotdecrease thetrain • HFACS analysis by thedriver. and 562personsreceived injuries. and seventhwere notderailed. ment houses.Thefourthandfifthcarswere derailed.Thesixth of theapartmentbuildingoncornerline. and crashedagainstthewallofparkinglotbyfirstfloor seventh carstoppedat09:19:04’.Thefirstrolled totheleft then second,third, fourth,andfifthcarsderailedfinallythe 304 mrightturncurve;thefirstcarderailedabout09:18:54, Compared withtheresults ofmajoraccidents,HFACS wasused The drivertendedtoconcentrateonthecommunicationbe- The triggerofthisaccidentwasspeedinganddelayinbraking In thisaccident,107persons(includingadriver)were killed, The secondandthird carscrashedintothepostsofapart- • ISASI 2008 ISASI Proceedings 64 “inadequate attention.” Organizational factor(Level4):Notrelated. • Supervisory factor(Level3):Notrelated. • was placedonotherthingsexcept thelanding gear. Psychological Precondition (Level2):Inbothcases,attention • error. Unsafeacts(Level1):Forgeting toputgeardown.Skill-based • HFACS analysis speed. Delayindecision-making. Unsafe act(Level1):Delayed recovery from lowaltitudeand were verysimilaraccidentpatterns. The analysesofthetwocaseswere outtogetherasthey carried HFACS analysis Three personswere killed. sharp leftturn,andlowspeedcrashedintoaricefield. tainous area. TheCessnadidnotrecover from lowaltitude,a two camerapersonstriedtotake photosfrom the slopeofamoun- To take photographsofanewhousefarmer, thecaptainand prefecture(2) Aug.16,2001,09:58,Cessna,Okayama a camerapersonwere killed. from lowaltitudeandspeed.Thecaptain,aninstructor, and preschool. Onthesixthapproach, theCessnadidnotrecover memory oftheiranniversary, thecaptaintriedtoapproach the In order totake photographsofchildren attheirpreschool asa Yamanashi prefecture (1) Jan.22,2004,10:29,aCessnacrashedinKofu city, Outline oftheaccidents 2. Crashaccidentswhileonphotographicmissions Notrelated. L-m: Notrelated.L-E: Notrelated.L-L: matically. Developthesystemofputtinglandinggeardownauto- L-H: Uselandingchecklistandnottodependonmemorychecklist. L-S: Preventive action light, hecompletelyforgot putthegeardown. the windowofcockpit.Trying toavoidthedirect thesun- made hisfinalapproach, hesawthesinkingsunlightinfront of his actionandwantedtogeardownonfinalapproach. Whenhe wind ofAmiAirport,heoncetriedtogeardown,butchanged tolandattheairport.Hefelttired.captain hurried Onthedown- Returning from SendaitoAmiAirport,Ibaragi prefecture, the (2) May26,2004,15:08,AmiAirport,Beechcrafttype liner, etc.Theinstructorcompletelyforgot toputthegeardown. avoid themountainandjetstream ofthecommercial air- Runway A,theinstructorwasverybusyadvisinghistrainee,to altitude thanthecommercial airliner. Atthegeardownpointof quested togoRunwayAbycrossing RunwayBwithahigher because ofsimulatedleftenginetrouble, andtheinstructorre- ing. Theinstructorreplied theydidn’t wanttoturntheright ing rightattheAhillbecauseacommercial airlinerwasapproach- Both casesoccurred asaresult ofthehumancharacteristic These accidentswere related tolackofconcentration. 1/14/2009, 8:22 AM Psychological condition (Level 2): Concentrated attention on the directly. There were three relay points but one-way communication. target (objects of photos) and high motivation to take photos for their business. (3) Oct. 18, 2005, Unaduki, Toyama prefecture Supervisory factors (Level 3): In case (1), an instructor on board While transporting materials needed to build a bridge in a deep was late in advising the time to recover. valley, a pilot put down the materials on the bridge and they hit Not related in case (2). the worker on the bridge. Organizational factors (Level 4): High priority for business, and The worker was injured on his right leg. The accident occurred low priority for safety. on the seventh time the materials were put down. When the ma- Safety management was not enough in these flight companies. terials were first put on the bridge, they were not put in the exact position so the worker requested via a maintenance person on Preventive actions board that the pilot move to the left a little. The pilot moved to L: Both pilots had 10 years’ flight experiences and more than the left little by little, but the materials hit the worker’s right leg. 2,000 flying hours. The pilots needed to focus on safety motiva- Non-verbal gestures were used in this accident. tion and no follow the camera person’s requests. L-L: (pilot vs. camera persons): The pilots must reject the cam- HFACS analysis era person’s request even if they were business related when safety The three cases had similar patterns and were analyzed together. is at risk. Unsafe act (Level 1): Pilots could not see the movement of the L-H: Not related. workers on the ground and could not hear their voices directly. L-S: Safety management rules are needed for business and tim- Perceptual errors. 10, 2008 SEPT. WEDNESDAY, ing of recovering. Precondition (psychophysiological condition) (Level 2): The pi- L-m: The company needs to manage safety and realize that safety lots became exhausted by repeated and frequent tasks of picking is always a high priority. up the materials and putting them down in inconvenient and dangerous places. 3. Helicopter accidents Supervisory factors (Level 3): Not related. During the period 2001 to 2006, helicopter accidents caused by Organizational factors (Level 4): The safety system between pi- inadequate communication between a pilot and workers on the lots and workers on the ground side was not sufficient. Commu- ground occurred five cases. Among these, one person died and nication was not sufficient. Helicopter pilots and the workers on two had serious injuries. The three accidents follow. the ground could not communicate directly, but they did communicate through two or three relay points. Outline of the accidents (1) Oct. 22, 2001, 15:20, Fuji Bell, Sapporo city, Hokkaido Preventive action using mSHEL model While transporting materials needed for building a park in the L-H: Improving communication devices was recommended. suburbs of Sapporo city, a helicopter pilot picked up materials L-m: Safety management was suggested to make the environ- (about a 1,000 kg bag of stone, wood, iron, etc.) and then put it ment safer and to maintain adequate communication among dif- down at the work site. During the 59th time of putting down the ferent job groups. bag of materials, the pilot picked up the ground worker who was putting out the materials bag. Soon the pilot and a maintenance Discussion person noticed they picked up the worker by the hook of the To take into account human factors, the HFACS model was used sling, so the pilot tried to put the man down on the ground. to analyze two major accidents first and then was used to analyze However, the worker’s body tended to hit the rock wall. The worker general aviation and helicopter accidents, They were then com- kicked the rock wall to protect for himself and he dropped from pared to the two major accidents. HFACS was very useful in de- the height of 5 meters onto the ground. He had serious injuries. veloping a human factors approach and easily attained the Level The pilot and a maintenance person on board misunderstood 4 organizational factors in most of cases. While analyzing the his gesture to “pull up the bag, all right.” The worker slipped results, some questions came up. backward at the time and his left hand raised upward without his 1) Concerning unsafe acts, many persons were involved in the intention. This meant “climb, all right.” In this flight, the pilot accident. For example, in the case of the near midair collision, and the worker could not communicate directly. Through relay there were five persons related to the accident—an ATC trainee, points, they communicated indirectly. an ATC supervisor, an ATC coordinator in the next seat, pilot A, and pilot B. Wanting to figure out the accident visually, the acci- (2) Aug. 20, 2005 dent related persons were asked on parallel and time sequen- While transporting materials needed for making a walking road tially to follow their behaviors. By figuring out the accidents, the in the mountain, the pilot was approaching the spot to put down resolving points (preventing key points) might be shown clearly. a net with materials (about 800 kg). Through analyses of HFACS, it might be difficult to figure out When the pilot noticed a worker who was standing on the the accidents related persons on parallel and time sequentially. ridge walk fell down on the ground, it was suspected the worker 2) On the other hand, when applying HFACS to general avia- on the ridge walk was hit by the net. The worker died. In this tions and helicopter accidents, something related to attention, flight, a maintenance person was not on the helicopter and for example, forgetting to use the landing gear, we Level 4 was stayed in the spot where materials were packed. In this case, the not attained. These accidents related to human characteristic pilot and the worker on the ridge walk could not communicate might finish at Level 2.

ISASI 2008 Proceedings • 65

Proceedings 2008.pmd 65 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 66 During thePeriod 1974-2006 Table 3.Aircraft Accidents CausesIncludingAllTypes ofAircraft Table 2.Aircraft Accident Occurence Rates(2001–2006) Table 1.Aircraft Accident Occurence Rates(1974–2007) tion existed andpreventive measures neededtobebuiltup. model ratherclearlyidentifiedwhere unsafeactsorcondi- to theresults oftheclassification.Through thecases,mSHEL used becauseitwasdifficulttocombinecountermeasures directly present paper, managementmwasaddingthefourfactors) 3) Whenpreventive measures were discussed,theSHELmodel(in accidents. what levelstheyattainedbothingeneralaviationandhelicopter not attainLevel4.Itdependedonthesituationsandcontents cases attainedLevel4organizational factors,butsomecasescould responsibility forthemselvesandtheyhadnosupervisors.Some accidents, supervisorylevelwasnotrelated becausethepilotshad 4 organizational factorswere adoptedsmoothly. Inhelicopter However, inthecaseofcrashed becauseoftakingphotos,Level • ISASI 2008 ISASI Proceedings 66 between preventive measures andtheresults ofanalyses. plied asonetrial.However, itisnecessarytodevelopthebridge 4. To establishpreventive measures, themSHELmodelwasap- the contentsofaccidents. 3. Itisalsosuggestedtoselecteachmodelfreely dependingon to theaccidentsonparallelandtimesequentially. 2. Itisdifficulttofigure outvisuallyhowmanypeopleare related the accidents. some casesare partiallyapplicabledependingonthecontentsof the HFACS modelisapplicableandusefulinmostcases,but accidents, commercial airlinersorgeneralhelicopteraccidents, 1. Without regard tomajororminoraccidents,aircraft orrailway Within limitedcaseanalyses,Iconclude Conclusion 1/14/2009, 8:22 AM ◆ Conversations in the Cockpit: Pilot Error or a Failure to Communicate? By Noelle Brunelle, H-53/S-61 Product Safety Team Lead, Sikorsky Aircraft Corporation, Stratford, Conn., USA

Noelle Brunelle is the H-53/S-61 Product Safety us. These internal representations are known as mental models Team lead at Sikorsky Aircraft Corporation. She has (see Reference 2). 20 years’ experience in aviation, including crew Mental models (also known as cognitive models or schema) station design and evaluation, airfield management, are developed as we explore the world around us. When we first and air traffic control, and she holds commercial and encounter an object, symbol, task, or situation, we focus our at- 10, 2008 SEPT. WEDNESDAY, instrument airplane ratings. She is currently a tention on the larger elements of its structure. Over time, we masters candidate in the human factors and systems discern more details, such as size, use, construction, and context. program at Embry-Riddle Aeronautical University with a focus on Tasks become subconscious, and key elements are arranged in cognitive and social psychology. Noelle is a past recipient of the Rudy patterns for retrieval at a later time. As our knowledge matures, Kapustin Memorial Scholarship. details needed to anticipate future behaviors are added to our overall system models. Well-developed mental models of the flight crew hears an aural warning but fails to recognize that it environment allow expert pilots to detect and place environmental signals an oxygen system malfunction. A warning light is elements and detect both emerging trends and the absence of Aperceived as a false alarm when an engine fire actually ex- anticipated signals. When like or similar events are encountered ists. During a cascading event, dozens of advisories, cautions, and again, these models are activated and guide behaviors and ex- warnings are displayed to the crewmembers, making it difficult pectations. The robustness of these models is affected by the for them to correctly diagnose the emergency. What do these amount and quality of the information communicated during three situations have in common? Each involves a breakdown in our experiences, with each repetition reinforcing the links be- communication between aircraft and the crew. tween cues (see References 3, 4). The automation installed in today’s advanced aircraft has as- The development of mental models used by pilots begins long sumed the role of a crewmember. This automated crewmember before the current flight. Knowledge and habits are communicated is responsible for monitoring aircraft status and advising the from instructor to student during training. These interactions re- pilot(s) of the status of the system. This paper will explore the sult in a framework of behavior and expectations that underlie conversations between the automation and the crew: how aircrew each subsequent flight. This framework influences preparation for mental models are developed, maintained, and used to support a flight including the type of information sought, the methods situational awareness and decision-making, current display phi- used to obtain this information, the depth of the information sought losophies, and challenges to effective communication between and the expectations and goals assigned to a flight. Once a flight aircrew and the aircraft. The author will also propose a method has begun, pilots maintain their mental models by performing a for evaluating these conversations so investigators may provide methodical scan of the outside environment, the flight instruments, feedback to designers to improve these interfaces. powerplant/drivetrain instruments, and the status of any utility systems. Information displayed by the cockpit indications is cross- Communication serves many functions—to transfer information, checked with cues from the external environment, as well as the to develop relationships, to predict behavior, to coordinate tasks sounds, smells, and vibrations generated by aircraft and are inte- (see Reference 1). Communication occurs on many levels, rang- grated into a representation of the current status of the flight. The ing from impulses sent between molecules or cells to messages current status of flight is then cross-referenced with previous indi- transferred between human actors and objects in their environ- cations and compared to predetermined expectations and goals ment. Communication begins when a message is transmitted and to forecast the future status of the flight. In the early stages of a continues through receipt, interpretation, and response. Every flight, these mental models can be closely aligned with actual events moment, millions of signals are communicated to us through but the models naturally diverge over time. sight, sound, taste, touch, and smell. Due to the sheer volume of In aviation, the use of mental models is commonly referred to these inputs, we are unable to process every message we encoun- as “situational awareness” or “SA.” ter. To compensate for the perceptual, cognitive, and memory According to one researcher (Endsley—Reference 4), situational limitations of the human mind, each of us utilizes a system of awareness is composed of five elements: geographical, spatial/ goal-driven internal representations to recognize, interpret, and temporal, system, environmental, and tactical. Geographical SA store these messages and use them to navigate the world around refers to maintaining awareness of one’s aircraft and its relation

ISASI 2008 Proceedings • 67

Proceedings 2008.pmd 67 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 68 of informationonthesedisplays followscommonguidelines. mitigate thepotentialformiscommunication, thepresentation tion, communication,andutility systems(seeReference 8).To provide aninterfaceforcrews todirect theoperationofnaviga- keypad anddedicatedkeys coupledwithacolorLCDscreen to crew. Flightmanagement systemsconsistofanalphanumeric status ofselectedaircraft andenvironmental parameterstothe onformattedpagestocommunicatethe and graphicsarranged (LCDs) installedontheinstrumentpanelthatusesymbols, text, units). Multifunctiondisplaysare full-colorliquid-crystaldisplays and flightmanagementsystems(alsoknownascontrol display aircraft systemsisaccomplished viamultifunctiondisplays(MFD) nition ofcockpitcrew (seeReference 7). these digitalsystemsare increasingly beingincludedinthedefi- tems assumetaskspreviously performedbyhumancrewmembers, agement systemsordigitalcockpits.Asautomatedcockpitsys- puter-based andmonitored systemsisprovided byavionicsman- resentations oftheexternal environment. Control oftoday’scom- be integratedintodisplays,providing increasingly detailedrep- burn, andspeed.Terrain, weather, andtrafficinformationcan puter-controlled enginesprogrammed tooptimizethrust,fuel previously actuatedbythepilothavebeenreplaced withcom- execute apre-programmed routing. Engineandfuelcontrols puters usingsatellitestotriangulateanaircraft’s positionand manually selectedbearingtoastation,isnowperformedbycom- pilots. Courseguidance,onceaccomplishedbypilotsflyinga assumed monitoringandcontrol taskspreviously performedby maintain awareness ofsystemstatus.Overtime,computershave (see References 4,6). oped toenhancethesharingofinformationamongcrewmembers communication. Crew resource management(CRM)wasdevel- progress ofthe flight.Crew mentalmodelsare maintainedby models are used toplanandcoordinate actionsandevaluatethe sibilities (seeReference 5).Duringflight, theseshared mental flight actionsdesignedtocoordinate goalsandindividualrespon- tations. Reinforcement ofthesemodelscontinuesthrough pre- is usedtodevelopshared mentalmodelsofbehaviorsandexpec- tasks. Indoctrinationtrainingprovided byacompanyorservice (both individualandteam),thestatusofrequired inflight bilities, otheractors(ATC, enemyforces), aircrew responsibilities of theflight,flightenvironment, aircraft systemsandcapa- awareness includesrepresentations ofthegoalsandexpectations members tomaintainequivalentmentalmodels.Thisshared craft, theenvironment, andothercrewmembers. ness ismaintainedwithcommunicationsamongapilot,theair- ence toataskandmissiontimingstatus.Situationalaware- SA includestheunderstandingofaircraft capabilitiesinrefer- concerned withweatherandregulatory environments; tactical function oftheoverallsystemonaflight.Environmental SAis systems butalsotheimpactofasubsystemdegradationormal- of anawareness ofthesettings,status,andfunctionsaircraft are classifiedasspatial-temporalSA.SystemSAconsistsnotonly times, elements oftime,suchasvelocityandestimatedarrival such asattitude,altitude,heading,andprojected flightpathand aircraft. Knowledgeofaflight’srelationship toelementsofspace to otherfeatures airports,waypoints,orother suchasterrain, In adigitalcockpit,communicationbetweencockpitcrew and In traditionalcockpits,pilotsmonitored dialsandmetersto Multicrew aircraft (ormultiaircraft flights)requires crew- • ISASI 2008 ISASI Proceedings 68 ill-defined cuesgeneratethesearch forpatternsandcanincrease message candelaycomprehension ofamessage.Unexpected or more difficult.Infrequently displayedcues orthosewithoutaclear When ambiguouscuesare present, patternmatchingbecomes lize establishedchecklistsorprocedures toresolve thesituation. ing mentalmodels,increasing theopportunityforcrews touti- been encountered previously can bequicklymatchedwithexist- indicated byclearlydefinedalertsorthatincludecues have cues) thattriggeraknownpattern(seeReferences 5,14).Events used (seeReferences 3,14).Matchingisdrivenbysignals(stop no clearmatchescanbefound,arandomsearch forsolutionsis ences are evaluatedfortheirrelevance tothecurrent situation.If one experienced before. Ifthisisnotpossible,previous experi- ation, anindividualattemptstomatchthecurrent situationto terns (seeReference 3).Thuswhenencounteringanunusualsitu- solved utilizingtheconsciousorsubconsciousmatchingofpat- response toanevent.Research hasshowncomplex problems are a signalwillbedetected. ing avisualsignalwithanaudiocue,canincrease theprobability 71% ofthetime(seeReference 13).Attenuation, includingpair- movements (saccades)were detectedcorrectly onthefirsttryonly verted) demonstratedthatchangesoccurred duringeye (the inabilitytodetectchangesadisplaywhileattentionisdi- will continue;research intothephenomenaofchangeblindness ing avigilancetask(seeReference 12).We alsoanticipatetrends ticipants were abletodetectanunexpected event whileperform- visible cue(inattentionalblindness)showedthatonly54%ofpar- tion ofunrelated cues.Research exploring thefailure todetecta time (seeReference 11).Focusing onataskcanaffectthedetec- from fixationreduces detectiontoaslittle2040%ofthe of vision,itiseasytosee-presenting asignalaslittle2degrees detect. Whenasignaliscloselyalignedwiththeobserver’sfield decision mustberecognized, butchangeisnotalwayseasyto tomation exist. Before adecisioncanbemade,theneedfor challenges toeffectivecommunicationbetweenaircrew andau- time asexperience withthesystemincreases. to usersbytheoperatinginstructionsandare reinforced over ority, orsequenceofoccurrence. Theserulesare communicated future systembehavior. Alertsmaybegrouped byfunction,pri- tion isperformingacorrective actiontoenable themtopredict advise crews ofachangeinsystemstatusandwhentheautoma- the current aircraft configuration.Designersmayalsoelectto approaching alimit,orwhentheinformationisnotnormalfor mally presented whenpilotactionisrequired, whena systemis sient alerts,suchaswarnings,cautions,andadvisories,are nor- size indicatesanescalationofevents(seeReferences 9,10).Tran- read inthenormaloperatingenvironment; anincrease infont numerical andtextual symbolsisselectedtoallowthembe limit hasbeenexceeded orasystemisinoperative.Thesizeof ing approached orasystemisdegraded,andred indicatesthata fies normaloperatingranges,amberindicatesthatalimitisbe- ment, differentiate, orattenuatesymbolscues;green identi- the environment orsystemtheyreference. Colorisusedtosupple- attitude indications)isprovided witharecognizable reference to of atapesignifyanincrease, whilegraphicinformation(suchas textual form.Clockwisemotionofadialandupward movement Dynamic datamaybepresented indialortapegraphic Once changeisdetected,mentalmodelsare usedtoguidethe Despite theuseofstandardized presentations andsymbology, 1/14/2009, 8:22 AM the likelihood that cognitive processes such as satisfacting (choos- Avionics, in Handbook of Aviation Human Factors, Garland D. J., Wise J. A. & Hopkin, V. D. Eds., p. 549-566, Lawrence Erlbaum Associates, Mahwah, ing the first option that meets minimum matching criteria) and N.J. confirmation bias (affirming prior interpretations by discount- 8. Sikorsky Aircraft (2005) Rotorcraft Flight Manual, Sikorsky Model S-92A. ing or dismissing conflicting information) both of which may delay 9. Sanders, M.S. & McCormick, E.J. (1993) Human Factors in Engineering and Design, McGraw-Hill, New York. or prevent the correct assessment of a situation (see References 10. Department of Defense (1999) Military Standard 1472F: Department of 6, 15). Previous “social” interactions may make otherwise clear Defense Design Criteria Standard: Human Engineering. indications ambiguous; less emphasis is placed on an alert known 11. Mack, A. & Rock, I. (1998) Inattentional Blindness: Perception without attention, in Wright, Richard D (Ed). Visual attention, p. 26-54, Oxford to have false indications, while a highly reliable alert reduces University Press, New York, N.Y, U.S. monitoring of the indicated parameter (Reference 16). Choices 12. Simmons, D.J., & Chabris, C.F. (1999) Gorillas in our midst: sustained made early in an event impact the choices available as the event inattentional blindness for dynamic events, Perception, 28, 1059-1074. 13. DiVita, J., Obermayer, R., Nugent, W. & Linville, J.M. (2004) Verification unfolds, and the longer it takes a crew to recognize that an error of the change blindness phenomenon while managing critical events on a has been made, the more difficult it is to recover once the correct combat information display, Human Factors; 46:2, p. 205-218. course of action is recognized. 14. Rasmussen, J. (1993) Diagnostic Reasoning in Action, IEEE Transactions on Systems, Man and Cybernetics, 23(4), p. 981-992. Unusual inflight and on-ground events require operators to 15. Sternberg, R.J. (1999) Cognitive Psychology, Second Edition, Harcourt Brace respond quickly with limited or partial information while in a College Publishers, Orlando, FL. dynamic environment. The quality of these responses is depen- 16. Meyer, J. & Bitan, Y. (2002) Why better operators receive worse warn- dant on the crew’s ability to detect, assess, and appropriately re- ings, Human Factors, 44:3, p. 343-353. spond to signals present in the environment. The consequences of making incorrect decisions can be dire: miscommunication APPENDIX 1 10, 2008 SEPT. WEDNESDAY, regarding heading, altitude, or location could result in controlled Part 1: Available Cues flight into terrain while misdiagnosis of a system malfunction What cues were available to the crew during the event? could result in a delayed or incorrect response, causing damage • Describe the pertinent signals. These descriptions should in- to the aircraft or injury to personnel. It is important to recognize clude the icon/text used, whether the cue was visual/aural/other, that selection of an improper course of action may not be the location of the cue, whether the cue was attenuated, coupled with result of poor decision-making by the crew, but rather the result another cue, constant or intermittent and/or displayed in more of the displays inaccurately communicating the current situation. than one location. Each accident, incident and unusual event provides the opportu- When did the cues appear (or extinguish) during the time line of nity to evaluate the transfer of information between the aircraft events? and the crew and the strengths and weaknesses of these interac- • Lay out signals along a chronological scale tions. My challenge to you, as safety investigators, is to use these • Include: whether the information updated during the course of opportunities to gather data that can then be used to improve events (if so how rapidly), whether the changes were attenuated, cockpit interfaces. whether the location of the information was static or dynamic, and Appendix 1 presents a series of questions for use when ex- (if available) what rules drove the presentation of the data? ploring the effectiveness of communication between an aircraft Were any distractors present during the event? and the crew. These questions are organized into four sections. • Describe each distractor The first section looks at the cues available to the crew, when • Was the distractor presented in visual, audio, tactile (vibration), they were available, and the quality of the signals presented. scent form? The second investigates what cues the crew needed to success- • Were threats such as smoke, fire, extreme weather conditions fully resolve the event and whether the crew detected, inter- present? preted and responded to these cues. The third is concerned • Were any social influences (provided by other crewmembers, with previous interactions between the crew and this and other agencies, or culture) in play? display interfaces. The fourth presents concluding questions. Was a checklist available to manage this event? This list is not intended to be all inclusive; it is offered as a Did the cues presented by the displays accurately reflect the sta- guide to increase the understanding of communication between tus of the aircraft? display interfaces and the crew. ◆ Did the cues presented by the displays support the correct decision/response path? References Were ambiguous indications displayed during this event? 1. Kanki, B.G. & Palmer, M.T. (1993) Communication and Crew Resource Management, in Crew Resource Management, Weiner, E.L., Kanki, B.G. & Helmreich, R.L. Eds, p. 99-136, Academic Press, San Diego, CA. Part 2: Crew Response 2. Besnard, D; Greathead, D. & Baxter, G. (2004) When mental models go What cues did the crew need to resolve (detect/diagnose/respond wrong: Co-occurrences in dynamic, critical systems, International Journal of to) this event? Human-Computer Studies, 60, 117-128. 3. Klein, G. (2003) The Power of Intuition, Currency Doubleday, New York, • Can include digital display or other system interfaces, aircraft, N.Y. and environmental cues 4. Endsley, M. (1999) Situational Awareness in Aviation Systems, in Hand- Were these cues available (generated by aircraft or in environment)? book of Aviation Human Factors, Garland D.J., Wise J.A. & Hopkin, V.D. Eds., p. 257-276. Lawrence Erlbaum Associates, Mahwah, N.J. • If not why? (Can include parameter not monitored, system 5. Orasanu, J.M (1993) Decision-making in the cockpit, in Crew Resource inoperative) Management, Weiner, E.L., Kanki, B.G. & Helmreich, R.L. Eds, p. 137-172, If available, was the cue detected? Academic Press, San Diego, CA. 6. Hutchins, E. (1995) Cognition in the Wild, the MIT Press, Cambridge, MA. • If not, why? (Can include cue was presented outside visual 7. Hammer, J.M. (1999) Human Factors of Functionality and Intelligent range, on MFD page not selected by crew, crew unaware infor-

ISASI 2008 Proceedings • 69

Proceedings 2008.pmd 69 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 70 What experience level/familiaritywiththeinterfacedidcrews have? (Include socialinteractionssuchasfalsealarms) What previous experiences hadthecrew hadwiththedisplays? Part 3:Previous Interactions Ifnot,why? • Did thecrew selecttheappropriate response? combined intoasinglealert) recognized, iconwasinfrequently observed,severalsignalswere mal reaction times,meaningoficon/phraseologywasnoteasily Ifnot,why?(Caninclude presentation didnotallowfornor- • If detected,wasthecuecorrectly interpreted? extinguished masked) orwasotherwise mation wasavailable,alerthadbeeninadvertentlysilencedor • ISASI 2008 ISASI Proceedings 70 fective communication? Did anyelementsofthedisplay/interfacecontributetoef- tween thecrews andthedisplays? Were there anyotherobstaclestoeffectivecommunicationbe- Part 4:ConcludingQuestions aircraft, inasimulator, oranecdotally? Was scenariosomethingtheyhadencountered before beitinan it wasdetected? Did crews trust/distrustoraccept/dismisstheinformation once the aircraft? Did cuesusedduringsimulatortrainingmatchthoseon current How wascrew withthisinterface? • Did crew haveexperience onmore thanoneinterface/aircraft? 1/14/2009, 8:22 AM Cockpit Information Recorder for Helicopter Safety By Roy G. Fox (M03514), Chief, Flight Safety, Bell Helicopter Textron Inc., Fort Worth, Tex., USA

Roy Fox is chief of Flight Safety at Bell Helicopter with 42 years of experience in helicopter safety. He directs system safety engineering and other flight safety functions and directs the worldwide accident investigations of all civil and military Bell helicopters and tiltrotors. Fox is a helicopter accident reconstructionist. He headed up the helicopter industry committees of SAE, AIA, AHS, and HAI and lectures worldwide on accident investigation, crash survival, human perfor- 10, 2008 SEPT. WEDNESDAY, mance, and other safety issues. He has provided technical papers in all aspects of aviation safety, including design, accident investigation, data analyses, human error, crash survival, and certification issues. He is a founding member of the International Helicopter Safety Team.

Abstract Helicopter safety has stagnated with roughly the same number Figure 1. Worldwide helicopter accidents/year. of civil accidents worldwide from year to year in spite of the annual introduction of new technology and new production heli- around the world via the South and North Poles in 2006/2007 copters. Helicopter accident investigations are stymied by infre- (helicopter world record). The CIR flight data monitoring pro- quent on-site accident investigations and limited information. gram will allow an operator to proactively use the CIR to identify The few component failure investigations are done well, since trends, standardize operations, and assist in pilot training/stan- there is hard evidence to examine that allows engineers to un- dardization. This paper describes the development and planned derstand and duplicate/verify those failures. The remaining 80% CIR use for the more than 5,000 Bell 206/407 helicopters operat- or more of accident causes are human related or totally unknown. ing worldwide. The CIR does not replace any FDR/CVR required Many helicopter accident causes are based on circumstantial in- by regulation, but provides the information needed for accident formation rather than on documented facts. Accident causes such investigation for the vast majority of helicopters not required to as “power loss for unknown reason” will repeat themselves year have an FDR. A CIR will reduce the time/cost of accident investi- after year. There is little detailed information due to the lack of gations, identify the actual causes, expedite corrective actions, and recorded data. Conventional digital flight data recorders (DFDR) reduce subsequent accidents and injuries in helicopters. are not required by regulations nor economically feasible for 95% of helicopters. Digital instruments/sensors needed for DFDR in- Background puts do not exist on the vast majority of the civil helicopter fleet. Helicopter safety has improved very little in the last decade or Bell has designed a new low-cost, non-intrusive, generic approach so. This is true in the civil and military fleets of the United States of a cockpit information recorder (CIR) specifically for the exist- and in other countries. The number of accidents each year for ing Bell helicopter fleet. The CIR meets the needs of helicopter U.S.-registered helicopters, U.S. military services, and their for- investigations and helicopter crash survivability criteria. A CIR eign counterparts is shown in Figure 1. Worldwide, the helicop- consists of a high-resolution digital camera, GPS, self-contained ter industry averages about 1.5 accidents per day. Accident counts sensor package, and a microphone. Data is stored in an external will increase as new aircraft are added to the fleet, but the num- crash-survivable memory unit. The external memory unit has a ber of aircraft also goes down from aircraft that are destroyed in field-removable memory card that can be inserted in a laptop PC accidents each year. Since the majority of the aircraft are in the for on-site accident investigation analysis and flight path recre- fielded fleet, significant improvement in helicopter safety must ation. Cockpit images at any point of the accident flight can be address the existing aircraft in the fleets. In reality, the aircraft reviewed/analyzed to read instruments, pilot actions/inactions, themselves are not responsible for 80% of the accidents. We must and timing issues, and to document the flight and emergency try something different and work on all causes. The number of procedures followed. CIR provides more information needed for accidents per year is a poor metric, as it does not include the helicopter accident investigations than DFDRs. Low cost is en- effects of the number of flight hours of exposure. The worldwide sured by a generic set of components that can be applied to vari- military and civil helicopter flight hours are unknown. A pro- ous models with minimal modification. gram has been initiated to develop and track worldwide civil he- A prototype CIR was installed on the Polar First 407 that flew licopter flight hours. This “data mining” computer program has

ISASI 2008 Proceedings • 71

Proceedings 2008.pmd 71 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 72 rate reduction waspossible(Reference 4).The80%accident previous studyhadindicatedthat an80%helicopteraccident ing thehelicopteraccident rate by80%in10years(2016).A national HelicopterSafetyTeam (IHST)withthegoal ofreduc- copter safetyimprovements. Thisagreement formedtheInter- licopter industrymustdosomethingtoward significantheli- (Reference 3).There wasanagreement thattheworldwide he- industry organization, andoperatorsfrom variouscountries services, originalequipmentmanufacturers (OEM),helicopter Montreal, Canadaincludedregulators, investigators,military do. ThisInternationalHelicopterSafetySymposium in ber 2005todiscusshelicoptersafetyandwhattheindustry could to flyandland.Thehelicopterindustrygottogetherin Octo- pansion ofthehelicopterindustryandwhere theyare allowed The stagnationofhelicoptersafetyhasbeenlimitingthe ex- IHST fort willhelptoachievethisrequirement. quency. Thus,recording flighthoursusingthedataminingef- of ratechangedifferent problems andtheirrespective fre- achievement oftheIHSTgoalwillrequire accuratemeasurement tion, andthusisthepublicperception ofhelicoptersafety. The data ontheHAIwebsiteisprimarypublicsource ofinforma- survey flighthourestimate(Reference 2).However, thisaccident due tokithelicopterinclusionandsomeinaccuraciesintheFAA ments. There are someerrors withinthenumberofaccidents, different approaches are neededtomake significantimprove- injury isnotimproving overthe10-year period.Again,some RFI showninFigure 2indicatedthattheindividualriskoffatal people onboard allaccidentswhowere exposed toharm).This times probability offatalinjury(numberfatalities/number injury (RFI)isaproduct ofaccidentrate(accidents/flighthour) has notbeenimproving. Theindividualoccupantriskoffatal ary 2006isshowninFigure 2(Reference 1).Theaccidentrate 10-year periodpriortotheinitiationofIHSTeffortinJanu- safety. TheU.S.-registered civilhelicopteraccidentrateoverthe helicopter isanindicatorofpublicawareness toward helicopter tracked. are beingaddedtothedataminingprogram andare being tered helicopters,pistonandturbinepowered, inallcountries copter SafetyTeam (IHST)effort,allmanufacturers’ civilregis- years. AspartofBell’sparticipationintheInternationalHeli- been usedbyBelltotracktheflighthoursofitsturbinefleetfor rates priortoIHST. Figure 2.U.S.-registered helicopteraccident The accidents/100,000flighthourrateofU.S.-registered civil • ISASI 2008 ISASI Proceedings 72 problem categories. Figure 3.JHSAT CY2000percentage ofsafety Figure 4.Worldwide civilhelicopters. goal isan80%accidentratereduction forallcivilhelicopters tion in10yearsforcommercial operations.IHST’s aircarrier hadthegoalofan80%fatalaccidentratereduc-copters. CAST 121 operations)andmodifiedtheprocess tobeusedinheli- approach forlarge(CAST) transportairplanes(Part aircarrier the public.TheIHSTtookCommercial Aviation SafetyTeam services are secretive anddonotrelease theiraccidentdatato different countriesmayornotparticipate.Manymilitary civil andmilitaryhelicoptersworldwide,theservicesof proper interventionsare used.Althoughthegoalisfor both rate reduction isaveryambitiousgoalbutachievableifthe 1/14/2009, 8:22 AM effects of the various interventions. The U.S. JHSAT has fin- JHSAT Interim Recommendations ished its first report for the CY 2000 U. S.-registered helicopter accidents (Reference 5). The JHSAT is conducting a similar 1. Promote Safety Management Systems (SMSs) analysis for CY 2001 with more detailed analyses and compari- 2. Improve NTSB information son of changes from year to year. This annual JHSAT analysis 3. Develop accurate helicopter flight hours process will continue to occur until the target year of CY 2016. 4. Establish a helicopter safety website The IHST requested some interim recommendations based 5. Proximity detection equipment on previous studies so that the JHSIT implementation process 6. Use flight recording devices and cockpit image could be developed and functional in time for the first JHSAT recording systems report. These recommendations were major areas of improve- 7. Improve pilot aeronautical decision-making ments needed, as seen by previous studies. This list of interim recommendations is Table 1 (Reference 6). Table 1. 2006 Interim Recommendations List Note that the sixth recommendation states: “Use flight recording devices and cockpit image recording systems.” The cockpit information recorder (CIR) discussed in this paper is intended to specifically address this recommendation. The bottom line in helicopter accident investigation is that we rarely know for sure what happened, other than mechanical failures, which are easily identified and documented. Many helicopter accident causes are de- 10, 2008 SEPT. WEDNESDAY, duced from circumstantial evidence or perhaps by comparison to an earlier accident that had a similar scenario. The helicopter industry needs the facts surrounding an accident, not opinions.

JHSAT The first JHSAT report of CY 2000 (Reference 5) broke accident Figure 5. Worldwide helicopter accident causes. cause factors into standard problem statements at the detail level and rolled up into larger problem categories. Figure 3 shows the percentage of helicopter accidents in major problem categories. It was not surprising that “Pilot Judgment and Actions” was the most prominent factor and was present in 78% of the accidents. The percentage varies a little over the years but has always been the largest factor. It is also the most difficult one to mitigate. The second most frequent problem was “Data Issues,” which was in 60% of the accidents. Some of this was due to the limitations of the investigation and that information was not available to understand what really happened in the cockpit and when. The CIR purpose is to document what actually happened in the cockpit, including instrument values, lights, noise, pilot actions, and inactions, when it happened, how the emergency was handled, and so on—basically, most of the information needed to accomplish Figure 6. 206/407 safety initiative study. the accident investigation other than parts examination and site information (large and small, piston or turbine powered) and in all types of (wreckage diagram, debris paths, ground scars, etc.). operation from private to offshore air taxi. It includes all acci- The JHSAT CY 2000 report (Reference 5) was focused on only dents, not just those in which one of the occupants dies. It is U.S.-registered helicopters. However, Figure 4 from that report critical that the IHST be data driven rather than opinion driven, shows that the U.S.-registered helicopters account for 50% of the which has been a major driver in helicopter safety for years. world civil registered helicopters. Although the causes of acci- IHST formed two subgroups, the Joint Helicopter Safety Analysis dents will be similar worldwide, the regulatory/control environ- Team (JHSAT) and the Joint Helicopter Safety Implementa- ments may be different. Regardless, implementation is specifi- tion Team (JHSIT). JHSAT analyzes accident data for root causes cally a regional effort, not a single worldwide regulation. The and potential interventions/mitigations and will measure the IHST is international in scope so there are JHSATs and JHSITs

ISASI 2008 Proceedings • 73

Proceedings 2008.pmd 73 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 74 in oneoftheotherlarge causefactor“buckets.” Having17%of Unknown are thoseaccidentswhere littleisknown tobeincluded ness (Part 27or29)for whichtheairframeOEMisresponsible. remainder ofthehelicopteris noted asnon-engineairworthi- (Partthe enginedesignandcontinuedairworthiness 33). The as theengineOEMhastypecertificateandisresponsible for areaimproved. isaseparateairworthiness Engineairworthiness crashed anyway. Assuch,theOEM’sprocedure mayneedtobe A CIRmayvalidatethatapilotusedtheproper procedures and Models 206sin2009. Certificate (STC)onBellModel407bytheendof2008and on present inwhichBellplanstohaveaCIRSupplemental Type CIR, vestigation tool.Thispaperherein describesthatjourneytothe features toincrease operatoruseratherthanjustanaccidentin- The CIRhasprogressed from concepttoareality andhasadded Reference 7.ThatCIRusesacamera,microphone, andaGPS. the cockpitwithoutrelying ontheaircraft systemswasdescribedin information recorder (CIR)thatgathersinformationinandaround really happening in thecockpit.Agenericconceptofacockpit low-cost meansisneededtodocumentandunderstandwhatwas a procedure) are actuallyworkinginthefieldedfleetoperations.A improvements ortheabilitytoknowifparticular changes(suchas proof. Thisdearthofknowledgeprecludes makingsignificant stantial withpiecesoffacts,becausethere islittletonodocumented beginning ofaviation.Mosthumanerrors accidentsare circum- age hasnotchangedsignificantlysincethefirst10accidentsin tion ofhumancausalfactorsinvolvespilots;thisrelative percent- failure.man errors) andisnotanairworthiness Thelargest por- then fails,thatisconsidered amaintenanceerror (oneofthehu- ure. However, if themechanicfailstoputoilingearbox,which followed byfailure fail- ofthegears—thisisstill anairworthiness ness failure. Ifagearboxsealfailsduringflight,sothatoilislost, gearbox withproper oil,etc.,failsinternally; suchisanairworthi- certificated. For example, animproperly manufactured gearina not happenifthepartstillmeetsFAR requirements asoriginally cally, failure anairworthiness isapartfunctionalfailure thatshould ures, eventhoughtheymightbeelectrical,hydraulic,etc.Basi- failure,tion forairworthiness whichsomemightcallmaterialfail- as showninFigure 5.AW isanabbrevia- analyzed toidentifythebasiccausalareas, (the last10years).Theseaccidentswere January 1998through December2007 ter accidentsworldwidefortheperiodof There were 3,705civilregistered helicop- accident causes Worldwide civilhelicopter on IHSTwebsitewww.ihst.org. tralia. IHSTinformationcanbefound Canada, Europe, Brazil,India,andAus- stages ofmaturityintheUnitedStates, far, there are regional JHSATs invarious ferent JHSATs ispartoftheIHST. Thus ideas andlessonslearnedfrom thedif- mon JHSAT analysisprocess. Sharing accident dataforanalysisusingthecom- that willusetheircountrieshelicopter being setupindifferent countries/regions The CIRwillprovide thefactsofwhatdidornothappen. • ISASI 2008 ISASI Proceedings 74 Figure 7.206/407CIRpotential withinU.S.fleet. lion flighthours.Asmentioned earlier, anyhopeofmeetingan cidents for2004to2005was conducted. Thisrepresented 5mil- determine whatwasneeded, an analysisofBellcivilturbinesac- an internalgoaltoreduce our accidentratesby80%2016.To must atleastmeetan80%reduction foritshelicopters.Bellhas nearest competitor. IftheIHSTworldwidegoalistobemet,Bell wide civilhelicopterfleet,whichissignificantlymore than the are inforeign countries.Bellsaccountfor35.5%oftheworld- dents occurintheUnitedStates,whereas 61.7%oftheaccidents ters incivilandmilitaryapplication.Only38.3%ofBell acci- Bell Helicopterhasanactivefleetofmore than15,000helicop- Bell 80%reductiongoal Figure 8.CIRcomponentlocations. factors except thosewhere theaircraft/CIR wasnotrecovered. available. TheCIRwilleventuallyeliminatenearlyallunknown occur yearafteryear. We alldothebestwecanwithwhat we have claimed “powerlossforunknownreasons” accidentscontinueto is correctable, asone cannotfixan“unknown” factor. These causefactor.lied withinengineairworthiness However, nothing dent reported cause of“powerlossforunknownreasons” istal- factors, theactualroot causeisunknown.For example, anacci- cidents willcontinuetorecur yeartoyear. Inmanyoftheknown the accidentcausesunknownmeansthatthosesametypesofac- 1/14/2009, 8:22 AM 80% reduction means a focused effort on fielded aircraft. What- distinction between Terrain Awareness Warning System (TAWS) ever is done in the field can be fairly quickly applied to a produc- for strikes above 150 feet and those obstacle strikes below 150 feet tion aircraft. Further, 82% of Bell’s civil turbine fleet are Models (46 m) was necessary, as TAWS is an aircraft-based GPS location 206/407; thus initial safety focus is on those specific models. Since being compared to the terrain elevation map database which is at this fleet is extremely large (more than 5,000 aircraft), interven- the rocks, not the top of 120 foot (37 m) tall trees. An active onboard tion cost per aircraft could be less when compared to a relatively obstacle proximity detection system is needed for the takeoff, land- small model fleet of, say, 200 aircraft. This large fleet can also ing, and low-level maneuvering, when is the region below the 150 provide the largest accident reduction in the shortest time. Fur- foot (46 m) above ground level. ther, by developing low-cost generic approaches for the 206/407 fleets, the same system could then be used on all other Bell mod- CIR potential influence on U.S. helicopter fleet els, for production and retrofit with compatibility checks and Figure 7 shows the models and their percentage of helicopters minor mounting and wire run changes. on the U.S. registry for those models with at least 1% of the U.S. fleet. Note that the 206 JetRangers, 206 LongRangers, and 407s Bell 206/407 safety initiatives account for 22.5% of the U.S. fleet. CIRs on these models can The 2-year study was refined to include only the 206/407 series acci- make a significant difference in accident rate reduction. It is an- dents and focused on the prime mitigation needed to eliminate ticipated that at least one other manufacturer is considering simi- those accidents. Generally there are several mitigations that could lar CIR means of recording data on non-digital helicopters (Ref- help a particular accident. The prime mitigation is the one with the erence 8). best chance of mitigating that accident. Figure 6 shows the results of 10, 2008 SEPT. WEDNESDAY, the 206/407 safety initiatives. The most significant mitigation is the CIR is not regulatory cockpit information recorder (CIR) found in 26.3% of the accidents, There is generally a lack of knowledge of what happened and because we don’t really understand what happened in those acci- when it happened for helicopter accident investigations other dents. The second mitigation, which accounted for 10.2% of the than those due to a broken part. A CIR is a low-cost approach to accidents was the Helicopter Operation Monitoring Program correct that lack of knowledge. In general, the documentation (HOMP), also called flight data monitoring (FDM), or FOQA in the needed includes airline world. FDM includes operator trending and use of their re- • what the pilot can see, his actions/inactions, timing of actions, corded data. CIR can provide a proactive means to reduce accidents partial incapacitation signs, and potential interference by others. as well as support an accident investigation. The next two mitiga- • instruments values, cautions/warnings and other indicators. tions “Targeted Pilot Training” and “Improved Autorotation” are • key helicopter parameters. part of the CIR system, as they allow us to target specific accident • ambient noises from the helicopter and crew. scenarios documented with the CIR and feed those scenarios into • aircraft flight path (GPS) and attitude relative to terrain. the pilot training, which includes autorotation training. Those four • internal cockpit environment changes (smoke, windscreen fog- items will use the CIR information. The fifth line was “Wire Strike ging, black glass displays, loose FOD, flying debris inside). Protection System (WSPS),” which can handle the majority of the A flight data recorder (FDR) or digital flight data recorder wire strike accidents. WSPS kits are available and installed on many (DFDR) could record some of this information, but both of these helicopters today. WSPS are needed on all helicopters that operate require sensors for input signals. The latest glass cockpit aircraft where wires exist. Those five items are Bell’s Tier 1 (highest prior- might have those DFDR inputs available, but the vast majority of ity), accounting for 51.1% of the 206/407 accidents. helicopters do not. Thus the DFDR signals would require the ad- Tiers 2 and 3 will be addressed later, after we get the CIRs in the dition of new sensors and recertification of all related certificated field. Tier 2 includes Helicopter Vibration Monitoring for 3.6% of systems. DFDRs are far too expensive and heavy to be a realistic the causes. The Performance Situation Indicator (PSI) is an indica- approach for the entire helicopter fleet. The specific requirement tor of how close the pilot has placed the aircraft to the edge of that mandates FDR/DFDR in the United States is the Code of Fed- aircraft performance and predictive of when the pilot may exceed eral Regulations, specifically 14CFR135.152, which states the different performance envelopes if no corrective changes are made. In essence, it will tell you ahead of time as you approach the Sec. 135.152 Flight recorders. edge of the cliff, not warn you as you go over the cliff edge. PSI (a) No person may operate a multiengine, turbine powered airplane or (13.1% of accidents) provides the pilot with an earlier indication to rotorcraft having a passenger seating configuration, excluding any pilot allow earlier corrective pilot actions, such as a go-around decision. seat, of 10 to 19 seats, that is brought onto the U.S. register after October Performance limits do not just consist of engine power limits and 11, 1991, unless it is equipped with one or more approved flight record- may change throughout the flight. Enhanced Vision Systems (EVS) ers that utilize a digital method of recording and storing data, and a are infrared systems that aid in seeing during low-visibility condi- method of readily retrieving that data from the storage medium. The pa- tions such as night, brownouts, and whiteouts. Several vendors are rameters specified in Appendix B or C, as applicable, of this part must be developing EVSs which could help in 11.7% of accidents where recorded within the range accuracy, resolution, and recording intervals visibility loss is an issue. The last item in Tier 2 is tail rotor strikes, as specified. The recorder shall retain no less than 8 hours of aircraft at 2.9% of accidents. Several companies are investigating proxim- operation. ity detection systems but none have yet developed systems with b) After October 11, 1991, no person may operate a multiengine, tur- reasonable cost and weight. The tail rotor strike is a low-speed bine-powered airplane having a passenger seating configuration of 20 to hover maneuvering issue rather than a far-distance high-speed 30 seats or a multiengine, turbine-powered rotorcraft having a passen- detection issue. Tier 3 items will be addressed after Tier 2. The ger seating configuration of 20 or more seats unless it is equipped with

ISASI 2008 Proceedings • 75

Proceedings 2008.pmd 75 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 76 highresolution colordigitalcamera(day/nightcapability). • mal modification(wiringand mounting).ACIRconsistsof a genericsystemthatcanbeadded todifferent modelswith mini- tive safetyactivities.CIRisalso anassetprotection device.CIRis monitoring forstandardization ofoperationsand otherproac- vestigations andprovides capabilityfortheoperatortodotrend obtains informationneededforon-sitehelicopteraccident in- The CIRisanelectronic dataacquisitionandstoragesystemthat CIR description beyond regulator requirements. same. CIRisasignificantadd-onsafetyfeature thatgoesfar on aflight,thesafetyofaircraft ascertificatedisstillthe not degradeexisting aircraft safety. IftheCIRfailstofunction are limitedtothosethatare neededtoensure thattheCIRdoes ter industryneedsincludingcrashsurvivability. Certificationtests certificated parts),lowcertificationcost,andmeetsthehelicop- CIR isthatithaslowcomponentcost(nothigh-dollaraviation country butwouldinothercountries.Thekey tothelow-cost significant helicopteraccidentsreductions willnotoccurinthat forward intothefieldedfleetforthatparticularcountry. Thus meet TSOrequirements, itwouldprevent theCIRfrom going corder. Ifagovernmentmandate were madetoforce theCIRto applicable tothehelicopterfleet,whichneedsalow-cost re- investigation needsthatdrove theTSOrequirements are not and encouragesvoluntaryfitmentbyoperators.Large airplane CIR systemthatmeettheneedsofahelicopterinvestigation such asTSO-C124borTSO-C176.Bellmusthavealow-cost that theCIRwillnotbetoanytechnicalstandard order (TSO) be thousandsofmilesaway. Afundamentaldrivingfactoris before anFDRhasmadeittothenearest FDRlab,whichmay those systemsthatare functioningproperly. Thismayoccur pleted whileonsiteandeliminatefrom furtherinvestigation the CIRwouldallowaccidentinvestigationtobenearlycom- MMEL itemthatwouldcauseaflightdelay, etc.Inmanycases, safety equipmentbeyondregulatory requirements andisnota CIR couldbeaddedonsuchaircraft buttheCIRis withaFDR, the fleet(95%)nothavingthoseregulatory requirements. The where suchisrequired byregulation. TheCIRisfortherest of signals thatwenttothedisplay. display byapilotisnotrecorded onlytheelectronic inaFDR, accident investigation.For example, whatisactuallyseenona they donotcoveralloftheinformationneededinahelicopter certainly canhelpinaninvestigationiftheyare installed,but add asensorandgetthatnewinstallationcertified.FDRsystems have anelectricalsensorforoneoftheseparameters,youto channels ofinputparametersthatmustberecorded. Ifyoudon’t thereoperate under14CFR135.IfyoudohaveanFDR, are many Further,with aFDR. notallmulti-turbinehelicopteroperators senger seats.Thusthevastmajorityofhelicoptersisnotequipped end of2005are multiturbinehelicopterswith10ormore pas- Only5.9%ofallhelicoptersontheU.S.registryFDR. asofthe ing under14CFR135),thathelicopterisnotrequired tohavean more passengerseatsforhire intheUnitedStates(e.g.,operat- from thestoragemedium. recording andstoringdata,amethod ofreadily retrieving thatdata one ormore approved flightrecorders thatutilize adigitalmethodof The CIRisNOTareplacement foranFDR/DFDRorCVR Unless theoperatorusesamultiturbinehelicopterwith10or • ISASI 2008 ISASI Proceedings 76 during NVGflight. Figure 10.CIRimageunderlow-lightcockpit Figure 9.CIRcameraimage. tery bus.TheCIRpowersup whenbatterypowerisappliedand with theaircraft isthrough a28VDCcircuit breaker offthebat- lines totheairspeedindication system.Theelectricalinterface by thepilot.TheADAHRShas aconnectionintothepitotstatic The displayforthisADAHRSunitiscovered andnot tobeused aviation ADAHRSunitisusedasasensorpackageforthe CIR. 206/407, andthecameraissimilartothatinFigure 8.Asport tem (ADAHRS)sensorpackageare mountedinthenoseofa tor use. anadditionUSB2.0connectorforfuture expansion oropera- • ground stationsoftware installedonalaptopPC. • operatordownloadUSB2.0portandCIRstatuspanel. • crash/fire survivableexternal memoryunit. • ADAHRSsensorpackageforinput. • global positioningsystem(GPS)antennaandcard. • functions. CIRboxwithprocess powerandprograms tocontrol allCIR • area microphone foracousticalanalysisofbackground noise. • The CIRboxandAirDataAttitudeHeadingReference Sys- 1/14/2009, 8:22 AM CIR playback The ground station software developed for the CIR operates on a laptop PC. Once the compact flash (CF) card is removed from the external memory unit (under IIC direction) and inserted into the laptop PC at the accident site, the software provides a screen like Figure 11. All data are indexed to the common GPS time. The lower right screen panel is the actual image taken. The recorded parameters from the sensor package and the instrument values derived by an optical recognition program (patent pending) are displayed in the simulation on the left side screen panel on a simulated instrument panel. The upper right screen panel is the typical strip chart display of multiple parameters (operator selected). All three screen panels are synchronized so the strip chart, instrument panel, and actual image are from the same GPS time. Figure 11 shows the cockpit view in the left panel, but the operator can also toggle to views from outside the aircraft over simulated terrain. The flight path is exportable as a GPX file. A standard GPX file of Figure 11. CIR ground station that flight can also be displayed on Google®Earth or other ter- 10, 2008 SEPT. WEDNESDAY, software display on laptop rain software programs when the investigator has access to the (above). Figure 12. EMU and Internet. It can also be view with any flight simulation software Prototype EMU (left). that accepts files with a .GPX extension, such as the Appareo Flight Evaluator software. The external memory unit is not accessible to the operator and should only be opened in the event of an accident investigation under the authority of the investigator-in-charge (IIC). Flight data stops when the power is removed. There is no Remote Indepen- monitoring activities are day-to-day operations not related to an dent Power System (RIPS). Helicopter accidents where DC power accident investigation and do not involve disassembly of the exter- is lost prior to impact are extremely rare to nonexistent; thus nal memory unit. For the normal FDM use, the CIR stored data there is no needed for supplemental electrical power. can be downloaded easily using a flash drive into a USB 2.0 port accessible to the operator after the flight. The normal FDM down- Seeing what happened loads would include all parameter data and GPS data, which will The primary means to acquire information is a still digital color download quickly. If desired, the same USB port can be used to camera. The present surveillance digital camera provides 1,280 download the audio and image files, but the download time will be × 1,024 pixel color photos of the instrument panel, pilot’s flight considerably longer due to the file size of the images. control sticks and pedals, and pilot actions. The camera has automatic light adjustment from extreme bright (which is com- CIR recorded data mon in polar regions) to the low-light environment in night The following data are recorded and the latest are retained vision goggles (NVG) equipped helicopters. The target image whereas older data are overwritten. All data are stored on a com- of Figure 9 is a single frame image from the prototype CIR pact flash card inside the external memory unit. installed on the Polar First 407 that flew around the world (over • Images. The most current 1 hour of images taken and stored both poles), covering 32,206 nautical miles (59,645 kilometers) at three frames/sec. The next 3 hours are stored at one frame/sec. at its May 2007 completion. Images can be converted to a movie Thus there will be images for the last 4 hours of flight/operation. for general understanding of what is occurring. Single frame- • Audio. The area microphone will record ambient sounds for to-frame examination is useful at specific points of interest. Al- the last 4 hours. though images are visible through the chin windows and • GPS data. The GPS data for the last 25 hours is recorded at 1 windscreen, that information is secondary to the instruments Hz. and internal cockpit information. Some variance due to cam- • Parameter data. The parameter data for the last 25 hours is eras may change this target view somewhat, but the basic area recorded at 3 Hz and in some cases higher. of interest is Figure 9. Camera frame rate testing was done to find the minimum ac- Camera focus and automatic light adjustment is set on the ceptable frame rate to minimize electronic storage needs. It was instrument panel to ensure reading of instruments. This is espe- found that one frame per second was acceptable and would catch cially critical when the outside is extremely bright. The camera people quickly pointing or touching items on the instrument can also handle low-light situations. An example out of a proto- panel. Bell elected to go with three frames per second for the type CIR installed on Bell night vision goggles (NVG) training latest hour, and only retain one frame per second for the older flight is seen in Figure 10. Reading instruments under NVG in- images. Faster frame rates are possible, but lower resolution is strument lighting is possible, whereas the locations of the con- needed to compensate for file size. Higher resolution images are trols are not reliable. It is sometimes possible to enhance indi- a key driver for those few critical frames, and thus was the prior- vidual slides and determine control stick locations. ity over frequency of images.

ISASI 2008 Proceedings • 77

Proceedings 2008.pmd 77 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 78 Over theyears,there were Model206accidentsinwhichthepi- CIR potentialuse—Example 1 site forCIRownerstouseand coordinate information withBell. agement System(SMS)program. Bellwillprovide aweb-based fore anaccidentoccurs.FDMispartofacompanySafetyMan- tor tocorrect anyinappropriate flyingoroperationalaspectbe- for operationsstandardization. Monitoringwillallowtheopera- toring forparts,flightprofiles, etc.,andiscriticalinformation monitoring (FDM)program. Downloadeddataallowtrend moni- The CIRdatarecorder allowsanoperatortohaveaflight data Flight datamonitoring that atleast30minutescanbeachievedontheEMU. test thatwasstoppedbefore reaching alimit.Itisanticipated has notyetbeenfire tested,butwillfarexceed thesoftdrinkcan tion, withatemperature of350°F(177°C).ThefinalCIR EMU (1,177°C). Thetestwasterminatedduetopropane tankexhaus- time isshowninFigure 13.Theflametemperature was2,150°F perature (indegrees Fahrenheit [°F])ontheinsidesurfaceversus had beenpaintedwithacoatofintumescentpaint.Thetem- CF card placedontheEMUtoshowrelative size. final CIREMUisshownontheleftofFigure 12withamemory successfully retrieved from all6testunitsafterthefire tests.The minutes whenthetestwasterminated.Theimagememory of intumescentpaint.Thatsoftdrinkcanhadbeentestedfor10 drink canwithaCFcard, internalfire foam,andanexternal coat tigating. Oneofthetestunits(onrightFigure 12)isasoft terminated atdifferent timesdependingonwhatwewere inves- find thelongesttimebefore lossofthememorydata.Tests were formed toevaluatedifferent materialsandapproaches, notto flame fordifferent timesupto15minutes.Fire testingwasper- laptop. Thesixunitswere thentestedwitha2,150°F(1,177°C) CF cards were thenchecked andwere successivelyretrieved ona modern militaryhelicoptersare designed.Theimagesstored in sec). Thisimpactspeedistheverticalvelocitytowhich tested from ahangarandimpacted concrete at42ft/sec(12.8m/ to handlefire andimpactwere tested.Allsixunitswere drop helicopter needs.Sixprototype configurationsofdifferent means The external memoryunit(EMU)iscrashsurvivabletowhata CIR external memory unit Figure 13.Intumescentpaintfire test A fire testwasconductedona0.020inchaluminumsheetthat • ISASI 2008 ISASI Proceedings 78 Figure 15.CIRpotentialtospeedupaccidentinvestigation. Figure 14.206real andclaimedpowerlossaccidentrate. retrieved byboats.Theaftendofthetailboom withthetailrotor lem. People andaircraft (lessthebackendoftailboom)were landed successfullyonpopout floatsintheoceanwithnoprob- The 407hassuchasituation. Thepilotreported abang,andhe that causalfactorisdocumented,thequicker thefieldfixoccurs. Sometimes abrand-newtypeofaccidentcauseoccurs.The faster CIR potentialuse—Example2 and CIRcanprovide it. what thepilotwasdoinginadvertently. Knowledgeisneeded, ago, Bellwouldhaveaddedthatguard withthefirstproof of rate duetopowerlosses.HadCIRtechnologybeeninplace years the FAA toissueanADandgotafurtherdrop intheaccident the fleetin1990.Noteaccidentratereduction. We thenasked this knowledge,Bellputaguard overthatswitchandretrofitted by mistake butimmediatelyturneditbackon(toolate!).With told Bellthathehadinadvertentlyactivatedthefuelshutoffvalve dents ofthe206.In1990,apilotinthistypeaccidentactually year. Figure 14showstheclaimedandactualpowerlossacci- not. Thattypeofaccidentcontinuestobereported from yearto manufacturer fixthe“unknownreason”? Theanswerisitcan- reasons.” Thatdoescloseoutareport, buthowdoestheengine vestigations typicallyresult inacauseof“powerlossforunknown indicated theenginewasfineduringtest.Thesetypesofin- lot claimedhehadapowerloss.Subsequentenginetestruns 1/14/2009, 8:22 AM and vertical fin were noted as missing after the aircraft landed on investigation and fielding of corrections. The time and expense the water. The missing tail boom and tail rotor were not recov- of accident investigations will be reduced by a CIR. Low-cost CIRs ered until many months later. Some time later, another accident also have FDM capability, which will encourage operators to in- happened in which a rapid left pedal occurred at high speed. stall CIRs on a voluntary basis. The CIR is being designed to Now with some potential evidence, testing of the unique situa- helicopter needs and is an added safety feature that does not tion was done, and potential improvements were developed. A degrade existing certification safety. Overall, the CIR is going to fix to preclude the pilot from introducing full left pedal at high allow helicopter safety to go to a new safety plateau. ◆ speed was quickly introduced to the field. Had a CIR been available and installed on the first accident aircraft, it would have References recorded the sharp left pedal input at high speed. The accident 1. Helicopter Association International website, http://www.rotor.com/ (July investigation on the real cause could have started on Day 2, not 3, 2008). months later after the sunken tail boom pieces were found. A 2. “General Aviation and Part 135 Activities Surveys,” Federal Aviation Administration website, http://www.faa.gov/data_statistics/ CIR will quickly identify these unusual pilot action accidents so aviation_data_statistics/general_aviation (July 3, 2008). that correction can begin quickly. 3. International Helicopter Safety Symposium, Montreal, Canada 2005. 4. Fox, R.G., “Measuring Safety Investment Effectiveness Relative to Risks,” American Helicopter Society 54th Forum, May 1998. Summary 5. “U. S. Joint Helicopter Safety Analysis Team: Year 2000 Report,” Bell is committed to the IHST goal of an 80% accident rate re- September 2007. May be accessed at the International Helicopter Safety duction by 2016 and will do its part. Bell’s major thrust to get the Team website, http://www.ihst.org/index.php (July 3, 2008).

6. Liptak, Mark, et al, “Interim Safety Recommendations to the Interna- 10, 2008 SEPT. WEDNESDAY, largest improvement in the shortest time period is to develop tional Helicopter Safety Team,” U.S. JHSAT, presented at Carmel IHST and field a low-cost cockpit information recorder (CIR). A CIR meeting, November 2006. will allow the understanding of human and unknown cause acci- 7. Fox, R.G., “The Path to the Next Helicopter Safety Plateau,” American Helicopter Society 61st Forum, June 2005. dents needed for improvements in aircraft, procedures, and op- 8. Barclay, A., “Cockpit Image Recording Systems,” International erations. A CIR will significantly speed up the process of accident Helicopter Safety Symposium, September 2007.

ISASI 2008 Proceedings • 79

Proceedings 2008.pmd 79 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 80 Two catastrophic accidents were introduced toshowitsbenefits. rence investigationtoreduce theworkingtimeofsitesurvey. found thatDGPSandthelaser rangercouldassistintheoccur- track, Jeppesencharts,radar images, etc.Intheearlystage,ASC used tomapallthespatialinformation,suchasflightpath,ground post-processing, thegeographicalinformationsystem (GIS)was wreckage, ground scars,andrelevant ground features. For the laser rangerwere adoptedinsitesurveyequipmenttolocate differential globalpositioningsystem(DGPS)andthehandheld accuracy andefficiencyofthesitesurvey. Inthebeginning, isintegratingseveraltechniquestoimproveASC theposition techniquesat ASC The evolutionofsitesurvey I. Introduction • ISASI 2008 ISASI Aviation Safety Council (ASC), Taiwan,Aviation SafetyCouncil(ASC), ROC,Tel:+886-2-89127388 Fax: +886-2-89127398 Precise DifferentialGPSonthe Engineering, NationalTaiwan University. the machineworkshop,DepartmentofMechanical Commercial Pilot Training Program anddirector of coordinator fortheNational Taiwan University ASC. Hiscareer experiencesincludetheprogram Dr. Hong-Tsu Young joined theASCin2003. tics from theNationalChengKung University;he with theASC.Heholdsamaster’sdegree inaeronau- Tian-Fu (William) Yeh joined theASCin2001. sensing from theNationalCentralUniversity;he the ASC.Heholdsamaster’sdegree inremote Ming-Hao Young been involvedinmore than40investigations. Council (ASC).HeJoinedtheASCin1998andhas withtheAviation Safety Investigation Laboratory Dr. Wen-Lin (Michael)Guan Proceedings Use ofModelHelicopterand 80 By Wen-Lin, Guan;Ming-Hao, Young; Tian-Fu, Yeh; andHongT. Young; Occurrence SiteSurvey isaflightrecorders engineerwith isthemanagingdirector ofthe isaflightrecorders engineer isthedirector ofthe to triggerthedigitalcamera. Usually, alighterpayloadis investigator cancoordinate withtheground pilottodecidewhen a ground stationbya2.4GHzvideotransmitter. speed), thenthesuperimposedsurveillancevideoistransmitted to mation (GPStime,latitude,longitude,height,heading,andground nel. ThecolorCCDcamerasuperimposestheGPSposition infor- the entire onboard platformcanbechangedbyaradiocontrol chan- camera, GPSreceiver, andreal-time videotransmitter. Theangleof include adigitalcamerawith9megapixels, digitalvideo,colorCCD graphic systemoftheRCmodelhelicopter. Theonboard payloads video, apassiveabsorbingdevicewasdesignedonboard thephoto- helicopter andtriggerservostodeflectthecontrol surfaces. commands are transmittedtotheonboard receiver ofthemodel a radiocontroller with10channels.Theground pilot’scontrol kg. Ontheground, thepilotcontrols themodelhelicopterthrough ter isanHIROBOFRYER 90withapayloadcapabilityupto10 control system,andphotographicplatform.Themodelhelicop- The aerialphotographicsystemincludesanRCmodelhelicopter, (a) Aerialphotographysystem The totalcostofanRCmodelhelicopterisaboutUS$8,000. architecture—there are twosubsystemstoperformtherequirement. outthemissionofaerialphotography.carry Figure 1showsthe decided tousetheRCmodelhelicopterasamobileplatform helicopter isportableandeasilyassembleddeployed.ASC the commercial fixed-wing UAV, theself-integratingRCmodel ferent levelsofautonomousflight(seeReference 3).Incontrastto cluded longendurance,middletohighcruisingaltitudes,anddif- erence 1,2).Thecommoncharacteristicsoffixed-wing UAVs in- been developedtoperformaerialphotographicmissions(seeRef- During thelastdecades,manyunmannedairvehicles(UAV) had Developing anRCmodelhelicopteratASC analysis iscosteffectiveintheapplicationof3-D modeling aerial photography. Integratingaprecise DGPSandimage-based integrating anRC(radio-controlled) modelhelicoptertotake begantoresolvetigators. In2004,ASC theseproblems byself- instantaneously are commonchallengestoaviationsafetyinves- distribution andhigh-resolution aerialphotosorsatelliteimages very difficulttoaccess.Gatheringabird’s-eye viewofwreckage in SectionII. A more detaileddescriptionofsitesurveytechniquesare explained Based onthesurveillancevideo ontheground station,anASC In order toimprove thequality of aerialphotoandsurveillance Wreckage distributedoverawidearea is orinruggedterrain 1/14/2009, 8:22 AM one aerial photo maybe enough to cover the entire occurrence site. If the wreckage is distributed more than hundreds or thousands of meters away, many aerial photos are needed to obtain the aerial panoramic view. To do follow- on measurements on the aerial photos, rectification of the photos should be done first. There are two methods to rectify the aerial photos. A more detailed description is explained in Section III. The imprecise method is to ignore the distortion of the camera lens, choosing at least three GCPs from the aerial photo then rectify it by software directly. The precise method is to cali- brate the camera first, put the lens distortion parameters into a commercial software program, and perform aerial triangulation to discover the orientation parameters of the photo. Finally, an orthogonal-image is generated and superimposed with the digital terrain model (DTM). 10, 2008 SEPT. WEDNESDAY, These corrected images could be used in a large mosaic or superposed on other aerial photos/sat- Figure 1. The system architecture of RC model helicopter at ASC. ellite images and terrain data to reconstruct the 3-D environment of the occurrence site. preselected to perform quick surveys. According to the results of the initial survey, the high-resolution digital camera and video II. Review of two fatal accidents recorder can be installed on the platform to carry out the precise B-747-400 Crash at Hong Kong International Airport aerial survey mission. (Oct. 31, 2000) Investigator-in-charge: Aviation Safety Council (ASC) (b) Ground system Invited accredited representatives: the NTSB (the state manu- The ground station includes a 2.4 GHz video receiver, remote facture), MCIT1 (the state of Operator), and Taiwan CAA controller with six channels, and a laptop computer. The ground station could in near real time display the superimposed video History of flight on the pilot’s portable device and record the video on the laptop On Oct. 31, 2000, at 2317 Taipei local time, Singapore Airlines computer in near real time. The on-ground pilot of the RC model (SIA) Flight SQ006 (B747-400, Reg. No. 9V-SPK), crashed on a helicopter adjusts the operating altitude and direction and other partially closed runway at Chiang Kai-Shek (CKS) International control command through a portable device. Airport during takeoff. Heavy rain and strong winds from typhoon Xangsane prevailed at the time of the accident. SQ006 was on a Post-process of the aerial photos scheduled passenger flight from CKS Airport, Taiwan, ROC, to Each aerial photo taken by the RC model helicopter may be use- Los Angeles International Airport, Los Angeles, Calif., USA. The ful to show the occurrence site. If the wreckage is not widespread, flight departed with three flightcrew members, 17 cabin crewmembers, and 159 passengers on board. The aircraft was destroyed by its collision with construction equipment and runway construction pits on Runway 05R and by post- impact fire. There were 83 fatalities, including 4 cabin crewmembers and 79 passengers; 39 seriously injured, including 4 cabin crewmembers and 35 passengers; and 32 minor injuries, including 1 flightcrew member, 9 cabin crewmembers, and 22 passengers.

The site survey task Two survey teams joined together to perform the ground survey and aerial survey. The ground survey teams equipped with two sets of DGPS receivers, a digital camera, and relevant field notes. Due to the shortage of technical manpower, ASC hired four technical engineers with GPS experience to join the site survey, and ASC appointed one investigator to lead the ground survey team and prepare the relevant plan. They spent 3.5 days finishing the well-planned site survey task. The survey included aircraft wreck- Figure 2. The superposition of SQ006 wreckage distribution age and ground marks conducted from Taxiway N1 through N8 and satellite image. along Runway 05R. The landing gear tire mark from the begin-

ISASI 2008 Proceedings • 81

Proceedings 2008.pmd 81 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 82 runway inaslightlyrightwing-down attitude.Thiswasfollowedby rate ofdescentandresulted inan extremely hard impactwiththe an attemptwasmadetoflare theaircraft, thisdidnotarrest the the glideslopeuntilnormal flare heightwasreached. Although runway centerline,butdescendedandstabilizedslightlylow on system engaged.FlightCI642continuedtotracktheextended pilot flyingthendisconnectedtheautopilotbutleftautothrottle becoming visualwiththerunwayatapproximately 700 feet,the northwest withheavyrain,resulting inawetrunway. east. Attheairport,there wasastrong gustingwindfrom the cal cyclonecentered approximately 50kilometerstothenorth- local time,HKIAwasaffectedbyweatherassociatedwitha tropi- passengers and15crewmembers onboard. About1947Taipei (HKIA). Theflightdepartedfrom Bangkok onschedulewith300 with anintermediatestopatHongKong InternationalAirport wasscheduledtooperatefrom BangkokNo. B-150) toTaipei Reg.On Aug.22,1999,ChinaAirline’sFlightCI642(MD-11, History offlight facture), (thestateofoperator) ASC Invited accredited representatives: theNTSB(thestateofmanu- Investigator-in-charge: CAD,HongKong (Aug. 22,1999) crashatHongKongMD-11 InternationalAirport (about US$16,000),respectively. were about 56,000NTD(aboutUS$1,800)and500,000 image; Figure 3showstheSQ006partialwreckage distribution. the superpositionofSQ006wreckage distributionandasatellite Runway 05LandO5RTaxiways (NI~N9).Figure 2shows BE-350 toperformtheaerialsurvey. Thesurveyfieldincluded 3, theAerialSurveyOfficeofForestry Bureau usedaBeechcraft survey missionwaspostponedabout1.5days.From November2- the northofTaiwan more than36hours.Therefore, theaerial but notvisibleindrierafternoonorwhentherunwaywaswet. mented. Thetire markswere visibleinthedamp,earlymorning ning ofTaxiway N1totheinitialimpactpointwasalsodocu- opposite from theflightdirection). Figure 3.Partial wreckage distributionofSQ006(asseen Flight CI642 carried outanILSapproachFlight CI642carried toRunway25L.After The operationalcostoftheground surveyandaerial theaccidenthappened,typhoonXangsanehadinvaded After • ISASI 2008 ISASI Proceedings 82 Figure 5.TheperspectiveviewofCI642mainwreckage. aerial photo. Figure 4.CI642superpositionofwreckage distributionand The missionofaerialsurveillanceistimeconsuming andex- • equipped withwaterproof GPS,camera,andvideorecorder, etc. Undersevere weatherconditions,investigatorsshouldbe • geospatial datalayersandformats. ing, contactwindows,report contentofthesitesurvey, and racy, mobilizationtimeoftechnicalpersons,detailitemsbill- pens. Theplanshouldincludetherequiring positioningaccu- Prepared anoutsourcing planbefore anaviationdisasterhap- • Challenge andlessonslearned perspective viewofthemainwreckage ofCI642. wreckage distribution andaerialphoto;Figure 5displays the scape areas. Figure 4displaysthesuperpositionofCI642 and theskidmarksobviousonRunway25Ladjacent landing ofthefinalpositionmainwreckage, thewreckage parts, the surveytask.Thewreckage surveyfieldincludedtherecord- Department. About20technicalstaffersspentoneweektofinish vey andaerialsurveytotheSurveyMappingOfficeofLand theaccident,CADwasoutsourcingAfter thetaskofground sur- task The sitesurvey in thehospital. jured. Oneoftheseriouslyinjured passengersdied5dayslater rival, andsixcrewmembers and45passengerswere seriouslyin- a grassyarea justtotherightofrunway. right. FlightCI642endedupinaninverted,reversed positionon wing, anoutbreak offire andanuncontrollable roll and yawtothe collapse oftherightmainlandinggear, separationoftheright Due totheaccident,twopassengerswere founddeadonar- 1/14/2009, 8:22 AM Figure 6. The relationship of relative image resolution Figure 8. Radial lens distortion. and flight altitude. WEDNESDAY, SEPT. 10, 2008 SEPT. WEDNESDAY,

Figure 7. The relationship of relative ground coverage Figure 9. Total lens distortion. and flight altitude. and 66.7 mm) estimate relative image resolution and ground pensive. Aviation safety investigators may consider alternative coverage at different flight altitudes. The results are shown in methods to achieve the essential requirements—timely cost-ef- Figure 6 and Figure 7. To show that resolution varies with flight fective, and high-resolution aerial photos to record the wreckage altitudes, two examples are illustrated here. (1) Using the wide- distribution. angle camera with a focal length of 6.2 mm and a flight altitude of 300 m AGL. The relative ground coverage is 387 m x 290 m. III. The results and discussion (2) Using a tele-angle side at the same altitude, the relative ground The RC model helicopter aerial photographic system had not coverage is only 27 m x 36 m. been used in an accident investigation at ASC for the past 4 To avoid misunderstanding during post-process, before mea- years. However, ASC staffers exercised the system to evaluate suring the relative distance from those aerial photos, the distor- the procedures and performance. This section describes the tions should be considered first. Table 1 shows that most of the characteristics of the onboard digital camera, the rectify meth- distortion came from radial direction of the lens. According to ods of aerial photos, and two exercises at suburban and moun- Figure 8 and Figure 9, the farther away from the image’s center, tainous areas. the more distortion there will be. The maximum distortion of the lens is 137.3 pixels. Characteristics of onboard digital camera The onboard digital camera is a Fujifilm FinePix S9500, with 9.0 Table 1. The Maximum Lens Distortion. million effective pixels, and 1/1.6 inch super CCD (6 mm x 8 mm). Axis-x ( Pixels ) Axis-y ( Pixels ) Its focal length ranges from 6.2 mm to 66.7 mm with a maxi- Radial lens distortion -109.1 -83.4 mum resolution 9.125 mega pixels (i.e., 2616 x 3488). Decentering lens distortion -2.61 -3.52 Four kinds of different focal lengths (6.2 mm, 24 mm, 35 mm, Total lens distortion 137.3

ISASI 2008 Proceedings • 83

Proceedings 2008.pmd 83 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 84 preparation. Thisexercise dem- elevation markandground about 815m.Figure 11showsthe copter tookoffatanaltitude of in Taipei. TheRCmodelheli- at Yang MingShanNationalPark tainous area wechosewaslocated In November2005,themoun- mountainous area Performance flighttestat Results offlighttests imprecise method. many error sources, sotheaccuracyismuch betterthanthatofthe (DTM) (seeReference 5).Thismethodtakes intoconsideration Third, ortho-rectify model theaerialphotosusingdigitalterrain to gettheaccuratepositionandattitudeofonboard camera. are measured byprecise DGPStoperformaerialtriangulationand togrammetry Suite(LPS)software togowiththeGCPs. ThoseGCPS relevant calibrationparametersintoLeicaPho- tion gridisshowninFigure 10.Second,input the parametersoflensdistortion;calibra- uses thePhotoModelersoftware tocalculate procedures are shownbelow. First, staff ASC effect.Thedetailed tortion, andtheterrain altitude oftheonboard camera,thelensdis- This methodconsiderstheorientationand Precise method the area willbelarger. withfoldingterrain rain effect,theerror oftheouterimageand not considerthelensdistortionandter- ware (seeReference 4)Sincethemethoddid photo through thedefaultsettinginsoft- at leastthree GCPs, (2)rectifying theaerial with thefunctionslistedbelow: (1)pickingout Earth. GlobalMapperiscommercial software Satellite imagescanbegottenfrom Google 1/5000 electronic mapsare anotherchoice. base mapsofarea ofinterest (AOI);sometimes before thesurveyordeterminedbyDGPS. and geographiccoordinates were bothknown maps. Therefore, imagecoordinates theGCP’s Jeppesen charts,satelliteimages,andelectronic maps. Thesources ofthebasemapinclude recognized from bothaerialphotosandbase method. GCPs are preselected pointsthatare aerial photostobasemapsintheimprecise GCPs are theonlyknownpointstoregister the Imprecise method rain, whiletheotherdoesnot. tortion ofthelens,andinfluenceter- here. Theprecise methodconsidersthedis- tioned inSectionIwillbeexplained indetail aerial photos.Two rectification methodsmen- The followingsectionexplains howtorectify Image rectifyingmethod In general,satelliteimagesare usedasthe • ISASI 2008 ISASI Proceedings 84 Figure 10. Calibrationgrid. Figure 13.TheimagestakenbyDV(a)takeoffsite.(b)Fumaroles neartakeoffsite. is nearlyorthogonal).(b)Altitudeat900m(cameraseeingforward). Figure 12.Aerial phototakenbydigitalcameraat(a)altitude1,205m(camera Figure 11(a)Altitudeoftakeoffsite.(b)Preparing fortakeoff. of Wu-Lai, whichislocatedatthesouthernoutboundofTaipei city. In November2006,anotherexercise wasperformedatarivervalley Integration flighttestatsuburban rivervalley cal distortion.Therelative positionerror isabout3m. the edgeofsuperimposedphotoscouldnotcorrect theopti- Earth withground resolution about2m.Figure 14reveals that ground resolution of6.25mandextracted animagefrom Google base mapsofFigure 14includedaSPOT-5 satelliteimagewith tos—five GCPs were appliedtocorrect theimagedistortion. The video clipsfrom theonboard videorecorder. were taken asshowninFigure 12.Figure 13showssomedigital most 390mabovetheground station),andseveralaerialphotos sults showedthemaximumflightaltitudewasabout1,215 m(al- receiver board, CCDcamera,anddigital videorecorder. There- photos. Theonboard platformincludedadigitalcamera,GPS tude andusedtheimprecise methodtosuperimposetheaerial onstrated thatthemodelhelicoptercanmaneuverathighalti- Figure 14showstheresults bysuperimposingtheaerialpho- 1/14/2009, 8:22 AM In average, the exercise area was about 400 m x 400 m. The model helicopter took off at an elevation of 180 m, and the relative covered area of the onboard digital camera was 240 m x 180 m. The cruising altitude of the model helicopter was about 186 m AGL. Applying the precise method was used to superimpose the aerial photos. Two adjacent photos are overlapped more than 50% to correct image dis- Figure 14. The superimposition of aerial photo and satellite images (SPOT-5, QuickBird). tortion. Each aerial photo contained at least four GCPs, which are distributed at the corner of the photos. The portable GCP was made of yellow plastic over cross tags a size of 1 m x1 m, which was attached on the ground. The positions of the GCPs are measured by precise DGPS to ensure its accuracies within 10, 2008 SEPT. WEDNESDAY, centimeters. Figure 15(a) shows the results of aerial photos taken by FinePix S9500. Figure 15(b) shows the results by superimposing the aerial photos and the satellite image extracted from Google Earth with a ground resolution of 1.5 m. Based on the rectified aerial photos, the relative ground resolution varied from 7 cm to 30 cm—satellite image and precise DTM data with grid size 40 m x 40 m. ASC succeeded in generating the 3-D modeling of the river valley. The result is shown in Figure 16.

Figure 15 (a) Aerial photo (above). (b) Superimposition of aerial photos with IV. Conclusion—remarks and a satellite image (below). future activities Well-prepared site survey techniques are essential to aviation safety investigations. Survey techniques require positioning accuracy, mobility, scope and resources of the site survey, geospatial data layers and formats, and so on. ASC has successfully self-integrated an RC model helicopter aerial photographic system with a 10-kg payload capability. The proposed system also was calibrated with well defined procedures to rectify the aerial photos into a single ortho-photo with geographic coordi- nates. To compare with other commercial UAV systems, or to outsource the national aerial surveillance agency to survey the occurrence site, the RC model helicopter is lightweight, highly mobile, and cost-effective and can obtain high- resolution panoramic photos. When- ever a fatal accident occurs and no in- stant aerial photos are available, the

ISASI 2008 Proceedings • 85

Proceedings 2008.pmd 85 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 86 3. JessicaDooley, EkaterinaTaralova, Prasad Gabbur, Timothy Spriggs, 2. AUVSI InternationalAerialRobotics Competition,http:// 1. Tad, McGeer, andJuris,Vagners, “HistoricCrossing anUnmanned References automatic procedure isthetrend. time-consuming andboring—developingasemi- lens; (3)Rectifying theentire aerialphotosis tortion maybeimproved byusingatelescopic outskirt ofaninteresting scene.Theopticaldis- will causeopticaldistortionespeciallyatthe focal lengthofthedigitalcameraistooshort,it riods ofheavyrainandwindisneeded;(2)ifthe waterproofing theonboard platformduringpe- site surveythere are three majorconcerns,(1) copter aerialphotographysysteminassistingthe reconstruction. age distribution,evenassistintherescue and money, andworkloadinmeasuringthewreck- application oftheproposed systemcansavetime, University ofArizona,Tucson, Az.http://controls.ae.gatech.edu/gtar/ “Development ofanAutonomousAerialReconnaissance System,” avdil.gtri.gatech.edu/AUVS/IARCLaunchPoint.html. Aircraft’s AtlanticFlight,”GPSWorld, p.24~30,February 1999. For future developmentofanRCmodelheli- • ISASI 2008 ISASI Proceedings 86 ◆ 1 Endnote 5. “LeicaPhotogrammetrySuiteProject Manager,” http:// 4. “Globalmapperusermanual,”http://www.globalmapper.com/helpv9/ MinistryofCommunicationsandInformationTechnology ofSingapore rocky.ess.washington.edu/data/erdas_pdfs/LPS_PM.pdf. GlobalMapperHelp.pdf. iarcpapers/uarizona2003.pdf 1/14/2009, 8:22 AM modeling oftherivervalleyWu-Lai. Figure 16.Reconstructionof3-D Gas Turbines and Ice—The Mysterious Culprit By Al Weaver (MO4465), Pratt & Whitney

Al Weaver is a Senior Fellow Emeritus having • Ice pooling overnight at the bottom of the engine inlet, re- retired from Pratt & Whitney after a long career in leased at high power during takeoff. promoting flight safety initiatives and expertise in • Ice formed by leakages from the fuselage (e.g., lavatory po- accident investigation. He currently teaches the Gas table water). Turbine Accident Investigation Course for the • Ice accretion on aircraft frontal surfaces (e.g., radomes and Southern California Safety Institute. engine inlets) released during flight. • Inflight hail.

his paper brings into focus the various kinds of ice that Internally generated ice: This means ice that generates by the 10, 2008 SEPT. WEDNESDAY, can affect gas turbine engines, leading to abnormalities combination of ingested water (including snow/freezing fog, ice Tand failures. It describes the sources of ice, its symptoms, crystals, etc.) and engine working cycle conditions at certain power and the investigative techniques and experience needed to iden- and rotation speed settings. tify probable sources. The author’s objective is not to offer a complete and definitive overview on the subject of ice and gas tur- Examples of internally generated ice bine engines but to increase the general awareness of both air- • Probe accretion that either blocks the probe or sheds abnor- craft operators and accident investigators on this problem. It is mally causing engine damage. the author’s opinion that in the future, there will still be major • Ice accretion on rotating engine spinners shedding and caus- investigations involving this mysterious cause. ing damage. The operating environment of a jet aircraft may cause the en- • Ice accretion on fan blades either generating abnormal symp- gine to encounter icing conditions or to face the ingestion of ice toms of vibration or shedding and causing damage. from external sources. Post-event investigations have revealed • Ice accretion on stator vanes shedding and causing downstream numerous sources of ice that have led to significant damage to ingestion damage. the engine(s) and/or to symptoms of abnormal operation, requiring pilot action. Of course, ice and gas turbines have been a rec- Symptoms of ice ingestion ognized concern for many years, and current regulations in air- Ice from either source may cause mechanical impact damage to craft and turbine engine design address much of this concern. either the engine stationary or rotating parts as well as blockages However, in spite of our general knowledge and assumptions, of air passages or probes affecting the engine stability and re- the operation of the aircraft in flight itself may present environ- sponse to pilot commands. In some cases, investigators deter- mental conditions not anticipated or adequately controlled. Like mined that ice ingestion had been so severe that the resulting other environmental factors, inflight icing is a threat that must FOD damage to the engine was beyond its certified blade loss be counteracted balancing the capability of the product to with- capability in terms of quantity of blades released. The risk re- stand extreme conditions and the need to restrict the acceptable lated to such inflight ice encounters is exacerbated by the fact operating environment. that all engines on an aircraft operate at the same time under the same environmental conditions. Obviously a combination of Sources of ice malfunctions on multiple engines will significantly affect the pi- The sources of ice that may threaten an aircraft jet engine can be lot workload in addressing any of these abnormal conditions. fundamentally classified as follows. The following table lists possible consequences of ice-related Ingested ice: This definition refers to ice that has been gener- events, possibly affecting more than one engine at the same time. ated outside the engine, either in the air by accretion to aircraft surfaces or from ground sources. During the event sequence, this Examples of abnormalities ice finds its way into the engine. • Mechanical damage dents/cusps/twist/bends/fractures to both stationary parts as well as rotating parts. Examples of ingested ice • Vibration either secondary to mechanical damage or simply • Slab ice from runway edges or tops of snow banks displaced due to uneven shedding of ice on a rotor. during reverse operation. • Engine inability to recover from stall/surging either from me- • Taxiway slush ridges on the gear released during gear retrac- chanical damage or ice-blocked bleed systems. tion shortly after rotation. • Engine control system effects from ice-blocked probes. • Ice left on the top of the fuselage or wings during dispatch It should be noted that engines can be affected by ice (and in and released at rotation during takeoff. particular by ice particles at altitude) even if no airframe icing is

ISASI 2008 Proceedings • 87

Proceedings 2008.pmd 87 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 88 damage onagasturbineengine hascausedasignificantpower operation. Infact,there islittlehistoricalevidencethatvisiblehail faces issufficienttoprove ordisprove aseriouseffectonpowerplant tive nornegativefindingofsoft-body damagetothefrontal sur- on thepropulsion system,itshouldbenotedthatneitheraposi- However, whenassessingthepossibleconsequences ofsuchevents cluding radomes,windscreens, engineinlets,and/orfanblades. observation ofbodydamagetofrontal surfacesoftheaircraft, in- DFDR readouts, maintenance,andflightlogs,etc. such asweathermapsandadvisories,ATC radarplots,CVRand Other informationwouldbeobtainedfrom documentalevidence the aircraft and/or engines, location,andrelative timingofevents. facts, manyofwhichare observationalsuchasvisibledamageto and followapathofinference betweencauseandeffect. tion hasevenbegun.Theinvestigatormustthenunearthclues actual icehasalmostalwaysmeltedbythetimethatinvestiga- incidents istorecognize thaticeinanyformwasinvolved.The The real challenge totheinvestigatorofmalfunctioningengine Investigative techniques icing conditions. ticles, sothecrew maynotbeabletoavoidthiskindofengine stalled onaircraft are generallyineffectiveindetectingicepar- observed bytheflightcrew. Weather radarandicedetectorsin- Figure 2 Figure 1 In thecaseofahailencounter, themostobviousevidenceis The typicalinvestigationproceeds asaninitialcollectionof • ISASI 2008 ISASI Proceedings 88 thump washeard, followedbyenginewindingdown.Aircraft had Factual information EVENT 2 body leadingedgedamageisfoundonaircraft surfaces. Risk control measures line withtheleakagesource. (wings, stabilizer, inletcowl,enginenosebullet,etc.)locatedin potential fuselageleak.Observationofleadingedgedamages Key pointers ward lavatory. Probable cause book writeupsofbroken landinglightsand/ordentedinletcowls. Investigation revealed streaking alongforward fuselageandlog- cowl wasrecovered, adentwasobservedonthelip(seeFigure 2). ing, numerous fanbladesmissing(seeFigure 1).Whentheinlet damage Observed fuel wasreported leakingdowntheaftstaircase. During approach, alow-fuel warninglightoccurred. On arrival, ing downandcontinuedvibrationforremainder oftheflight. the pilotreported aloudbangincruise,followedbyenginewind- Factual information EVENT 1 age observationandanalysis,whichisthesubjectofthispaper. engine performanceandcertificationissuesratherthanondam- encounters. Thediscussionofthisthreat wouldfocusmainlyon the observationofdamageonengineparts. when iceissuspectedasacauseandbygivingsomeguidancefor help investigatorsbypointingoutsomeareas ofconsideration cause, andpossibleriskcontrol measures. Theprimaryaimisto along withadescriptionoftheobserveddamage,probable this section.For eachevent,somefactualinformationwillbegiven, A numberofengineice-related investigationsare summarizedin Summary ofrelevantinvestigations expected environment. powerplant malfunctions,and/ortoleranceoftheengineto weather detectionandavoidance,crew response toice-related recommendations would address anyunsafeconditioninicing related causalchainisconsistentwiththefindings. would likely leadtheinvestigatingteam toconcludeifanice- the expected engineperformancelimitationsandcrew actions tity ofwaterorhail,altitude,andpowerbeingdelivered) against tal andoperationalconditionsassociatedwiththeaccident(quan- caused bytheprimarydamage. the inabilityofcrew torecover from theinitialmalfunction secondary totheinitialice-related damageandmaywellbedueto thermal damagetotheturbineshouldnormallybeconsidered as significant soft-bodydamageaffectingthecompressor system.Any important tostress thatinthiscase“primarydamage”refers to sider thatprimarydamagemaynotbepresent ontheengines.Itis (including icecrystalsataltitude),theinvestigatorsshouldcon- loss. Instead,asinthecaseofanyweather-related considerations The eventspresented donotincludesevere weather(hail/rain) According totheoutcomeofinvestigation,resulting The analyticalresults ofmatchingtheestimatedenvironmen- : Singleengineinvolvementonthetrajectoryof 1/14/2009, 8:22 AM : Ingestionoflarge blockoficefrom leakingfor- : Inletcowlmissing,enginenosebulletmiss- : Justaftertakeoff, as gearwasraised,aloud : Onanaircraft withtail-mountedengines, : Address potentialfuselageleakageifsoft- Figure 3

Figure 5 WEDNESDAY, SEPT. 10, 2008 SEPT. WEDNESDAY,

Figure 4

taken off several hours after a snow storm at airport. Figure 6 Observed damage: After the air-turn-back, one engine was observed with crushing damage to the inlet cowl and numerous missing fan blades (see Figure 3). Dirt was found trapped in sound proofing holes in fan area (see Figure 4). An engine nose bullet buckle was crushed (see Figure 5), and white stains were observed on the compressor vanes (see Figure 6). The other engine had moderate leading edge dents and curls. Probable cause: Slush shed off the gear at retraction after takeoff and was ingested by the engine. Key pointers: Multiple engine involvement in takeoff regime following snowstorm. Crushing damage ahead of fan, dirt and staining in fan-compressor area. Risk control measures: Inspect gear prior to dispatch for slush buildup. Be mindful of taxiway slush ridges.

EVENT 3 Figure 7 Factual information: This type of event is characterized by several occurrences in the same time frame, often same day, same Probable cause: Ice that formed in front of engine at low power aircraft model, usually associated with snow storm conditions. was released at takeoff and was ingested into the high-pressure During takeoff or flight, the flight crew reported engine stall/ section, resulting in damage to the blades of the first stages. surging to one or more engines. Key pointers: Multiple events, involving engines in same fleet Observed damage: Borescope investigations or engine teardown and in same time frame. History of operation showed that the examinations at scheduled overhaul revealed tip curl/dents/cusp engines were run at low power in snowing/icing conditions, typi- in the forward stages of the aft compressor (high-pressure) spool cally on ground. Soft-body damage originated in forward stage

ISASI 2008 Proceedings • 89

Proceedings 2008.pmd 89 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 90 following operationsinfresh snow conditions. Key pointers shedding. ing onthelocalairflowconditions attheinstanticewas both aheadofandslightlyintersectingthefanblades,depend- up from lowpowertohighpower. Theiceimpactedtheinlet Probable cause fan (seeFigure 8)andattipsoffanblades(seeFigure 9). damage Observed events involvedenginesofthesamefleetintimeframe. and walkaround findingsofminordamageatengine inlet.The Factual information EVENT 4 to shediceinfront ofenginebefore highpoweroperations. Risk control measures with takeoff andaninflightstall/surge. of high-pressure spool.Onsetofsymptomsisoftenassociated Figure 9 Figure 8 • ISASI 2008 ISASI : Softimpactsbothaheadoffan andjustatfantips Proceedings : Iceaccretion onspinnershedduring spool- : Smalldentstoacousticmaterialinfront of : Multiplecomplaintsofvibrationorfannoise 90 : Adhere torecommended fanspool-ups Figure 11 stalled/surged justafterrotation. overnight layoverinnear-freezing conditions,multipleengines Factual information EVENT 6 quent spoolupstoshedice. power operationinicingconditionsand/orperformmore fre- Risk control measures operating insnowyorsevere icingconditions. engine hadtransitionedfrom lowpowertohigherwhile Key pointers ward duetothetwisted shapeofthefanblades. power tohighinflight.Fan bladeicewaspumpedrear- Probable cause behind thefan(seeFigure 10). damage Observed initially spooledupbutthensustainedapermanentpowerloss. conditions, theengineswere spooledupforlanding.Allengines Factual information EVENT 5 garding periodicspool-upsoffantoshedice intheseconditions. Risk control measures Figure 10 : Damageisjustaftoffanattheouterwall.The 1/14/2009, 8:22 AM : Fan bladeiceshedwhiletransitioningfrom low : Pre-impact damagefound tooutercaseliner : Duringthefirstflightof day, following : Duringalow-power approach insnowy : Adhere torecommended procedures re- : Increase theminimumRPMforlow Observed damage: All engines were found with moderate random soft-body damage. Ripples (see Figure 11) and corner rubbing (see Figure 12) were observed on fan blades. Probable cause: Sheet ice ingestion from aircraft surface ahead of engine. Key pointers: leading edge ripples, random soft damage, overnight standing in freezing precipitation. Multiple engines involvement. Risk control measures: Hands-on pre-flight check after deicing.

EVENT 7

Factual information: The aircraft was flying above 26,000 feet in icing conditions. On all 4 engines, the high-pressure spool speed rolled back to 40-45%. The crew shut down Engines 1 and 2 due to rising turbine gas temperature. Engine 2 was restarted and recovered, as did engines 3 and 4. Figure 12 Observed damage: No damage was found in the compressor. The turbine section showed thermal damage. Risk control measures: Restrictions on the operating environ- 10, 2008 SEPT. WEDNESDAY, Probable cause: Encounter with ice particles and inadequate tol- ment for unmodified engines. Modifications on the engine to erance of the engine to such threat. eliminate the phenomenon. ◆

ISASI 2008 Proceedings • 91

Proceedings 2008.pmd 91 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS nostic, oradministrativepurposes whowere treated andreleased. count orincludeindividuals hospitalized forobservation,diag- In-patienthospitalizationofthree ormore personnel.Does not • A permanentpartialdisability. • $1,000,000. Direct mishapcosttotaling$200,000ormore but lessthan • following: Class Bmishap— DestructionofaDODaircraft. • A fatalityorpermanenttotaldisability. • Direct mishap costtotaling$1,000,000ormore. • following: Class Amishap— hap cost,orextent ofinjurytopersonnel. into fourclassesdependingontheamountofdamage,total mis- the riskmanagementprocess. propulsion (DOP)isresponsible forinstitutingandmaintaining information, andinsighttotheprocess. TheAirForce director of and theenginemanufactures. Bothbringspecializedexpertise, taining fleetreadiness. mum amountofriskreduction from taxpayers’dollarswhilemain- in atimelyandproperly prioritizedmannertogainthemaxi- manages itsenginefleetstoensure engineproblems are corrected first-time occurrences. Thispaperwillexplain howtheUSAF original designspecifications.Theycanbeknownproblems or operational factors,orchangesintheaircraft’s missionfrom its costs. Theymaybeduetodesignissues,maintenanceerrors, chute Associationtandemandacceleratedfreefall instructor. designated parachuteriggerexaminerandisaUnitedStatesPara- is aFederal Aviation Administrationmasterparachuteriggeranda airframe andpowerplantmechanicwithinspectionauthorization.He pilot certificatewithinstrumentandmultiengineratingsisan and F/A-22 aircraft, bothforeign anddomestic.Hehasacommercial investigations coveringC-17,E-3,F-15, F-16, F-14, F-111, T-6A, Whitney accidentinvestigatorfor13yearswithmore than35on-site has beenaPratt &Whitneyengineerfor30yearsandaPratt & 92 H Accidents or“mishaps,”astheUSAFcallsthem,are divided The riskmanagementprocess isateameffortoftheUSAF • ISASI 2008 ISASI Turbine EngineRiskManagement B mishapsandare thesecondhighestdriverinmishap United StatesAirForce (USAF)flight-related ClassAand istorically, enginefailures accountforabout25%ofall Embry-Riddle Aeronautical University.Embry-Riddle Greenwood University andamastersdegree inairsafetyfrom Aeronauticalengineering from Embry-Riddle N.M. Hehasabachelorsdegree inaerospace Center atKirtlandAirForce Base,Albuquerque, for Pratt &WhitneyassignedtotheAirForce Safety Richard Greenwood Proceedings A mishapresulting inoneormore ofthe A mishapresulting inoneormore ofthe 92 In theU.S.AirForce is aflightsafetyinvestigator By Richard P. Greenwood, Pratt &Whitney 3. Solutiondevelopment/implementationphase. 2. Interimriskmanagementphase,and 1. Issue/problem identificationphase, proceeds through three phases and NRIFSDstomanagerisklevels. pulsion-related mishapsandevents,usesClassA Down isclassifiedasaClassEevent.TheUSAFrecords allpro- Non-Recoverable InflightShutdown(NRIFSD)oranInfightShut able mishapprevention information.Inthepropulsion arena, a event reports provide anexpeditious waytodisseminatevalu- important toinvestigate/report formishapprevention. ClassE not meetreportable mishapclassificationcriteriabutare deemed $200,000. Direct mishapcosttotaling$20,000ormore butlessthan • following: Class Cmishap—A may beonlytoasmallsubpopulation ofaparticularmodelen- to ascertaintheriskofcontinued operationtothefleet.Therisk so analystscanzero inontheroot cause. aimed atgatheringasmuchdatapossibleabouttheproblem assembly practicesmightbereviewed. Alltheseprocesses are performed. Batchesofhardware maybeinspected.Overhaul and spread theproblem maybe.Engineorlabtestsneedtobe them withtheaimofdeterminingexactly whatandhowwide- (TCTOs) maybeissuedoncertainsuspectenginestoinspect bases mayalsobequeried.Time compliancetechnicalorders common hardware orcomponentswithcivilaircraft, thosedata- tabases ofengineincidents.Incaseswhere USAFengines share problem. BoththeUSAF andtheenginemanufactures keep da- root causesoproper corrective actionmaybeinstituted. or allofthesequestionsmayneedtobeanswered togetthe mechanic properly trained?Was hegiventhecorrect tools?Some that allowedmisrigging?Are thetechdatainsufficient?Was the Why wastheactuatormisrigged?Was there adesignproblem misrigged compressor vaneactuator. Thisisnottheroot cause. For example, abroken compressor blademightbetracedtoa tion mustbeperformedtogettheroot causeoftheproblem. formation. Onceaproblem isidentified,athorough investiga- ment manufactures reports andtestsare theusualsources ofin- Lead theFleetPrograms, foreign militaryfleets,ororiginalequip- sources. Mishapinvestigations,pilotwrite-ups,deficiencyreports, An initialproblem report maysurfacefrom severaldifferent 1. Issue/problemidentificationphase Let’s lookateachoneindividuallyandseehowtheywork. Once amishaporeventoccurs,theriskmanagementprocess There are alsoClassE“events.”Theseare occurrences thatdo Once theroot cause isidentified,ariskassessmentperformed During thisphase,dataare usuallygathered tohelpdefinethe 1/14/2009, 8:22 AM mishapresulting inoneormore ofthe gine. An example of this would be if an improper heat treat were system flying hours estimated is used to calculated failure rates. done to a particular batch of parts because of a faulty heat-treat Continuing with the example above of four predicted NRIFSDs oven. The risk may be spread out over many different engine from the compressor blade fatigue failure, if the predicted flying models. An example of this would be if many different engines hours (drawn from USAF data) is 300,000 hours, the NRIFSD were serviced with a contaminated batch of oil. In any case, the rate would be 4/300,000, or 1.3 NRIFSDs/100,000 flying hours. population of engines at risk must be bounded and the projected If the engine was in an F-16, we would also calculate the number number of hours these engines are going to fly for the life of the of future Class A mishaps (destroyed aircraft). Using the 79% fleet determined. A historical records search is also performed to severity factor, that would be 3.16 future Class A mishaps over find other similar incidents that may have occurred. Once the the life of the weapons system. root cause is identified and the population of suspect engines There are three threshold values used in the USAF to manage bounded, a statistical analysis is performed to estimate the future risk. Two are based on Non-Recoverable Inflight Shutdowns rate of occurrence for the problem under investigation. (NRIFSD) and the other on Class A mishaps. The NRIFSD thresh- There are several different statistical tools used to predict fu- olds for aircraft with one or two engines are 0.01 and 0.05 ture risk. The Weibull analysis and Monte Carlo analysis are two NRIFSDs per 100,000 flying hours (computed over the life of of the most common. The choice of which to use depends on the the weapons system). The thresholds are 0.05 and 0.10 for three nature of the problem. A Weibull (named after Waloddi Weibull, or more engine aircraft. The Class A threshold for all aircraft is a Swedish engineer, scientist, and mathematician) can be used as 0.5 Class As until the next inspection/repair opportunity. The a good first cut tool when not much is known about the problem required corrective action depends on what the NRIFSD rate or and there have been very few (maybe just one) failures. It can number of Class As is predicted by the risk analysis. For example, 10, 2008 SEPT. WEDNESDAY, predict if a risk of failure decreases with age (such as in an initial if a risk analysis for a specific problem predicts less than 0.01 quality problem), stays constant with age (indicating a random NRIFSDs and less than 0.5 Class A mishaps (one or two engine failure), or increases with age (indicating fatigue or wear-out aircraft), the program manager is only required to review the modes). The goal is to predict the probability of failure over time. problem. If the risk analysis predicts between 0.01 and 0.05 A Weibull analysis not only uses failure data, but also success data. NRIFSDs, the program manage will monitor the situation and A Monte Carlo analysis can best be used when there are many has the option of implementing some type of corrective action. variables affecting the problem, and the variables need to be When the risk analysis predicts a NRIFSD rate of greater than manipulated to see the effect on risk reduction. The variables 0.05, some type of corrective action is required to reduce the may be production tolerances, instrumentation data handling, projected risk to below that threshold. Table 1 summarizes the test schedules, control trims, unscheduled maintenance activi- current risk thresholds and required actions. The NRIFSD thresh- ties, probabilities of detection, human error rates, etc. All the old tends to protect smaller fleets while the Class A threshold variables are given a random occurrence factor and the simula- tends to protect larger fleets. The corrective action must be suffi- tion run over and over, thousands of times, if necessary, to give a cient to drive the risk below the established threshold. (It should predicted rate of occurrence. The more variables, the more ran- be noted that due to the cost of maintenance and repair of en- domness, the better it works. gines and inflationary drivers, there are a growing number of Severity factors are then used to define the probability that an Class A mishaps that do not result in the loss of an aircraft.). event may result in a safety incident. It is based on historical data. Obviously, in our example of a compressor blade fatigue prob- For example, we know by analyzing past events that when an lem, we are over both thresholds and corrective action is required. F-16, a single engine fighter, has a NRIFSD, 79% of the time that will result in a destroyed aircraft (Class A mishap). Example: There were four compressor blade failures in an engine fleet from a 2. Interim risk management high-cycle fatigue failure mode. If none of them resulted in a If the problem turns out to be a basic design issue with a compo- NRIFSD, an assumption would be made that the next one would, nent, the solution might be a redesign and retrofit of the fleet. In resulting in a severity factor of 1/5. If the Weibull analysis pre- some cases, this could take years to accomplish. This is where the dicted 20 more blade failures over the life of the fleet, we would concept of interim risk management comes into play. What can apply the severity factor and predict four NRIFSDs over that time. be done NOW to reduce the risk? This usually comes in the form Regardless of the method used, the idea is to predict how of- of inspections or operational restrictions. These temporary solu- ten the particular failure mode will occur in the future. Once the method is chosen, the analysis can be “calibrated” or compared to actual experience. If, for example, the analysis predicts that five events should have occurred by now, but there has been only one, then some of the assumptions made in the analysis may be incorrect and need further refinement. Once the number of predicted failures is calculated, the weapons Table 1. NRIFSD and Class A Threshold Values

ISASI 2008 Proceedings • 93

Proceedings 2008.pmd 93 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 94 hardware inLeadthe Fleetengineswillensure thatanypotential of operatingtimeasquickly as possible.Havingtheredesigned to keep theseenginesflyinginorder toaccumulateahighamount ignated ashigh-usageengines. Thefieldunitsmake everyeffort Program. ThisUSAFProgram selectscertainenginestobedes- engine managerwillmostlikely make useofthe“LeadFleet” retrofit isbegun. tests, and/orfieldserviceEvaluationsmayberequired before a will correct theproblem. Labtests,ground enginetests,flight the AirForce engine specialiststobesure itmeetstheneedsand speed ahead.Thecontractor’sredesign effortiscoordinated with ation oftheCIPstackingmightberequired. mitigation. Ifnot,theriskmayrisetosuchalevelthatreevalu- continue tobesure theymaintaintheircalculatedlevel ofrisk However, trackingoftheeffectivenessinterimactionsmust case, theinterimriskreduction actionswillhavetocontinue. redesign maybedelayeduntilmore fundingisavailable.Inthat higher priority, duetohigher riskorbettercosteffectiveness,the other problems are determinedbytheCIPmanagertobeofa will bereviewed and“stacked” againstotherissuesforfunding.If nent Improvement Program (CIP)contract.Here, theCIPtask will usuallyfalltotheenginemanufacturer, undertheCompo- be tasked tocomeupwithacost-effectivefix.Theredesign effort redesigned hardware orrevised assemblypractices. pending ontheproblem. Itisusuallyintheformofretrofit of lion dollarproject orasimpletechnicalorder (TO)changede- tions orinteriminspections.Thiscanbeamultiyear/multimil- all enginestoservicewithouttheneedforoperationalrestric- This finalphaseconcentratesonthemethodsneededtoreturn 3. Solutiondevelopment/implementationphase order. odic borescope inspectionsforthecompressor blade mightbein some interimriskmitigation.For alow-cycle fatigueissue,peri- at inthedamagingportionofflightenvelopecouldsupply tronic enginecontrol, asoftware changemodifyingthevaneangle in front ofthefailingcompressor bladecontrolled byanelec- of theenvelopemightbeappropriate. Ifthere were variablevanes flight restriction toavoidthatpart portion oftheflightenvelope,a found tobedrivenbyaparticular ample, ifthehigh-cyclefatiguewas be increased. tion/incorporation ratemayhaveto than initiallyanticipated,theinspec- mine therateofoccurrence isgreater to occur, orinspectionfindsdeter- rate iscorrect. Ifincidentscontinue to monitortheissuebesure the threshold values,thenitisimportant necessary tokeep theriskbelow ware incorporationisdetermined If acertainrateofinspectionorhard- solution totheproblem isdeveloped. tions are putinplaceuntilafinal During theintroduction phaseofthehardware retrofit, the When CIPfundingisinplace,theredesign effortgoesfull- When hardware redesign isrequired, theenginemanagerwill For ourcompressor bladeex- • ISASI 2008 ISASI Proceedings 94 Figure 1 This riskassessmentisperformed toquantifytheriskWAF that aportionoftheWAF fleetisexposed toincreased safetyrisk. affects abatchofWAF engines(E0009toE0019).This has shown ures andsubsequent research indicatedaprocess error, which enced aNRIFSDwith1,252totalcyclesaccumulated.These fail- total accumulatedcycles(Ccy).Shortlythereafter, E0010experi- encing ahigherwearoutratethanthebalanceofWAF fleet. problem exists withaseriesofWAF engines,whichare experi- The results ofthisinvestigationledtotheconclusionthatabatch root causeofthesefailures inorder toprevent future safetyevents. fractured “D”stagevaneshasprompted aninvestigationintothe Two Recent World AirForce (WAF) safetyincidentsrelated to Introduction Table 2 established threshold values. is required tokeep ariskofcontinuedoperationbelow AirForce factors are brought togethertomake thedecision ofwhataction the buckoutoftaxpayers’dollars. the risktofleetataminimumwhilegettingmostbangfor cation toafieldedsolution.Allthesestepsare required tokeep tion issufficienttokeep theriskbelowthreshold. monitored toensure thefixisworkingandrateofincorpora- their manifestationintherest ofthefleet. shortfalls intheredesign willbecomeapparent earlyon,priorto Engine E0009experienced anIFSDinAugust2002with1,591 The followingisasampleriskassessmentshowinghowallthese As canbeseen,italongprocess from problem identifi- Again, throughout theretrofit phasetheproblem needstobe 1/14/2009, 8:22 AM and provide recommendations to bring the WAF risk below safety thresholds.

Population at risk/exposure to risk The population at risk is all WAF engines that have received suspect vanes. Based on a records search, it has been determined that suspect parts have been installed in WAF engine serial Table 3 numbers E0009 through E0019. These engines are exposed to risk of failure until the suspect parts are removed from these engines. The Weapon System Life for the WAF is calculated based on the following information provided by the WAF: • WAF average fleet fly rate: 25 cycles per Month and 2 cycles per engine flight hour (EFH). 10, 2008 SEPT. WEDNESDAY, • WAF assumed engine retirement age: 12,000 cycles. • WAF total accumulated cycles: see attached histogram (Table 2).

Historical data A search of the System Safety Database has shown that throughout the history of the WAF engine program, there have been four vane failures (including the most recent failures in E0009 and Figure 2 E0010). Of these four failures two have resulted in NRIFSDs (Table 3). (NSDV) of 4,000 Ccy. • Replacing the suspect vanes in a rapid retrofit program before Severity factor they accumulated 160 additional Ccy. The severity factor for this risk assessment is based on the his- The next table shows the calculations of number of future ex- torical information presented in the historical data section of this pected failure for the 4,000 Ccy NSDV situation based on the risk assessment. above Weibull plot. Calculations for the baseline and 160 Ccy Of the four cases of vane failure, two have resulted in NRIFSDs. retrofit schedules are similar.

Therefore, the assumption is made that 2/4, 50%, of vane failures 4,000 Ccy will result in NRIFSD’s. Additionally, the historical Class A mis- Current Depot Visit 4,000 Ccy Vane Ccy F(X+a) F(X+a)- hap severity factor of .79 is used to calculate the number of Class Current Vane Vane Ccy F(X) from from F(X)/(1- A mishaps resulting from NRIFSDs. Engine S/N Time at Depot Weibull Weibull F(X)) E0009 1591 Risk prediction tool E0010 1252 The risk prediction tool used in this assessment of fleet risk for E0011 2474 4000 0.1778 0.402 0.2727 the failure mode related to “D” stage vanes is a straightforward E0012 2668 4000 0.2038 0.402 0.2490 E0013 2751 4000 0.2152 0.402 0.2381 Weibull analysis. E0014 2614 4000 0.1964 0.402 0.2559 The two failure engines were sister engines, and an investiga- E0015 2555 4000 0.1885 0.402 0.2631 tion was performed to determine if a batch issue was present. It E0016 1970 4000 0.1165 0.402 0.3232 was concluded that a process change was made during the time E0017 2219 4000 0.1456 0.402 0.3002 period that included engines E0009 to E0019. Based on this in- E0018 2284 4000 0.1536 0.402 0.2935 formation, a Weibull analysis was performed on only these sus- E0019 2538 4000 0.1862 0.402 0.2652 pect engines. This analysis yielded the following Weibull param- Total Expected Failures: 2.4609 eters: β = 2.01 & η = 5,569 (Figure 2). The total risk of continued operation of the at risk engines was Calculations calculated based of three scenarios. The application of the Weibull parameters to the WAF fleet in- • Baseline (do nothing) risk of operating the engines to their formation yields the following predicted number of failures (Fig- full 12,000 Ccy life. ure 3, following page). • Replacing the suspect vanes at the Next Scheduled Depot Visit Summary of results

ISASI 2008 Proceedings • 95

Proceedings 2008.pmd 95 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 96 Based onthemethodsandassumptionsusedinthisriskanalysis, Calibration of operation. have themreplaced before accumulationanadditiona160Ccy A mishaps).Alltheengineswithsuspectvaneswillberequired to threshold limits (0.05NRIFSDsper100KEFHand/or0.5Class retrofit scheduleisrequired toreduce WAF fleetrisktobelow current totalaccumulatedcycles. pect enginehasaccumulatedanadditional160cyclesfrom its 3. RapidRetrofit—Replace current suspectpartswhenthesus- rent suspectpartswhenthe engineisreturned todepot. 2. Retrofit atNext Scheduled DepotVisit (NSDV)—Replace cur- 1. BaselineRisk—Nocorrective actiontoWeapon SystemLife(WSL). ous fleetmanagementscenarios: The aboverisksummaryshowsthetoWAF fleetforvari- Figure 3:Fleetmanagementscenario. Based ontheassumptionsmadeinthisriskassessment,arapid • ISASI 2008 ISASI Proceedings 96 level flightatasafealtitudeasdeterminedbythesituation. would havecausedtheenginetofail,oraircraft cannotmaintain ful, orfurtherinvestigationdeterminesthatcontinuedoperation tion determinesthatarestart attemptwouldnothavebeensuccess- dures whereby theengineisunabletorestart, orfurtherinvestiga- engine malfunctionorbytheaircrew followingflightmanualproce- SHUTDOWN— ASC/LP &OCALCLP.ASC/LP Retrieved from http://propulsion-best- United StatesAirForce (June10,2003) United StatesAirForce (July6,2004,IncorporatingChange1,Aug.9, United StatesAirForce. (Feb.14, 2006). References practices.wpafb.af.mil/. epubs/AFMAN91-223.pdf. 223). Retrieved from http://www.e-publishing.af.mil/shared/media/ 2006) mil/shared/media/epubs/AFI91-204.pdf. Force Instruction91-204).Retrieved fromhttp://www.e-publishing.af. Aviation

1/14/2009, 8:22 AM Safety InvestigationsandReports Any engineshutdowninflight,eitherduetoan NON-RECOVERABLE INFLIGHT manual procedures. or bytheaircrew following flight ther duetoanenginemalfunction — INFLIGHT SHUTDOWN(IFSD) Hover taxiisconsidered flight. physically offtheactiverunway. way meanstheentire aircraft/UAV is the landinggear. Clearoftherun- the aircraft weightissupportedby craft, theaircraft hasalightedand or verticaltakeoff andlandingair- of therunwayor, forhelicoptersand/ fixed-wing aircraft/UAV taxiesclear for flightcontinuesuntileitherthe mencing anauthorizedflight.Intent or takeoff powerisappliedforcom- aircraft/UAV brakes are released and/ for flightisconsidered toexist when INTENT FORFLIGHT— Definitions (AFMAN91-223) NRIFSD, and0ClassAmishaps. the experience of2failures, 1 These valuescorrelate verywellwith NRIFSDs and0.7ClassAmishaps. dicted nearly1.8failures todate,0.9 the Weibull analysiswouldhavepre- Any engineshutdowninflight,ei- Safety InvestigationsandReports Best Practice PCOEBP99-06RevC (Air Force Manual91- ◆ Intent (Air A Review of Rapid Changes in General Aviation and Their Likely Effect on GA Safety in Four Countries By Robert Matthews, Ph.D., Office of Accident Investigation, Federal Aviation Administration, USA

Bob Matthews has been with the FAA since 1989, multaneously, the improvements offered by glass and by VLJs where he has been the senior safety analyst in the will be partly offset by new risks and by some new patterns. Office of Accident Investigation for the past 13 years. Other changes also will improve overall fatal accident rates His previous professional experience includes 9 years even if rates remain unchanged within the various populations THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, in national transportation legislation with the U.S. and activities captured by the label of “GA.” Demographic changes Department of Transportation, 2 years as a consult- and the effects of price likely will reduce activity among many ant with the European Union and the Organization less-experienced pilots and among riskier types of flight. Con- of Economic Cooperation and Development in Paris, and several years versely, with the technological expansion noted above, those popu- as an aviation analyst for the Office of the Secretary at the U.S. DOT. lations and flight activities that generally have relatively good His academic credentials include a Ph.D. in political economy from accident records will expand in absolute terms and especially in Virginia Tech’s Center for Public Administration and Policy Analysis, relative terms. Consequently we may compute and report lower and he has been an assistant professor, adjunct at the University of fatal accident rates Maryland since 1987. However, despite these caveats, the primary conclusion is that technological changes that are well under way will substantially he air taxi industry and large segments of general avia- improve net GA safety. The real caveat is that the net benefits will tion (GA) are undergoing rapid and fundamental tech be realized incrementally rather than in a one-off revolution in Tnological change for the first time in several decades, with safety. the broadly-based introduction of glass cockpits, a sustained increase in the business jet fleet, and the introduction of new Changes in the demographics of general microjets or “very light jets” (VLJs). This paper initially set out to aviation in four countries show how significantly these changes will improve overall GA Fatal accident rates in general aviation1 have improved incre- safety in four countries with large GA systems by reducing the mentally for years from better powerplants, improved air traffic frequency of certain types of accidents that tend to have severe services, better weather information, and other improvements. outcomes. However, the paper reaches more modest conclusions. Yet, for the most part, GA has been denied the rapid and re- The bottom line remains that the technological changes will sub- peated breakthroughs in safety that technology has brought to stantially improve overall safety but with more caveats than were the air transport industry. Instead, with the exception of the very initially anticipated. high end of the market (corporate jets), most of GA continued to This paper analyzes fatal GA and air taxi accidents from Aus- operate with a badly dated technological base, with carburetor- tralia, Canada, the United Kingdom, and the United States to based piston engines, limited onboard information, limited com- estimate the degree to which the increased application of new munications, etc. technology will affect GA safety in each of the four countries. The analysis uses accident data and accident investigation re- Changes in the fleet ports from the four countries as its primary source material. The The primary explanation for the technological stagnation rests paper is based on a methodology that mapped several key char- with the long-term collapse in the production of new, light air- acteristics of the new technology to each fatal accident in each of craft that began after 1978 and continued into the latter 1990s. the four countries. The central conclusions are as follows. Factors included the continued exposure of U.S. manufacturers Overall, GA safety will improve significantly as glass cockpits to product liability claims in accidents involving small GA aircraft enter the GA fleets at an accelerating pace and as very light jets decades after they were produced. Other factors included higher (VLJs) start to enter the fleet in large numbers among air taxis, fuel costs, higher landing fees and other user charges in many business operators, and the upper end of the private pilot mar- regions, plus improved travel alternatives, the loss of GA airports, ket. Simultaneously, the corporate jet fleet will continue its rapid demographic changes, and a glut on the market from some ex- growth in all four countries. These trends will enable GA to leap- cess production during the “good days.” frog several generations of foregone technological advances in The General Aviation Manufacturers Association notes that aviation and begin to close the gap with air carrier safety. shipments of GA aircraft by U.S. manufacturers peaked at nearly However, large portions of GA activity, and of GA fatal acci- 18,000 in 1978, with nearly 14,000 deliveries to the domestic dents, will prove to be immune to much of the innovation. Si- market and 4,000 delivered abroad. Deliveries collapsed to just

ISASI 2008 Proceedings • 97

Proceedings 2008.pmd 97 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 98 eral othersomewhatlesscommon fatalaccidentscenarios. much lessfrequent fuelexhaustion, andimprovements insev- into instrumentconditions,lower ratesoflosscontrol inflight, advertent flightintosevere weatherorinadvertentvisual flight accidents involvingcontrolled (CFIT),lessin- flightintoterrain Glass-cockpit GAaircraft shouldexperience lowerfrequencies of safety.that automationandtechnologyhavehadonaircarrier nificantly improved. workload issignificantlyreduced andsituationalawareness issig- that iscertifiedfornewairliners,theneteffectmuchsame— the equipmentmaynotbedirectly comparabletoequipment ers andtheupperendofbusinessjetmarket. Whilemuchof lar inconcepttothosethatnotlongagowere reserved forairlin- engine reciprocating aircraft nowoffersfunctionsthatare simi- nated theneedtomanageprop RPMsorfuelmixture. tude;, fuelwarningdisplays;andnewFADECs thathaveelimi- indicators thatproject speed,altitude,verticalspeedandatti- flight directors thatimprove theprecision of flight;6-secondtrend formation viadatalink;airportmapsandnavigationalcharts; bility ofonboard weatherradarorvirtuallyreal-time weatherin- space; displaysofothertransponder-equippedtraffic;thepossi- a multifunctiondisplay(MFD);graphicdepictionofcomplex air- notes that“glass”addsatleastaprimaryflightdisplay(PFD)and (AOPA) notesthatglass-cockpitaircraft are asubsetofTAA. AOPA and anautopilot.TheAircraft OwnersandPilots Association having atleastamovingmap,anIFR-approved GPSnavigator, The FAA definesa“technologicallyadvancedaircraft” (TAA) as Glass cockpits effect ofthesechangeswillbepositiveandsubstantial. for glasscockpits,thereby increasing theirpersonalrisk,thenet ket. Thoughsomepilotsmayprove tobeill-prepared forVLJsor or microjets, were beingdesigned andare nowenteringthemar- growth beginningaboutthe mid-1990s.Inaddition,verylightjets, neously, themarket forbusinessjetsexperienced unprecedented Today mostnewproduction isavailableonlywithglass.Simulta- tions onsmallerGAaircraft andasretrofits forexisting aircraft. has recovered. added more andmore technologytoitsproducts asthemarket approach 18,000unitsperyearagain,thenewproduction has cover by1997and1998.ThoughU.S.production willnever production facilitiesandprocesses, theindustrybegantore- Allowing forthenecessarytimetobuildorders andtorebuild sponded withtheGeneralAviation Revitalization Actof1994. aged inplace. 10 years.Inshort,thefleetremained essentiallystaticandsimply that from 1994to2004,theaverageageofGAfleetincreased Infrastructure, Transport andRegional Developmentreported report toitsParliament in2006,theAustralianDepartmentof fleet turnoverfor20years. ers andthedeliveryofbusinessjets,GAexperienced virtuallyno the exception ofsomeadvancesbyaircraft kitmanufactur- more than400aircraft were delivered todomesticbuyers.With 2,000 by1983andwere wellbelow1,000by1993,whenjustabit The effectsonsafetyalsoshouldcompare welltotheeffects With thisequipment,thecockpitofonce-humblesingle- The technologybeganwithglasscockpitsbeingoffered asop- Hope finallybegantoemerge whentheU.S.Congress re- Data from Australiamake thepointratherdramatically. Ina • ISASI 2008 ISASI Proceedings 98 of fiscalyears(September30). U.S. registry withvalidairworthinesscertificatesasofend Figure 2.CirrusSR20/22andDiamondDA40 aircraft on are nowglasscockpit. Figure 1.Makemodelsinwhichallaircraft with glasscockpitsalready may accountfor8to10percent ofall craft averagemore flighthoursthanolder aircraft, smallaircraft the penetrationof“glass”in thefourcountries.Sincenewair- purchases ofglasscockpitswithnewaircraft wouldatleastdouble 0.8 percent ofthefleet. However, retrofits andearlier, optional of theoverallfleet,whilepenetrationinUKhasreached just fleet abitmore slowly butatastillcomparablelevelof2percent tively, asofMay2008.InCanada,theseaircraft haveentered the craft accountfor3percent and2.7percent ofthefleet, respec- rapidly intheU.S.andAustralia,where theassuredly glassair- available. and showstheserialnumberafterwhichonlyglasswas made the mostcommonairplanesthatare nowavailableonlywithglass spective make-model wasavailableonlywithglass.Figure 1lists model, oneachnationalregistry thatwasproduced afterthere- retrofitted tovariousstandards. ment, northenumberofaircraft oneachregistry thathasbeen new aircraft that were delivered withtheearlieroptionalequip- the fleetbecausewecannotaccuratelyidentifynumberof we cannotidentifyexactly howmanyglass-cockpitaircraft are in craft. However, evenif weacceptauniformdefinitionof“glass,” make-model aircraft beganincorporatingglasscockpitsinallair- equipment outlinedabovewasoptional.In2003and2004,many Light aircraft withglasscockpitshaveentered thefleetmost However, wecanidentifythenumberofaircraft, bymake and When glassfirstbeganenteringthesmallaircraft fleet, the 1/14/2009, 8:22 AM factor is related to the fallout from 9/11. Security, congestion, higher load factors, and increased price have combined to make “premium travelers” seek alternatives to the airlines. Premium travelers (those who buy first-class, business-class, or full-fare coach tickets) are the one group that can generate meaningful profits, but they have shifted in large numbers to business or corporate aircraft, fractional ownership, air taxis, or to flying their own aircraft. Aviation Daily reports that the number of trips by premium travelers who used other segments of aviation equaled 18 percent of all premium tickets sold by U.S. carriers in 2000. By 2008 that figure was equal to 41 percent.

Changes in the mix of who is flying in GA Figure 3. Business jets in service in four countries. All data as of Figure 4 shows trends in total GA flight hours in Australia, Canada June 30 of each year. (Source: Airclaims) and the U.S. from 1996 through 2006. Each country reports data slightly differently and each defines terms somewhat differently, which makes precise comparisons impossible. For example, THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, Canada reports hours for private, corporate, and “other” flight as a single figure. Australia reports private and business flight hours separately, and the U.S. reports “personal,” “business,” and “corporate” flight as three distinct activities. Australia and the U.S. also report several other separate activities that may be recorded as “business” flight elsewhere. Generally, since 1999, trend lines in all three countries are modestly negative, but the aggregate trend lines obscure significant changes within the distribution of flight activity. As Figure 5 shows, “private and corporate” flight in Canada decreased by one-fourth in the decade through 2006. Similarly, as of 2006, Figure 4. Trends in total GA hours, 1996–2006 in Australia, private flight in Australia had decreased by 16 percent from its Canada, and USA. peak in 2002 and personal flight in the U.S. had decreased 20 percent from its peak in 2000. Agricultural flight also has fallen flight hours in the U.S. and Australia. Given the rapid growth in sharply in the two countries that report it separately, and instruc- business jets in all four countries, plus the penetration of new tional or training hours have decreased from their peaks. Since small aircraft, the total glass-cockpit fleet already accounts for data on training hours include training for various upgrades of nearly 15 percent of all GA flight hours in the U.S. and perhaps existing pilot certificates, the data understate the decrease in train- 12 percent in Australia, Canada, and the UK. ing for new pilots. The Cirrus SR20/22 and the Diamond DA-40 illustrate just Cost explains much of the decreases in personal flight or in- how rapidly TAA and glass-cockpit aircraft have entered the fleet structional flight. A person with no flight experience can expect in the United States. Based on data through June 2008, Figure 2 to spend a total of about $10,000 to obtain a private pilot’s shows that, by the end of FY 2008 (September 30), the U.S. air- license in the U.S. In addition, the cost of fuel has soared, and craft registry will have nearly 550 active DA40s and 3,300 active many regions continue to witness higher landing fees, reductions Cirrus SR20/SR22 aircraft. These two fleets alone will produce in available airspace, and new security restrictions. Then add the just more than 1 million flight hours in the U.S. in 2008. factor of higher prices for certified aircraft, which start around US$300,000 for a well-equipped airplane and can easily approach Business jets or exceed US$1 million. The bottom line is that the populations The business jet fleet has doubled or tripled in the past 15 years and fleets with the highest accident rates account for a steadily in each of the four countries, as shown in Figure 3. Though the decreasing share of flight hours. size of the markets varies, Figure 1 shows comparable trend lines In contrast, given their prices, glass-cockpit and other techno- among the four countries. From 1983 through 1994 or 1995, the logically advanced aircraft are unlikely to sit on the ramp for weeks business jet fleet in each country grew only slightly, if at all. Be- at a time. Instead, these aircraft are being purchased primarily ginning in 1994 or 1995, the fleets in Canada, the UK, and the for business or air taxi operations, and by private pilots who fly U.S. began rapid and sustained growth that has not yet abated. frequently for personal reasons. The hours associated with these The figure indicates that the rapid growth did not begin in Aus- aircraft and with the rapid growth in business jets will replace tralia for several years after that, but the pace since then has rep- much of the lost activity among the more recreational pilots and licated the growth in the other three countries. in the higher-risk activities such as amateur aerobatics, casual Several factors explain this sustained and rapid growth in the flight in local practice areas, etc. business jet fleet. First was the sustained economic boom that The result is that aggregate accident rates should improve sim- began in the early to mid-1990s, which made business jets more ply as a function of GA’s demographics. Finally, add the improve- affordable and more attractive to many companies. The second ments offered by glass-cockpit aircraft and other technologically

ISASI 2008 Proceedings • 99

Proceedings 2008.pmd 99 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 100 landing longandfastand/or goingaround. Ten ofthe24oc- delivered with glasscockpits.Ofthe24fatalaccidents,4involved expectation thatthetechnologywouldensure theirsafety. have exposed themselvestohigher-risksituations,perhaps inthe who are a bitmore likely tooperateinIMC.However, somepilots glass aircraft, namelyoperatorswhoflyfortransportpurposesand and confirmedAOPA’s findings. a surprisingfrequency ofcontrolled (CFIT) flightintohighterrain cockpit aircraft intheU.S.undertaken forthispaperalsofound sented inweatheraccidents.Areview offatalaccidentsinglass- noted thatTAA andglassaircraft are disproportionately repre- aircraft donotslowdownlike someotheraircraft. AOPA also explained thisbynotingthatmanyofthehigh-performanceTAA TAA aircraft haveafairlyhigh numberoflandingaccidents.AOPA trouble, butitwillnotsaveusfrom fundamentallybaddecisions. dent pilotstoavoidtrouble ortorespond safelyiftheygetinto world, thenewequipmentwillhelpproperly trainedandpru- learning curve.Theyalsohavetheirlimits.Asintheaircarrier istics andwillrequire somenewskillsandatleastatemporary More importantly, theseaircraft havetheirownflightcharacter- they accountforanythingthatapproaches amajorityofGAhours. craft are enteringthefleetrapidly, theywillrequire timebefore Though someofthepreceding datahaveshownthattheseair- Factors thatwillrestrictordelaythesafetybenefits mentally ratherthaninaone-offsafetyrevolution. eral factorssuggestthattheimprovement willbeachievedincre- bilities andsituationalawareness thatthenewaircraft offer, sev- tially so.Yet, despitethesharpimprovement innavigationcapa- TAA andglass-cockpit aircraft willimprove safetyandsubstan- Net effectsofglasscockpitsonfatalaccidentrates GA accidentrates,asdiscussedindetail,below. advanced aircraft, andtheneteffectsshouldbesubstantialon Figure 5.GAflighthours (000)byselectedflightactivitiesinthree countries. The U.S.hashad24fatalaccidents inaircraft thatclearlywere Some ofthissimplyreflects thedemographicsofwhobuysTAA For example, anAOPA analysisofTAA accidentsfindsthat • ISASI 2008 ISASI Proceedings 100 above, thenewequipmentalready has helpedtoreduce fatal governments report, suchasfatalaccidentrates. technology willhaveontheaggregate measures ofsafetythatmost nents inflight.This,turn,willminimizetheimpactthat new on thoseaccidentsrelated toabrupt failures ofsystemsorcompo- those activities.Thetechnologyalsowillhaveonlylimited effect nology associatedwiththenewfleetwillhavelittletonoeffects on substantial share oftotalflighthours.For themostpart,tech- cal helicopterservices,andotherswillcontinuetoaccount fora work, aerialobservation,airtours,offshore energy support,medi- is decreasing. Nevertheless,sectorslike agriculture, otheraerial significantly so.AsFigure activityinseveral sectorsofGA 5shows, ply willnotbeinfluencedbythenewtechnology, oratleastnot other TAA aircraft willcomefrom varioussectorsofGAthatsim- short, glassstillrequires good,basicflyingskills. and un-programmed instructionsatapilotinbusyairspace.In nology caninvitetrouble whenATC startsbarkingunexpected the aircraft is properly programmed, overreliance onthetech- sion flyingandtake uswhere weexpect togo.Finally, evenwhen equipment correctly sothattheairplanecanperformitspreci- ask forit. updates inflight,theairplanewillnotgiveusweatherunlesswe or XMweather. Notunlike otherpilotswhofailtogetweather several weatheraccidentsoccurred despitehavingweatherradar because adifferent pagewasdisplayedontheMFD.Similarly, displaysandwarningsystems,presumablycurred despiteterrain not thesameasusingthatsystem.SeveralCFITaccidentsoc- level intoalake. for suchactivity),andanotherpilotflyingVFRatnightflewwings flight (high-performanceaircraft probably are nottherightfleet Onepilotlostcontrol whileflyinglowonawildlifeobservation • Severalothersincludedlossofcontrol innightIMC. • divert toseveraldifferent airports. Yet, despitethesehonestcaveatsandtheexamples outlined The remaining limitationsonthepositiveimpactsofglassand In addition,glass-cockpitaircraft require that weprogram the As someoftheseexamples imply, havingasystemavailableis 1/14/2009, 8:22 AM short innightIMCaftertryingto proach, whileanotherpilotlanded ing “trouble” withhiscoupledap- night, advisedATC thathewashav- Apilot,wholandedshort,IFRat • known icing). aircraft wascertifiedforflightinto into knownicing(noneofthefive known icing,andthree involvedIFR Two accidentsinvolvedVFRinto • volved nightVFR. while anotherCFITaccidentin- onclimbout, both struckhighterrain at nightfrom mountainouslocations; other veryexperienced, tookoffVFR Two pilots,onelow-time andthe • amples. flight. Beloware somebriefex- Several alsoinvolvednightVFR known icinginvisualconditions. conditions (IMC),and2involved curred ininstrumentmeteorological onboard weather information, traffic alert systems, autopilots, Australia Canada UK and moving maps. All CFIT 46 64 63 In contrast, weather information was found to have limited Emergencies 8 38 19 positive effect on weather-related accidents that occur during take- Loss of Control in Flight 40 42 46 off and climbout. The primary explanation is that poor weather Loss of Control Maneuvering 4 4 4 during that stage of flight was rarely a surprise. Good onboard Loss of Control on T/O & Climbout 6 5 3 weather information in many such accidents in all four countries Midair Collisions 50 67 50 would merely have provided one more source of information to Undershoot-Overshoot 23 14 20 be ignored. TOTAL 18 23 20 The degree to which these improvements will affect accident (N Accidents Reviewed) 158 144 129 rates in each country depends on its current mix of accidents. For example, though glass-cockpits and other TAA aircraft may essen- Figure 6. Percent reduction in selected accident types tially eliminate fuel exhaustion, this will have little effect on the in three countries with glass-cockpit aircraft. UK’s accident rate because that has not been a significant issue in fatal accidents in the UK. Similarly, a significant reduction in high- terrain CFIT accidents will have a relatively modest net effect in Austra- THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, lia, where mountainous terrain is less pervasive than in other regions. As a result, a higher proportion of Australia’s CFIT accidents involve low-level flight and low terrain, where Figure 7. Selected classes of fatal accidents in the U.S. by fiscal year terrain warning systems will be less 2008 based on data through May 31 (8 months). effective. Australia also has had an unusually high number of wire strikes accident rates and can be expected to do so at an accelerating among its fatal accidents, and those events will not be easily influ- pace as we work through the learning curve. The anticipated enced by the new technology. In contrast, CFIT is a major issue in positive influences are outlined below. Canada and the United States, where three major, north-south mountain chains traverse the continent. CFIT in the UK falls some- Estimated reductions in fatal accidents where between the experience in North America and Australia. The effects of TAA and glass-cockpit aircraft were estimated As Figure 6 illustrates, the new aircraft should have compa- by analyzing 444 fatal airplane and helicopter accidents from rable effects on accident reduction across the different countries 1998 through 2007 in Australia, Canada, and the UK, plus in several accident categories. The total estimated reduction re- 2,126 fatal accidents in the United States from October 2001 flects differences in accident mixes across the different countries. (FY 2002) through May 31, 2008. The analysis tested each Note that the estimates implicitly reflect the distribution of acci- fatal accident against the key characteristics of glass-cockpit dent types among the various categories of flight activity, includ- aircraft, as identified above, (e.g., PFD, MFD, autopilot, moving agriculture, low-level observation, etc. ing map, electronic charts, fuel-distance radius, etc.). The ef- Due to the size of its system, recent data from the U.S. provide fects estimated here are intentionally cautious and reflect the some statistically defensible evidence of how these factors might likelihood of the new technology being used in a particular influence overall fatal accident numbers in the near term. Figure flight regime (such as agricultural work) or the technology’s 7 shows recent U.S. trends since FY 2003 in several categories of ability to affect the causes of an accident (such as fuel manage- accidents that typically have severe outcomes. As the figure shows, ment versus pilot incapacitation). fatal CFIT accidents have decreased 61 percent since 2003, while The strongest effect will occur in fuel management. This has fatal undershoots-overshoots have decreased 37 percent. Fatal been a persistent source of a small percentage of fatal accidents. loss-of-control-in-flight accidents has decreased 36 percent. As Excluding other fuel issues, like fuel contamination because of with anticipated improvements found in the other three coun- failure to secure fuel caps, straightforward fuel starvation ac- tries shown in Figure 6, decreases in fatal loss-of-control acci- counted for 4.4 percent of fatal accidents in Australia from 1996 dents while maneuvering or during takeoff and climbout are not to 2006, 3.5 percent in Canada, and 6.4 percent in the U.S. as dramatic, but they are meaningful. Only fatal loss-of-control Only the UK data show fuel exhaustion to be a rare causal fac- accidents during emergencies show no change, consistent again tor in fatal GA accidents. With the fuel-management tools avail- with findings shown in Figure 6. able on new aircraft, none of the four countries reviewed has Overall, fatal accidents in the U.S. are expected to be about 30 yet to have an accident, fatal or non-fatal, involving fuel starva- percent lower in FY 2008 than in FY 2003. A small decrease in tion Though human creativity may enable some pilots in the flight hours since 2003 can explain perhaps 5 percent of the de- future to accomplish the task, these aircraft should nearly elimi- crease. The major factors appear to be those emphasized in this nate fuel exhaustion and fuel mismanagement as a risk. The paper: the entry of TAA and glass-cockpit aircraft into the fleet, other areas of strong impact will be in CFIT, midair collisions, the growth of business jets in the fleet, and changes in the mix- loss of control in flight, and approach-and-landing accidents. ture of the purpose of flight. Changes in flight purpose probably Many of these reductions were related to assumptions about have been the most significant factor in the decrease to date.

ISASI 2008 Proceedings • 101

Proceedings 2008.pmd 101 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 102 required forgreater penetrationofthefleet,alearningcurveas Several factorspreclude thatfrom happening,suchasthetime tries, thoughperhaps atdifferent paces. and lastingimprovements infatalaccidentratesallfourcoun- nology inseveraldecades.Thesechangeswillbringsignificant ing airtaxis,isundergoing itsfirstbroadly basedchangeintech- those changeswillcontinue.Asaresult, generalaviation,includ- ies, asdoesthecontinuedandrapidgrowth inbusinessjets,but countries reviewed inthispaper. Thepaceofmarket entryvar- beginning toenterthefleetsinsubstantialnumbersallfour Glass-cockpit andothertechnologicallyadvancedaircraft are Conclusions the improvement forthenext severalyears. along withmore businessjetsandnewVLJs,shouldaccelerate However, overthelongerterm,TAA andglass-cockpitaircraft, Improvements willnotoccurasanabruptrevolution inrates. • ISASI 2008 ISASI Proceedings 102 For thepurposesofthispaper, “generalaviation” excludes scheduledpas- 1 “GA” oftenisusedinamannerthatsuggestswell-defined,singleclassof Endnotes substantial overtime. mental, buttheimprovements willbepersistentandincreasingly the newfleet.Instead,improvements willcontinuetobeincre- cance ofcertainactivitytypesthatwillnotbeinfluencedmuchby some pilotsmoveintoneweraircraft andthecontinuedsignifi- corporate aviation,for-hire sightseeingorairtours,etc. flight activity, includinghelicopters,airtaxis,personalflight,business planes, andlighter-than-airships.“GA” isusedhere tocapture allother its data,thispaperdefinesGAtoexclude microligths orultralights,sail- port aircraft. Also,toreflect differences inthewayeachcountryorganizes senger serviceandnon-scheduledpassengerorcargo serviceinairtrans- accident datathatcapture slightlydifferent fleetsandactivities. define GAslightlydifferently, andeachcountrycomputespublishes operating environments. Yet thefourcountriesexamined inthispaper captures ahostofverydifferent activitiesindifferent fleetsanddifferent activity. Inpractice,“GA” essentiallymeans“otherthanairlines,”which 1/14/2009, 8:22 AM ◆ Bringing the Worldwide Helicopter Accident Rate Down by 80% By Jack Drake, Helicopter Association International, USA

Jack Drake is currently an independent aviation Association International (HAI), who represented U.S. operators. safety consultant and co-chair of the International As the initiative has grown internationally, other countries have Helicopter Safety Team’s Accident Analysis Group. stepped up or expressed interest in using or adapting the model He is a former director of safety for Helicopter developed in the U.S. by the IHST. Association International and director of operations At the writing of this paper, the European Aviation Safety safety for America West Airlines. Before that, he was Agency (EASA) and Canada are continuing the initiative by ex- an investigator and manager at the National amining more closely their regional accidents while refining the THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, Transportation Safety Board for 26 years; and he was a pilot, flight IHST methodology to optimize the ability to identify corrective instructor, and safety officer in the U.S. Navy. Jack has been a member actions there. Several other countries and regions have begun to of ISASI since 1977. organize similar teams to determine how the process can reduce accident risk elsewhere. The methodology of the IHST was his presentation was motivated by a personal desire to adapted from the U.S. Commercial Aviation Safety Team (CAST), spread the word about an exciting new approach to acci- which set out to substantially reduce worldwide commercial air- Tdent prevention that has particular applicability to air safety line fatal accidents by addressing proactively common accident investigators, safety researchers, and aviation safety agencies. Tra- causes. Many of us have seen some of the by-products that additionally, if we were participants in a government-led aircraft acci- dressed controlled flight into the ground, approach and landing dent investigation, the objectives would be to determine the fac- accidents, and uncontained engine failures. The IHST set a simi- tors that led to the accident, to define the “probable cause” (or lar but higher goal—to reduce the rate of all helicopter accidents, causes), and to initiate corrective actions to prevent future acci- worldwide, by 80%—and progress is already being made. dents. The safety recommendations that followed would usually advocate regulatory change to require sometimes narrowly defined Measuring our progress corrective actions. This methodology is frequently addressed as While it must be admitted that the 80% goal was borrowed from the reactive approach or “preventing the last accident.” CAST, the expectation from the beginning was that the goal could That’s the way fatal air carrier accidents have been addressed be achieved—because of the early success of CAST in bringing in many countries over the past 40 years, and despite lots of criti- down the fatal air carrier accident rate and a belief that the heli- cism, the approach has helped to bring the air carrier accident copter community could be convinced that a systematic approach rate down substantially. Unfortunately, general aviation accidents, to helicopter safety was both overdue and needed. The IHST especially those that did not involve mechanical failures of criti- hoped for and saw an early reduction in the U.S. helicopter acci- cal components, although much more numerous, usually do not dent count and rate (in 2006) that was apparently the result of result in the issuance of safety recommendations—either because enthusiasm for the program and improved industrywide safety the accidents were not investigated to sufficient depth to support awareness. While that improvement was gratifying, it also became recommendations or because regulatory change could not be apparent that we didn’t actually know the U.S. and worldwide justified. Studies of similar accidents are infrequently conducted helicopter accident rates because we didn’t have a good handle and we continue to experience accidents just like we did before. on the denominator in the equation, helicopter operating hours. A more proactive approach and a desire to improve the world- Measuring future helicopter accident rates (and our progress) wide helicopter accident rate, which was perceived to be unac- would require more accurate measures of helicopter flight hours, ceptably high and negatively influencing the safety image of all which had traditionally been estimated based on limited opera- helicopter operations, led to the formation of the International tor surveys and were notoriously inaccurate. FAA flight hour esti- Helicopter Safety Team (IHST) in late 2005 and its commitment mates were used by the helicopter industry to calculate accident to reduce the worldwide helicopter accident rate by 80% in 10 rates. The IHST decided it would start its program using indus- years. It was recognized by the government-industry partnership try-accepted accident rate data from the years immediately pre- that constituted the IHST that its goal could not be achieved by ceding the start of its programs, but it also committed to initiate looking at general aviation and helicopter accidents and investi- an effort to improve the flight hour measurement that was criti- gative reports in the same way. cal to accurate accident rate calculations. Bell Helicopter has taken The taskforce formed to address and try to correct the prob- the lead on this and is collecting flight hour data for all helicop- lems contributing to the helicopter accident rate was led initially ter models worldwide. The process will use data points from air- by the U.S. Federal Aviation Administration (FAA), airframe and craft sales, public records of aircraft registrations, service diffi- engine original equipment manufacturers (OEMs) in the United culty reporting, maintenance data, and other sources. The data States, and by operators and associations, such as the Helicopter will allow us to calculate accident rates more accurately in the

ISASI 2008 Proceedings • 103

Proceedings 2008.pmd 103 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 104 jority oftheteam.Theteam wasselectedfrom applicantswith result wouldbedata-based,objective,andacceptable tothema- the ground rules,andtheCAST-based process assured thatthe used bytheJHSAT. Thecharteroftheorganization established JHSATs whileithasalsorefined itsaccidentanalysisprocess. gional role inacoordinated effortwithotherstateorregional thy changeisthattheU.S.JHSAT hasgraduallyassumedare- and partlybecauseoftheevolutiontasking.Onenotewor- partly becauseoftheexpansion oftheprocess internationally teams. Notsurprisingly, theroles oftheU.S.teams haveevolved, organization andtheinitialmakeup of theU.S.JHSAT andJHSIT mentation Team (JHSIT).ThefirstchartillustratestheIHST JointHelicopterSafetyImple- tions istheworkofIHST’s vetting, prioritizing,andsellingofthebestrecommenda- JointHelicopterSafetyAnalysisTeamIHST’s (JHSAT). The production ofrecommended interventionsisthefunctionof ceptable toacost-consciousindustry. Theanalysisfunctionand ventions thatare considered mostfeasibleandeconomically ac- come from theanalysisprocess wouldbebasedonthoseinter- to address eachofthosefactors.Recommendations thatwould to accidentcauses(root causeanalysis)andtofindinterventions examine accidentreports toidentifytheeventsthatcontributed tors, manufacturers, operators,andothersafetyspecialiststo Very simply, itusesthecombinedtalentsrepresented byregula- proactively toallsegmentsofaviationandotherindustries. ther, there isnoreason itsprinciplescouldn’t beapplied effort toreduce theriskofhelicopteraccidentsworldwide.Fur- international safetyprogram thathopestogrow to aworldwide it wasdominatedbyU.S.participantsinitsfirst2years).Itisan without increasing regulation. ItisnotaU.S.program (although ment-industry partnershipthatseekstobringaboutsafetychange and describedbrieflyhere. First (Figure 1), IHSTisagovern- achieve ahighersafetygoalisillustratedbythefollowingcharts The process whereby theIHSTisanalyzingaccidentdatato The IHSTprocess than previously indicatedbyindustrydata. higher thanpreviously estimatedandaccidentratesare lower future and(webelieve)willallowustoshowthatflighthoursare Figure 1 The secondchart(Figure 2)illustratestheanalyticalprocess • ISASI 2008 ISASI Proceedings 104 Figure 2 ferent mission categories,themajorityofsafetyissuesand the report discusses theaccidentsfrom theprospective of15dif- ries//usJHSAT2000Report.pdf). Itisinteresting tonotethatwhile free downloadfrom theIHSTwebsite(http://ihst.org/images/sto- data analysisandrecommendations isavailableto thepublicby dividual interventions. occurrences wasfoundtooutweighthequalitativeanalysisofin- frequently intheroll-up ofallthedata,asfrequency of JHSAT (numberingabout 135)were thosethatappeared most Those interventionsthatbecametherecommendations ofthe roll-up ofthedata,there were about1,200SPS-interventionpairs. the problem orwouldeliminateitinareal-world setting.Inthe how wellthegroup felttheSPSorlinked interventiondefined NTSB reports. and interventionsthanwouldbefoundintheconclusionsof atmoredeterminations andtypicallyarrived problem statements might havebeenprevented. We didnotrely on“probable cause” collective experience, todeterminehowtheproblem oraccident actly whyaneventoccurred, westillattempted,basedonour gations fortheSPSs.Whendatawere insufficienttodefineex- sponding interventionsthatwere thoughttobeappropriate miti- data). Havingdefinedtheproblems, wedevelopedasetofcorre- of theaccidentsorourabilitytodefinethosecauses(missing safety chainthatwere considered tohavecontributedthecauses lem statements(SPSs)corresponding totheeventsorlinksin methodology thatincludeddevelopmentofstandardized prob- items (reports, statements,photos,andsupportingdocuments). which consistedof197accidentreports andabout4,000 docket tion SafetyBoard (NTSB)calendaryear2000accidentdataset, cided tostart(inearly2006)withtheU.S.NationalTransporta- ing intheJHSAT group analyses).Thus,theU.S.JHSAT de- still beinlitigation(precluding somemembersfrom participat- completed byinvestigationauthoritiesandrecent accidentsmight takes afewyearsbefore entire calendaryearaccidentsetsare essary toselectadatasetthatwasseveralyearsoldbecauseit operators, andtobringbearreal worldexperience. Itwasnec- members whowouldrepresent regulators, manufacturers, and dustry. There wasadeliberateefforttoachievebalancebetween safety experience, whoalsorepresented across-section ofthein- accident investigation,safetyresearch, andproactive aviation The U.S.JHSAT report summarizingitsfirstyear ofaccident The identifiedSPSsandinterventionswere “scored” basedon Having establishedwhatwewouldexamine, wedeveloped a 1/14/2009, 8:22 AM intervention recommendations were substantially the same across that may have led to the accident, and the JHSAT elected to mission categories. Most of the problems defined were opera- consider this information as it examined how the accident might tional, and most of the interventions addressed better risk man- have been prevented. Probable cause: Undetermined. NTSB rec- agement, operational oversight by operators, and training. The ommendations: None. presentation of the JHSAT report to the IHST, in September 2007, officially transferred the result of the first year of JHSAT Problem statements effort to the JHSIT, which was tasked with deciding which recom- • Pilot experience lead to inadequate planning with regard to mendations to prioritize and how they should be implemented. weather. That work is on-going, even as the JHSAT is now concluding its • IFR system incompatible with mission. second year of accident data analysis. • Management policies/oversight inadequate. • Management disregard of human performance factors (i.e., We know more than we know! duty/flight time, fatigue). An in-depth review of a large number of accident reports and • Pilot disregarded cues that should have led to termination of their probable causes reveals many things, but not all we’d like to course of action. know—particularly if our task is to determine responsibility for • Darkness, fog, and rain. the accident (our tasking was to look for prevention opportuni- • Data/information not available to investigators. ties, not for causes). We’d like to know more about the pilot’s THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, training and decision-making, whether undocumented human Proposed interventions factors were involved, the exact sequence of events, what the pi- • Company risk assessment/management program. lot saw and what actions were taken, how the aircraft systems re- • FAA installation of ADS-B in GOM to facilitate IFR operations sponded, and how company standards (or lack thereof) and pres- in adverse weather and at night. sures affected crew performance on the accident flight. Without • Establish company SOP that disallows flying in adverse weather detailed documentation of these things and digital data from the at night except under IFR. aircraft, many of those questions remain unresolved in too many • Company SOP to eliminate onerous flight schedules and re- cases. However, the accident reports, especially when examined duce risk of fatigued pilots. in the context of reports of similar events, do reveal a great deal • Incorporate non-punitive fatigue call-in protocol. about how such accidents might have been prevented. We can • Company risk assessment/management program. read between the lines to some extent, especially when we’ve seen • Cockpit recording device with underwater locator. the same set of circumstances described in a variety of reports. The JHSAT examination, even of investigation reports that were Case Study #2: EMS Positioning Flight lacking, found lots of fertile ground for interrupting the causal “Fire-Radio Dispatch” directed the launch of an EMS helicopter chain with proactive action to reduce the accident frequency and to an LZ on a residential city street at night, although the LZ was rate. The following case studies are offered to illustrate the pro- only a few minutes away and an ambulance was already on scene. cess and the potential value of the JHSAT process and data Patient transport was intended to end at a hospital in another city. The launch decision by a non-aviation dispatcher was not Case Study #1: Offshore, Part 135 Cargo questioned by the pilot/operator. Operator guidance (to ground The helicopter went missing and presumably crashed on a night emergency response crews) had previously established minimum overwater flight in support of oil industry operations over the LZ requirements, but a non-conforming LZ was selected and was Gulf of Mexico (GOM) in deteriorating weather. The accident accepted by the pilot. The pilot’s high/low recon did not detect flight was one of several that day for the 61 year-old pilot, who obstructing wires, and ground personnel incorrectly advised the transported personnel and cargo between shore bases and oil pilot that there were no wires. Ground personnel did not ad- rigs, and from rig to rig. The pilot’s duty day began at 0800 and equately protect the LZ from approaching automobile traffic, was drawing to a close 13.5 hours later, after about 7 hours of which necessitated a go-around on final approach. The approach flight time, as he tried unsuccessfully to find the oil rig that was was not stabilized—the pilot carried insufficient power to clear his final destination. Meteorological data indicated that the flight obstructing wires—necessitating a controlled crash under the most likely encountered adverse weather (high winds, low ceil- wires. The pilot had only 28 hours in make/model. Probable cause: ings, rain, and reduced visibility) in darkness. Although he was Pilot failed to detect the presence of the wires and his misjudg- highly experienced in VFR operations, the pilot was not IFR- ment of clearance from the ground during the evasive maneuver. rated and the aircraft was not equipped for instrument flight. NTSB recommendations: None. The pilot relied on a GPS receiver, a telephone, and DR navigation to find his destination, as there was no FAA communications Problem statements or radar flight-following available near the presumed crash site. • Improper launch decision by non-aviation dispatch/commu- Analysis showed that the aircraft was about 25 miles from its des- nications center. tination and well off course when the pilot last spoke to a com- • Customer pressure to complete mission. pany dispatcher. The aircraft never arrived and the wreckage was • Flight crew decision-making inadequate. not found. As with all the other cases examined, the aircraft was • Management policies/oversight inadequate. not, nor was it required to be, equipped with cockpit or digital • Improper landing site selection by ground emergency flight data recorders. Nonetheless, the NTSB report was rich with personnel. information that provided an understanding of the circumstances • Pilot unaware of obstructing wires near the LZ.

ISASI 2008 Proceedings • 105

Proceedings 2008.pmd 105 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 106 dations addressed missiongroups separately, membersmay ISASI than wehavetappedinthepast. Whiletheresultant recommen- on theanalysesofgeneralaviation orhelicopteraccidentreports dations showthatthere isgreater potentialforprevention based These casestudiesandtheroll-up oftheintervention recommen- potential recommendations whenothersseemed more viable. sometimes resulted incombining,rewording, ordropping some same orsimilaraccidents.Theroll-up ofthesimilarinterventions Together they demonstratethere are manywaysofpreventing the kinds ofsafetyrecommendations beingconsidered bythe IHST. The proposed interventionsinthecasestudiesaboveillustrate Roll-up ofU.S.JHSAT fleetwiderecommendations Improvement Act). IncludehelicopterdatainPRIA(Pilot Records • Installcockpitdatarecording devices. • Usecrash-resistant fuelsystems(whenavailable). • Implementanon-punitivesafetyeventreporting system. • training. Conductprocedural intentionalnon-compliance(PINC) • Develophiring/screening criteriaforpilotapplicants. • Establish anoperatorsafety/riskmanagementprogram. • Proposed interventions Crash-resistant fuelsystemhadbeenremoved. • DataunavailabletoanalyzetheLOCmaneuver. • Absenceofthreat-free safetyeventreporting system. • Inadequatecrew hiring/screening criteria. • InadequatecompanySOPandoperationaloversight. • Pilot disregarded rulesandSOPs. • Improper pilotdecision-makingandactions. • Problem statements NTSB recommendations: None. decision toperformanabruptlow-altitude aerobatic maneuver. taking, andhehadacriminalrecord. Probable cause:Thepilot’s that theaccidentpilothadahistoryofaggressive flyingandrisk fire andbothoccupantswere killed.Theinvestigationrevealed pilot subsequentlylostcontrol andcrashed;there wasapost-crash other whenonepilotradioedtheother, “Hey, watchthis.”The Two ENGaircraft were flyingseveralhundred feetfrom onean- News Gathering(ENG)Flight Case Study#3:Returning from Electronic dards/controls. EstablishEMSmissionspecificoperationalriskassessmentstan- • Riskassessmentprogram thataddresses nightLZoperations. • Riskassessment/trainingforLZpersonnel. • Establishpre-approved landingsitesforEMSactivities. • Reinforce thepurposeandimportanceoflandingsiterecon. • Establish/assertoperationalcontrol/oversight byoperator. • Missionspecific(EMS)operationalriskassessmentprogram. • Assertiveness/AMRMtrainingforflightcrew. • communications centerpersonnel. Missionspecific(EMS)riskassessmenttrainingfordispatch/ • Proposed interventions model. Evasivemaneuverrequired—pilot inexperienced inmake/ • • ISASI 2008 ISASI Proceedings 106 Make greater avoidancewarningsys- useof helicopterterrain • resistant fuelsystemsandpersonallocatordevices. Improve crashsurvivalbymaking greater use ofavailablecrash- • flexibility forinstallationof(HUMS/EMS)data recording systems. detection ofimpendingfailure. Regulatory: Provide regulatory (HUMS) orEngineMonitoringSystems(EMS)capabilityfor early ImplementationofHealth andUsageMonitoringSystems • available foraviationemployerbackground checks. helicopter pilotsandFAA disciplinaryactionsandmake thisdata ground checksbyhelicopteroperators.Expand PRIAtoinclude (PRIA) informationmore readily availabletoemployersforback- Regulatory: Make Pilot Records Improvement Actof1996 • military surplusaircraft, engines,andcriticalparts. (DRMS)—develop aneasilyaccesseddatabasetoidentifyreleased operations. DefenseReutilization andMarketing Services stronger actiontominimizeunapproved partuseinpublic-use lic-use operatorscomplywithPart 91operatingrules.GSA:Take tenance tocivilICA(orequivalent)standards. Require thatpub- Regulatory: Holdpublic-usemilitarysurplushelicopter main- • improved regulatory oversightofmaintenance. (ICA).Pushstrictadherenceued airworthiness toICA,including ance systemsandensured adherence toinstructionsforcontin- Improve maintenancebybetterintegrationofqualityassur- • operations. considerations result inrefusing toacceptorcancelingflight ize agreements toshare weatherdata,especiallywhen Companiesoperatingin the samelocalareas shouldformal- • helicopter EMS(HEMS)weathertool,andothersystems. information, bothreporting andreceiving, through PIREP, the provide greater accesstoweatherinformation. Share weather (AWOS) infrastructure andotherweatherreporting sources to making. Improve theAutomatedWeather ObservingSystem data neededforpreflight planningandforinflight decision- riorating weatherconditionsbyexpanding availabilityofweather Infrastructure: Ensure thatcrews are aware ofadverseordete- • ment malfunctions,andlossoftailrotor effectiveness(LTE). state (settlingwithpower),dynamicrollover, systemsandequip- OEM rotorcraft flightmanualtoaddress autorotation, vortex ring described inthe Provide extensive initialandrecurrent emergency trainingas • areas, andpinnacleapproaches. stop maneuvers,landingpracticeonplatformsandinunimproved sitions, model-specificpowerandenergy management,quick- instrument meteorological conditions(IIMC),make/model tran- and limitations,emergency procedures, inadvertentflightinto of tailrotor effectiveness(LTE), aircraft performancecapabilities nautical decision-making(ADM)withregard toautorotation, loss ing devicestoreduce trainingriskandimprove trainingandaero- Promote increased useofsimulators,trainingaids,andtrain- • obstacles. and otherhigherriskmaneuvers,flightincloseproximity to Identifyandmanagerisksassociatedwithmission,low/slow • event reporting systemstoaddress employeesafetyconcerns. tional decision-making.Establishandusenon-punitivesafety (SMS) toriskmanagementimprove individualandorganiza- DevelopanduseaformalizedSystemManagementSafety • mendations). Someoftheseare summarizedbelow. that were proposed across missiongroups (thefleetwiderecom- be more interested inthekindofdata-basedrecommendations 1/14/2009, 8:22 AM Rotorcraft FlyingHandbook andasoutlinedinthe tems (HTAWS), obstacle proximity detection and protection vices), and other information that would aid the investigator in equipment, radar altimeters, synthetic/enhanced vision systems determining root causes of the accident. The NTSB subsequently (SVS/EVS), video recording systems (including rearward-facing responded that it would use the IHST suggestions to improve its cameras), and wire strike protection systems (WSPS) as applicable accident investigations. to aircraft mission. The IHST participants were very encouraged by the NTSB • Encourage development and use of optional aircraft warning response and have high hopes that the result will allow root cause systems to include low rotor speed, low fuel quantity, and dy- analysis and better safety recommendations in the future. If there namic rollover alert systems. is similar progress in getting more helicopters equipped with re- • Install Health and Usage Monitoring Systems (HUMS) to de- cording devices in the future, a quantum leap in credible acci- tect impending mechanical failures, and utilize HOMP to moni- dent investigation findings can be expected to follow. tor and provide oversight of flight operations. • Install cockpit/data recording devices appropriate to mission Safety is an attitude and aircraft model—such as cockpit image/information record- To conclude, I’d like to refer to some anonymous ramblings (au- ers (CIR), (low cost) flight operations data recorders, GPS posi- thor unknown) that attempt to define what we are trying to do. tional flight recorders, CVR/DFDR, and FOQA quick access re- • Safety is not an activity to be engaged in only when one is corders (QAR). being watched or supervised. Note: Although cockpit and flight data recorders were not installed on any • Safety is not posters, slogans or rules; nor is it movies, meet- THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, of the 197 helicopters in the calendar year 2000 accident dataset, it is not ings, investigations, or inspections. farfetched in 2008 to be asking for their installation in many helicopter • Safety is an attitude, a frame of mind. make/models. Sikorsky (as part of its Safety Enhancement Program) is • It is the awareness of one’s environment and actions all day, currently installing CVR, FDR, and current generation TAWS as stan- every day. dard equipment in its commercial helicopter models and offering retrofit kits • Safety is knowing what can injure or damage, knowing how to for its S-76 helicopters that were produced before 2005. Bristow/Air Logis- prevent the injury or damage, and acting to prevent it. tics has installed low-cost flight operations data recorders in its Bell 206 The International Helicopter Safety Team (IHST) takes the pro- and 407 aircraft and has recently received FAA approval for its flight active attitude that anyone’s helicopter accident belongs to all of operations quality assurance (FOQA) program, and ERA Helicopters was us. Accidents affect our collective reputation as the providers of air the first FAA-approved helicopter FOQA program. Without digital or video transportation and the suppliers of air services that don’t exist else- recording equipment installed, it is virtually impossible to accurately recon- where. We don’t need to accept accidents or a high industry acci- struct the events leading to many helicopter accidents. With such recorders, dent rate, and it affects our profitability if we do so. The U.S. JHSAT it is possible to improve accident investigations and also to use digital data attitude is that interventions can be identified and mitigated for all to reconstruct training or operational flights as a means of improving training accidents, even when the exact causes are not known to the opera- and flight crew performance. tor or the investigators. We don’t have to sit back any longer and wait for a probable cause determination before we initiate risk re- Accident investigating and reporting duction measures. We can use the data-based solutions derived by The IHST sought improvement in accident investigation report- a team with broad helicopter safety expertise to reduce risk and ing so that reports by the investigating authority would be more the helicopter accident rate, and we can use that process to learn useful for identifying root causes and implementing appropriate from other accidents. Other groups of helicopter safety experts and responsive safety actions. To facilitate this, in June 2007 representing other countries and regions are using similar pro- members of the JHSAT and JHSIT met with two NTSB mem- cesses to examine accident data from other parts of the world. All bers, the deputy director for regional operations, regional direc- of us are working hard to deliver to you unbiased and data based tors, and helicopter experts to discuss IHST findings and to of- solutions to prevent the problems that show up in the accident fer suggestions, including a checklist (provided later) seeking reports. But what is your attitude? Are you ready to use that data to documentation of the planning that preceded the accident flight, bring about a more proactive safety culture, better operational over- weather data available to the pilot, a description of any inflight sight, better mission-specific operational training, better risk-based emergency and how the pilot responded to it, a description of launch and inflight decision-making, and the installation of equip- the size and complexity of company operations, the operator’s ment that will reduce pilot workload, reduce accident risk, and program for managing risk and safety, the pertinent operator better define why accidents occur? Those of us on the JHSAT hope SOPs and operational oversight, the pilot’s pertinent (mission) you’ll find our process useful and employ it elsewhere to improve training and experience, company hiring criteria, the availability accident investigations and make better use of the information and usage of safety/mission equipment (including recording de- contained in those reports. ◆

ISASI 2008 Proceedings • 107

Proceedings 2008.pmd 107 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS Airline Pilot Associations,where hecurrently serves. 2008 Johnwasselectedasthedirector ofsafetyfortheCoalition 2006 JohnwasselectedtobecomesafetychairmanforSWAPA, andin and incidentinvestigations,includingtheMDWoverrunevent.In Southwest AirlinesPilots’ onseveralaccident Association,Johnserved flies thelineasaB-737captain.Assafetycommitteememberfor 108 B they cangetawaywithwithout beingcaught(pathological),sys- cal, bureaucratic, andgenerative.There are systemsthatdowhat that there are basically three typesoforganizations: pathologi- SMS andthekindofpeople weseeeveryday. SMSteaches us not hard tomake thecorrelation betweenthebasicconceptsof tem themachinesandpeopleoperatedinasanorganism? It’s what if,instead,wechangedourperspectiveandlookatthe sys- it makes senseformostofustothinkintermsmachines.But not partofapresidential inquiry? tors usetohelpgainasimilarperspective,especiallyifthey are tions were justrightfordisaster. Sowhatcanthenewinvestiga- tile fieldsforhazards to develop andlaydormantuntilcondi- all pointedtoorganizational safetyculture issuesthatmade fer- Dryden AccidentandtheColumbiainvestigation board how tolookatsafety. Virgil Moshansky’s Inquiryreport intothe factors thatatthetimewere seeminglyunrelated. to theaccidentsite,however, mayhavebeeninfluencedbymany conditions, andinteractionscanbeclearlyseen.Thepathtaken the benefitofhindsight;andconnectionsbetweenevents, basic humanfactorstextbook willpointout,however, youhave and oversightsasifyouwere followingastream uphill.Asyour backwards untilyoutracealltheactiveandlatentfailures, errors, ing willteachyoutothinklinearly: Startattheaccidentandwork Safety ManagementSystems(SMSs). repeated inthefuture. Oneofyourbesttoolsistheknowledge and tomake sure thereasons fortheirseemingobscurityare not pathogens thatmayhavelieddormant,undiscovered untilnow, place slowlyovertime.Thekey istouncovertheresident safety tectonic forces thatshapedtheeventualoutcomemayhavetaken dar screen, beyondthesimulatorortrainingmanuals, you are investigating arose from. Beyondthecockpitorra- Since airplanesare machinesandaccidentsinvolvemachines, The SafetyManagementSystemisatitscore aphilosophyabout It’s adifferent wayofmappinganinvestigation.Formal school- • ISASI 2008 ISASI the systemthatgaverisetoconditionsaccident ness marksortheFDRreview, there laysthebedrock of eyond the45-degree shearlipsofmetalfailure, thewit- a pilotforSouthwestAirlinesin1996andcurrently signals officerontheUSS asasenior landing Skyhawk, andalsoserving 1996 asaNavalaviatorflyingtheF-14 Tomcat, A-4 entered until theU.S.Navyin1986andserved Boston Universitywhere hemajored inmusic.He John Gadzinski Proceedings SMS asanInvestigationTool By Capt.JohnGadzinski, 108 received hisdegree in1986from Eisenhower

Director ofSafety, SouthwestAirlinesPilots Association (ISASI CorporateMember) (ISASI . Johnbecame aircraft brakingonwinter contaminatedrunways.Outofmany very detailedandscientifictests hadbeendoneontheissueof took meayeartofigure out.Here wastheproblem: Aseriesof indeed setthebasisforanaccident. model? Iwilldemonstratehowsuchaorganizational culture can knowledge thatrisksexist asafundamentalpartofthebusiness of badconsequences?Isitareduction ofrisk?Doesitevenac- central issueofwhatsafetymeanstoanorganization? Isitalack 4. Dothepracticesoforganizations followthe procedures? 3. Dotheprocedures employedreflect this policy? 2. Dopeopleknowaboutit? 1. Isthere awrittenpolicyonsafety? basic questionsaninvestigatormuststartwith organization’s SafetyManagementSystem,there are really four a learningculture. • a reporting culture, and • a justculture, • aninformedculture, • tributes out isSMS.Asafetyculture isdefinedintermsoffourbasicat- that, youneedthefourprinciplesofasafetyculture asspelled system thatiscontinuouslyself-correcting andresilient. To do when someoneislooking;theobjectofgametocreate a learn thatit’snotenoughtosimplycatchviolationsanderrors its abilityto culture andphilosophyonsafetycanoftenactasaprecursor to this lessonandmanyothers,SMSteachesusthatanorganization’s seen conditionsandhowsuccessfuloutcomescanresult. From together asateamandadapttothenew, unplanned,andunfore- trol ofApollo13.We seehowagroup ofindividualscancome cockpit ofAlHaynesandUnitedFlight232orthemissioncon- is considered a“generative”organization. such anorganism, albeitfrom abusinessperspective.Thisiswhat end, wealwayshopethattheorganization weworkforlookslike nonjudgmental approach toanacquisitionofknowledge.Inthe embody theconceptsofcontinuallearning,improvement, anda Armstrongs ortheTiger Woods whophysicallyandemotionally of viewandlearnalesson.OfcoursewealllookuptotheLance unless asuddentrauma(heartattack)makes uschangeourpoint model ofsafety. We dowhatismostcomfortableandreasonable logical). We tendtospendoureverydaylivesinthe“bureaucratic” ment, merely hopingthatnothingbadwouldbecomeofit(patho- some point,mostofus(usuallyatanearlyage)livedforthemo- as aconsciousactofcontinuousself-improvement (generative). accident (bureaucratic), andsystemsthatstrivetolearngrow tems thatdowhattheyare comfortablewithuntilthere isan One ofthebiggestchallenges Ihadinasafetyinvestigation At itsheart,though,theabovequestionsmustbebuilton the It soundsincredibly simple,butwhenmeasuringan We studyexamples ofgenerativesystemswhenwelookatthe It’s nothard tothinkoftheseconceptsinhumanterms.At identify 1/14/2009, 8:22 AM andmanageriskincomplex systems.We also years and millions of dollars, a final report had been drawn up tory agency. That culture placed a high value on eliminating un- and the data had been presented. The chart is probably familiar certainty and applied that to an area where uncertainty was un- to most of you who have ever dealt with this problem and looks avoidable. The result was a lack of information on risk that blinded like this: the crew to a dormant safety hazard and ended up in a well pub- licized runway overrun. Braking Coefficients for all Aircraft vs CRFI The hazard in this case was a type of contamination that can be hard to observe and even harder to predict regarding aircraft braking performance. Most commercial jet aircraft have a fully modulating antiskid system that protects the aircraft tires from failure to skidding and helps in directional control when landing on slippery runways. This works well when there is very little shear between whatever the tire is rolling on and the prepared pavement of the runway. Place a deformable surface between those two, however, and the effect is similar to total dynamic hydro- planing. Although the aircraft systems may be commanding 3,000 psi of hydraulics to the brakes, the antiskid systems may only be allowing 300 psi to the brake pads due to the increased slip ratio THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, caused by the increase in horizontal shear between the tire and the pavement. Added to this was a major safety variable. This condition is Source: Transport Canada Flight Research Laboratory Report LTR-FR-183, June 2002. very hard to directly measure and communicate in a timely fash- ion. The runway condition for one jet could be different from the The chart above shows us a couple of things. One is that there next landing 5 minutes later with no significant visual cues to the is a wide range of data points with little resemblance to a linear airport. The hazard described is known as “slush” and can form correlation. If we statistically take the mean average, we can draw in a variety of ways from snow when local temperatures are within a correlation line (solid line). If we reduce the slope of that line, 3 degrees Celsius of freezing. When this happens, runway fric- we capture the vast majority of data points above the new calculation readings can be invalid, surface conditions may not visually tion shown (dashed line). The logic goes that if you wanted to chance appreciably, and aircraft braking performance can dete- make a correlation between the two values that captured more riorate dramatically. There are no indications in the cockpit of than 95% of the hard data, you could do it; but it wouldn’t be how such braking system performance can be affected, very little 100% foolproof. There would still be some data points below the visual cues to alert airport operators, and almost no high-speed line that would represent a non-conservative relationship. indication to the pilot. This is because at normal landing speeds, Sounds simple enough, but the problem was that there were the effect of wheel brakes can be completely masked by the aero- two sets of very smart people living in two different countries that dynamic decelerating forces acting on the aircraft. By the time took this concept and came to very different conclusions. the pilot notices, it is too late. The conclusion I drew was that it was this difference in cultures Conditions like these are often described as “pathogens” be- that contributed to the accident. In simple terms, one defined cause while they may present a significant variable in safety, they safety as an absence of liability to engineering uncertainty. The only produce bad results when placed in the correct environment. other defined safety as the reduction of risk to an acceptable level. In this case, all that was needed was a short runway and some The policy of the latter was clearly spelled out, communicated faulty assumptions and any organization blind to this hazard could though advisory publications, and practiced operationally by pi- find itself unexpectedly thrust into a runway accident. But if the lots and airport personnel. Most importantly, they recognized purpose of an investigation is to prevent such accidents, what that their system was not perfect and communicated when con- must be done then is not only to look at the proximate cause ditions would preclude any use of such a risk assessment tool. associated with the event but more importantly understand why The other culture was where the accident occurred and their the organization was blind to such a pathogen to begin with. For method of risk management was articulated as follows: that we go back to our knowledge of safety management. SMS is at its very heart a collection of best practices institu- While it is not yet possible to calculate aircraft stopping distances tionalized by an organization and its culture. As such, these prac- from friction measurements, data have been shown to relate to tices define what poses the least legal liability for the organiza- aircraft stopping performance under certain conditions of pavement tion. That is easy to say, but hard to practice. What happens contamination, and are considered helpful by pilots’ organizations.” when you put legal concerns ahead of safety practice? You get procedures that reflect a management of legal risk. How many The questions are then asked, what is the safety policy this times does a manual state “should” or “recommended”? Clearly verbiage is supporting? What procedures are we to follow, how someone who does something that’s not recommended would are we to know when to follow them, and what should our prac- be found at fault if the consequences for the judgment made tices be? turned out to be undesirable. The environment stated above was developed by people who But what if the choices made by the person at the time made had the best of intentions, training, and skills but their concept sense in the context of the situation? How was the policy on safety of risk was heavily influenced by the safety culture of their regula- supported by the procedures written? How was the person in-

ISASI 2008 Proceedings • 109

Proceedings 2008.pmd 109 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 110 implementation guide,suchastheonepublishedbyTransport room. AneducationinSafetyManagementSystemsandabasic cockpit oftheaircraft mustbetiedtothe“cockpit”ofboard bined withknowinghowanorganization itself“flies”safely. The is operated.Knowinghowanaircraft fliessafelymustbecom- both howthemachineisoperatedbutalsoorganization tinually changesitselftoconstantlyadapt. the organization thatsupportstheminteracts,learns,andcon- accidents andincidentsbeyondthebentmetalintoway increasing levelofriskmanagementdemandsthatwelookat do theconsequencesforsystemfailure. Theneedforanever- sult inanaccident.Asthereliability ofourmachinesincreases so anomaly cancascadeoutofcontrol inunexpected waysandre- machines inwaysthatare oftendifficulttopredict. Asystem interact withmachinesthatotherhumansandtheir policy theroot causeorisitthedecisionsmadebypilot? gation, isthephilosophyofriskmanagementbehindwritten becomes unacceptable?Ifthisafindinginyourinvesti- not mandatory, isthere everapointwhere theriskofnotusingit volved tounderstandit?Ifaflightdirector shouldbeusedbutis The role oftheinvestigatorthenmustincludeknowledge Aviation isreferred tosometimesasa“meta-system.”Humans • ISASI 2008 ISASI Proceedings 110 investigator. derstanding thatprocess needstobethegoalofeverysafety mitigated muchmore effectivelynowthaneverbefore. Un- the bestpracticesandtechniquesofSMS,thesefailures canbe the ApolloIpadfire. Thanks toanewapproach tosafety, and “failure ofimagination” whenitcametoawareness ofriskin ers were. safety culture were simplynotaskingthesamequestionsasoth- happened wasbecausethepeoplewhooperatedinaccident’s deeper levelitbecameclearthatthereason whytheaccident aged riskandtheotherwasmore focusedoneliminatingit.Ona was tobedonewhentheywere found.Oneorganization man- as itdefinedhowanorganization looked forhazards andwhat list. Inthiscase,themere presence ofanSMSprogram waskey, spectives inourexample managedsafetyusingabasicSMScheck- and SMSaswell. bers notonlyinaccidentinvestigationbutalsohumanfactors truly outstandingsafetydepartmentwillhavetotrainitsmem- ing from aninvestigation.Anorganization wishingtopossessa Canada, canbethetouchstoneforuncoveringmanyissuesaris- In theend,itwasasastronaut Frank Bormandescribedasa As aninvestigator, itwasnecessarytolookat howthetwoper- ◆ 1/14/2009, 8:22 AM Investigating Unmanned Aircraft System Accidents By Thomas A. Farrier (MO3763), Senior Analyst, Aerospace Safety and Operations, Analytic Services, Inc., Arlington, Va., USA

Tom Farrier is an aerospace safety and operations means that, for the foreseeable future, every UAS investigation senior analyst for Analytic Services, Inc., of Arling- carries with it the potential to make a significant contribution to ton, Va. In addition to working on unmanned regulatory decision-making. aircraft safety for the Federal Aviation Administra- Regulators have several common goals in their quest to inte- tion’s Air Traffic Organization, he supports the U.S. grate unmanned aircraft systems into their existing airspace sys- Department of Defense on aviation safety issues. tems. They obviously want to prevent midair collisions between THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, Tom also serves as a subject matter expert in aviation- UAs and occupied aircraft; they want to minimize the likelihood related disciplines ranging from homeland security to airline, airport, of UA crashes with the potential to cause loss of life, injury, or and heliport safety. A retired U.S. Air Force command pilot, he is a property damage on the ground; ideally, they would seek ways of member of the U.S. Air Force Safety Hall of Fame. preventing the loss of unmanned aircraft themselves; and they are vitally interested in not creating increased ATC workloads The views expressed in this paper are the author’s and do not reflect while trying to avoid any of the above. official positions of Analytic Services, Inc., or its clients, including the To these ends, there are three fundamental issues that are be- Federal Aviation Administration and the Department of Defense. ing explored in the quest to integrate unmanned aircraft system operations with those of other aircraft: Introduction • To what extent are unmanned aircraft systems capable of op- It doesn’t matter whether you are a friend or a foe of unmanned erating interactively and cooperatively with other users of the aircraft systems (UAS). They are coming. Unmanned aircraft sys- airspace? tems of virtually every possible type will, at some point in the • To what extent does the remote location of the pilot from the not-too-distant future, share most classes of airspace with occu- aircraft he or she is flying affect the safety of the overall activity? pied aircraft. • To what extent are there limits on the number of unmanned Although the side-by-side operation of manned and unmanned aircraft that can be safely operated in a given geographical loca- aircraft may at some point become commonplace, unmanned air- tion, and what drives such limits? craft systems are not yet as advanced to this end as some may wish Before being faced with the need to conduct a formal UAS to assert. This is primarily because the technology itself—espe- investigation, there are three sources of information—some ob- cially where it is intended to compensate for UAS’ lack of “see- jective, some inherently partisan—which investigators should and-avoid” capability—is to some extent still in its infancy. Cur- cultivate to develop personal perspectives on these issues: rent UAS operations often are as much research- development- • Manufacturers of unmanned aircraft systems, oriented as they are practical applications of mature capability. • Military operators of unmanned aircraft systems, and Many commercial concerns looking to build and sell unmanned • Non-commercial users of comparable systems (i.e., hobbyist aircraft systems have virtually no prior experience in the aero- model aircraft pilots). space domain, but their desire to gain a foothold in an entirely The balance of this paper is intended to acquaint readers with new kind of market is leading them to innovate. Similarly, many the basics of unmanned aircraft systems—what they are, how they governmental entities perceive great value in the kinds of capa- work, and the hazards they pose—and how that basic knowledge bilities that UAS provide, but are not pursuing their develop- can be applied to investigating UAS accidents. Readers wishing ment in a consistent manner. These two factors suggest that many to delve more deeply into the specific of UAS operations and practices long held to be “industry standard” in the areas of airsafety concerns should periodically refer back to the three key craft manufacture and operations are going either unrecognized issues and consult the three principal resources listed above to or disregarded in the quest to move forward in the UAS arena. guide their own self-education process. Meanwhile, regulators have been obliged to make many critical decisions regarding the safety of various technologies, opera- What is an unmanned aircraft system? tional concepts, and rule-driven requirements for unmanned air- There are two possible answers to this question: one that seeks to craft almost exclusively on the basis of manned aircraft experi- be descriptive, and one that flirts with being irreverent. In the ence. None of the processes currently used to evaluate UAS risks latter case, the current reply is “Nobody knows!” and authorize UAS operations were designed with UAS in mind. There is general agreement by both International Civil Avia- The long-term correctness of regulatory strategies resulting from tion Organization and U.S. Federal Aviation Administration au- these processes will be judged, at least in part, on the nature of thorities that the flying part of an unmanned aircraft system meets safety issues identified through UAS accident investigations. This the definition of an “aircraft” for regulatory purposes. However,

ISASI 2008 Proceedings • 111

Proceedings 2008.pmd 111 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS (SHEL) model. Edwards’ 1972“Software-Hardware-Environment-Liveware” terdependencies withinaviation-oriented systems:Professor Elwyn that there already isatime-testedframeworkforexamining in- the existing aviationsystem.Manyreaders probably are aware aircraft systemsintermsofthenewrelationships theybringto UAS issue,aswelltheimportanceofunderstandingunmanned existing aviationsystem. 112 22, 2007) Material andConsiderationsforUnmannedAircraft Systems(March “system” partofthenamingconvention.InDO-304, the aboveconsiderations,butisabitvaguewhenitcomesto of RTCA developedaworkingdefinitionthataddresses mostof craft withnooneaboard. Sofar, sogood. erations. So,let’sstipulatethatan“unmannedaircraft” isanair- ment) andasufficientlyreliable UAS tosupportpassengerop- tion ofasufficientlyrefined businessmodel(ormilitaryrequire- occupied UAS, becausethere isunlikely tobeaviable combina- ful tosay),there’s somevirtueinthegeneralconceptitexpresses. context ofanaircraft (aswellasit’sbeingabitmore ofamouth- the “U”inUAS. Settingasidetheimprecision ofthatword inthe der-neutral through substitutionoftheword “uninhabited”as art. There are occasionalattemptstorender thistermmore gen- to beready toexpand yourhorizons. what youalready knowaboutaccidentinvestigating…youjustneed a widebodypassengerjet.Thismeansyoudon’t havetothrow out few caveatsdiscussedbelow)toaUAS accidentastooneinvolving sion hasassembledandcandrawuponthat’sasapplicable(witha investigator. There’s asubstantialbodyofknowledgeourprofes- of “aircraft” isagoodplacetostart,especiallyifyou’re anairsafety is ornot. sence ofregulatory languagethatcanshedlightonwhataUAS beyond thattop-levelunderstanding,there isanear-totalab- a stand-alonesystem small considerationwhenoneacknowledgesthataUAS isatonce control ofanunmannedaircraft iseffectedbecomesarelatively UA andapilotlocatedelsewhere. However, themeansbywhich on theairframeitself,andsomerequiring interactionsbetweena controlled “withoutdirect humanintervention”—some resident of “UA,” there are ahostofpossible waysthatsuchaircraft canbe among thevarioustypesofaircraft meetingthebroad definition this particulardetail.Apartfrom thedesigndifferences thatexist ment shouldbeexpected tobringwithitthepotentialforreal, duction ofanentirely newtechnologyintoa working environ- to onecomponentinasystem affectstheothers.Thus,intro- portant principleunderlying Edwards’ concept isthatanychange The abovediscussionillustratesthecomplexity oftheoverall Now comesthetricky part.SpecialCommittee203(SC-203) For theforeseeable future, there willbenosuchthingasan Next, considerthe“unmanned”partofcurrent termof Let’s backupamomentandregroup. Thebaselinedefinition As farasthelastsentenceisconcerned,there’s alotofdevilin For ourpurposes,it’sessentialtoremember thatthemostim- ments thatmakeupaUAS. from withinorontheaircraft.human intervention aircraft (UA) isanaircraft operatedwithoutthepossibilityofdirect associated elementsrequired tooperateintheNAS.Anunmanned An unmannedaircraft systemisanunmannedaircraft andits • The word “system,”asusedinthisdocument,includesallele- ISASI 2008 ISASI , SC-203 definesaUAS, SC-203 asfollows: 2 Proceedings and 112 apartoffarlarger, highlystructured 1 Guidance system segments. in DO-304tovisuallydepict theconceptofunmannedaircraft the relationships theyhavewitheachother. the SHELmodel,especiallyinthattheyare definedintermsof As such,thevarioussegmentscanbealignedreasonably wellwith stand-alone, discrete elementsandtheinteractionsamongthem. ter anywhere thataUAS mightoperate,segmentsconsistofboth text orforthatmat- oftheU.S.NationalAirspaceSystem(NAS), term the“segments”ofunmannedaircraft systems.Inthecon- sion, thepotentialroot causesofUAS accidents—iswhatthey ing thehazards associatedwithUAS operations—andbyexten- to evolve. those interested inkeeping upwithhow theUAS sector islikely be considered foundationalandisworthyofclosereading by the otherwayaround. For allofthesereasons, DO-304should tion systemfitintoaUAS-centric operationalmodel,insteadof spective thatrequires envisioninghowexisting usersoftheavia- miliar, andtheydefineunmannedaircraft systemsfrom aper- the sametime,theyintroduce terminology thatisattimesunfa- tems intothelarger aviationsystem already inoperation.At impacts andimplicationsofintroducing unmannedaircraft sys- erations. Theseformausefulbasisfordiscussingthecountless damental conceptsregarding generalcharacteristicsofUAS op- hasdonemuchtodevelopandelaborateonsomefun- SC-203 systemsegments Unmanned aircraft accidents foratleastthenext decade,ifnotmuchlonger. variability thatwillprovide challengestoinvestigatorsofUAS operations varywidelyfrom oneinstancetothenext. Itisthat mactic abasisaspossible. work withit…preferably onasroutine, consistent,andanticli- however, othersinthe surrounding airspacemustbeprepared to piece ofmetal.Oncethatmetalispersuadedtobecomeairborne, trol loop—eitherasapilotorprogrammer—is anon-flying what itdescribes.AUA withoutahumansomewhere initscon- aircraft system”isatonceimprecise andthebestavailablefor mitted tofly. skill levelsappropriate totheairspace withinwhichtheyare per- knowledge andqualificationmixingwithotherpilotstrainedto thepotentialforpilotsmeetingvariablestandards ofaviation • sibility, and unique attributesofeveryUAS operatedintheirareas ofrespon- airtrafficcontrollers whomustbespecificallybriefedonthe • require severalwaiversjusttogainadmittance, anenvironment consistingofregulated airspacewhere UAS • standards, UAS hardware thathasyettobedefinedbyanyconsensus • UAS software that’shighlyvariablefrom systemtosystem, • action. Thecurrent stateoftheartincludes of whichare subjecttomanagementensure theircorrect inter- software, hardware, environmental, andliveware components,all and totheexisting processes upon whichtheyrely. working init(mannedaircraft pilotsandairtrafficcontrollers), but sometimesunquantifiable,impactsonthepeoplealready The following diagram was developed by SC-203 andincluded The followingdiagramwasdeveloped bySC-203 conceptthatisreadilyOne SC-203 applicabletounderstand- In short,thewayshumansare involvedin,oraffectedby, UAS This lastpointisthereal reason whytheterm“unmanned Applying thehelpfultermsofSHELmodel,aUAS has 1/14/2009, 8:22 AM craft that enhance their mutual situational awareness. Although some readers may argue that other aircraft are in fact part of the larger airspace system within which each UAS operates (i.e., the NAS), the SC- 203 separation of the two highlights the fact that controllers and other aircraft each perceive and react to a UAS through different means. This in turn invites safety personnel—including air safety investigators—to explore how those different paths could result in hazards to the manned aircraft, as will be discussed presently.

How unmanned aircraft systems THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, differ from manned aircraft (and each other) Let’s start with the good news. There’s nothing magic about unmanned aircraft systems in and of themselves. Un- manned aircraft fly using the same aero- dynamic principles as their heavier- (or lighter-) than-air manned counterparts. A thorough investigation, using the Figure 1. Unmanned aircraft system segments (from DO-304, Guidance Material same familiar techniques of gather- and Considerations for Unmanned Aircraft Systems [March 22, 2007]). ing testimony and analyzing evidence, will lead to accurate and use- The aircraft segment consists of the UA plus as much (or as ful conclusions in most cases. little) onboard hardware and software as it requires to conduct a Now, the bad news. Unmanned aircraft systems can be differ- flight from takeoff through landing.3 At the high end of capabili- ent in any number of ways from manned aircraft. Most members ties, a UA’s avionics suite may include a control system (receiving of the aviation community key on UAS’ inability to clear their commands and providing aircraft performance and health feed- own flight path (of which more presently). Small size, and in some back); a communications relay for beyond line-of-sight operations; cases deliberate design for minimum observability, can make it navigation, traffic and terrain avoidance, and surveillance systems; equally hard for other aircraft to acquire and avoid them as well. and a flight management computer to support in-flight stability However, there are many other subtle and unsubtle differences and reduce pilot workload. At the opposite extreme, a low-tech, that have a bearing on their relative safety within, and impact on, line-of-sight UA may have little more than the ability to receive manned aircraft sharing the skies with them. For example, the pilot inputs and turn them into control surface movements. design of any unmanned aircraft system intended for operation The control segment consists of the pilot, as well as any non- beyond the pilot’s line of sight must support the pilot’s situational UA-mounted equipment that supports launch and recovery, awareness in terms of flight conditions, aircraft performance, and flight planning, and flight control and operations. In its sim- the health of the vehicle itself. plest form, the control segment may be no more than a pilot Unfortunately, the more information needed to provide such with a hand-held controller, with the UA taking off by being awareness, the more bandwidth is required to provide it. There- hand-started, thrown into the air, and landing via parachute or fore, it is left to each manufacturer to make tradeoffs and risk capture in a net. At the other end of the scale are ground con- decisions regarding the level of detail and sampling rates required trol stations with comprehensive pilot displays and significant to substitute for the pilot’s inability to directly perceive turbu- automation supporting each mission profile. Also, even though lence, precipitation, ice accumulation, a growing high-frequency SC-203 did not explicitly address this point, an observer or chase vibration, or the smell of a short-circuit. pilot is required for safety purposes should be considered part Along these same lines, there are a whole range of hazardous of this segment. The inclusion of such an individual creates a situations that can result from the pilot not being located in the “segment within a segment,” since the observer must commu- aircraft. These may include anything from the consequences of nicate directly with the UA pilot. the pilot losing control of the aircraft to the pilot not being aware The communications segment is best understood as the link of what’s happening to the aircraft. In addition, the wide variabil- or links that connect the pilot to the aircraft, and the pilot to ity in performance and equipage among individual systems means the controlling air traffic facility and other sources of aviation- that there are few hard and fast rules regarding their relative related information. This segment also is intended to encom- abilities to safely interact with other aircraft. Rather, this variabil- pass any electronic interactions between the UA and other air- ity greatly complicates the investigator’s task, since any given UAS

ISASI 2008 Proceedings • 113

Proceedings 2008.pmd 113 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 114 endurance flight—maybe Manyunmannedaircraft—especially thosedesignedforlong • a failure ofcontrol lawsthatsubjectedittoextreme stresses. of suchanaircraft couldindicateaseriousdesignflaw, orpossibly ited bythephysicallimitationsofoccupants.Aninflightbreak-up tended tobecapableofhigh-performancemaneuveringnotlim- turally robust thanmannedaircraft, simplybecausetheyare in- Somemilitaryunmannedaircraft maybesignificantlymore struc- • two completelyoppositescenarios: with anapparent inflightbreak-up, aninvestigatorcouldface to piecetogetheranaccidentsequence.For example, whenfaced bilities alsohasthepotentialtomisleadinvestigatorsattempting logue thatisinprogress ontheseissues. accident investigationsmustbeusedtoinformtheongoingdia- ferent inappearance,behavior, andapplications.Theresults of velop ameaningfulsetofthresholds foraircraft thatare sodif- regulatory structure isgoingtobe. It’salmostimpossibletode- ing orclassifyingunmannedaircraft systemswithinaconsistent one’s awareness ofjusthowcomplicatedtheprocess ofcategoriz- simple actofgoingthrough thisexercise willdomuchtoraise that lendsitselftoapples-to-applescomparison.However, the or reprogrammable orbit point,initiateterminationsystem,etc.). Lostlinkbehavior(e.g.,return toorigin,flypredetermined • periods ofcontrol linkloss,etc.),and mission withminimumpilotintervention,autonomousduring Capabilityforautonomousflight(e.g.,fullypreprogrammed • tributed, etc.), Type ofground control (lineofsight,internal/external, dis- • Vehicle applications(surveillance,etc.), • Echelonofcontrol (militaryonly), • Line-of-sight/beyond-line-of-sightoperations, • Climb/cruise/dash/loiter/approach airspeeds, • Serviceceiling, • Maximumrateofclimb/descent, • Vehicle takeoff gross weight, • Vehicle wingspan, • Vehicle length, • pare themagainstoneanotherbasedonthefollowing: random (ifIdidit,I’dbeaccusedofstackingthedeck)andcom- the reader isinvitedtopickthree systemsofdifferent sizesat with unmannedaircraft across thesizeandcomplexity spectrum, of performance,capabilities,andphysicalattributesassociated configuration, capabilities,andlimitations. involved inanaccidentmustbeassessedbasedonitsspecific every investigationmustbe approached withacleanpieceof dards ofmanufacture, certification,andoperationare adopted, have beenfactorsinagivenaccident. Untilwidelyacceptedstan- as ameansofmakingjudgments astoUAS attributesthatmay unmanned aircraft systems,eitherintermsofhow theyworkor component needtobeslightlystrengthened. limits, orperhaps thatthemargins ofsafetyforaflight-critical (or unknowingly)flewitintoflightconditionsthatexceeded its up ofthistypeaircraft couldindicatethatthepilotknowingly need toincorporatecrashresistance features. Aninflightbreak- aircraft, sincetheyare optimizedforweightsavingsanddon’t Finally, thenature ofindividualUAS constructionand capa- Much ofthisdataispubliclyavailable,butnotalwaysinaform To gainadeeperappreciation forthecountlesscombinations The bottomlineisthatitimpossibletogeneralizeabout • ISASI 2008 ISASI Proceedings 114 less structurallyrobust thanmanned conversely, isunabletointervenewhentheneeddosoexists). pilot iseitherunaware oftheneedtointerveneinanoperationor, station); andinterestingly, automation-inducedevents(where the pilot shiftscontrol ofaUA inflighttoanotherpilotorcontrol transfer ofcontrol problems (where somedefectoccurswhena movements visuallyastheyoperateahand-heldcontrol device); tions (where “external pilots”operatetheUA byobservingits narios underwhichaccidentsoccurinvolvedirect-control opera- For example, onerecent study and shouldbefollowedcloselybytheinvestigationcommunity. is emerging asasignificantarea ofinquiryforresearch projects the UA’s current phaseofflight. of thatinformationneedstobepresented tothepilotbasedon ensure thetimelyandappropriate selectionofwhateversubset tion flowsbetweenthecontrol andaircraft segmentsandhowto Human performance,especiallywithrespect tohowinforma- • cies used,lostlinkbehavior),and Control linkstabilityandreliability (pastperformance,frequen- • interfaces), pilot/flight managementorcontrol system,andon-board system Aircraft-specific reliability (structure, propulsion system,auto- • identified inthree mainareas. ers’ systems.Thismeansthatproblems are continuouslybeing ization amongthevariouscomponentsofdifferent manufactur- stages ofdevelopment,andthere islittleinthewayofstandard- Most present-day unmannedaircraft systemsare inrelatively early systems in unmannedaircraft Sources ofpotentialaccidentrisk certificate—experimental category—iftheywish toflyintheNAS. for COAsatthistime,butis free toseekaspecialairworthiness Anyoperatorotherthanthosedescribedabovemaynot apply • limited topublicentitiesorcontractors tothoseentities. aircraft” asprovided in14CFR§1.1,andtheiroperatorsare COAsare issuedonlyforUAS thatmeetthedefinitionof“public • National AirspaceSystem dum ofAgreement forOperationofUnmannedAircraft Systemsinthe tions, andExemptions”), orpursuanttotheFAA/DOD ity OperationandAdministration zation (COA)issuedinaccordance withFAA Order 7210.3, may onlybeconductedunderaCertificateofWaiver orAuthori- fined inTitle 14,CodeofFederal Regulations (14CFR),Part 73 UAS operationsoutsideregulatory specialuseairspaceasde- • tivities ofnational-levelinterest: of militaryreadiness, research anddevelopment,otherac- byunmannedaircraftaccess totheNAS systemsforthepurposes policy determinationsasaninterimmeasure toensure essential U.S. Federal Aviation Administration(FAA) hasmadethree broad their proper operationandoveralleffectiveness. which themselvesneedtobesubjectcontinuousevaluationfor various combinationsofdesignfeatures andprocedural controls, ated withUAS operations.Suchhazards maybemitigatedby to haveatleastageneralsenseoftheprincipalhazards associ- fairly narrowly focusedissues, it isequallyusefulforinvestigators and atotallackofpreconceptions. paper, awillingnesstoaskseeminglyover-simplifiedquestions, To thelatterpoint,humanfactorsinunmannedaircraft systems In theabsenceofexisting regulations totheaboveends, Although itisusefultobeaware oftheimportancethese 1/14/2009, 8:22 AM , Sept.24,2007. , Chapter18(“Waivers, Authoriza- 4 suggeststhatthree commonsce- Memoran- Facil- 5 • Loss of control or • Internal/external visual pretty much always will have a live pilot to interview. Beyond communications links limitations that, virtually every accident investigation will be heavily depen- —Sustained loss of control link —ATC loses visual contact with unmanned —Sustained loss of data link aircraft (UA) dent on the nature and specific capabilities of the involved ve- —Lost communications —Observer loses visual contact with UA hicle and systems. • Between ATC and PIC —Inability of UA to detect/respond to visual • Between PIC and OBS cues (e.g., hold short line, light gun signals, As explained above, at present, there is no reliable, consistent etc.) taxonomy that permits the categorization or classification of the • Other system issues —Other aircraft unable to see UA —UA system failures vast array of possible UAS configurations. Similarly, there is no • Degraded control • Outside interference or • Uncontrollable intrusion such thing as a “standard” UAS—almost every one incorporates • Engine malfunction —Wake turbulence on UA design features and performance attributes unique to the indi- —Positionable ambigiuty —Unauthorized aircraft in Class D airspace —UAS latency not otherwise described —UAS operations team human vidual system. Terminology for various system components also (i.e., unforseen system failure mode performance associated with human/machine interface, tends to vary from one manufacturer to the next, meaning it is etc.) • UAS operations team human sometimes difficult to fully understand exactly how a given sys- —Power failure in tower performance —Crosstalk (command intended for UA on tem works until you can equate its logic to that of other systems ground received and acted upon by UA in —Lack of standardization UAS-specific flight) training or currency with which you may be more familiar. • Pilot • Observer Notwithstanding the above, it is possible to construct a list of • Controller —Unrecognized/unexpected meterological generally descriptive questions that can help drive the investiga- change tion in productive directions with a minimum of wasted time. For THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, example, Figure 2. Class D airspace UAS-related hazards. 1. Propulsion: What type of engine does the aircraft use and how is it powered, e.g., AVGAS, MOGAS, diesel, Jet-A/JP-8, special The key to the above is that all of these policy-based controls fuel, electric (solar or battery-powered), etc.? Is the powerplant must of necessity be interim measures. It is clear to all concerned certified for aviation use, was it built specifically for the unmanned that the growth of UAS activity in the United States soon will aircraft, or was it adapted from an existing engine used for other overwhelm the FAA’s ability to manage individual UAS opera- purposes? Are there any unusual components that might pose tors’ activities. Therefore, the COA process owner—the FAA’s Air hazards to investigators in the field following a crash (capacitors Traffic Organization (ATO)—has been developing a means of with high residual charges, fuel cells, etc.)? assessing UAS hazards as they affect other aircraft in, and con- 2. Control: How does the pilot control the aircraft? Does the sys- trollers of, regulated airspace. Their approach is based on one of tem incorporate a hand-held controller, a fully equipped ground the main components of the FAA’s Safety Management System: control station, or both? What type of instrument layout is used the Safety Risk Management (SRM) process.6 by the pilot for control, navigation, communications, and mis- Throughout 2007, the ATO had a team of experts evaluating sion execution? To what extent does the aircraft provide infor- the various hazards that could be reasonably expected to be en- mation to the pilot about its operating conditions and environ- countered in the course of UAS operations in Class D airspace. ment, such as turbulence, icing, vibration, overheat/fire, etc.? If This panel generated the following list: the control link is lost, what is the aircraft designed to do, and The three hazards underlined in Figure 2—sustained loss of how much time normally will elapse before it autonomously ex- control link and system failures resulting in degraded or total ecutes a course change or termination subroutine? Does lost link loss of control—were assessed as “initial high risks” by the panel- behavior change throughout the flight, or is it preprogrammed? ist. While the specific assessments and the recommendations for 3. Operations: Is the aircraft designed for line-of-sight opera- reducing the residual risk are still undergoing formal review, the tions only, or is it intended to be operated beyond visual range? implications are clear: a lot can go wrong with a UAS in the con- If the latter, how does the pilot maintain contact with the aircraft fines of Class D airspace that can quickly lead to significant risk and with the ATC facility responsible for its area of operations? to persons and property in the air and on the ground.7 How does the pilot navigate? Does the navigation system afford Investigators are invited to consider the above list as a starting the pilot the ability to change heading, altitude and airspeed at point for development of a list of generic issues that should be will or as directed by air traffic control? Can the pilot identify and explored in the context of each UAS-related investigation. De- proceed to navigational fixes and waypoints upon request? termining how specific attributes of the various types of unmanned 4. Collision vulnerability: What does the aircraft look like? Is it a aircraft systems may be related to these hazards is discussed in highly visible color, or designed to be difficult to visually detect? the next section. Does it incorporate position and/or anti-collision lights? On the size spectrum, is it closer in wingspan to a manned aircraft, or is it Planning and carrying out a UAS investigation more model-like? Given that kinetic energy is expressed as KE = The simplest way to approach a UAS investigation is to treat it ½ mv2, how fast is it designed to fly, and how much does it weigh? exactly as you would any other aircraft investigation: systemati- 5. Construction: What is the aircraft made of? Does it consist of cally, deliberately, and scaled appropriate to the loss sustained. aviation-grade components, or is it essentially off-the-shelf in However, the only way you can do that in real time is by prepar- manufacture? Is the aircraft made of primarily radar-transpar- ing well in advance and building understanding of the different ent or radar absorbent materials, such that it would generate aspects of unmanned aircraft systems and operations to which little or no primary radar return in normal operations? If so, you will have to pay special attention. does the aircraft incorporate a transponder? There is one indisputable fact about unmanned aircraft sys- 6. Flight systems: What avionics are used to support the UAS’ tem accidents: unless it has been a VERY bad day, an investigator operation? Are radios TSO-compliant? What frequencies are used

ISASI 2008 Proceedings • 115

Proceedings 2008.pmd 115 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 116 pendent expert intotheinvestigation from theoutset. cryption inasystem,make itvirtuallyessential tobringaninde- trol protocols, aswelltheinclusion ofcontrol commanden- specific subjectmatterknowledge. Proprietary conversion orcon- ing software defectsadauntingtaskforvirtually anyonelacking able self-correction andresponse toon-board navigationinputs. that allofthoseon-board communicationswillbetwo-way toen- outcomplexhas theabilitytocarry lostlinkbehavior, thatmeans another operatinglanguage.IftheUAS isself-stabilizingand/or lating theresulting commandstotheflightcontrol actuatorsinyet control inadifferent linkinputsthatarrive format,andthentrans- control laws inonecomputerlanguage,applyingthoselawsto and stabilizingunmannedaircraft involvetakingexisting setsof consulting capacity. Someoff-the-shelfapproaches tocontrolling engineer asapartoftheinvestigation,eithermemberorin sonably sophisticatedUAS, itwouldbeprudenttohaveasoftware ate commandsbacktotheflightcontrol actuators. can quicklycascadeintofaultydatatothepilotandinappropri- the flightcontrol actuatorstotheflightmanagementcomputer— highlight howonefailure—say, lossofperformancefeedbackfrom on atimelineandtracedtotheirsource. Thismethodwilltendto various segmentsorinternaltoonesegmentshouldbemapped shown inFigure 1.Anydisruptionsintheinteractionsamong the “segment”diagram UAS underinvestigationagainsttheSC-203 thespecificcomponentsof tifiable. Thisinvolvesarraying in somecomplicatedscenarioswhere root causeisnoteasilyiden- itself toa“systems”approach toinvestigationthatmaybeuseful to developcredible recommendations. incidents, aswellyieldingusefulfactualinformationuponwhich well-documented investigationofmostUAS-related accidentsand preferred practicesandchecklists,shouldsupportathorough, visualization software? the datastream? Istherecorded datacompatiblewithanyflight data? Isthere anyon-board recording devicethatcanfillgapsin link alsoresult inlossofdownlinked performanceandhealth compared withtheaccidentsequence?Doeslossofcontrol to theonebeingflownattimeofaccidentthatcanbe tained? Are there recordings availablethatshowasimilarprofile format? Whatisthesamplingrate?Howlongare suchdatare- operations?Whatparametersaremal GCS captured, andinwhat record flightperformanceandotherrelevant dataduringnor- 8. Flightdata:DoestheUAS ground control stationtypically needs ofthepilot? in thedirection offlight?Ifso,howisitsusecoordinated withthe load usedtosupportflightoperations,e.g.,anopticsballaimed aircraft power, ordoesithaveitsownpowersupply?Isthepay- of thatpayloadpotentiallyhazardous? Doesthepayloaddrawon 7. Payload: Whatkindofpayloadscan theUA Isanypart carry? that helpensure itssaferecovery? or degraded,are there automaticprotocols forload-shedding electrical powerare aboard theaircraft, andiftheyare interrupted ability todetectandreact toconflictingtraffic?Whatsources of affect thecommunicationssegment?Doesaircraft haveany cal sources ofradiomagneticfrequency interference thatcould for line-of-sightandbeyond-line-of-sightcontrol? Are there lo- The sheercomplexity makes ofmanysucharrangements find- One finalconsideration:For anyinvestigationinvolvingarea- The peculiarnature ofUAS designandoperationalsolends The abovequestions,usedincombinationwithaninvestigator’s • ISASI 2008 ISASI Proceedings 8 116 In agrowing numberofcases,themostvaluablepartanun- an unmannedaircraft beinglooked uponasbeing expendable. tively lowcostofbottom-end UAS withitthe possibilityof carries interest innotcrossing oneonablind hill. pose ofadoubleyellowline,driversunderstandtheyhave vested point ofviewastrafficrules—oncetaughtthemeaningand pur- such, aviationregulations are writtensomewhatfrom thesame serious, possiblymortalinjuryshouldtheyprove incorrect. As withthemtheimplicationof but manyinflightjudgmentscarry make decisionsabouttheirflightsbasedonavarietyofinputs, of anunmannedaircraft is may notbesuitablefortwofundamentalreasons. tems are operatinglooselyundergeneral-aviation-typerules,which commercial operations.However, fornow, unmannedaircraft sys- their casefor“onelevelofsafety”togreat effectinmosttypesof the AirLinePilots Associationandothershavesuccessfullypressed aviation hassignificantlyevolvedovertime,andorganizations like many years.Thepresent-day frameworkofregulations governing large. for badpracticesorchoicestoadverselyaffectthepublicat ommendations needtobemadetoward limiting theopportunity to besubjectedclosescrutinyinconsideringwhetheranyrec- being done,andwhatwasnottoprevent theaccident. could occur. Thisshouldallowagapanalysisbetweenwhatwas anaccidentsequencebeforeinterrupting aworst-caseoutcome mitigation assertedashavingbeeninplacewiththeintentof scope, quality, reliability, andproper implementationofeach UAS andflightactivityunderconsideration; andassessingthe understanding eachhazard resulting from thecombination of the exact configurationandcapabilitiesoftheinvolvedUAS; mitigations beeninplace.Thiswillrequire fullydocumenting cident sequencemighthavebeenbettercontrolled haddifferent the accidentsequence? did someproperty orcharacteristicoftheUAS startorsustain have beenequallylikely tohavebeeninvolvedinanaccident,or Would amannedaircraft operatingunderthesameconditions • mance oftheUAS itself? ducted? Was theactivityconsistentwithdesignandperfor- dent suitabletotheairspaceandaltitudeatwhichitwascon- Was theUAS activitybeingperformedatthetimeofacci- • those waivershaveanybearingontheoccurrence? If not,whatregulations (ifany)were waivedfortheUAS, anddid plicable tomannedaircraft operationsattheaccidentlocation? Was theUAS conforminginallrespects totheflightrulesap- • how theUAS out.For operationwasbeingcarried example, important toexamine eachaccidentsequenceinthecontext of mitigations thatwork,andtheonesdon’t. space moveahead,airsafetyinvestigatorsmusthelpidentifythe efforts tonormalizeUAS activityandintegrateitintocivilair- ers, andassumed“bestpractices.”For atleastthenext decade,as have beenenabledbyapatchworkofregulations, policies,waiv- ity ofUAS operationsconductedanywhere intheworldtoday The pointhasbeenmadeelsewhere inthispaperthatthemajor- Making usefulrecommendations Second, unlike mostmannedaircraft, thesimplicityand rela- First, unlike anyotherclassandcategoryofaircraft, thepilot Finally, thequalityofpilot/operatordecision-makingwillneed Then, theinvestigatormustdeterminewhataspectsofac- In developingUAS-related accidentrecommendations, itis 9 Thissetofissueshasnotrequired consciousaddressing for 1/14/2009, 8:22 AM never atriskofphysicalharm.Pilots manned aircraft is its payload, usually followed by its engine. If safety of the NAS, it becomes obligatory to formally explore the an operator of a UAS will not suffer serious financial harm from hazards and resulting risks stemming from the change. This pro- casual or negligent operation of it, and if there is little likelihood cess is illustrated in Figure A-1. of a destroyed aircraft being traced back to them, there is less Obviously, the introduction of unmanned aircraft systems in incentive to be responsible participants in the aviation system. the NAS represents such a change of the type anticipated by the The latter possibility begs an obvious question: how useful or SRM process—possibly the most significant change since the in- relevant are investigations of accidents where at least one of the troduction of jet air carrier operations in the mid-1950s. Equally involved assets is considered disposable? As has been noted sev- important, this change may reasonably be expected to adversely eral times throughout this paper, there are no easy answers to affect the safety of the system as a whole if not accomplished issues like this, but answer them we must. responsibly. Therefore, by definition, the SRM process should be applied to the issue, and a Safety Risk Management Document Conclusion (SRMD) of some type normally would be required to either per- Unmanned aircraft systems will, sooner or later, become a sig- mit or deny the change. nificant sector of the overall aviation community. That means At this point, the challenge was to determine the best means that they also will be involved in accidents, and as equal partners of applying the SRM process to the system-level changes associ- in aviation safety, their operators and pilots will have to learn ated with UAS operations. Essentially, there were two options for from those accidents. If they do not accept their responsibility to doing so THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, others in the shared environment of aviation operations, they 1. Treat each new application for a certificate of waiver or au- should not be permitted access to it. thorization (COA) as an individual change subject to the SRM UAS investigations in the coming years need to take into con- process, preparing a new SRMD for each as a part of the applica- sideration all of the regulatory issues raised in this paper, as well tion process or as those technical issues more commonly at the heart of most 2. Accept the existing COA process as sufficient for maintaining aviation accidents. There are strong commercial incentives driv- the safety of the NAS in the near term, and use SRMDs to sup- ing interest in placing unmanned aircraft systems in urban areas, port both the review of individual COAs today and UAS-related in the heart of the most congested airspace, and in the same rulemaking as it evolves. environment used by current operators of a whole range of light The COA process is designed to gather all information re- aircraft and helicopters. Air safety investigators must be objec- quired for informed decisions regarding the acceptability of each tive judges of the extent to which both administrative and tech- application and does so very effectively. Nevertheless, there is nological protections will be needed to keep these current users obvious value in subjecting various aspects of UAS integration to safe today and tomorrow while providing for the appropriate more detailed analysis, especially as rulemaking efforts intended and evolutionary growth of the UAS sector. ◆ to accommodate them move forward. For that reason, the second option was selected. However, the integration of UAS into Appendix A the NAS was deemed too complex and encompassing a change to be addressed through a single SRMD. Therefore, the SRM Identification of Unmanned Aircraft System Hazards Through process was adapted for use as a framework for systematic review The Federal Aviation Administration Safety Risk Management of the various hazards associated with UAS operations in differ- Process ent classes of airspace. The first SRMD created under this approach considered the In its customary application, the Safety Risk Management (SRM) risks associated with operating unmanned aircraft systems in Class process is triggered by a proposal to change any part of the NAS. D airspace. The panelists appointed to develop the SRMD’s pre- If that change is determined to have the potential to affect the liminary hazard assessment followed a deliberate strategy of identifying as hazards any conditions that could be reasonably expected to result in risk in conjunction with the operation of at least some—but not necessarily all—types of UAS in the Class D environment. The panel then determined the worst credible potential outcome for each hazard based on the specific UAS attribute or attributes seen as resulting in the most severe consequences in the context of that hazard. Class D airspace represented a good starting point for several reasons. First, U.S. military operators of UAS had an urgent need to expand UAS activity at a number of locations Figure A-1. Determining requirements for a FAA Safety Risk Management Document. where the services manage non-joint

ISASI 2008 Proceedings • 117

Proceedings 2008.pmd 117 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 118 currently undergoing top-level review withinthe FAA. Thehaz- level ofseveritybecausenohuman beingisaboard. 8. AhulllossofaUA maynotalwaysresult ina“catastrophic” ducted overpopulatedareas. 7. UAS operationsinClassDairspaceatpresent are notcon- ATC duringUA operations. observers are notrequired tohavedirect communication with 6. UAS pilot(s)willhavedirect communicationwithATC; ground ing traffic. tion withthepilot,iscapableofassistingpilotinde-conflict- ous visualcontactwiththeUA, andwhoisindirect communica- confliction; aproperly qualified observerwhomaintainscontinu- UA operatestoidentifyotheraircraft thatmayrequire trafficde- tact withtheUA whilescanningtheenvironment inwhichthe 5. Therole oftheobserveristomaintainvisualline-of-sightcon- countered. every proposed UA operationwhere thosehazards maybeen- Analysis; allsuchcontrols mustbeconfirmedtoinplacefor recognized as“existing controls” withinthePreliminary Hazard duce theseverityorlikelihood ofindividualhazards are tobe 4. Operationalpracticesinuseunderapproved COAsthatre- gated therisksidentifiedinapplicableFAA policystandards. D airspaceSRMD,thepanelassumedthatoperatorhasmiti- consistent withthecontrols andmitigationscontainedintheClass granted anFAA COAoranFAA certificate specialairworthiness ness rules,metcertification/qualificationrequirements, andbeen 3. IfaUAS operatorhascompliedwithestablishedFAA airworthi- mitigations. perform “seeandavoid”),thepanelwillsearch foralternative plicable FARs (forexample, becausenoindividualisonboard to by theFAA; inthosecaseswhere aUAS cannotcomplywithap- eral aviationregulations (FARs) except whenspecificallyexempted 2. UAS operatorsandaircraft mustcomplywiththeexisting fed- mended mitigationswillbegenericinnature. UA activitytobeencountered oraffected;therefore, recom- 1. Eachhazard shallbeassessedonthebasisofmostlikely tions includedthefollowing: conclusions foreachhazard assessed.Paraphrased, theseassump- were madetoguidethepanel’sdeliberationstoward consistent hazards, increased controller workload,etc.).Then,assumptions consideration mightinvolveairtrafficcontrol impacts(collision repeatedly usedbythepanelistsincaseswhere thehazard under that cantake offandlandwithoutrunways.Thiscriterionwas guished betweenUAS thatrequire runwaystooperateversusthose assessment ofindividualhazards. Specifically, thepaneldistin- was onediscriminatingfactorthatcouldbeusedtohelpwiththe tions from thesameairfield. by virtueofbothtypesconductingtakeoff andlandingopera- manned andunmannedaircraft isensured inClassDairspace for whichtheClassDairspacehasbeencreated. Finally, amixof sponding densityofaircraft inthevicinityofprimaryairport ing generallycharacterizedbyaircraft convergence andacorre- nature ofoperationsinClassDairspacelendthemselvestobe- radio contactwithairtrafficcontrol (14CFR91.129).Also,the tions inClassDairspace,namely, therequirement fortwo-way articulated minimumregulatory requirement foraviationopera- use (i.e.,militaryonly)ClassDairspace.Second,there isaclearly The result ofthisprocess—the so-called“ClassDSRMD”—is In theClassDenvironment, thepanelconcludedthatthere • ISASI 2008 ISASI Proceedings 118 result inasomewhat the likelihood ofacollision. aircraft, combinedwithavisualobserver, significantlyreduces ment suggestedthattimeandspaceseparationofUAS from other to others.However, theFAA ATO ClassDSRMDpanel’sassess- of manydebatesregarding thehazard anunmanned aircraft poses other’s route offlight. sistent behaviorbyallaircraft through direct reference toeach the ultimategoalofpreventing midaircollisionsbyensuringcon- sons behindwhythatconceptemerged; theyare atthecore of see-and-avoid. However, it’simportanttobearinmindtherea- tics Administrationlaidthefoundationforentire notionof the notionofminimumsafeseparation,U.S.CivilAeronau- other except byprearrangement. Indefiningrightofwayand well, requiring pilotstokeep atleast500 feetawayfrom each persisted. Anewelement—“Proximity inFlight”—wasaddedas tent anddetail,buttheirgeneralpreoccupation withrightofway “Flying Rules.” the sectionsettingforththeseprocedures wascalled,verysimply, when encounteringanotheraircraft. Thiswasthecore concern; how eachpilotwastodetermineiftheyhadtherightofway than fivepages,butonefullpagewasdedicatedtoexplaining chanics, andairtrafficrules.Thelatterconsistedofjustmore spection andoperationofaircraft, licensingofpilotsandme- written compendiumsofrulesgoverninglicensing,marking,in- Regulations nautics Branchpublished standard foundinmostcontemporaryoperatingregulations. which wasthedrivingforce behindthegeneral“seeandavoid” that mustbeaddressed. However, thereal key isrightofway, lack ofanonboard pilotasbeingtheoverarching consideration It iscommonforthoseconcernedwithUAS safetytofocusonthe The CriticalityofUAS “See-and-Avoid” Limitations Appendix B body ofthispaper. ards andriskstheSRMDidentifiedare discussedinthemain party ortheother. Second,theactof “avoidance”itselfmustbe react toindependentindications ofaconflictknownonlytoone any timepilotsandairtraffic controllers receive andattemptto the entire aviationcommunity. First, there isroom forfatalerror hasmadetwopointsclearto lision Avoidance Systems(TCAS) an unmannedaircraft. have seenandbeguntorespond toanimpendingconflictwith could result inconfusion onthepartofpilotswhothemselves detection ofaconflictisstandardized andfullyunderstood,it 2. Unlesstheavoidancemaneuverresulting from anS&Asystem’s technological feasible. currently inplaceare discarded whenS&Atechnologybecomes an immediatehazard tosurrounding aircraft ifthemitigations 1. Thefailure ofaUA’s sense and avoid(S&A)systemcouldpose two reasons: Use ofvarious“sense-and-avoid”technologiesmayactually The inabilityofaUAS tosee-and-avoidhasbeenatthecenter By 1943,thecivilairregulations hadgreatly expanded incon- On Jan.1,1932,theU.S.DepartmentofCommerce’s Aero- The implementationandrefinement ofTraffic AlertandCol- , a34-pagedocumentrepresenting oneofthefirst 1/14/2009, 8:22 AM less safeenvironment inbusyairspace,for Aeronautics BulletinNo.7—AirCommerce standardized and purposeful; if aircrews are trained to trust their • Utilities patrol and construction equipment and follow its direction, it will keep them safe. Many of these activities could be accomplished economically by Time and again, the safety of any given UAS in any environ- unmanned aircraft systems that exist today. Taking this observa- ment seems to come down to one simple concern: its predictability. tion to its natural conclusion, it seems inevitable that manned air- The right of way of individual UAS is not separately defined from craft (especially helicopters) and unmanned aircraft performing that of analogous manned aircraft, and unmanned aircraft rarely similar or related activities will come in close proximity to each are capable of keeping their distance from other aircraft, clouds, other on a regular basis as UAS operations become widespread. or terrain without pilot intervention. Therefore, it is convenient This in turn means that collision likelihood at certain loca- to cluster these specific concerns under the umbrella of see-and- tions—for example, over the scene of a major traffic accident— avoid. However, the real issue is what other pilots can expect of a may be expected to be substantially greater if unmanned aircraft UA they encounter in flight. For now, there is no good answer to lacking a standard technological means of avoiding other air- that core concern. craft are permitted to engage in traffic surveillance or electronic news gathering operations at will. Appendix C Assuming a threat of this type evolves along the lines suggested above, investigators may find themselves responding to the scene The Worst-Case Scenario: Midair Collisions Between Manned of a manned aircraft accident only to discover that an unmanned And Unmanned Aircraft aircraft may have been involved in the sequence of events. Should THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, that be the case, it may open the door to a host of new mitigation Everyone in the UAS community acknowledges that the worst requirements, and it will be up to air safety investigators to make possible accident—in terms of both direct consequences and the the case for them. likely effect on public acceptance of UAS operations—would be a collision between a manned and unmanned aircraft. Unfortu- Endnotes nately, such an accident seems not only plausible, but also rea- 1 DO-304, Guidance Material and Considerations for Unmanned Aircraft sonably likely given many of the applications envisioned for fu- Systems (March 22, 2007), RTCA, Inc., (Washington, DC: 2007), p. 3. ture unmanned aircraft systems in the civil sector. 2 See Civil Aviation Authority [U.K.], CAP 719: Fundamental Human Factors Concepts (2002), available at www.caa.co.uk, for a brief overview of this model. While proponents of UAS expansion are justifiably wary of 3 The DO-304 model deliberately excludes any reference to the UA’s pay- being involved in an accident with a commercial air carrier, they load—camera, sensors, etc.—in describing the aircraft control segment. seem much less attuned to the likelihood of undesired and unex- This seems to beg several questions, including the precision of navigation control required for the design mission, the power demands of the pay- pected interactions with manned aircraft performing the same load on the UA’s electrical system, and safety-of-flight practices involving kinds of activities that they advocate carrying out with unmanned the use of payload capabilities to help clear the UA’s flight path, look for aircraft systems. For example, there are 20 generally recognized reported traffic, etc. 4 Human Factors Implications of Unmanned Aircraft Accidents: Flight-Con- uses of civilian helicopters— trol Problems, DOT/FAA/AM-06/8 (Washington, DC: Federal Aviation Ad- • Agriculture (Part 137) ministration, Office of Aerospace Medicine, April 2006). • Air carrier (Part 127) 5 An excellent compendium of these issues may be found in Eduardo Salas and Nancy J. Cooke, et al., Human Factors of Remotely Operated Vehicles • Air taxi (on-demand, Part 135) (San Diego, CA, USA: Elsevier, Ltd., 2006). More than half of its content • Air Tour (scheduled/on-demand, Part 135) can be related to various aspects of UAS hazards and challenges raised • Electronic news gathering throughout this paper. 6 See Appendix A for a discussion of how the FAA ATO SRM process is • Emergency medical services being applied to the challenges of UAS integration. • Executive transport 7 Some readers may be puzzled by the absence of a “midair collision” hazard • Exploration in the SRMD list. This is because the SRM hazard assessment process holds a midair collision to be a potential outcome of a hazard, not a hazard per • External cargo (Part 133) se. Thus, the possibility of midair collision drove the “severity” assessment • Forestry in the evaluation of the various hazards listed. See Appendix B for a brief • Government contract operations discussion of the relationship of the “see and avoid” requirement to the actual needs of safety in flight. • Herding 8 Onboard video, if available, can be a useful diagnostic tool if a midair • Law enforcement collision, unexpected flight into terrain or an obstacle, or a similar “exter- • Logging nal” is suspected. However, if a vehicle’s control link is lost at the start of the accident sequence, about the best you can hope to learn from such • Offshore oil and gas platform support visual information is whether the UA executed its lost link behavior prop- • Photography erly. While it’s a novel experience to watch an actual pilot’s eye view of a • Pollution monitoring crash, after one or two viewings, investigators will probably determine that their time may be better spent elsewhere. • Skiing 9 See Appendix C for a brief discussion of the circumstances under which • Traffic surveillance UAS and manned aircraft are most likely to come into conflict.

ISASI 2008 Proceedings • 119

Proceedings 2008.pmd 119 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 120 F Barbara, andholdsabachelorofartsdegree inanthropology. (ISASI). SheisagraduateoftheUniversityCalifornia,Santa She isamemberoftheInternationalSocietyAirSafetyInvestigators supervisor, andemergency procedures instructorforWorld Airways. Safety Board’s staff, Marshallwasaflightattendant,attendant and Performance DuringEmergency Situations.”Before joiningthe authored thespecialinvestigationreport “FlightAttendant Training Board’s safetystudyonairlinepassengereducation,and co-authored theBoard’s safetystudyonemergency evacuation,the She hasconductedmore factorsinvestigations.She than150survival Office ofAviation Safety’s Factors Survival DivisioninMay2000. tation SafetyBoard sinceJune1984andwasselectedaschiefofthe Nora C.Marshall from theairplane. crawled overthewingandtwo passengershelpedpullhimaway out themaincabindoor. Oncehewasoutsidethe airplane,he wreckage. Thefirstofficerreported that hewasthenabletocrawl efforts, thepilotswere abletofree thefirstofficer’slegsfrom the officer pulledonanoverhead barwithhisarms.Through these officer bythebeltandpulledonhislowerbodywhile first engines andmasterbatteryswitchthengrabbedthe first they couldseesmoke andflames.Thecaptainshutdownthe pilots statedthatthere wasanurgent needtoevacuatebecause pedals andwreckage thatintrudedthrough thecockpitfloor. The in theirseatsbecauselegswere entangledintherudder person inthebuildingreceived minorinjuries. seriously injured. The“cabinaide,”eightpassengersandone building. Thetwopilotsandpeopleintheautomobilewere a six-lanehighwayandparkinglotbefore impactingabrick an airportperimeterfenceandstruckautomobileasitcrossed ground speed ofabout110knots.Theairplanetraveledthrough the departure endofRunway6atTeterboro Airport(TEB)ata fire atTeterboro andduringotheraccidentsinvolvinginteriorfires. rescue andfirefighting (ARFF)crews inextinguishing aninterior ness ofahighreach extendable turret (HRET)usedbyaircraft safety regulations. Inaddition,thispaperwilldiscusstheeffective- of thecabinuncovered surprisingnoncompliancewithbasiccabin the accident,passengerinterviewsandthorough documentation company safetytraining.Althoughalloftheoccupantssurvived After theairplanestopped,bothpilotsreportedAfter beingtrapped In February 2005,aBombardier overran ChallengerCL-600 • Occupant Protection—A CaseStudy ISASI 2008 ISASI security, seatbeltusage,knowledgeofemergency exits, and highlights themostbasiccabinsafetyissuessuchas or thispaper, Ihaveselectedanaccidentinvestigationthat Bombardier ChallengerCL-600, By NoraC.Marshall(MO3036),Chief,SurvivalFactors Division,OfficeofAviation Safety, Proceedings hasbeenaninvestigatorattheNationalTranspor- Teterboro, N.J.,Feb. 2,2005 120 National Transportation SafetyBoard (Presented byFrank Hilldrup) resulted inreduced compliance withpassengerseatbeltusage the passengers’sightmadethem difficulttolocateanduse concluded thattheintentional positioningoftheseatbeltsout remove thecushions tolocatetheseatbelts.TheSafetyBoard have hadtoeitherblindlyreach behindtheseatbackcushionsor ever, withtheseatbeltsstowedin thisposition,passengerswould mon amongoperatorsofcorporateandcharterairplanes. How- sulted inatidierpassengercabinandwasreportedly notuncom- cushions. Positioning seatbeltsbeneaththeseatbackcushionsre- because theyhadbeenintentionallyplacedbeneaththeseatback three divanseatswouldnothavebeenvisibletothepassengers the cabinfloorduringaccidentsequence. out theevent.Thetwounrestrained passengerswere thrown to locate theirseatbeltsandwere therefore unrestrained through- takeoff roll, andtwopassengersseatedonthedivan couldnot Two ofthefourpassengersfastenedtheirseatbeltsduring sengers hadtheirseatbeltsfastenedwhenthetakeoff roll began. caused theinjurieshereceived tohishand. roll toprevent spillageandbelievedthatthebroken coffeecup aft row statedthathepicked uphiscoffeecupduringthetakeoff near passengerseatsduringtheinvestigation.Ainan ceramic/china cups.Severalglassesorcupswere recovered onor after theyboarded, andthebeverageswere servedinglassesor fastened hisseatbelt.Manyofthepassengersreceived beverages indicated thatifhehadreceived asafetybriefinghewouldhave dressing them;onesaiditwasa“shortbriefing,”andtheother ing before takeoff. Two passengersremembered thecaptainad- gers reported thattheyhadnotreceived apreflight safetybrief- ambulance, andwassubsequentlytaken toahospital. was picked upbyapasserbyinanautomobile,wasdrivento The cabinaidejumpedoutandranawayfrom theairplane.She gers beganpushingandkickingthedoor, anditeventuallyopened. “lever atthetop[ofbulkhead]butitwasnotworking.”Passen- “got theleveropen” andthatshethentriedtousetheelectric main cabindoor. Shetoldinvestigatorsthatshebelieved gers toldhimtheyhadseenheroutsidetheairplane. on theairplanebecauseofhiscabincheckandpassen- Although hedidnotseethecabinaide,knewthatshewas of theairplanebefore heexited through themaincabindoor. crawled through thecabinarea toensure thateveryonewasout Post-accident examinations revealed thattheseatbeltsat Passenger interviewsindicatedthatonlyfouroftheeightpas- All eightpassengerswere interviewed,andsixofthepassen- The cabinaideunbuckledherseatbeltandmovedtoopenthe Similarly, afterthecaptainfreed hislegsfrom thewreckage he 1/14/2009, 8:22 AM requirements. The Board recommended that the FAA require all her failure to collect beverage service items before takeoff, and 14 CFR Part 135 certificate holders to ensure that seatbelts at all her inability to open the main cabin door and conduct a compe- seat positions are visible and accessible to passengers before each tent evacuation, the Board concluded that the cabin aide’s train- flight. ing did not adequately prepare her to perform the emergency Passengers reported that the cabin was dark and smoky when duties with which she was tasked. The Board issued a recommen- the airplane stopped. The cabin aide had not opened the main dation to the FAA to require that any cabin personnel on board cabin door so a passenger from one of the forward seats felt around 14 CFR Part 135 flights who could be perceived by passengers as the door until he found the door handle, which he then rotated. equivalent to a qualified flight attendant receive basic FAA-ap- When the door did not open, he pushed and kicked it. With the proved safety training in at least the following areas: preflight help of another passenger, he eventually was able to open the briefings and safety checks, emergency exit operation, and emer- main cabin door and passengers and the cabin aide evacuated. gency equipment usage. The recommendation also stated that Although the cabin aide indicated that she evacuated behind all such training should be documented and recorded by the Part of the passengers, at least two passengers reported that she ex- 135 certificate holder. ited before them. The Board concluded that the cabin aide’s training did not adequately prepare her to perform the duties with Aircraft rescue and firefighting which she was tasked, including opening the main cabin door Teterboro air traffic controllers indicated that the airplane’s ac- during emergencies. celeration appeared to be normal; however, the airplane did not THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, Although a flight attendant was not required on the flight, the lift off when they expected it to. Therefore, the controllers initi- Safety Board evaluated the cabin aide’s actions, performance, ated notification to ARFF before the airplane ran off the end of and training. The operator’s documentation and guidance re- the runway. According to interviews with ARFF, ATC, and pas- garding cabin aide and flight crew responsibilities were unclear; sengers, ARFF responded within 1 minute of notification, reached however, the cabin aide told investigators that she ensured that the airplane within 3 to 4 minutes of the accident, and immedi- the cabin was “secure,” implying that passengers were restrained, ately initiated efforts to extinguish the exterior airplane fires. and that other items were secured before the takeoff roll. Physi- Firefighting personnel from neighboring communities arrived cal evidence and passenger statements indicated that this was to assist in the firefighting effort. However, the interior fire was not the case. The Safety Board concluded that the cabin aide did not extinguished until a high-reach extendable turret (HRET) not perform a seatbelt compliance check before the accident flight, vehicle with a skin-penetrating nozzle arrived from Newark In- which resulted in two passengers being unrestrained during the ternational Airport. The vehicle arrived about 0851 (about an accident sequence. hour and 33 minutes after the accident), and the interior fire was The cabin aide was not required to receive safety-related train- extinguished within minutes of its arrival. Although the vehicle ing because she was not a required crewmember (flight attendant) was successful in extinguishing the fire, the operators initially for the accident flight. Nonetheless, the operator did provide its experienced problems piercing the airplane skin when the nozzle cabin aides with some training. The accident cabin aide stated that tip folded backwards and had to be reset. she had received verbal instruction regarding the emergency main The Safety Board has a long history of concern about the abil- cabin door operation and had operated the main cabin door handle ity to extinguish aircraft interior fires. For example, the Board’s and electric toggle switch in a simulated emergency scenario dur- 1998 report on its investigation of a DC-10 cargo aircraft fire at ing her training. Her description of her efforts to operate the door Newburgh, N.Y., concluded that ARFF “capabilities must also be after the accident was consistent with the training she reported improved so that firefighters are able to extinguish aircraft inte- that she had received; however, it revealed that her training had rior fires in a more timely and effective manner” and issued Safety not provided her with an adequate understanding of the door Recommendation A-98-79 to the FAA. The recommendation mechanism and operation. The cabin aide told investigators that asked the FAA to “review the aircraft cabin interior firefighting she was not familiar with the arm/disarm handle and that she tried policies, tactics, and procedures currently in use, and take action to use the electric switch at the top of the bulkhead to operate the to develop and implement improvements in firefighter training door; however, this switch is not needed, and should not be used, and equipment to enable firefighters to extinguish aircraft inte- during emergency operations. rior fires more rapidly.” The Safety Board classified the recom- The Safety Board was concerned that Part 135 operators and/ mendation as “Closed-Acceptable Action” because, as a result of or certificate holders may delegate important safety functions to FAA research and development, an elevated boom with a skin- cabin aides/customer service representatives who are not prop- penetrating nozzle was developed, and the FAA funded 12 re- erly trained and qualified to perform those functions. Further, gional ARFF training facilities with simulators that were to be the Board was concerned that passengers might mistakenly be- used for interior attack training. lieve that a cabin aide/customer service representative on a char- On Feb. 7, 2006, another inflight fire occurred on a cargo flight ter flight had received safety training equivalent to that of a quali- shortly before it landed at its destination airport in Philadelphia, fied flight attendant, when in fact, that aide/representative might Pa. The three flightcrew members sustained minor injuries and have received minimal or no safety training. The Board believed the airplane and most of its cargo were destroyed by fire after that providing those individuals with basic safety training could landing. The ARFF personnel who used the HRET/SPN during provide valuable safety results in an emergency, especially in the the emergency response stated that they experienced problems event of flight crew injury such as was seen in this accident. penetrating the fuselage with the device and had to reposition On the basis of the cabin aide’s performance during the acci- the tip of the nozzle a few times before successfully piercing the dent sequence, including the lack of a seatbelt compliance check, airplane’s fuselage.

ISASI 2008 Proceedings • 121

Proceedings 2008.pmd 121 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 122 experience fightinganinteriorfire. ThePHLandTEBARFF lent safetyrecord, mostARFF personnelmaynothaveanyactual problems usingthedevice.Further, becauseofaviation’s excel- ARFF personnelatbothPhiladelphiaandTeterboro encountered the HRET/SPN. neither oftheACsspecificallyaddressed trainingontheuseof and shouldbeprovided guidanceontheequipmenttraining, dures fortheuseofeachhose,nozzle,andadapterusedlocally, ARFF personnelshouldbetrainedtoidentifytheproper proce- sory Circulars (AC)150/5210-17Aand150/5220-10Cstatethat in operations,tactics,andstrategies.AlthoughtheFAA’s Advi- on theskilllevelofoperatorandrequired continualtraining ing materialsstatethatthesuccessfuluseofdevicedepended and InternationalFire ServiceTraining Association(IFSTA) train- spread ofinteriorfires andreduce highcabintemperatures. FAA handline, includingtheabilitytobettercontrol andcontainthe HRET/SPN outperformedthestandard roof-mounted turret and Despite havingreceived sometrainingontheHRET/SPN, In 2005,theFAA conductedresearch thatdeterminedthe • ISASI 2008 ISASI Proceedings 122 out theindustry. ommendations, whichare intended toimprove safetythrough- firefighters provided substantialsupport foragencysafetyrec- prehensive informationgainedfrom passengers,crew, and appropriate levelofinvestigation.Aswasseeninthiscase,com- fatalities, itisimportantthatnon-fatalaccidentsalsoreceive an expend agreat dealofresources explaining thecauseofaccident sons fortheinvestigator;althoughmostinvestigativeagencies reach extendable turret withskin-penetratingnozzle.”(A-07-100) ing methodstoobtainandmaintainproficiency withthehigh- ance toaircraft rescue andfirefighting personnelon the besttrain- fires. TheSafetyBoard recommended thattheFAA “provide guid- duced theeffectivenessofdeviceinfightinginterioraircraft not adequatelytrainedontheuseofHRET/SPN,whichre- response uptothattime. sponses hadneverusedthedeviceduringanactualemergency personnel whousedtheHRET/SPNduringemergency re- Examination oftheTeterboro accidentprovides importantles- The SafetyBoard concludedthatsomeARFFpersonnelwere 1/14/2009, 8:22 AM ◆ Problems in Operating Emergency Evacuation Slides: Analysis of Accidents and Incidents With Passenger Aircraft By Gerard van Es, Senior Consultant, NLR-Air Transport Safety Institute, Amsterdam, the Netherlands (Presented by Rombout Weaver)

Gerard van Es is a senior consultant in safety and and the Air France aircraft’s weather radar was displaying heavy THURSDAY, SEPT. 11, 2008 SEPT. THURSDAY, flight operations at the NLR Air Transport Safety precipitation encroaching on the runway from the northwest. The Institute, the Netherlands. For 12 years, he has been aircraft landed long down the runway and reverse thrust was se- involved in accident and incident investigation and lected late after touchdown. The aircraft was not able to stop on analysis. He has conducted numerous studies into the 9,000-foot runway and departed the far end. The aircraft runway incursions, landing overruns, flight data stopped in a ravine and caught fire. The cabin crew ordered an analysis, pilot-controller communication, occupant- evacuation within seconds of the aircraft stopping because fire was survivability, and more. He holds a bachelor of science degree in aircraft observed out the left side of the aircraft, and smoke was entering engineering and a master of science degree in aerospace engineering. the cabin. All passengers and crewmembers were able to evacuate the aircraft before the fire reached the escape routes. A total of 2 Abstract crewmembers and 10 passengers were seriously injured during One concern in cabin safety is that aircraft can be evacuated quickly the crash and the ensuing evacuation. The Air France Airbus A340- and safely in case of an emergency. Aircraft that have emergency 300 was equipped with emergency evacuations slides as required exits more than 6 feet from the ground are required to have an by certification rules. At one exit (L2) the evacuation slide did not approved means to assist the occupants in descending to the deploy and the passengers had to jump out (see Figure 1). Of the ground. For this purpose, emergency evacuation slides are used. 16 passengers using this exit, 2 were seriously injured: one when The rapid deployment, inflation, and stability of evacuation slides he jumped from the exit (10-12 feet above the ground), and the are critical elements of the evacuation system. Any problem with other when pushed out of the exit by another passenger. The slide one of these elements could endanger the lives of the occupants. at another exit (R3) deployed correctly. However shortly afterwards Unfortunately, investigations of accidents and serious incidents this slide deflated and the Exit R3 was assessed as unusable by the involving an evacuation of the occupants often showed that slides cabin crew. The slide at Exit L1 partially deployed/inflated. Given did not function properly. This paper presents an analysis of his- the nose-down, left-wing-high attitude of the aircraft, neither the torical emergency evacuations in which slides were used. The fac- intermediate tie restraint device nor the toe tie restraint device tors that have hampered the use of emergency evacuation slides separated from the slide. As a result, the slide came to rest folded are identified from these data and are analysed in-depth. in half against the fuselage. When passengers jumped from Exit Examination of historical emergency evacuations involving evacuation slides showed that in 54% of all cases one or more slides did not function properly. The most important slide problems identified in evacuation accidents are slide inflation problems, aircraft attitude, wind, burned slide, incorrect rigging of the slide, and ripped slide. Problems with evacuation slides have been reported since their first appearance on aircraft. Despite many recommendations made by accident investigation boards regarding the improvement in slide reliability, problems with slides keep occurring at a similar rate.

Introduction On Aug. 2, 2005, an Air France Airbus A340-300 aircraft departed Paris, France, on a scheduled flight to Toronto, Canada, with 297 passengers and 12 crewmembers on board. While approaching Toronto, the flightcrew members were advised of weather-related delays. On final approach, they were advised that the crew of an Figure 1. Evacuation of passengers at Exit L2 without an aircraft landing ahead of them had reported poor braking action, emergency evacuation slide.

ISASI 2008 Proceedings • 123

Proceedings 2008.pmd 123 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS for U.S.operatorswere obtainedfrom othersources the FAA AccidentIncidentDataSystem (AIDS).Additionaldata currence Reporting Scheme(MORS,)andfrom theUnitedStates Occurrence Reporting System(CADORS),UK’sMandatoryOc- currence reporting systemsare used:theCanadianCivilAviation ations. For thispurpose,datafrom thefollowingmandatoryoc- with lessseriousconsequences.Theseare oftenprecautionary evacu- are rare, itwasalsonecessaryforthisstudytoanalyzeevacuations 124 A literature surveyofprevious investigationsonproblems with Literature survey Results aircraft and/orinjuriestothepassengers ten related tooccurrences involving(significant)damagetothe worldwide. TheaccidentsintheNLRAirSafetyDatabaseare of- database coversaccidentsand(major)incidentswithcivilaircraft first datasource tobeusedistheNLRAirSafetyDatabase.This passenger aircraft are identifiedusingseveraldatasources. The ations are analyzed.Secondlyevacuationoccurrences involving gency egress situations generic senseandincludesprecautionary evacuationsandemer- isting orperceived emergency. Thetermevacuationisusedina is definedasthedisembarkationofpassengersbecauseanex- rences are analyzed.For thepurposeofthisstudy, anevacuation emergency evacuationslides,dataofhistoricaloccur- In order tomake aninventoryofcommonproblems whenusing Approach Analysis ofevacuationoccurrences ation slides. is limitedtowestern-builtpassengeraircraft equippedwithevacu- mon problems whenusingemergency evacuationslides.Thestudy The mainobjectiveofthestudyistomake aninventoryofcom- Study objectiveandscope TSB report A05H0002). due tothetrainingandactionsofwholecabincrew. (Source: injuries tothepassengers.Inendevacuationwassuccessful Air France A340hampered theevacuationandalsocausedserious through thistube.Theproblems withseveraloftheslideson evacuation towaitforpassengersalready ontheslidetopass ing atube.Atonepoint,theR1cabinattendanthadtostop ment pathpushedagainsttheslide,causingittocurlinward, form- the bottomofslide,vegetationoneithersidedeploy- aircraft. Asaresult, therateofdescentwasslowedconsiderably. At slide wasveryshallowbecauseitalmostperpendiculartothe deployed automaticallyasdesigned.However, theangleof had beenpunctured intwoareas. Theslideatemergency ExitR1 pletely. Post-occurrence examination ofthesliderevealed thatit on topofthem.Duringtheevacuation,slidedeflatedcom- were unabletoextricate themselvesbefore otherpassengersjumped L1, somebecametrappedinthefoldedportionofslideand in lightofitsobjectives. tions withthislastcategoryofaircraft are excluded from thisstudy as wellaircraft thatdonothaveevacuationslides.Theevacua- currences withaircraft thatare equippedwithevacuationslides First someoftheavailablestudiesonaircraft emergency evacu- The results oftheanalysisare discussedinthe next sections. All thedatafrom theprevious-mentioned sources includeoc- • ISASI 2008 ISASI Proceedings 1 124 . 2 . Sincesuchoccurrences 3 . Table 1.Problems withSlidesIdentifiedbyNTSBandTSB NTSB andtheTSB. 46.9% ofthecasesandisbyfarbiggestproblem foundbythe listed inTable 1.Failure oftheslidetoinflatewasidentifiedin with evacuationslidesidentifiedintheTSB/NTSBstudiesare (combination oftheresults ofthethree studies).Theproblems found (40%).Thisleadstoacombinedslideproblem rateof41% NTSB study(NTSB,1974),analmostsimilarpercentage was ing slideuse,theslidesdidnotoperatecorrectly. Intheother study (NTSB,2000)foundthatin37%oftheevacuationsinvolv- were used,someproblem occurred withtheslides.OneNTSB (TSB, 1995)showedthatin47%oftheevacuationswhere slides 1974; NTSB,2000;TSB,1995;andFedok, 2001).TheTSBstudy aircraftsenger-carrying coveringdifferent periodsintime(NTSB, evacuation accidentswithU.S.-andCanadian-registered, pas- and Canada(TSB).Theseorganizations reviewed pastemergency the accidentinvestigationorganizations from theU.S.(NTSB) reasons fortheslideproblems. dents). ThestudyconductedbytheCAAUKdoesnotreport any evacuations indicatingthatthesewere minoreventsonly(inci- problems were identified.Nofatalitieswere recorded withthese occurred withUK-registered aircraft. Inninecases(15%),slide CAA UK,62actualemergency evacuations(withslidesinvolved) ld nltdisd icat6.3 9.4 12.5 (%)* Amount vivable, Western-built 46.9 Searches were conductedintheNLRAirSafetyDatabase forsur- 3.1 Analysis ofaccidentsinvolvingevacuations *One accidentcanhavemore thanoneslideproblem assigned People injured becausetheyloose stabilisationondescent Slide inflatedinsideaircraft Slide broke looseofaircraft 12.5 No deploymentofslideduetoproblems withemergency Problems withslidesduetoextreme attitudeoftheaircraft Problems duetowind No (automatic)inflationofslide Identified problem craft operationsworldwide.The queryresulted in151accidents query wasconductedforthe period 1970-2003andcovered air- evacuations inwhichemergency evacuationslides were used. The deploy withnoobviouscause(6%) rigging (11%),inflationdevicemalfunctions(7%),andfailure to bly oftheslides(29%),grit-barmechanismfailure (15%),mis- fied duringmaintenance/testdeploymentare: incorrect assem- slides duringactualevacuations.Someoftheproblems identi- with slidesduringmaintenance/testdeployment,andtheuseof UK, 1995).Thestudylooked bothatproblems thatoccurred occurrences from 1980to1994withUK-registered aircraft (CAA ing accidentsthatoccurred duringtheearly70s. attitude. Theseproblems are basedonNTSBreports concern- lems duetowind,burnedslides,punctured slides,andaircraft The deficienciesquotedbySnyderare inflationproblems, prob- escape equipmentwere summarizedbySnyder(Snyder, 1976). gency egress from transportaircraft, deficiencieswithemergency present study)are brieflydiscussedinthissection. were foundofwhichthemostinteresting results (inlightofthe evacuation slideswasconducted.Anumberofrelevant studies xtdo 9.4 exit door Detailed studiesonemergency evacuationswere conductedby The CAAUKstudiedthereliability ofslidesbyanalyzingslide In areview oftechniquesusedincrashprotection andemer- 1/14/2009, 8:22 AM 5 , passengerjetaircraft accidentsinvolving 4 . Intheperiodstudiedby bankment. Steep slide angles appear to be the biggest problem for evacuees. At a slide angle of approximately 48 degrees, evacuees have a tendency to hesitate before entering the slide because of its steep appearance (Barthelmess, 1980). Such steep angels were reported in a number of cases. Wind had an adverse effect on the use of escape slides in 11 (12.4%) cases. In these cases, the wind blew them up against the sides of the aircraft preventing their use. Table 3 lists the 11 cases. The mean wind during these evacuations varied from 6 to 28 knots. A similar range of wind values (3-25 knots) was found for those evacuations in the sample in which wind did not cause a problem when using the slides. An explanation for this last observation in the data could be that the wind direction relative to the aircraft’s position also plays an important role. The slides were burned in 10 (11.2%) cases. In all these cases, slides were deployed at the side of the aircraft where a fire was present. Due to the intensity of most of the fires, the burning of Figure 2. Relative number of evacuations with 11, 2008 SEPT. THURSDAY, slide problems during the period 1970-2003. the slide was unavoidable. Incorrect rigging of the slide was identified as the cause of the in which emergency evacuation slides were used. Problems with slide problem in seven cases (7.9%). using the slides were identified in 81 (54%) accidents. As shown In six cases (6.7%), the slide was ripped. In four cases, it was in Figure 1, this share increased starting from the late 70s until determined that this was caused by the shoes some of the evacu- the earlier 80s. The share has dropped during the late 80s. Since ees were wearing. then it has not changed much (see Figure 1). An overview of the There are a variety of problems with slides that were listed identified problems with evacuation slides in 81 analyzed acci- under the category “other” in Table 2. Some examples are slides dents is shown in Table 2. The ICAO ADREP taxonomy was used falling of the aircraft after being deployed and slides that infor the classification of the slide problems. Eight-nine slide prob- flated into the aircraft itself. lems were identified in the sample of 81 accidents. In 25 (28.1%) cases, the slide did not inflate (not automatically Table 3. Cases with Slide Problems due to nor manually). The cases in which the slide did not inflate auto- Wind as Identified in the Accident Sample matically—but did directly after the manual inflation handle was pulled—were not considered as slide problems in this study. How- Date Location Aircraft type Wind speed (knots) 7-30-1971 San Francisco, USA B-747-100 20 ever, when there was a significant delay in deploying the slides 1-02-1982 Sault Ste. Marie, Canada B-737-200 22 gusting to 36 manually, the case would be considered in the present analysis. 5-12-1983 Regina, Sask, Canada DC-9-32 18 gusting to 28 The NTSB/TSB results shown in Table 2 show a higher amount of 11-05-1983 Johannesburg, South Africa B-747-B 6 3-25-1987 Chicago, USA DC-10-10 14 problems with the inflation of slides. This is due to the fact those 2-01-1990 Baltimore, USA DC-10-10 12 cases where the slide would not automatically deploy, but did manu- 3-05-1994 Regina, Canada DC-9-32 22 gusting to 27 ally, were still counted as a slide problem by the NTSB/TSB. There 12-24-1997 Schiphol, the Netherlands B-757-200 32 gusting to 42 7-09-1998 San Juan, Puerto Rico A300-600 13 does not appear to be a general explanation why some slides did 7-12-2000 Wien, Austria A310 13 gusting to 17 not inflate properly. There are a large number of different causes 11-30-2000 Shannon, Ireland B-737-800 28 gusting to 42 such as empty inflation bottles and incorrect assembly. Analysis of incidents involving evacuations Table 2. Problems Identified with the Use of Slides The accidents analyzed in the previous section are often related In 81 Accidents Analyzed to occurrences involving (significant) damage to the aircraft and/ Identified problem Amount (%)* or injuries to the passengers. To have an understanding of slide Slide not inflated 28.1% problems that have occurred during less serious events, incidents Aircraft attitude 15.7% involving slide use were analyzed (including precautionary evacu- Other 13.5% Wind 12.4% ations). These incidents are also used to estimate the slide use Slide burned 11.2% frequency of occurrence. This frequency can be used to deter- Incorrect rigging 7.9% mine the probability of emergency evacuation slide use in mean Slide ripped 6.7% Unknown 4.5% wind conditions higher than 25 knots. Evacuation data from the *One accident can have more than one slide problem assigned following mandatory occurrence reporting systems are used: the Canadian Civil Aviation Occurrence Reporting System In 14 (15.7%) cases, the aircraft attitude at rest was such that (CADORS), UK’s Mandatory Occurrence Reporting Scheme some of the slides were either too steep, did not reach the ground, (MORS), and from the United States the FAA Accident Incident or curled up under the aircraft (due to limited space to deploy it Data System (AIDS). The U.S. data were expanded with addi- properly). Unusual aircraft attitudes were mainly the result of the tional evacuation occurrences obtained from other sources in- collapse of the nose gear or the main aircraft landing gear. How- cluding an airport survey. The overall time period ranged from ever, in some cases the aircraft ended in a ditch or over an em- 1987-2003. However, each of the three sources had slightly dif-

ISASI 2008 Proceedings • 125

Proceedings 2008.pmd 125 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 126 study. Thefatalityrate of thefatalityrateanalyzedevacuationaccidentsinthis having proper functioningslidesfollowsfrom theexamination functioning ofevacuationslidesinthepast.Theimportance Board (NTSB)oftheU.S.haveaddressed theproblem ofproper years. Safetyorganizations suchastheNationalTransport Safety tion slidesinaccidentshavebeennotresolved overthelast33 lyzed inthisstudysuggestthatthebasicproblems withevacua- are similartothoseidentifiedinprevious studies.Thedataana- The problems withevacuationslidesasidentifiedinthisstudy Discussion ofresults deployment ofslides contained atotalof130emergency evacuationsinvolvingthe adjusting firms,andlitigationrecords. Thedatafinalsample airports). Additionaldatawere obtainedfrom airlines,insurance as therecords ofairportmanagers(through asurveysentto63 the evaluationincludedFAA, aswell theNTSB,andNASA, period of1988through 1996.Theprimarydatasources usedfor evacuations withU.S.-registered aircraft thatoccurred duringthe case, theslidedeployedpartiallyintogalley. the slidewaspunctured (possiblybyhigh-heeledshoes).Inlast in whichtheslidetwistedoninflation.There wasacaseinwhich (4.7%), problems withtheslideswere reported. There wasacase ations withUK-registered aircraft were identified.Inthree cases were noreported slideproblems withthese12evacuations. ations withCanadian-registered aircraft were identified.There However, thiswasnotthecaseforallofU.S.data. dian- andUK-registered aircraft inthetimeperiodsconsidered. ratives were availableforallthereported evacuationswithCana- 2003, theUKdata1987-2003.andU.S1988-1996.Nar- ferent timeperiods.TheCanadiandatacovered theperiod1995- cases were notreported. the aircraft. Thereasons forslideproblems intheremaining three cases, theslideswouldnotinflated;inonecaseslidefelloff seven cases(8.8%)theslidesdidfunctionasexpected. Inthree were available. Analysisofthe80evacuationsrevealed thatin vided inincidentreports; therefore, thenumberofproblems with tailed informationregarding evacuation meansisoftennotpro- less thantheinformationthat isgiveninaccidentreports. De- the informationprovided intheincidentreports isnormallyfar with evacuationslideswhentheyoccurred. Thelevelofdetail ports examined inthisstudydonotalwaysmentionproblems dents (intheorder of28%).Itisbelievedthat theincidentre- would haveoccurred atasimilarrateforbothaccidentsandinci- with incidents.However, itwasexpected thatinflationproblems evacuation slides.Bydefinition,suchproblems will not befound nose andmaingearsresulting inratheruniqueproblems with dents oftenare related todamaged aircraft, fires, and collapsed bined result). There are severalreasons for thisdifference. Acci- accidents ismuchhigherthanfoundintheincidents(6.5%, com- talities duringsurvivableaccidents. erly functioningevacuationslidescanreduce thenumberoffa- were noproblems were encountered withtheslides.Clearlyprop- the slidesoccurred is1.7timeshigherthanforthoseevacuations Hynes (Hynes,1999)evaluatedprecautionary emergency For theperiodof1987through 2003,63slideinvolvingevacu- For theperiodof1995through 2003,12slideinvolvingevacu- The share ofproblems (54%)withslidesfoundintheanalyzed • ISASI 2008 ISASI Proceedings 6 . For 80ofthe130evacuations,narratives 7 126 inthoseevacuationswere problems with should beabletofunctionwithoutproblems duetothewind. slightly higherthanthemaximumwindunderwhichslides 1998. Duringthisaccident,themeanwindwas28knots,whichis this requirement. listedinTable TheB-737-800 3wascertifiedin under whichslidesmustfunctionandare therefore exempted from JAR/FAR 25,Section25.810regarding themaximumwindspeed fied formanufacture priortotheintroduction oftherequirement fied before 1990.Thismeansthattheinvolved aircraft were certi- allaircraftExcept listedinTable fortheB-737-800, 3were certi- published NoticeofProposed Rule MakingNPRMNo.84-21). 20, 1990.Theruleoriginatesfrom aproposal madeinthe80s(see occupants safelytotheground.” tance ofonlyoneperson,toremain usableafterfulldeploymenttoevacuate winds directed from themostcriticalangle,todeployand,withassis- pants indescendingtotheground, musthavethecapability, in25-knot Route,and Escape statesthat“ current JAR/FAR 25,Section25.810Emergency Egress Means Assist not beenexamined to theknowledgeofpresent authors.The influence ofstrong gustsupontheproper functioningofslideshas strong gustscancause difficultieswhenoperatingtheslide.The gustiness ofthewind.Whenhavingmoderatewindconditions, cause problems whenusingslides.Anotherfactorcouldbethe unfavorable winddirection evenmoderatewindconditionscan Most likely thewinddirection playsanimportantrole. With an very similartothosewhenproblems didoccurduetothewind. lems duetowind,despitethefactthatwindconditionswere that numerous evacuationswithslidesoccurred withoutanyprob- speed itselfisnotadecisivefactor. Thisisfurthershownbythefact vere meanwindconditions,whichindicatesthatthe cases. Theproblems occurred underbothmoderateaswellse- improper maintenancecausemanyoftheseproblems. (including civilaviationauthorities, transportsafetyboards, air- Disseminatethefindingsofthisreport toallinterested parties • Recommendations similar rate. ment inslidereliability, problems withslideskeep ata occurring made byaccidentinvestigationboards regarding theimprove- first appearanceonaircraft. Despitemanyrecommendations Problems withevacuationslideshavebeenreported since their • burned slide,incorrect riggingoftheslide,andrippedslide. accidents are slideinflationproblems, aircraft attitude,wind, Themostimportantslideproblems identifiedinevacuation • tion properly. showed thatin6.5%ofallcasesoneormore slidesdidnotfunc- Examination ofhistoricalincidentsinvolvingevacuationslides • tion properly. showed thatin54%ofallcasesoneormore slidesdidnotfunc- Examinationofhistoricalaccidentsinvolvingevacuationslides • Conclusions slide inflationproblems majority ofSDRsrelated toslides(28%)wouldhaveresulted from reports (SDRs)filledbyU.S.operatorsalsoshowedthatthevast is thattheslideswouldnotinflate.Ananalysisofservicedifficulty be underreported. evacuation slidesidentifiedinincidentsthepresent studycould Problems withslidesduetowindhavebeenidentifiedinseveral The mostsignificantproblem withslidesidentifiedinthisstudy 1/14/2009, 8:22 AM 8 . Improper packing/installationand ThisrulebecameeffectiveasofAug. An approved meanstoassisttheoccu- craft manufacturers, slide manufacturers, and airlines). Emergency Egress from Air Transport Aircraft, AGARD AG-221, 1976. TSB, A Safety Study of Evacuations of Large Passenger-Carrying Aircraft, • Analyze the influence of strong gusts upon the proper func- Transport Safety Board Canada, Report SA9501, 1995. tioning of slides. • Analyze service difficulty reports related to slides to identified Acknowledgement the relation with problems found during accidents and incident The authors gratefully acknowledge the cooperation and assis- evacuations and to monitor any influence of regulations regard- tance given by Joji Waites of the CAA UK SRU, Jennifer McCarthy ◆ ing slide reliability. of Transport Canada, System Safety, and Günther Raicher of the References Flugunfalluntersuchungsstelle of Austria. Barthelmess, S.J., Evacuation Slides…History and New Technology, Flight Safety Foundation FSF, Cabin Crew safety Bulletin, NOV/DEC, 1980. Endnotes Carbaugh, Hard Nose Gear Touchdown, Flight Safety Foundation FSF, 1 Definition taken from the Transportation Safety Board of Canada. European Aviation Safety Seminar, 2002. 2 The accident definition given by ICAO ANNEX 13 is used in this study. CAA UK., Escape Slides. Data + Plus, published by Safety Regulation 3 In particular, data were obtained from a survey made by Hynes and Asso- Group SRG, CAA UK, 1995. ciates for the FAA in 1999. Fedok, J.T., Evacuation Slide and Slide/Raft Reliability, National Transport 4 The percentages refer to the total number of problems found during main- Safety Board (NTSB), International Aircraft Fire and Cabin Safety tenance/test deployment. Research Conference, 2001. 5 The NLR Air Safety Database does contain information on both Western- Hynes, M.K., Frequency and Costs of Transport Airplane Precautionary and Eastern-built aircraft accidents. However, information regarding evacu-

Emergency Evacuations. FAA Report DOT/FAAJAM-99/30, 1999. ations and slide use is very limited for Eastern-built aircraft. 11, 2008 SEPT. THURSDAY, NTSB, Emergency Evacuation of Commercial Airplanes, National 6 These evacuations were limited to only those aircraft that operated under Transport Safety Board, Safety study NTSB/SS-00/01, 2000. Part 121. NTSB, Safety Aspects of Emergency Evacuations from Air Carrier Aircraft, 7 Ratio of total number of onboard fatalities by the total occupants on board. National Transport Safety Board, Special study NTSB-AAS-74-3, 1974. 8 Data were obtained from the FAA. Reporting period for the SDRs was from Snyder, R.G., Advanced Techniques in Crash Impact Protection and 1997-2003.

ISASI 2008 Proceedings • 127

Proceedings 2008.pmd 127 1/14/2009, 8:22 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 128 • ISASI 2008 ISASI Proceedings ISASI 2008PictorialReview 128 Photos byEsperisonMartinez,Editor 1/14/2009, 9:36 AM ISASI 2008 PICTORIAL REVIEW

ISASI 2008 Proceedings • 129

Proceedings 2008.pmd 129 1/14/2009, 9:36 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 130 • ISASI 2008 ISASI Proceedings 130 1/14/2009, 9:36 AM ISASI 2008 PICTORIAL REVIEW

ISASI 2008 Proceedings • 131

Proceedings 2008.pmd 131 1/14/2009, 9:36 AM Proceedings 2008.pmd ISASI 2008 PROCEEDINGS 132 • ISASI 2008 ISASI Proceedings 132 1/14/2009, 9:36 AM