Air Safety Through Investigation APRIL-JUNE 2017 Journal of the International Society of Air Safety Investigators

Nonprecision Approaches: Status and Evolution—page 5 Investigation of Single-Pilot Operation Accidents—page 8 Links for a Successful Investigation: C-212 Robinson Crusoe Island Accident Case—page 14 Reverse Engineering the Causal Links Reveals Safety Analysis Issues—page 19 The Effect of Commuting on Pilot Self-Assessment of Stress and Performance —page 22 CONTENTS Air Safety Through Investigation Journal of the International Society of Air Safety Investigators FEATURES Volume 50, Number 2 5 Nonprecision Approaches: Status and Evolution Publisher Frank Del Gandio By Thomas Lepagnot, Accident and Incident Investigator, Airbus—The author looks at Editorial Advisor Richard B. Stone recent nonprecision approach events and how they still can be a major causal factor for Editor J. Gary DiNunno aircraft accidents and incidents. He notes that nonprecision approaches are becoming safer Design Editor Jesica Ferry with new technology but pilot adherence to procedures and respect for minima are crucial. Associate Editor Susan Fager 8 Investigation of Single-Pilot Operation Accidents ISASI Forum (ISSN 1088-8128) is published quar- By Fabio Couto Bonnett, Air Safety Investigator, Embraer Air Safety Department—The terly by the International Society of Air Safety author compares air accidents involving one-pilot versus two-pilot business jet operations Investigators. Opinions expressed by authors do not necessarily represent official ISASI position over a 37-year period. He notes that even though the number of two-pilot accidents was or policy. higher, single-pilot accidents resulted in more fatalities. Editorial Offices: Park Center, 107 East Holly 14 Links for a Successful Investigation: Avenue, Suite 11, Sterling, VA 20164-5405. Tele- C-212 Robinson Crusoe Island Accident Case phone 703-430-9668. Fax 703-430-4970. E-mail By Luis Gracia, Head of Product Safety, Airbus Defense and Space–Military Aircraft—The address, [email protected]; for editor, espmart@ author discusses how a successful investigation of a complex accident can be accomplished comcast.net. Internet website: www.isasi.org. ISASI Forum is not responsible for unsolicited by merging scientific technologies and linking information and data from other sources. manuscripts, photographs, or other materials. 19 Reverse Engineering the Causal Unsolicited materials will be returned only if submitted with a self-addressed, stamped enve- Links Reveals Safety Analysis Issues lope. ISASI Forum reserves the right to reject, By Sébastien David and David Romat, Senior Safety Investigators, BEA—The authors exam- delete, summarize, or edit for space con- ine the safety assessment process for complex aircraft systems and design and conclude that siderations any submitted article. To facilitate the process can be vulnerable to errors or inaccuracies that may arise at various stages and editorial production processes, American Eng- lead to aircraft component or system failure. lish spelling of words is used. 22 The Effect of Commuting on Pilot Copyright © 2017—International Society of Air Safety Investigators, all rights reserved. Publica- Self-Assessment of Stress and Performance tion in any form is prohibited without permis- By Thomas M. Friesacher, a Ph.D. candidate at Cranfield University, UK, and an active sion. ISASI Forum registered U.S. Patent and senior airline pilot and instructor, and Dr. Matthew Greaves, Head of the Safety and T.M. Office. Opinions expressed by authors do Accident Investigation Center, Cranfield University, UK—The authors are conducting re- not necessarily represent official ISASI position search on stress exposure and susceptibility to error among cockpit crews in relation to pilot or policy. Permission to reprint is available upon application to the editorial offices. commuting practices. They note that pilot commuting to and from work can be stressful and fatiguing and therefore can have a significant negative effect on air safety. They suggest that Publisher’s Editorial Profile: ISASI Forum is print- a sound industry-level fatigue risk-management program rather than assigning responsibil- ed in the United States and published for profes- ity to individual pilots could enhance flight safety. sional air safety investigators who are members of the International Society of Air Safety Inves- tigators. Editorial content emphasizes accident investigation findings, investigative techniques and experiences, regulatory issues, industry ac- cident prevention developments, and ISASI and DEPARTMENTS member involvement and information. 2 Contents 3 President’s View: A Global Air Safety Advocate Subscriptions: A subscription to members is pro- vided as a portion of dues. Rate for nonmem- 28 News Roundup bers (domestic and Canada) is US$28; Rate for 30 ISASI Information nonmember international is US$30. Rate for all 32 Who’s Who: Aegean Airlines libraries and schools is US$24. For subscription information, call 703-430-9668. Additional or replacement ISASI Forum issues: Domestic and Canada US$4; international member US$4; do- mestic and Canada nonmember US$6; interna- ABOUT THE COVER tional nonmember US$8. Not many instruments were recovered from the wreckage of a Chilean C-212 military aircraft near Robinson Crusoe Island (see page 14), but the most relevant information was provided by the g’s indicator, where the needle was pointing to a negative vertical acceleration of -1.6 g’s. The aircraft was flying in inverted position with a significant downward acceleration. INCORPORATED AUGUST 31, 1964 2 • April-June 2017 ISASI Forum PRESIDENT’S VIEW

A GLOBAL AIR SAFETY ADVOCATE

SASI has a number of new members countries participated in technical pres- Virginia, and is managed by our one full- who may not be fully aware of our entations, social events, a business meet- time employee, Ann Schull, who is our organization’s accomplishments, the ing, and networking with colleagues. office manager. Ann handles commu- Iscope of our global efforts, and what ISASI 2017 is scheduled to take place nications, inquiries and requests from we do to enhance air safety investi- August 22–24 in San Diego, California. members, and mailings to members, gation. Even those of us who’ve been ISASI 2018 will be held in Dubai in the among other duties. This office is located around our Society for some time could United Arab Emirates October 29– five minutes from Washington Dulles probably use a refresher. So I want to November 1. International Airport, near Washington, give all ISASI members an update on the The Society’s publications and website D.C., and can be accessed by telephone Society’s status and activities. have a global audience. ISASI publishes a during normal business hours or by fax ISASI will turn 53 this summer. The quarterly magazine, ISASI Forum, which and e-mail at any time. Society was founded in the United States provides Society news and events and There are now 11 societies around under articles of incorporation in the includes edited versions of the techni- the world that are mostly active with District of Columbia on Aug. 14, 1964. At cal papers presented during the annual their own seminars, communications, the organizational meeting, the govern- seminars. ISASI Update is a periodic networking resources, and more. These ing bylaws of the Society were adopted newsletter covering news and events societies elect officers, hold meetings, and the first slate of officers elected. A that is e-mailed to all Society mem- and set agendas for their respective more thorough history can be found in bers. ISASI’s website provides members members. These societies also serve as the July-September 2014 issue of ISASI electronic access to ISASI information, ISASI seminar hosts when the event is Forum posted to the library on ISASI’s publications, events, activity reports, held in their region. website. The Society currently has 1,369 guidelines, and additional information These regional societies are the Asian WE ARE AN OFFICIAL OBSERVER DURING MEETINGS OF THE INTERNATIONAL CIVIL AVIATION ORGANIZATION—A UNITED NATIONS-SANCTIONED ENTITY THAT ESTABLISHES RULES AND PROCEDURES FOR AVIATION.

individual members and 138 corporate that members may find useful as air Society of Air Safety Investigators, Civil members who are based in 80 countries. safety investigators. Aviation Department of Hong Kong, ISASI—a U.S.-based 501(c)(3) tax-exempt ISASI’s International Council admin- president; the Australian Society of Air organization—is financially sound, and isters the Society’s business. The Inter- Safety Investigators, Rick Sellers, presi- an outside accounting firm conducts an national Council members include the dent; the Canadian Society of Air Safety audit and reports on the Society’s financ- Society’s president, vice president, sec- Investigators, Barbara Dunn, president; es on a yearly basis. retary, treasurer, executive advisor (the the European We’re an official observer during meet- immediate past president), and coun- Society of Air ings of the International Civil Aviation cilors representing the affiliated nation- Safety Inves- Organization—a United Nations-sanc- al societies and international members. tigators, Oliv- tioned entity that establishes rules and As the current ISASI president, I sit on ier Ferrante, procedures for aviation. ISASI represent- the Society’s International Council along president; the atives participate in numerous ICAO with Ron Schleede, vice president; Bob Korea Society committees and working groups whose MacIntosh, treasurer; Chad Balentine, of Aviation activities can be found in reports posted secretary; Dick Stone, executive advisor; and Railway to our website. and Councilors Caj Frostell, Internation- Accident As many of you can attest, ISASI holds al; Toby Carroll, United States; Barbara Investigation, an annual seminar. The ISASI 2016 sem- Dunn, Canada; Rob Carter, Europe; and Tea Hwan Cho, Frank Del Gandio inar was held last October in Iceland, Alister Buckingham, New Zealand. president; the where 271 delegates representing 40 Our international office is in Sterling, Latin American ISASI President April-June 2017 ISASI Forum • 3 PRESIDENT’S VIEW

Regional Society of Air Safety Investiga- Our Reachout Program is headed by tions throughout the year, and the num- tors, Guillermo Palacia, president; the ISASI members who train government ber of awardees is dependent upon the Middle East North Africa Society of Air and airline personnel about air safety amount of available funds. To date, ISASI Safety Investigators, Ismaeil Mohammed issues and the Society. Our instructors has awarded scholarships to 42 students, Al Hosani, president; the New Zealand don’t receive remuneration but do expect and five of these have received full-time Society of Air Safety Investigators, Alis- a per diem to cover daily expenses. The jobs in aviation due to their involvement host must supply air trans- with ISASI. “OUR REACHOUT PROGRAM IS portation, facilities, meals, We have 15 working groups—Airports, Air Traffic Services, Cabin Safety, Cor- etc. Reachouts are designed to porate Affairs, Critical Incident Stress HEADED BY ISASI MEMBERS provide high-quality and inex- Management, Flight Recorder, General WHO TRAIN GOVERNMENT AND pensive training opportunities Aviation, Government Air Safety, Human to individuals and organiza- Factors, ICAO, Investigators Training AIRLINE PERSONNEL ABOUT AIR tions and to introduce ISASI and Education, Military Aviation Safety in areas of the world where and Accident Investigation Military Air SAFETY ISSUES AND ISASI.” gains in accident investigation Safety Investigators, Society Positions, prevention may be achieved. Unmanned Aircraft Systems, and Men- ter Buckingham, president; the Pakistan ISASI Reachouts respond to the needs toring Program. Several working group Society of Air Safety Investigators, Syed of the particular location of the work- manuals are available on the ISASI website Naseem Ahmed, president; the Regional shop. The specific training program listed under Guidelines. These groups (CIS) Society of Air Safety Investigators, is developed following a request from accomplish most of their work via e-mail. Sergey Zayko, president; and the United local organizers. The workshops may be Forward a request to Ann Schull if you’re States Society of Air Safety Investigators, supported by ISASI corporate members interested in participating in any of these Toby Carroll, president. In the United or local sponsors who provide air travel working groups States, the Society is also broken down and accommodations for the instruct- The Society’s most prestigious recog- into regional chapters that cover Alaska, ing staff. There usually are no registra- nition is the Jerome F. Lederer Award, which is presented annually during the Arizona, Dallas/Ft. Worth, Great Lakes, tion fees, and no social events are held Society’s seminar for “outstanding lifetime Mid-Atlantic, Northeast, Northern Cali- that would add to the cost. Instructors contributions” for technical excellence to fornia, Pacific Northwest, Rocky Moun- prepare their own lesson plans and their improve air accident investigation tech- tain, Southeast, and Southern California. own handout materials and provide a niques, to achieve ISASI objectives, and Assisting in the work of the Interna- full range of services to those attending to enhance aviation safety. A 12-member tional Society are standing committees, the workshops. To date, ISASI has held selection committee reviews one-page special objective committees, and tech- 52 Reachout seminars and trained 2,600 nominations of a worthy individual, nical working groups that address air- attendees. group, or organization submitted by ISASI craft accident investigation policy and Established in 2003, our Scholarship members. Guidelines and procedures for standards, government air safety investi- Award Committee is another very active nominations can be found on ISASI’s web- gation, human factors, flight recorder, group. The committee evaluates papers site under Awards. and technical library issues. There are written on the subject of air safety inves- Another ISASI effort worth highlighting 11 standing committees: Audit, Award, tigation challenges submitted by students is our Student Mentoring Program, which Ballot Certification, Board of Fellows, attending an aviation school. Committee creates a formal link between experienced By-Laws, Code of Ethics and Conduct, members then select one to four stu- ISASI members and university/college dents for the Rudolf Kapustin Memorial Membership, Nominating, Scholarship students interested in a career in aviation Scholarship Award, which provides the Award, Reachout, and Seminar. safety. A student attending an aviation selectee(s) with a one-year ISASI member- Our Seminar Committee may be university or college who joins ISASI as a ship and allows the selectee(s) to attend student member is eligible to sign up for a the busiest as it coordinates the cur- the annual seminar. ISASI provides the volunteer ISASI mentor who can guide the rent-year event while assisting the host selectee(s) with a $2,000 stipend to cover student toward a career in a variety of air societies to budget, plan, and execute most expenses. At the seminar, each safety professions. We currently have 25 seminars for the following two years. selectee presents the chosen paper, which students participating in this program and This assistance can include helping the is then published in ISASI Forum. Each se- 48 ISASI members serving as their men- host society present site proposals to lectee is also offered courses at SCSI, TSI, tors. There are 22 students who participat- ISASI’s International Council, negoti- and the Cranfield University Safety and ed in the mentoring program who are now ating with hotels for food and meeting Accident Investigation Center. Applica- working within the aviation industry. room services and participant room fees, tion details and more information can be The bottom line is that our Society is and developing pre- and post-seminar found on our website. These scholarships very active and recognized around the activities. are funded from voluntary member dona- world as a leading air safety advocate.

4 • April-June 2017 ISASI Forum Nonprecision Approaches:

Status and Evolution Thomas By Thomas Lepagnot, Accident and Incident Investigator, Airbus Lepagnot

(Adapted with permission from the author’s technical paper entitled Nonprecision Approach has an engineer diploma from École NPA: Status and Evolution presented during ISASI 2016 in Reykjavik, Iceland, October 18–20, Nationale de l’Aviation Civile (ENAC) in 2016. The full text of this presentation can be found on the ISASI website at www.isasi.org in the Toulouse, France. He began his career Library tab under Technical Presentations.—Editor) in 1998, as a flight ops engineer in a French charter airline (STAR Airlines, PAs are still the scene of an • Impacts far from ideal touchdown now named XL Airways France), important number of accidents. point, and responsible for the development of the airline operational documentation This statement was particularly • No EGPWS alert (outside the true for Airbus during the past (AOM, MEL, etc.), the aircraft per- N EGPWS envelope). formance computation (takeoff and 12 months. That is the reason why it has been decided to dedicate one full day This event involved an A330 air- landing performance) and monitoring (aging performance), and also being of the 22nd Airbus Flight Safety Con- craft that was conducting an RNP AR in charge of drawing up and following ference held in Bangkok, Thailand, this (0.3 nautical miles) approach during up on all the operational authorization year to this specific subject. You will daylight (early morning) with auto- requests (AWO, RVSM, ETOPS) with find in this document an extract of what pilot (AP1) and both flight directors local authorities. Airbus presented on this topic during engaged. After 45 minutes of holding He then moved to the Quality As- the conference. and one go-around due to bad visibili- ty (fog), the aircraft initiated a second surance Department of the operator approach following an improvement as the operational quality manager NPA—Case study of visibility (above minima) an- in charge of the supervision of the First, we will cover an NPA that oc- nounced by the tower. JAR OPS 1 regulation for the opera- curred in 2015 with, fortunately, no At minima, the captain who was the tor side and JAR FCL 1 regulation for fatalities (only some light injuries), but pilot flying (PF) decided to continue the type-rating training organization with the loss of the aircraft (beyond a little bit below with AP1 ON as he (TRTO). economical repair). had most likely no visual reference of Lepagnot joined Airbus in 2006 in The following points are generally en- the runway. At 50 feet RA, the captain the Flight Operations Support Depart- countered in most of the accidents oc- said “appearing” and disconnected the ment as a flight ops engineer for the curring during NPAs (and this is actually AP1 at 14 feet, i.e., one second before A320 and A330/340 aircraft family. the case for the event we are focusing on touchdown. The aircraft performed At this position, he was in charge of the technical support to airlines for in this article): a hard landing and touched down operational documentation (FCOM, • An inappropriate use of the auto- about 400 meters after the runway QRH, and FCTM) and procedures. He flight system, threshold on the left-hand side of the was also involved in coordinating this • Challenging meteorological condi- runway axis with the left main landing activity with the Airbus Training Policy tions, gear outside the pavement area. Then, Department. TOGA thrust was selected one second • Poor visual references at or below Then he took the position of safety before the thrust levers were retarded minimum descent altitude, enhancement and policy manager to idle and set to rev max. • Late go-around decision, within the Flight Operations Support The aircraft Department. As such, he was respon- finally stopped sible for coordinating the activities at about 1,400 linked to the Airbus product safety pro- meters from the cess for all Airbus aircraft types (e.g., threshold with enhancement of the safety of flight op- both main landing erations and operational procedures). gears outside the Lepagnot joined the Airbus Prod- runway and with uct Safety Department in 2013 as an the nose laid on accident and incident investigator. In the ground (nose this position, he is leading the Airbus landing gear investigation, coordinating the in- collapsed). Only depth Airbus analysis and technically one person was supporting investigation boards in Figure 1. Case study injured during the their investigations.

April-June 2017 ISASI Forum • 5 aircraft position (through navaids), and • Not straight- forward monitor- ing of the vertical trajectory. However, tech- nology has evolved. What was true 40 years ago, when NPAs were con- structed, is not necessarily the case now, and the distinction between precision and nonprecision is no Figure 2. Case study longer as clear. emergency evacuation. The aircraft was guidance, and NPA design evolutions declared a hull loss. • the precision of the navaids that Introduction of the FMS in the 1980s has During analysis of this event, investi- are used to position the aircraft on allowed the construction of lateral and gators found that the coordinates of the vertical profiles independent of navaids. runway threshold coded into the Flight Coupled with the deployment of the Management System (FMS) nav data- Inertial Reference System, the FMS also base of the involved aircraft were wrong provides more accurate positioning and (not on the runway centerline, but offset flight planning. But not until the 1990s from about 26 meters on the left of the was a significant breakthrough made re- runway centerline). By construction, the garding accuracy in aircraft positioning RNP AR approach is anchored to the with the implementation of the Global runway threshold. Positing System (GPS)—12 meter accu- Before recalling what are the standard racy and worldwide coverage. GPS now operating procedures (SOPs) and the allows very precise positioning. best practices that should be applied to Figure 4. MCDU This technology has allowed the safely fly an NPA, let’s review the differ- design of a new type of approach that no ent designs of NPAs that can be encoun- the lateral trajectory is not very tered today. longer uses navaids (e.g., ground-based accurate. information), but aircraft-based infor- First NPA designs mation with enough accuracy to enable NPA—Design evolutions In the 1970s, these approaches were lateral and vertical guidance. These Definition actually designed based on lateral approaches are called RNP approaches Let’s start with a definition or at least course or pattern supported by radio (also called RNAV [GNSS] approaches an explanation of why these approaches navaids (VOR, NDB, DME) with a step on charts) or RNP AR approaches (called are called nonprecision approaches. In down or even no vertical path. RNAV [RNP] approaches on charts). the 1970s, this king of approaches was These approaches—built using what This new type of NPA has several ad- called a nonprecision approach com- is now old technology, but that still vantages compared to a “conventional” pared to a precision approach because exists—are by their very construction NPA (i.e., NPAs based on navaids): • an NPA does not provide vertical more demanding to fly for a flight • A continuous descent final crew than a precision approach for the approach, following reasons: • An MAP at runway threshold, • Minimum descent altitude (MDA) leading to level off and destabili- • Allows much more accurate track to zation (dive and drive), be flown, • Missed approach point (MAP) not • Enables fully managed guidance located at runway threshold, along the lateral and vertical trajec- • Final segment not aligned with tory, and the runway, • Makes the monitoring of the vertical • Poor accuracy to compute the flight path easier. Figure 3. VOR 6 • April-June 2017 ISASI Forum In this connection, the International aged mode, the approach stored in the Civil Aviation Organization (ICAO) is- nav database must be either produced sued in September 2010 Resolution A37- by an approved supplier compliant with 11, which provides recommendations to ED76/DO200A requirements or validat- urge all sates to implement RNAV and ed and approved by the operator. For RNP not only for enroute operations, but RNP AR (e.g., RNAV [RNP]) procedures, also for terminal areas in accordance both conditions should be fulfilled. Then with the ICAO Performance-Based Nav- during the descent, the flight crew has igation (PBN) concept. Airbus promotes to check the navigation accuracy and and actively supports the implementa- manage a potential degraded navigation tion of safe and efficient PBN operations situation. worldwide. The PBN concept allows the design Figure 6. Visual reference Approach procedure of safer and more efficient instrument Among other actions, the NPA proce- flight approach procedures. However Control Center. dure asks the flight crew for the follow- such approaches are very “data depend- ing actions: ent,” meaning they strongly rely on the Most of the actions to prepare the approach are performed during • Check arming and engagement of accuracy of the published aeronautical the lateral mode, data and on the correct coding of the descent preparation. A good and FMS nav database. Even if the FMS nav comprehensive preparation is one of • Check that the FAF is flown accord- database issue was not the main root the key points for the safe conduct of ing to the chart (with associated case of the accident, the first case study the approach. callout), Indeed, an approach not fully presented in this article is, however, an • Check arming and engagement of briefed and rushed due to ATC or eloquent example of this dependence. the vertical mode, Therefore, one of the safety challenges weather constraints is most of the • Respect the approach chart and in of this new type of approach is to ensure time one of the significant contrib- that the nav database inserted into the utors to incidents or even accidents particular the published minimum FMS of each aircraft is correctly coded during NPAs (where the workload is sector altitude, with the accurate data. This requires the high). • Monitor the vertical profile and the What are the main and specific implementation and the strict appli- flight parameters, points that should be reviewed at the cation of a robust FMS nav database • The PM role is crucial in this moni- checking process. descent preparation when a NPA is planned to be flown? toring, • The aircraft capability to fly the NPA—SOP best practices • At minima, respect the Golden Rule: planned type of approach (final “If no or insufficient visual referenc- Approach briefing app, Flight Landing System, etc.); es, go around”; and Preparing an NPA starts on the ground • The consistency between the before flight. The validation of the FMS • If visual references are lost below MCDU F-PLN page and the ap- nav database and the check of the GPS minima, go around. proach chart with a special check primary availability at the destination (if on the final segment, e.g., final the approach requiring GPS is expect- approach fix position and altitude, ed) are usually done by the Operations final course, flight path angle, M AP, a n d minima; • The strategy for the vertical guidance— selected or Figure 7. Go-around managed; and • Approach Conclusion briefing To conclude, we can say that NPAs are including still the scene of an important number missed- of accidents. NPAs are evolving in a safer approach way. PBN implementation allows pilots strategy. to fly safer and more efficient approach To be procedures, however, a robust FMS nav allowed to database checking process becomes fly an NPA in critical. As always, adherence to SOPs Figure 5. Approach vertical man- and respect of minima remain crucial. April-June 2017 ISASI Forum • 7 Introduction aircraft certified under Part 25 and Part aircraft. The following are some known A recent study comparing accidents 23 rules, respectively. One of the vari- workload factors considered significant involving one-pilot versus two-pilot busi- ous differences in the certification rules when analyzing and demonstrating work- ness jet operations in a 37-year period between small and large aircraft is the load for minimum flight crew determina- revealed that 37 percent of the analyzed requirement for at least two pilots in large tion: accidents involved jets crewed by one-pi- transport-category airplanes. • The impact of basic airplane flight lot versus 63 percent with jets crewed by In almost every area of certification, the characteristics on stability and ease two pilots. Even though the number of standards for jets have been more rigor- of flight path control. two-pilot accidents was higher, single-pi- ous than those for turboprop airplanes. • The accessibility, ease, and simplicity lot accidents resulted in more fatal crash- One of those standards had been the re- of operation of all necessary flight, es. Embraer has assisted investigation quirement for two pilots, which remained power, and equipment controls, in- authorities in several events involving sin- in force until 1977 when Cessna won cluding emergency fuel shutoff valves, gle-pilot operations, and valuable lessons approval for single-pilot operation of its electrical controls, electronic con- were learned from these events in terms Citation I-SP with the intent to market it trols, pressurization system controls, of training, publications, investigation against small twin turboprops. Since then, and engine controls. procedures, and safety factors involved other small jets have also been certified as single-pilot operations have pecu- to be crewed by one pilot, such as the • The accessibility and conspicuity liar characteristics when compared to Eclipse 500, Mustang, Premier I, Phenom of all necessary instruments and two-pilot operations. Embraer has looked 100, Phenom 300, Honda Jet, and some failure-warning devices such as fire deeper into operational aspects present Citation versions. Most single-pilot jets warning, electrical system malfunc-

(Adapted with permission from the author’s INVESTIGATION OF technical paper entitled Investigation of Single-Pilot Operation Accidents present- ed during ISASI 2016, in Reykjavik, Iceland. The full presentation with references can SINGLE-PILOT be found on the ISASI website at www.isasi. org in the Library tab under Technical Presentations.—Editor) OPERATION ACCIDENTS By Fabio Couto Bonnett, Air Safety Investigator, Embraer Air Safety Department in the occurrences with the objective to are very light jets (VLJ), which fall under tion, and other failure or caution identify trends, develop improvements, the small aircraft category as they usually indicators. The extent to which such and enhance the investigation process. have maximum takeoff weights under instruments or devices direct the For a thorough understanding, this 10,000 pounds (4,535 kilograms). proper corrective action is also con- paper presents the concept of single-pilot For many years, cockpits of aircraft sidered. operation, its certification requirements, certified under Part 23 requirements were • The complexity and difficulty of limitations, and the profiles of the pilots simple in design and used instruments operation of the fuel system, with who usually crew aircraft in single-pilot and systems that were also similar in particular consideration given to the operations. This paper aims to share operation. This made it easy for pilots to required fuel management schedule Embraer’s experience gathered from transition safely from one Part 23 air- required by structural or other air- years of supporting investigations of this craft to another. However, because of the worthiness considerations. Addi- type of occurrence worldwide to provide continuous growth of modern technol- tionally, the ability of each engine to investigators with important aspects to ogy and the reduced cost of electronic operate continuously from a single be observed throughout the investiga- components, newer and more-complex tank or source that is automatically tion of occurrences involving single-pilot integrated avionics are increasingly being replenished from other tanks if the operations, as well as to point out the installed in Part 23 airplanes. These new total fuel supply is stored in more importance of turning the lessons learned systems have changed the appearance, than one tank. from these occurrences into assertive and operation, and man-machine interface. feasible recommendations. 14 CFR Part 23, §23.1523 establishes • The degree and duration of concen- the criteria for determining the mini- trated mental and physical effort Single-pilot jets: background mum flight crew, and in order to have involved in normal operation and in Most business jets are certified in the an aircraft certified as single-pilot, some diagnosing and coping with malfunc- transport category because they have aspects—such as workload, pilot inter- tions and emergencies, including maximum certified takeoff weights great- face with cockpit equipment, and degree accomplishment of checklist and er than 12,500 pounds (5,670 kilograms)— of automation—must be consistent location and accessibility of switches the threshold between large and small with having only one pilot on board the and valves. 8 • April-June 2017 ISASI Forum • The extent of required monitoring of Human error is often related to ing on the flight phase, weather, terrain, the fuel, hydraulic, and pressurization workload, and there is usually a positive infrastructure, and other factors. systems. correlation between excessive workload Psychomotor skills related to the ability After the certification authority deter- and the occurrence of errors. It should be to control the aircraft are especially mines that the proposed design allows noted that errors could also be associated called upon during takeoffs, landings, and the pilot to physically manage the cockpit with low workload. Levels of workload emergency situations and are less called from the left seat, actual flight testing that are too low are often found in fully upon during cruise phase. On the other will determine if the airplane can be automated systems where the operator hand, cognitive skills are needed through- approved for single-pilot operation. The serves largely as a monitor of the au- out the entire flight and are related to the results from these flights are the basis for tomated processes. In these cases, the satisfactory conclusion of the operation the Flight Standardization Board (FSB) operator-pilot may become inattentive in each flight phase, operation of the dif- Report, which specifies training, check- and/or bored, and this situation is gen- ferent systems, performance assessments, ing, and currency requirements for flight erally referred to as task underload. At reading and execution of emergency crews operating the referred aircraft. the opposite extreme, levels of workload procedures, emotion control, etc. In this case, it is the airplane that is that are too high often cause the pilot During normal operation, the workload approved for single-pilot flying, not the to miss important information, fail to can be generally foreseen for each phase pilot. Therefore a training program must perform tasks, make errors, or engage in of the flight, allowing the pilot to antic- be developed by the aircraft manufac- task shedding in an attempt to reduce ipate the actions and reduce workload. turer, and it needs to be approved by the workload. During emergency situations, exceptional certification authorities in accordance The single-pilot operation introduc- events require specific actions (immedi- with the FSB report. es a different dynamics in the cockpit ate or not) from the pilot. The degree of From the owner-pilot perspective, compared to a dual-crew operation. The complexity associated with an emergency single-pilot operation is all about flexi- decision-making process and the overall will determine the urgency and sequence bility, and it is understandable why most management of the flight rest with the of actions to be taken by the pilot. Gener- of them prefer to fly their business jets solo pilot, and, therefore, automation ally, these situations increase the work- without a copilot. The convenience of plays a very important role in reducing load of the pilot, who must keep focused taking off when you want, staying there as the workload throughout the flight. Even on managing the flight while applying long as you want, and all other aspects of though aircraft systems are known to be the necessary measures to manage the operating your own aircraft are at least a very reliable, they are not equipped with emergency. little more complicated when you need an airmanship as humans are, and, there- The workload during normal and ab- extra pilot. fore, single-pilot operation increases the normal operations is taken into account need for threat and error management, when an aircraft is certified as single-pi- Single-pilot operation: human adequate training, planning, and deci- lot, and the absence of one crewmember performance sion-making. in the cockpit is a characteristic of this Since a second pilot is not available to kind of operation and not a limiting factor In aviation, the decision-making process support the operation, the solo pilot is for good operational performance. has been an area of interest for investiga- responsible for flight planning, systems tors and aviation safety professionals. The monitoring, flying the aircraft, communi- Single-pilot operation: history of occurrence of errors in the decision-mak- cation, and self-evaluation that provides occurrences ing process is usually related to the avia- the necessary feedback for further perfor- tion context itself, which is surrounded by A 2015 analysis comparing accidents mance improvement. When combined, quick-changing scenarios and challenging involving one-pilot versus two-pilot busi- these actions demand a significant cog- factors that may compromise crew per- ness jet operations from 1977 through nitive and psychomotor workload, which formance, such as complexity of systems 2014 revealed that, from a statistics and level of automation. varies throughout the operation depend- standpoint, there is only a slight safety Workload is defined as the relation- ship between an individual’s capacity to perform a task (mental and/or physical) graduated with a degree in aeronautical engineering in 2005 and and the level of system and situational has worked in the aviation industry since 2002. He joined Embraer’s demands associated with the perfor- Air Safety Department in 2012 and has worked since then as an air mance of that task. The basic notion is safety investigator in the Investigations Group, which is responsible related to the differences between the for providing technical support for official investigations involving amount of resources available to the Embraer products according to provisions of ICAO’s Annex 13. operator (human being) and the amount Fabio Bonnett is also a certified flight instructor, type-rated in the Phen- of resources demanded by the task. Couto om 300 as pilot-in-command and is the focal point for operational Tasks that demand much of the human’s Bonnett aspects at Embraer Air Safety Department headquarters in Brazil. resources are considered high-workload Writing this paper would not have been possible without the expertise tasks. Conversely, tasks that demand little and good will of all Embraer colleagues who volunteered their time to of the human’s resources (capacity) are support me. considered low-workload tasks.

April-June 2017 ISASI Forum • 9 advantage to having a multiple cockpit statistically wise. instruct the operator of the aircraft to pull crew in single-pilot jets. The analysis Every flight, single-pilot or not, has the associated circuit breaker and keep examined 107 accidents, 40 of which were hazards and some level of risk associated the aircraft powered off so that the unit is in jets piloted by a one-pilot crew versus with it. It is critical that operators and de-energized, preventing the audio from 67 accidents in jets crewed by two pilots. pilots are able to differentiate, in advance, being overwritten. If, for any reason, this Although there were more two-pilot between a low-risk flight and a high-risk is not feasible, the investigator should do accidents, half of the single-pilot acci- flight, and then establish an assessment it immediately upon arrival at the crash dents were fatal crashes compared to 45 process and develop risk-mitigation site. Some aircraft may have more than percent of two-pilot accidents. strategies to address flights throughout one recording unit, so it is important that On Aug. 2, 1979, a Citation 501 flown by that range. A risk-assessment tool allows all related circuit breakers are pulled. New York Yankees catcher Thurman Mun- pilots to identify the risk profile of a flight The Phenom 100 and 300 are equipped son crashed in Akron, Ohio. The accident in its planning stages. with a combined voice and data recorder received very extensive news media cov- Many corporate operators may have the installed in the rear section of the aircraft. erage, but one very important aspect was perception that having two qualified pi- The Phenom 300 has an additional flight not reported. This was the first fatal crash lots on board the aircraft reduces the risk data recorder (FDR) unit installed in the involving a single-pilot certified light jet. level and provides the operation with a front section of the aircraft (optional), According to the NTSB final report, the higher level of safety than having just one and there are different circuit breakers for probable cause of the accident was the pilot. Even though the numbers presented each unit. pilot’s failure to follow the appropriate herein do not support this perception, checklist and to recognize the need for many operators choose to limit their Central maintenance computer and to take action to maintain sufficient single-pilot operations according to the The aircraft’s central maintenance com- airspeed to prevent a stall into the ground profile of the mission as a way to mitigate puter (CMC) stores a variety of important during an attempted landing. the risks in specific operations. information. Aircraft with advanced avi- This accident, followed by several oth- onics display advisory, caution, and warn- ers throughout the years, raised questions Single-pilot operation accidents: the ing messages depending of the type of about the safety of single-pilot opera- investigation malfunction. These messages are logged tions—whether they are inherently less After the investigation authority has been into the CMC’s memory and can be down- safe when compared to two-pilot opera- notified of an accident, it is likely that a loaded for further analysis if the unit is tions. The fact is there is no evidence that go-team will be launched to the crash not damaged. If it is safe to power up the this accident could have been avoided if site. It is important to remember that a aircraft, the investigator should download there had been another pilot sitting in the single-pilot accident is no different than the data on site. In most cases, the unit is right seat. any other accident, and all necessary removed from the aircraft and preserved Out of the 107 accidents with business precautions must be taken to ensure for further analysis at the manufacturer jets certified for single-pilot operation, the safety of the group during the onsite of the component. Embraer Phenom 67 were crewed by two qualified pilots activities. Such precautions include a 100 and 300s CMC records, among other while 40 were crewed by one qualified thorough risk assessment prior to de- parameters, latitude, longitude, and pilot. Going deeper into the numbers, ployment of the team, use of appropriate groundspeed of the aircraft upon takeoff approximately 45 percent of the two-pilot safety equipment, and health precautions and landing, and they are able to transmit accidents resulted in 102 casualties, while among other things. the CMC logs to an Embraer server every 50 percent of the single-pilot accidents The following topics present suggested time the aircraft lands—thus allowing resulted in 58 casualties. Even though the lines of investigation for a single-pilot investigators to quickly determine the percentages of fatal accidents are similar, accident, based on Embraer’s experience touchdown point of the aircraft within the numbers show that more people with this kind of event throughout the minutes after the accident takes place. perished in two-pilot accidents from 1977 years. The events described herein are to 2014. based on final reports from accident Photos The most frequent type of accident was investigations worldwide. Just like any other accident, the inves- runway excursion on landing, and most tigator should not hesitate to take as of them were survivable. Runway excur- Activities at the crash site many photos as possible, even if it feels sions with more serious results typically like they will not be of help in the future. happened due to the crew’s inadequate Recorders Also, remember to document everything decision-making process, such as electing Most VLJs are equipped with a cockpit before an item is touched or moved. It is to continue on an unstable approach and voice recorder (CVR) unit, and it is imper- recommended not to delete photos from land. The study revealed that 26 runway ative that the recorded audio is not over- the camera so that the file number se- excursions happened on two-pilot op- written after the accident. Since many quence is not disrupted. Recording videos erations versus 12 on single-pilot opera- accidents are survivable and the damage can also be a helpful tool to register the tions—more than double. to the aircraft is usually not very exten- condition of certain parts of the aircraft The study showed that the number sive, it is not uncommon for the aircraft and the accident environment. Some- of accidents are proportional to the to be powered up after the event. There- times, available time at the crash site may fleet size. Therefore, the fleet with more fore, whenever feasible, upon notification be limited, and narrated high-definition aircraft is likely to have more accidents, of the accident, the investigator should videos can be a quick and reliable way to

10 • April-June 2017 ISASI Forum document the crash site. ing, oil level) pitot tubes, angle-of-at- training in the full-flight simulator or tack vanes, landing gear general in the actual aircraft. Most Part 91 VLJs Cockpit condition (including tires, wheels, and crewmembers come from twin-engine Since most VLJs are not equipped with brakes), general condition of doors piston and turboprop aircraft, and VLJs an FDR unit, cockpit photos are a very and emergency exits, and any other are usually their first jet experience. They helpful resource for operational anal- items the investigator finds relevant are usually businessmen and do not fly on ysis of single-pilot accidents. They will a daily or weekly basis. show the positions of knobs, switches, Crash site and surroundings Most accidents involving VLJ operation push buttons, flap lever, landing gear As mentioned, runway excursion is the are essentially related to operational as- handle, emergency parking brake lever, top type of occurrence with VLJs. It is pects, and the following factors have been condition of oxygen masks, emergency important to document runway condi- present in the majority of the events that equipment, whether a performance tions (drainage, holes, surface uniform- Embraer has analyzed. data card was filled out for that phase ity), runway markings (touchdown point, of flight, etc. braking marks, hydroplaning marks), Training The investigator should also take runway departure point, impact marks It is recommended to research the photos of the covers of the onboard etc. crewmember’s training history, back aircraft manuals to register which revi- to basic training at the flight school, to sion of the manuals the crew was using. GPS markings identify possible learning difficulties After taking as many photos as A handheld GPS is very helpful for the the pilot might have had in the past or possible in the cockpit, the investigator investigator to put together a crash site behavior profiles that could be identi-

Figure 1. Recorded GPS tracking along the runway threshold used as reference for calibration.

may want to try the push buttons and sketch. Using the GPS, the investigator fied in the accident. document their positions since they are can mark the location of debris, touch- very difficult to identify in photos. down point, runway departure point, as Previous equipment flown by the well as record individual tire mark tracks crewmember Passenger cabin throughout the runway. It is important An aircraft differs from an automobile Detailed passenger cabin photos will to remember that, for better accuracy, all in that one can drive different models show the investigators the condition markings must be done within the hour. and operate their systems without major of seat belts, use of emergency exits, In addition to that, it is recommended difficulties. Each aircraft has different sys- use of emergency equipment, safety that the investigator record a tracking tems, procedures, limitations, and han- card information, etc. This will help the over a known region, such as runway edg- dling characteristics. It is not uncommon investigator gather data for the survival es, so the recorded markings and tracks for VLJ pilots who have logged hundreds factors investigation. can be adjusted on the map if necessary. of hours on twin-engine piston or turbo- Figure 1 shows the tracking recorded prop aircraft to revert to their previous Outside aircraft along the runway edges during the onsite knowledge on those aircraft and get the External photos may also be a source activities further used to calibrate the procedures mixed up in their minds. The of information for further questions position of the tires marks recorded over same can happen to pilots who logged about aircraft damage. It is very impor- the runway. thousands of hours on widebody jets. tant to take photos of the wings, flap In one event, the pilot was monitoring panel positions, flap actuators, flight Lines of investigation the fuel levels in each wing after takeoff control surfaces, trim tabs, engines’ Depending on the country, pilots are and noticed a certain difference between general conditions (fan blades, cowl- allowed to get their initial and recurrent those tanks. While still climbing and

April-June 2017 ISASI Forum • 11 this personal characteristic is sometimes brought into the cockpit, influencing the pilot’s decision-making process. In one event, the aircraft ex- perienced a runway excursion after landing on a water-con- taminated runway. Upon take- off from the origin airport, the weather conditions at the destination were favorable to a landing under visual flight rules (VFR), but throughout the flight, weather conditions at the destination started to Figure 2. Segments of a landing—unfactored landing distance. deteriorate. The pilot reported difficulties in coordinating without getting any fuel imbalance crew alert- the ground before takeoff, the crew received a clearances with ATC. The ing system (CAS) messages, the pilot decided CAS message, indicating a brake fail condition approach would initially be to open the fuel transfer valve to balance the that they attempted to unsuccessfully reset. conducted to the southeast; fuel and commanded a turn, which aggravat- They decided to continue their departure, and but due to the start of precip- ed the imbalance to a point where one of the the CAS message stayed active for the entire itation over the airport, the wings got really heavy and large aileron trim flight. There was a pilot type-rated in the air- runway in use changed. In the deflection was necessary to keep the wings craft occupying the left seat and another pilot meanwhile, in the base leg, leveled. The pilot requested to turn back and in the right seat who was not type-rated in with the runway in sight, the landed the aircraft uneventfully. During the the aircraft. The pilot on the left was flying the pilot was instructed by ATC investigation, while interviewing the pilot, airplane for most of the flight and conducted a to perform a 360-degree turn he mentioned that he opened the cross-feed GPS approach. Just before landing, the pilot on to maintain separation from to balance the fuel. However, the aircraft he the right took over and, after touchdown, dis- three others in the traffic pat- was flying at the time of the occurrence did covered that they had no brakes. The airplane tern. Precipitation increased not have a cross-feed system but a gravity fuel began skidding after the emergency parking over the airport, and even transfer system. The pilot was relatively new brake (EPB) handle was pulled. though visibility was reduced, to this aircraft type and brought his previous In another event, the aircraft overran the the pilot configured the knowledge from the equipment he had flown runway limits after landing on a water-con- aircraft for landing, continued for more than five years prior. taminated runway. The pilot sitting on the left with the approach, and ended was type-rated in the aircraft, and the pilot on up skidding off the runway. Passenger in the right seat the right was not. According to the FDR data, The pilot reported that he was It is not uncommon for a passenger to sit in the touchdown occurred approximately 1,700 motivated to land due to the the right seat during single-pilot operations. feet (520 meters) past the runway threshold. As previous difficulties with ATC Based on previous accidents analyses, some per the CVR, the pilot sitting on the right, who and also due to the weather. of these passengers were pilots, not type-rated was not type-rated in the aircraft, landed the He was concerned that if he in the aircraft, and were assigned operational aircraft with verbal assistance from the pilot had to go around, he would duties such as callouts, communications, FMS on the left. not be able to proceed back to programming, aircraft configuration, and even the airport due to the dete- the landing itself. Having someone sitting in Motivation riorating weather. The pilot’s the right seat does not decrease the single-pi- Motivation causes one to act or behave in motivation played a very lot operation safety itself, but if, during critical certain ways. The word “motivation” itself is important role in his deci- phases of the flight, the pilot-in-command is neutral in meaning and may have positive or sion-making process, leading engaged in extra activities (not expected in negative connotations such as making safe him to take unnecessary risks. single-pilot operations) such as explaining decisions or taking risks. Human error is Even though this was a sin- the functioning of the aircraft systems and context dependent and is usually aggravated gle-pilot operation, this was monitoring the actions taken by the person by personal characteristics such as experience, not the case of an owner-pilot sitting in the right seat, higher cognitive skills self-confidence, pride, etc. This combination operating the aircraft. The might be demanded and may affect the pilot’s may lead individuals to ignore evidence in pilot was an experienced cap- capacity to focus on what is relevant to the favor of anything they disagree with and give tain, with more than 17,000 flying task. In some countries such as Brazil, more weight to information that confirms hours logged in commercial the person occupying the right seat may not what they know to be true. Such a tendency is aviation. operate the aircraft or its systems unless this known as confirmation bias. Owner-pilots are person is fully type-rated in the aircraft. usually successful businessmen who are used Human stress In one event, when the aircraft was still on to taking risks in their professional lives, and Stress has been a frequent

12 • April-June 2017 ISASI Forum cause of accidents in aviation. Defining Design regulation requires manufac- that, the approach was performed with a stress is not a simple task since its causes, turers to provide landing distance figures Vref overspeed of 10 knots and a 7-knot also known as stressors, come from differ- for dry runways. Landing distances for tailwind component, which increased the ent sources. wet runways are determined by simply required landing distance. The aircraft There are several good definitions of multiplying a factor over the dry landing departed the end of the runway at 37 stress, but the following is very interest- distance, and this multiplication is man- knots and collided with a fence. This ing: “Stress is the state of dynamic tension dated by operational requirements. The aircraft type provides the crew with wind created when you respond to perceived dry unfactored landing distance provided information, and in the referenced event, demands and pressures from outside and by the manufacturer is determined in neither the pilot-in-command nor the from within yourself.” two parts, as shown in Figure 2. The first pilot in the right checked the tailwind Basically, this definition states that part corresponds to the airborne dis- component in the avionics. stressors are present in both external tance, which is the distance between the Most Part 91 operators do not have and internal factors. By nature, stressors point in trajectory in which the aircraft policies in place for assessing whether can be environmental (e.g., temperature, is 50 feet above runway surface and the sufficient landing distance exists at the noise, luminosity), psychosocial (e.g., touchdown point. The second part is the time of arrival, even when conditions family, work, friends), and psychological ground distance, which is the distance (including runway, meteorological, sur- (e.g., health, hunger, well-being). Stressors from touchdown to the complete stop. face, airplane weight, airplane configura- cause the human body to have responses The ground distance may be divided into tion, and planned usage of decelerating that are usually common and sometimes a transition phase, where the decelerating devices) are different and worse than nonspecific ones, and the magnitude of devices are beginning to be applied, and a those planned at the time the flight was the responses are proportional to the rele- full braking phase, with the decelerating released. vance of the stressors to each individual. devices fully in operation. Human performance is intimately If deviations are present in the ap- Inflight performance related to stress level. As stress rises, one’s proach, such as Vref overspeed, tailwind, The manufacturer also provides per- motivation and attention also rise, caus- aircraft high over runway threshold, and formance numbers for climb, cruise, ing performance to improve. If the stress long flare, the numbers provided by the descent, holding, and drift down so that level becomes too high, motivation and aircraft manufacturer will no longer be the crew can plan the flight as to fuel attention degrade, leading to a reduced valid and more runway length will be consumption and operational limitations performance. required for the aircraft to stop within the considering aircraft weight, altitude, and As mentioned, owner-pilots of VLJs runway limits. Such deviations are often ISA deviation. are usually successful businessmen present in runway excursions involving Some Part 91 operators of single-pilot who use their own aircraft for business. single-pilot operations, and the reason VLJs do not have an extensive back- A businessman, tight on schedule and is that these operators do not have flight ground in aviation, especially when it flying himself to an important business data monitoring programs associated comes to high-performance aircraft. meeting, usually brings his expectations, with their operations. These programs Some important aspects of performance strategies, and concerns to the cockpit, feature algorithms to identify certain and aerodynamics may not be well com- which increase his level of stress, possibly patterns in routine operations, with the prehended by these individuals, leading leading him to a scenario of self-imposed objective of enhancing flight safety by to nonadherence to the published per- pressure where his performance is likely identifying potential risks and modifying formance numbers, resulting in a flight to be degraded. training programs accordingly. outside the certified envelope. In one event, the aircraft experienced In one event, the aircraft experienced Aircraft performance a runway overrun after landing in a a loss of control in flight at 41,000 feet. Performance has been a contributing wet runway. On board the aircraft were According to the planned flight profile, factor in most single-pilot accidents—not four passengers and two pilots. The the aircraft should step climb to flight the aircraft performance itself but the aircraft was heavy, only 143 pounds (65 level (FL) 390 and maintain leveled flight crew’s assessment about it and adherence kilograms) below the maximum land- for approximately 30 minutes before to the aircraft limitations and perfor- ing weight. There had been recent rain climbing to FL410, which was the final mance numbers. The accidents analyzed showers over the destination airfield, and cruising level. However, prior to takeoff by Embraer, in which performance was a marginal VFR conditions prevailed. The one of the passengers did not board, and factor, resulted either in runway excur- pilot on the right was not type-rated in the pilot-in-command assumed that sions or loss of control in flight. the aircraft and was handling communi- being one passenger lighter would allow cations and the avionics, being verbally the aircraft to climb straight to the final Landing distance assisted by the pilot-in-command. The cruising level. The pilot-in-command In almost all runways excursions, the available landing distance was 3,600 feet spent a large amount of time explaining available runway length is not sufficient (1,100 meters), and, according to the the aircraft systems to the person sitting for the aircraft to stop within the runway operational manuals, for the given weight in the right seat, who was not type-rat- limits as a result of the actual runway and approach flaps, a distance of 4,124 ed in the aircraft, and thus he failed to condition, approach speed, aircraft feet (1,257 meters), would be required for identify the airspeed slowly decreasing configuration, tailwind, long flare, brake a full stop, which was greater than the application delay, etc. available landing distance. In addition to (Continued on page 30)

April-June 2017 ISASI Forum • 13 LINKS FOR A SUCCESSFUL Figure 1 INVESTIGATION: C-212 ROBINSON CRUSOE ISLAND ACCIDENT CASE By Luis Gracia, Head of Product Safety, Airbus Defense and Space–Military Aircraft

(Adapted with permission from the author’s technical paper entitled Links for a Successful Investigation: C-212 Robinson Crusoe Island Accident Case presented during ISASI 2016, in Reykjavik, Iceland. The full presentation with references can be found on the ISASI website at www.isasi.org in the Library tab under Technical Presentations.—Editor)

his paper introduces how a suc- civil personnel from the NGO and a Chil- nation airport was mandatory when the cessful investigation on a complex ean TV channel supported by two FACH nonreturn point is overcome. FACH policy accident can be accomplished even public relations representatives. approves operating this way, based on the Twhen you don’t have any data from As part of the civil personnel contingent, actual distance between the island and the the flight data recorder (FDR) or cock- on board were the brother-in-law of the continent and in the absence of alternative pit voice recorder (CVR). Most accident minister of defense, who was also the NGO airports other than those located on the investigations are normally based on data chairman, and the most popular Chilean continent. from the inflight recordings, but how can TV showman and his team, who were The flight was properly planned by the an investigation proceed if the accident providing news media coverage. crew with knowledge of the weather at aircraft wasn’t fitted with these recording The accident had a huge effect on the both airports and enroute. The weather devices? This paper shows how it’s possible Chilean population, and the Chilean forecast enroute stated winds from the to perform the investigation by linking president designated a civil judge as the west-northwest of 20 to 30 knots at 3,000 information and data from other sources maximum authority for the investigation feet, increasing at higher altitudes up to and merging different technologies avail- over any other civil or military Chilean 50 knots at 11,000 feet. A cold front was able in the aviation sciences to determine organization. expected enroute with light to moderate the accident causes. For the investigation, the civil judge ice formation at FL050 to FL070. The The study case presented is linked to designated two independent investigation weather forecast at the destination airport the accident of the C-212 Series 300 Model teams: the FACH official investigation corresponded to a postfront with insta- DF MSN 443, operated by the Chilean Air board and a second nonofficial investiga- bility, unlimited visibility, winds from the Force (FACH) that occurred on Sept. 2, tion board chaired by Airbus Military, the south-southwest of 20 knots, and cloudy to 2011. The aircraft was lost at sea while per- aircraft manufacturer. Both boards were partial clouds with cumulus clouds based committed to preparing their own inves- at 3,000 feet up to 15,000 feet. forming a second approach to Robinson tigation report identifying the accident The flight was delayed the morning of Crusoe Island Airport in the Juan Fernan- causes. September 2, as the weather was expected dez archipelago in Chile in high crosswind To provide independence and credibility to improve. The aircraft finally took off at and inclement weather conditions. to our work, Airbus Military created a mix 16:51 UTC (13:51 local) and was expected The airplane was a military twin-tur- team under our leadership, with accredit- to return to Santiago the same day. The boprop transport aircraft, with a fixed ed investigators from Dowty Rotor (UK), two pilots were properly qualified for the landing gear, nonpressurized, equipped the propeller manufacturer; Honeywell flight, but only the captain had previously with a rear fuselage ventral door and ramp, (U.S.A.), the engine manufacturer; and flown to the island. The takeoff weight was used for passengers and cargo transport, estimated to be 8,265 kilograms, which is with a maximum takeoff weight of 8,100 Accident Investigation and Research (AIR– slightly overweight from the maximum kilograms. Canada), the general advisors. weight allowed (8,100 kilograms), but this had no influence on the accident. Investigation overview History of the flight The route was partially covered by San- The accident flight was a logistic one sup- The aircraft didn´t exhibit any relevant tiago radar, and the aircraft was tracked porting humanitarian actions by a nongov- defect or malfunction prior to the flight, up to 30 nautical miles beyond the MORSA ernment organization (NGO) to help the and a 1A maintenance inspection had reference point. local population after suffering a tsunami. been recently passed. The aircraft was full The flight enroute encountered adverse Juan Fernandez archipelago is part of Chil- of fuel. No external fuel tanks were fitted. weather conditions: a strong permanent ean territory and is located in the middle Flight endurance declared was 3 hours and headwind with varying intensity, numer- of the Pacific Ocean 410 nautical miles 35 minutes for an EET (estimated elapsed ous clouds, and storms that forced major from Santiago. time) of 2 hours and 40 minutes flight plan. changes in heading and flight level, with There were 21 people on board. Four The aircraft didn’t have enough fuel for the aircraft climbing up to FL150 versus were the FACH crewmembers, and 15 were a return flight, and landing at the desti- the FL090 authorized level. Radio commu- 14 • April-June 2017 ISASI Forum of the island. The runway is a “carrier type,” accident, a major rescue operation was with a length of 3,304 feet, width of 59 feet, performed to recover the wreckage from and elevation of 433 feet. The unique local the sea floor. That wreckage was moved to help is a wind sock, and the Aeronautical a hangar, where it was laid out for airplane Information Publication special advisories reconstruction. are a cliff at both runway headings and animal presence on the runway. Accident investigation 1. Information available Wreckage recovery The aircraft didn´t have an FDR or CVR, Aircraft wreckage was found on the and the onboard GPS didn’t have recording seabed, at a depth of about 164 feet in capability. Information from inside the line with the direction set by the channel aircraft was obtained only from a broken between the islands some days later. Only but recovered VHS videotape from a TV a few aircraft parts such as the ramp, a camera. This information showed that the main landing gear wheel, and other light nications were held in VHF with Santiago pilot-in-command was the second officer, internal parts (cushions) were found in his first trip to the island, while the control center and with Robinson Crusoe floating in the sea. Chilean authorities Island local control. No communications captain was seated on the right manag- used two sea robots for seabed screening ing communications. A photograph was were held in HF with the oceanic control and for supporting the work of the divers center on the second half of the route. extracted from the videotape showing the in recovering bodies and some aircraft takeoff and landing card, where figures The aircraft arrived at the island at light parts (propellers, instrument cockpit 19:48 UTC, after a two hour and 57 min- for the takeoff speed were used to confirm panel). The sea robots took videos and GPS the takeoff weight based on the aircraft ute flight. A local representative was wait- positions from the different parts found at ing on the airfield to welcome the aircraft performance tables. the bottom of the sea. Flight radar tracking information was and passengers. This witness was the Two and a half months after the only source who saw the aircraft when available only for the first half of the flight it arrived at the island. He described the because of the aircraft flight path as follows: The aircraft limitation in the flew over Runway 14 (north to south) and radar coverage performed a teardrop maneuver to the located on the right to an invert heading approaching continent. It to Runway 32. But the maneuver was provided informa- performed at very low altitude, as the tion about time, witness lost sight of the aircraft while the position, altitude, pilot performed the maneuver. When the and ground aircraft was on the Runway 32 heading, speed. VHF audio a balked landing was experienced with records with San- high and gusty crosswinds, with the air- tiago control and craft deviating to the right of the runway. Robinson Crusoe Island were also An open left turn for a new approach Figure 2 to Runway 32 was initiated through the available. No channel between the airfield and Santa Clara Island; but the aircraft disappeared below the hills around the airport, and it was never seen again. was born in Madrid, Spain, in 1958. He has a master’s degree (MSc) in aeronautical engineering from Madrid Polytechnic University and master’s in direction of production, technology, and opera- Robinson Crusoe airfield tions from the University Institute for Business and Administration The Juan Fernandez archipelago consists ICADE of Pontifical University of Comillas. Gracia started working of the islands of Robinson Crusoe (a sin- in 1983 for the former Spanish aeronautical company CASA, then gle village), Santa Clara (inhabited), and Luis EADS CASA, Airbus Military, and finally Airbus Defense and Space the separate island of Alejandro Selkirk. Gracia in the Flight Test Department. He’s an experimental flight test engi- It’s a sharp mountainous area of volcanic neer with more than 1,200 flight test hours. He was the head of the origin with significant heights from up to Flight Test Department for 17 years, with a deep involvement in the about 3,000 feet as well as sea cliffs more Eurofighter, the A330 tanker, the A400M, and the light turboprops than 328 feet high. (C-212, CN-235, and C-295) programs. In 2010, he was nominated as The airport is unattended, with no tow- head of product and flight safety. He is also an associate professor at er, VFR, or beacon. Meteorological info Madrid Polytechnic University, teaching flight mechanics. and radio control are provided by an of- fice located in town, at the opposite side

April-June 2017 ISASI Forum • 15 turbulence generated by the presence of that island in high wind conditions when the aircraft flew at the back of the island while flying through the channel between both islands.

4. Meteorological information After the accident, the Chilean Meteorological Institute determined the existing weather around the airfield using information taken from • images provided by satellites to view cloud activity and storm cells. • local data from the meteorological station located close to the island’s village. • analytical models and meteorological data gathered Figure 3 in the South Pacific. Based on this information, it is was noted: “the Juan problems or an emergency were winds were encountered (10 knots Fernandez archipelago, around 19:00 and 20:00 UTC, declared at any time. Meteorologi- or more) and maximum continu- was under strong instability postfront, with significant cal conditions on the island at the ous power was used, there would development of cumulus [clouds] near and west of the time of the accident were comput- be enough fuel remaining for 90 island; the archipelago was affected by a region of strong ed based on the on-ground local minutes. These amounts of fuel winds (at least 30 or 35 knots) from 18:30 or 19:30 UTC, records and satellite information. matched the marks found in the not ruling out that these conditions persisted until A key element for the investigation fuel tank content instruments, so after 20:000 UTC.” This indicates the occurrence of high was the precise and detailed testi- it was concluded that the lack of or variability in terms of wind intensity and horizontal and mony provided by the witness. shortage of fuel was not a contrib- vertical variation. Information about the land- uting factor to this accident. The institute concluded that the conditions allowed the ing conditions on the island was presence of strong instability around the aerodrome of provided by a previous commercial 3. Witness testimony–flight test Robinson Crusoe around 19:00 to 20:00 UTC, with aver- flight that landed on the island in The witness located at the airfield age winds of more than 25 knots, gusty, strong horizontal a second attempt after a balked was visually tracking the aircraft wind shear (more than 180 degrees in two minutes), and landing caused by a high and gusty path after the balked landing until the presence of upwind and downwind associated with crosswind. the aircraft was obscured by the proper circulation of vertical development clouds. This Another source of information surrounding hills. Investigation situation was caused by of open cells (cumulus clouds). was the examination of the recov- teams were detached to the island Given the presence and characteristics of open cells, ered wreckage parts, especially the to perform real flight checks. Inves- it can be concluded that there was a strong instability, engines and propellers, some cock- tigators used another FACH aircraft and therefore at least moderate turbulence in the sector, pit instruments, and the aircraft to fly over the channel between the and the presence of downwind between Santa Clara and structure. two islands at different altitudes Robinson Crusoe Island. while the investigation board 2. Route performance members positioned themselves 5. Engine and propeller examination One of the hypotheses regarding at the same location of the witness Both engines were partially disassembled to examine the accident that we examined to observe if the plane was visible the rotating parts. The damage exhibited was consistent was that the aircraft crashed into through the surrounding hills the sea because of a lack of fuel profile—while trying to match the Figure 4 or that a shortage of fuel caused aircraft altitude over the channel stress for the crew, which resulted with the exact location where the in wrong actions. A performance aircraft was obscured by the sur- analysis was done to evaluate this rounding hill according to witness. hypothesis. Total distance and time Tests showed that aircraft alti- were matched for different power tude in the channel should be 650 settings, and wind speed was cal- feet or less. It should be noted that culated based on data provided by the airfield elevation is 433 feet, radar tracking or estimated where and Santa Clara Island’s maximum no radar data were available. height is 1,226 feet. An analysis using maximum Investigators concluded that the cruise power showed that the aircraft was flying at a much lower remaining fuel in the tanks should altitude than the height of Santa have been enough for a 110-minute Clara Island, and therefore the flight. And even if stronger head- aircraft was exposed to the wake 16 • April-June 2017 ISASI Forum covered was completely flattened. All these factors showed that the left wing impacted the water with high energy. Before that, the wingtip was ripped off when it touched the water. • The outer right wing slammed into the water symmetrically along the leading edge. It was broken up into much larger sections than the left wing, indicating that impact occurred at a lower energy. • The aircraft nose was destroyed and was rotated 30 degrees to the right, as it could be observed in the lower fuselage beams. Figure 5 • The ramp traveled forward. with both engines operating at the time cators showed marks around the normal • The upper fuselage skin was ripped off by water surface friction loads. of impact. The damage observed in the range. Flaps indication was about 14 curvics of the turbine impellers suggests a percent, and APP/TO (25 percent) was • The vertical fin had pulled away from medium-/high-power setting. The damage the recommended deflection for landing the rear fuselage. observed among the rotating parts was in high crosswinds. The most relevant consistent with the turbine overdriving the information was provided by the g’s 8. Impact reconstruction and accident compressor when the rotating propellers indicator, where the needle was pointing were slowed by impact with water. to a negative vertical acceleration of -1.6 scenario Investigators concluded that both pro- g’s. The aircraft was flying in inverted Based on the wreckage structural damage pellers were rotating at the time of impact. position with a significant downward and the already mentioned findings, the Based on the bending of the blades, the acceleration. sequence for the water impact could be propellers had power and were operating reconstructed. Investigators concluded that the aircraft struck the ocean in an within their normal flight range. Initial 7. Examination of the structure abnormal attitude with significantly past propeller damage occurred at the time of Aircraft structural integrity at the time impact with the water, and the secondary 90-degree left bank. The aircraft was in- of the crash was confirmed based on verted and still rolling to the left while side damage was consistent with a propeller recovered parts and the examination of under power entering the water and being slipping to the left. The break-up sequence underwater videos. All control surfaces shows the aircraft was flying forward (it driven aggressively into reverse by the were found, as well as some of the wing increase of torque caused by the density had forward momentum), but it was also parts and the stabilizers. The recovered quickly dropping (side slipping) to the left. change from air to water. Investigators aircraft parts were laid out in a hang- concluded that both engines were operat- The aircraft nose was also dropping; ar in order to reconstruct the aircraft. however, the aircraft did not cartwheel. It ing in the normal range at the time of the When all recovered parts were displayed accident. rolled inverted while the outer portion of in their proper positions, the following the left wing was slicing into the water and findings were observed: literally shattering from water forces. 6. Cockpit instrument inspection • No large sections of the outer left At the same time, the aircraft nose and wing were recovered. Structure was Not many instruments were recovered, cockpit were destroyed when they impact- and most of them were from the front scattered in many small pieces. A small leading edge part that was re- ed the water and rotated some 30 degrees central panel. Both propellers’ RPM indi- to the right while being crushed rearward by water forces. Figure 6 When the aircraft rolled totally inverted, the right wing slammed into the ocean and broke into three large sections. The top of the fuselage was rippled like an accordi- on by water friction forces, and the rear fuselage and dorsal fin displayed hydraulic crushing on the right side. The vertical fin was ripped away from the rear fuselage attachment, indicating the aircraft had forward momentum throughout its destruction. The horizontal stabilizers were the less damaged parts as most of the impact ener-

April-June 2017 ISASI Forum • 17 airport is located. this is combined with the convective The Aeronautical flow resulting from the meteorological Engineering School situation. from Madrid Polytech- nic University manu- 10. Investigation results factured the escalated Investigators concluded that the accident model and tested it in was caused by the loss of control of the their wind tunnel facili- airplane while performing the tailwind leg ties. The flow through the channel between the islands pressure and speed of Robinson Crusoe and Santa Clara to were measured in all an estimated height of 650 feet or less, affected areas. Smoke during the circuit approach to Runway 32 was also used for flow in a very low trajectory (with little height visualization. difference above the runway), where very Airbus Military also adverse airflow conditions were found, performed an analytical including wind shear, which exposed the study using computer crew to extreme flight conditions. Figure 7 fluid dynamics models Adverse airflow conditions were the re- for wind flow around sults of a combination of different factors, gy was already dissipated by the crushing the islands, which was tuned to wind tun- including of others parts. The right inverted horizon- nel results and used as a graphical support • very unstable atmosphere, with tal stabilizer struck the water first (aircraft means for them. strong turbulence and possibly even- banked 15 degrees left), causing diagonal Four wind directions were tested: 210 tually powerful down gusts arising compression while the left stabilizer only degrees, 240 degrees, 270 degrees, and from the presence of open cells after a showed inertial effects. 300 degrees. The results showed that the front passed. As a summary of impact reconstruction, rugged terrain and the sharp shape of • the presence of the two counter-ro- it was concluded that all findings were con- Santa Clara Island, with dimensions of 3 tating vortexes in the Santa Clara sistent with a loss of control from a relative- kilometers x 1.5 kilometers and a maxi- Island downwind wake. ly high groundspeed and low altitude above mum height of 1,226 feet, resulted in the • the presence of strong and gusty the ocean surface. But the real question appearance of two downwind vortexes with crosswinds that were very variable in was: What caused the crew to lose control high instability. These two vortex tubes are strength and direction in a very short of the aircraft in flight in such circum- dragged along the wind direction toward time. stances? Because there were no failures Robinson Crusoe Island (see Figures 8 and of the aircraft systems, two main external 9) and resulted in an unstable wake for any These investigation results were well contributors were identified. aircraft crossing through. accepted by all parties involved in the • Instability caused by the meteorologi- These vortexes caused rotational move- accident, and no one questioned the cal condition as described earlier. ments in the air mass causing alternate up- conclusions reached. • Downwind instability generated by the ward and downward flow presence of Santa Clara Island when in a very short distance, flying in high winds at its wake at low resulting in changing altitude. strong gradients in airflow Both effects are not obvious and tangi- vertical speed and wind- ble, and they could not be fully understood shear rates. An aircraft by the public. In addition, determining the flying at 500 feet through effects’ intensity and if such intensity could the channel between both be enough to cause loss of control of the islands would find signif- aircraft is difficult. The investigators decid- icant downwind followed ed to measure the second effect through a by upwind flows and Figure 8 wind tunnel test. finally stronger downwind when crossing through Figure 9 these counter-rotating 9. Local airflows determination–wind tunnel vortexes. It happens over a test distance of less than 3,300 To determine and quantify the airflow in feet, which means about the channel between the islands in the 15 seconds for the normal presence of strong winds from the south aircraft airspeed. southwest, Airbus Military decided to build In such situations, the a wind tunnel model of the area that in- difficulty to maintain cluded Santa Clara Island and the western aircraft control becomes tip of Robinson Crusoe Island, where the evident, especially when

18 • April-June 2017 ISASI Forum Reverse Engineering the Causal Links Reveals Safety Analysis Issues By Sébastien David and David Romat, Senior Safety Investigators, Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile

(Adapted with permission from the author’s technical paper entitled Reverse Engineering the Malaysia (state of occurrence) participat- Causal Links Reveals Safety Analysis Issues presented during ISASI 2016, in Reykjavik, Iceland. The ed in the investigation. The investigation full presentation with references can be found on the ISASI website at www.isasi.org in the Library lasted more than four years to determine tab under Technical Presentations.—Editor) all lessons learned from the event. The n May 24, 2011, a Dassault Fal- Summit that was being held in Deauville, final report was published early in 2016 con 7X operated by Jet Link AG France, during which the same type of and is available on the BEA website. Op- suffered a pitch trim runaway aircraft (among others) was expected erational aspects of the event give “posi- during the descent phase to to be used to transport the leaders and tive” lessons, but they are not detailed in O this paper. Kuala Lumpur Airport in Malaysia. The delegates participating at this event. pitch attitude and load factor reached 42 An airworthiness directive released on degrees nose up and 4.6 g’s, respectively. June 16, 2011, allowed restarting flight Origin of the failure In reaction to the loss of controllability in operations with a limited flight envelope The investigation revealed that a solder- pitch, the reflex inputs of the pilot flying, after implementing Dassault modifica- ing defect on one pin of an onboard unit who banked the aircraft up to 98 degrees tions. Flight operations with full flight component was the triggering event of to the right to lower the aircraft’s nose, envelope resumed on Aug. 29, 2011. the THS runaway. This soldering defect were consistent with nose-high recovery Since the event occurred in Malay- stems from a manufacturing defect that techniques. This reaction, applied and sian airspace, the Bureau d'Enquêtes et was not detected during the manufac- adapted from an excessive pitch attitude d'Analyses pour la sécurité de l'aviation turing process. It was caused by insuffi- recovery technique attributed to train- civile (BEA) informed the Malaysian civil cient heat during the soldering process ing the pilot flying received during his aviation authorities who delegated the because the plated through hole had not military career, was decisive in temporar- investigation to the BEA. In accordance been properly insulated from the rest of ily recovering control of the airplane by with the provisions of International Civil the circuit board. Part of the soldering changing the nose-up pitching move- Aviation Organization (ICAO) Annex 13, heat was therefore absorbed, preventing ment into a turn, despite the trimmable accredited representatives and advis- a proper solder. horizontal stabilizer (THS) being in full ers from Switzerland (state of registry The equipment involved was the hori- nose-up position. and of operation of the airplane), the zontal stabilizer electronic control unit During the maneuver, the crew also United States (state of manufacture of (HSECU), which drives the main electri- had to handle two dual-input situations equipment involved in the runaway), and cal motors of the THS actuator. Its design as the pilot not flying made simultaneous inputs on his sidestick. Nevertheless, the crew managed to temporarily stabilize is a BEA senior safety investigator and coordinator of investigator the aircraft’s attitude with the horizontal training and investigation techniques. He graduated in 1997 as an stabilizer in full nose-up position. Param- aeronautical engineer from the French National Graduate School of eter analysis and crew accounts tend to Civil Aviation (ENAC). He joined the BEA Engineering Department show that the dual-input visual, tactile, in 1998 to work initially on flight recorder readouts and perfor- and sidestick priority control alerts ena- mance studies. During his career with the BEA, he has participat- Sébastien bled the crew to identify the dual-input ed in many major investigations as the investigator-in-charge or phases and act appropriately. Approxi- David accredited representative, as well as head of working groups, for mately two minutes after the beginning example the Human Factors Working Group during the investi- of the runaway, a monitoring function gation of the Air France A330 Flight AF447 accident. He has been automatically switched to a redundant type-rated on the Dassault Falcon 7X and has a master’s degree in control channel, which returned the hori- human factors. zontal stabilizer to normal operation. To ensure the highest level of safety, Dassault Aviation and the European Aviation Safety Agency (EASA) agreed to is a BEA senior safety investigator. He graduated in 2005 as an aero- temporarily ground the Falcon 7X fleet nautical engineer from the French National Graduate School of Civil until the event was investigated. At the Aviation (ENAC). He joined the BEA Engineering Department in time of the accident, the fleet was com- 2008 and has been in charge of flight recorder readouts and aircraft posed of 112 aircraft having accumulated systems analysis. He has participated in many major investigations more than 75,000 flight hours. David as systems group leader, such as the Germanwings A320 Flight Moreover, this serious incident oc- 4U9525 accident and the Swiftair MD-83 Flight AH5017 accident. curred two days prior the 37th G8 Romat

April-June 2017 ISASI Forum • 19 authority, EASA (like the FAA for U.S. programs) is involved in the early stages of the type-certification process, particu- larly to validate the selected means of compliance and the certification doc- uments presented as proof. The agency is not obligated to verify all documents, carry out any inspections, or conduct or be present for any tests to check the validity of compliance. EASA and the de- sign organization define the documents to be reviewed by the authority depend- Figure 1 ing on the project to be certified. and manufacture were subcontracted by • How were the consequences of this During the certification of the Dassault Dassault Aviation to Rockwell Collins. inductive coil soldering defect evalu- Falcon 7X, THS runaway was considered The micro cracks on an induction coil ated in the safety analysis conducted a catastrophic failure condition. It results solder caused the HSECU to generate during aircraft design? from the regulatory requirements that incorrect nose-up commands to the • What was the validation process of airplane systems and associated com- motor controlling the horizontal stabiliz- this assessment? ponents, considered separately and in relation to other systems, had to be de- er and to transmit nose-down values to • Why the decisions taken during the monitoring systems, indicating a change signed so that this failure condition was safety assessment process had an extremely improbable and did not result in the opposite direction to that in which impact upon the airplane design and from a single failure. Compliance with the motor was actually moving. therefore upon the serious incident? Consequently, the nose-down orders those requirements had to be shown by ICAO’s Manual of Aircraft Accident computed by the flight control comput- analysis, and where necessary, by appro- and Incident Investigation (Doc. 9756, ers were consistent with the feedback priate ground, flight, or simulator tests. Part III, Investigation) indicates that from the HSECU. Hence the monitoring The analysis had to consider investigations “often identify design or function, which by design relied only • possible modes of failure, including systems issues that are related to acci- on HSECU information to detect an malfunctions and damage from dent causation” and that “many safety HSECU-induced THS runaway, did not external sources. recommendations do address design trip. • the probability of multiple failures improvements” but that safety analysis and undetected failures. process are seldom investigated. This last Scope of the investigation point was confirmed in the framework • the resulting effects on the airplane The identification of the faulty electrical of the Dassault Falcon 7X investigation and occupants. connection that led to the inflight upset when looking at final reports addressing • crew warning cues, corrective action was not the end point of the investiga- similar issues. Furthermore, without required, and the capability of de- tion. As a general point of view, the de- judging beforehand, system safety as- tecting faults. sign of the aircraft must adequately con- sessment documents on complex systems The analysis is the result of a highly trol undesired events to ensure the safety like fly-by-wire control system can be complex safety assessment process and of aircraft and systems. It is accom- considered protected or “confidential.” comprises many different types of analy- plished by a series of analyses that have Therefore, requests from investigation sis, including a specific function to identify hazards authorities may encounter some reluc- • FHA (functional hazard assessment): and then to control the probability of an tance from aircraft design organizations These are preliminary engineering accident occurring from the hazard or to and equipment manufacturers. That was assessments that are frequently reduce the severity of an accident. Those the case with the HSECU manufactur- updated as the aircraft and system analyses can therefore be of considerable er, which took several months to send designs evolve. They list the main interest to safety investigations in identi- requested answers and documents. functions of the primary flight con- fying latent failures and possible causes trol system and identify failure con- of each failure mode. That’s the reason Safety assessment process ditions associated with each of these why failure to detect design vulnerabili- Before describing the analysis of the functions. The severity of each failure ties and associated consequences despite investigation, some key elements are pro- condition is also evaluated in FHAs, the system safety analysis process was vided dealing with the safety assessment as well as the corresponding safety also investigated. process. objective in terms of probability. One aspect of the investigation was to Approved design organizations ap- • PSSA (preliminary system safety as- determine why the effects of a soldering plying for type certificates must demon- sessment): For each failure condition defect had not been properly anticipated strate compliance with applicable tech- identified in the FHAs, the safety and addressed during design. The objec- nical conditions and submit to EASA the objective is cascaded down to the tive was therefore to look for answers to means by which compliance is demon- equipment level, on the same princi- the following questions: strated. As the primary certification ple as fault trees. 20 • April-June 2017 ISASI Forum • FMEA (failure modes and effect latent, the number of similar results in at various stages of the process, including analysis): At the equipment level, a this FMEA led to a failure to mention the • imprecise assessment of the structured and inductive analysis HSECU in any of the failure conditions effects of the failure types identified is performed to evaluate for each identified in the SSA for the Falcon 7X in the FMEA, validation of the FMEA, individual component the effects of flight control system. and, in general, the varying results its failure modes on the system. The Those SSA results were not challenged of FMEAs even when using the same FMEA is used to feed the PSSA to get by Dassault Aviation despite the highest methodology (human and equipment the final system safety analysis. manufacturer organizational factors). verification and validation level that • SSA (system safety assessment): were in place throughout the design of • lack of mechanisms for detecting SSAs take into account the results of this critical system. The approval of the potential critical errors in equipment FMEAs and other safety assessments primary flight control SSA by the certi- manufacturer FMEAs during the and contain the definitive list of sys- fication authority did not contribute to aircraft safety assessment and certi- tem failure conditions and associat- finding this error either. fication process. ed probabilities. The purpose of SSAs The SSA results for the primary flight • the design organization’s capability is therefore to check compliance with control system consequently affected the of managing and supervising design safety requirements (see Figure 2). development of the monitoring func- when equipment (especially critical tions associated with the THS control equipment) is designed by partners or subcontractors. Investigation of the safety assessment system. In the situation of the event, the monitoring functions of the THS control • limitations in the SSA verification process channel were actually depending on process by the aircraft manufacturer As indicated, the potential effects of a the HSECU itself to detect an HSECU and in the approval process by EASA. hardware component failure should be malfunction. This architecture did not • limitations of the safety analysis, like identified and detailed in the FMEA for ensure that the control unit would detect FMEAs, which were developed a few the item in question. The HSECU FMEA, a malfunction or that reconfiguration to decades ago for traditional hardware performed by Rockwell Collins as Das- another control channel could take place system and not for advanced avion- sault Aviation’s subcontractor, identified via an independent method. This type of ics and computer-based fly-by-wire a defective electrical link (similar to the architecture nevertheless met regulatory systems. soldering defect) on the faulty compo- requirements (at the time of the design of The BEA addressed safety recommen- nent (an induction coil) as a potentially the airplane), which were not explicitly dations to EASA and the FAA aimed latent failure. Its effects were considered requiring independence between moni- at filling gaps that may occur during not visible on the HSECU. toring and control channels. This enabled The imprecise assessment of the effects aircraft design in the safety analysis a single failure to cause THS runaway, process. But drafting safety recommen- of component failures in the FMEA of the considered catastrophic. dations for complex topics involving HSECU prevented the proper evaluation After this serious incident, Rockwell widely used industry standards, ad- of these effects in the safety analysis of Collins updated the HSECU FMEA using vanced avionics, and numerous organiza- the whole THS control system. the same methodology. This new FMEA tions was not easy. That’s the reason why The SSA of the primary flight control gave results totally different from the system conducted by Dassault Aviation FMEA that was valid before the event. those safety recommendations raised the took into account the results of the Dassault Aviation also modified THS weaknesses that were identified during HSECU FMEA performed by Rockwell monitoring so that a THS runaway this investigation and confirmed by other Collins after verifying certain failure caused by an HSECU failure can be ones by asking EASA and the FAA, in modes. Beyond the effects of the induc- detected independently by monitoring coordination with SAE and EUROCAE, to tion coil failure, considered “potentially” propose and develop additional or alter- units in all native means. The weaknesses involve situations. • the FMEA methodology for electron- Conclusion ic equipment and software. The investiga- • The insufficient or inadequate means tion therefore to check the independence of system revealed that control and the monitoring of said for a complex system. system like the primary The time allocated to this investigation flight control made it possible to go beyond what is system, the commonly investigated. Thanks also to safety assess- the cooperation of the aircraft manufac- ment process turer, light was shed on vulnerabilities in is vulnerable the complex process of system safety to errors or analysis, which will hopefully help avoid inaccuracies. similar issues and improve overall flight Figure 2 They can arise safety. April-June 2017 ISASI Forum • 21 By Thomas Friesacher (ST6730), Cranfield University, UK, and Matthew (Adapted with permission from the authors’ technical paper entitled The Greaves, ESASI Committee Member, Cranfield University, UK Effect of Commuting on Pilot Self- assessment of Stress and Performance THE EFFECT OF COMMUTING ON PILOT presented during ISASI 2016, in Reykjavik, Iceland. The full presenta- tion with references can be found on SELF-ASSESSMENT OF STRESS AND the ISASI website at www.isasi.org in the Library tab under Technical PERFORMANCE Presentations.—Editor)

irline pilot commuting is one of the tion guide for operators. In the guide, ICAO ad- operators on the effect of com- most unknown factors in a well-es- dresses “extended commute prior to scheduled muting on pilot self-assessment of tablished aviation safety and fatigue flight duty period.” The fatigue hazard asso- stress and performance. A risk management system (FRMS). In a ciated with commuting is mentioned in only As part of the study, 3,906 pilots U.S. National Transportation and Safety Board one line of the 150-page document. A personal from European airlines were invited (NTSB) investigation report, pilot commuting mitigation strategy on a microlevel is present- through e-mails sent to their work was identified as a factor in the occurrence of ed to the responsible crewmember in the rec- e-mail addresses to participate in a fatal accident, and the NTSB issued a rec- ommendation to “arrive at duty with sufficient a survey. Additionally, 37 national ommendation that operators “address fatigue time to allow adequate sleep, ensuring fitness associations of airline pilots were risks associated with commuting.” Given that for duty.” Delegating responsibility to mitigate invited to distribute the survey to pilot commutes, both before and after flight the hazard of an industrywide practice that their national members. Five hun- duty, can be time-consuming and stressful, has been occurring for many years to individu- dred and twenty-eight usable ques- there is a potential for pilot commutes to have al crewmembers appears to be an inadequate tionnaires were returned and used a significant negative effect on safety. Howev- approach by industry. in the analysis. It was necessary to er, pilot commuting remains one of the least For the first time, in the 2009 investigation create a definition of “commuter understood aspects of aviation. report of the Colgan Air accident, the NTSB pilot” to ensure that commuter This research conducted a study on the recommended “operators to address fatigue pilots could be distinguished from commuting practices of airline pilots and risks associated with commuting, including noncommuter pilots in the study. the related stress experienced by pilots. The identifying pilots who commute, establishing To answer this question, the study research collected data on self-assessed pilot policy and guidance to mitigate fatigue risks authors consulted general commut- performance on commuting days. The study for commuting pilots, using scheduling prac- ing studies. investigated the mode, time, and distance of tices to minimize opportunities for fatigue in In Europe, the general public’s av- commutes; the form of housing and interme- commuting pilots, and developing or iden- erage daily commuting time is 37.5 diate housing used in the commutes; and the tifying rest facilities for commuting pilots.” minutes from place of residence self-assessment of stress and performance. The However, it remains unclear what has changed to the workplace and back accord- study found significant results in relation to since 2010 in relation to industry protocols for ing a study that Stutzer and Frey the stress experienced by commuter pilots and managing the fatigue related to pilot com- conducted in 2007, and most of their self-assessment of work performance muting. The magnitude of the problem also this commute is along well-estab- compared to noncommuter pilots. Noncom- remains unclear, as does the number of pilots lished routes of public and private muters tend to rate their subjective stress who commute to work and how long their transport infrastructure to central experience lower and their work performance commutes are. business districts. higher than commuter pilots on commuting The present study investigated the commut- Airports are seldom near a days. ing practices of European airline pilots in a central business district. There is broad study designed to gather empirical data no typical airport location, and Introduction on this issue. The data gathered focused on there is limited data on airline the following aspects of commuting: different Little is known about airline pilot commuting pilot commutes, as well as uncer- modes used, time spent, cost associated with in the highly regulated aviation industry. How- tainty among official institutions commute, intermediate housing away from ever, researchers recognize the commuting about typical pilot commutes place of residence, subjective stress experi- experience as a potential source of stress and and duration of a typical airline enced during commute, reason for commut- believe that commuting might have an effect pilot commute, according to the ing, and frequency of commute. Data were also on the overall professional performance of a National Research Council. In gathered on the pilots’ self-perceived perfor- pilot. addition, the National Research mance on commuting days. The aviation industry governing body, the Council sees these values on the International Civil Aviation Organization typical pilot commute duration and (ICAO), mandates that operators manage Methodology “these dividing lines [as] arbitrary.” and control actively the adjacent issue of pilot An investigation was conducted with selected To account for this lack of infor- fatigue and has created an FRMS implementa- European airline pilots of various European mation, this study uses the data on

22 • April-June 2017 ISASI Forum the daily commuting time of the general that Sloan and Cooper developed in 1986 of the required answers provided and to public in Europe, doubles this value, and was used. Sloan and Cooper noted that “it ensure a nonpunitive level. adjusts it to account for airport location seems reasonable to conclude that there is inconsistencies, rounding the commute such a thing as self-reported pilot perfor- Results time for airline pilots to 45 minutes of mance and that the test appears to meas- Demographic information of one-way travel time. The commute time of ure at least part of it.” They further explain participants 45 minutes of one-way travel was set as the that the test is “to be used as a screening The 528 participants were residents of dividing line between noncommuter and device for application on relatively larger 29 different European nations and had commuter pilots. Based on this dividing sample sizes with an aim of making broad their crew based in 31 different European line, the following question was posed to discriminations between groups of pilots.” countries. Of all the participants, 49.4% the participants: “Are you commuting to The 15-item test for pilot self-report per- (n = 261) reported their role as captain, your pilot base from outside a travel radius formance used a five-point range. This part the remaining 50.6% (n = 267) stated their of 45 minutes?” of the survey was presented to the com- position as a form of copilot. Of the 528 After answering yes or no to this ques- muter and noncommuter pilots at the end participants, 504 were male (95.5%), and tion, the survey directed participants to of the survey. 24 were female (4.5%). the appropriate set of questions for a com- The original introduction text to the The majority of the respondents de- muter or noncommuter pilot. Both groups commuter pilots on the test was modified clared themselves as commuter pilots were posed a set of questions related to from Sloan and Cooper’s wording, “Think subjective stress and pilot performance. about your last few flights recently,” to (56.8%; n-300); the remaining 228 partici- It’s important to note that the survey “Think about your last few flights recently pants (43.2%) reported they were noncom- was self-assessed, which means that all on days where you commuted to work” to muter pilots. the measures are subjective and highly ensure that the pilots’ answers responded The role of captain indicated having an dependent on the participants’ retro- more directly to the cause and effect of influence on the commuting practices spective judgement and recall. Therefore, pilot commuting. of the pilots: 52.2% of captains reported the data yielded from the surveys reflect In addition, in the original direction being noncommuters, compared to 43.2% this subjectivity, and the veracity of the “Please rate yourself on the scales by cir- of the total participants. This supports the answers depends entirely on the degree to cling the number of your answer. Remem- hypothesis that captains are more willing which the participants provided accurate ber, we are relying on you to make this as to take residence within a 45-minute range answers. accurate a measure as possible,” the word of the home base. In the survey, the measure of pilot “scientific” was added before the word Age was not indicated as having an self-assessed stress was conducted for “measure” for both commuters and non- influence on whether the pilots were com- the commuting and noncommuter pilots commuters so that the direction then read, muters (mean age for commuter pilots: through a set of stress-measuring ques- “Please rate yourself on the scales by cir- 41.2 years) or noncommuters (mean age of tions. The following was the entry question cling the number of your answer. Remem- noncommuter pilots: 41.2 years). for the set: “How do you feel about your ber, we are relying on you to make this as Table 1 (see page 24) presents the demo- commute?” The rating was provided on accurate a scientific measure as possible.” graphic characteristics of the participants. a five-point Linkert scale, ranging from In addition, for both groups, the following The study found that the European “totally agree” (1) to “totally disagree” (5). assurance was provided: “The answers are noncommuter pilots live an average of The following lists the factors posed on 100% anonymous and confidential.” This 111.79 kilometers away from their home stress: line was intended to support the honesty base compared to commuter pilots, • Commuting imposes stress on my life.

• Commuting imposes stress on my is an active senior airline pilot and instructor. His doctoral research partner. is in the field of stress exposure and susceptibility to error of cockpit • Commuting leads to discussions in my crews in connection with pilot commuting habits at Cranfield Uni- relationship. versity, UK. He is lecturer for intercultural cooperation at the Salz- • Commuting limits the socialization burg University of Applied Science. As an instructor, he is putting time with my friends. special emphasis on intercultural error prevention and flight safety Thomas M. • Friends turned away from me because of CRM. With his supervisor, Dr. Matthew Greaves, he is working on of my commuting/time issues. Friesacher the subject at Cranfield University, UK. • Commuting makes me think about the safety issues connected to my com- is the head of the Safety and Accident Investigation Center at Cran- muting. field University. He specializes in engineering aspects of safety and • I think that commuting influences the accident investigation. His research focuses on the use of science, quality of my colleagues’ work. technology, and flight data both in the accident investigation pro- • Commuting influences my overall life cess and for the enhancement of safety. He is a Fellow of the Royal happiness. Dr. Matthew Aeronautical Society and member of the European Society of Air To measure the factor of self-assessment Safety Investigators Committee. pilot performance, the standardized test Greaves

April-June 2017 ISASI Forum • 23 trip, indicating a very in- self-reported performance of the pilot dur- tense engagement of time ing flight duty is better (Sloan and Cooper and resources. test). Table 2 presents the commuting time and Analysis commuting distances of Stress pilot commuters of the The total stress level was calculated for study participants. both groups from a set of eight different The responses of the questions related to stress. The answer commuter pilots found (n range was from “totally agree” (indicating = 300) that 43.9% plan this stress from commuting) to “totally disa- journey “almost always” gree” (indicating no stress from commut- or “always” on a long-term ing). The analysis found a significant differ- basis. It was also found ence between the two groups, supporting that 67.1% “sometimes” the hypothesis that the noncommuter experience problems in pilots feel less stress from their journey to their commute. This re- work (mean 2.9) than do the commuter sult was indicated by the pilots (mean 2.6). (t(394)=3.168 p<0.001, following question: “How one-tailed). often do you experience Table 3 presents the stress levels of problems in your com- commuter and noncommuter pilots of the mute?” Considering the study participants. connection between this The analysis of the stress factor and factor and self-reported the factor of time of commute to arrive at pilot performance finds home base found a significant difference interesting results related in the stress levels of the noncommuters to pilot commuting. Results indicate a (<45 minutes of one-way travel time) and who indicate that they commute to work on negative correlation between prob- commuters that needed more than 180 average 753.06 kilometers. The difference lems experienced during commutes minutes to arrive at home base (F(4/390)=- in the commuting distance is evident when and subjective performance in the 4.379, p< 0.001, ANOVA). This further set considering the intermediate housing facilities cockpit (rs=-0.28, p<0.001, one-tailed). of results in relation to self-reported stress at the designated home base. The commuter This result indicated that when fewer levels is similar to the findings comparing pilots who reported using a form of intermedi- problems occur in a commute, the stress levels with travel irregularities in the ate housing facilities at their home base lived statistically significantly further away from the home base than the commuter pilots not using intermediate housing facilities. Similar to distances, the difference in commuter qualities is also visible in the travel times from the place of residence to home base. The noncommuters average a travel time of 25 minutes (mean 00:25, SD 00:11) (values in hours/minutes), whereas the commuters av- erage a travel time of 03.02 hours (mean 03:02, SD 02:55) (values in hours/minutes). The commuter pilots were asked the following question: “How often per month in an average duty schedule do you commute to your place of residence?” The frequency was a little under five times per month (mean 4.99, SD 2.85). The maximum number of commutes in this question was presented as >9 times; in- terestingly, 15.9% of commuter pilots indicated this intense amount of commuting behavior. It’s important to note also that 43.1% of the commuter pilots reported traveling five times or more per monthly duty schedule between the place of residence and home base. The average of this travel time was 03.02 hours (hours/minutes) of one-way travel time per

24 • April-June 2017 ISASI Forum between the noncommuter pilots and the commuter pilots that report traveling more than 180 minutes from residence to home base. The noncommuter pilots sub- jectively indicated a higher performance during their cockpit tasks (F(4/,370)=6.825, p<0.001, analysis of variance–ANOVA-test). A significant difference was also noted between commuter pilots who have 91–179 minutes of one-way travel time commute. These two factors correlated my colleagues’ work (t(365,4)=3.022, to home base and commuter pilots who (rs=0.350, p< 0.001, one-tailed) between p<0.05, one-tailed). have more than 180 minutes of one-way noncommuters and commuters. One ex- • Commuting influences my overall travel time to home base. The results found planation for this result is that fewer travel life happiness (t(397)=-3.155, p<0.001, that the commuter pilots with the shorter irregularities result in less-subjective stress one-tailed). commuting times self-reported a signifi- experience. Table 4 presents the individual stress lev- cantly higher level of work performance This result is similar to the result be- els of commuter and noncommuter pilots ((F(4/,370)=6.825, p<0.001, analysis of tween the factors of travel cancelations of the study participants. variance–ANOVA-test, Bonferroni: p<0.05, and stress level. To gain answers to the mean difference = -0.04949). post-hoc factor of travel cancelations, the follow- Performance tests, Bonferroni). These results support ing question was posed to the commuter the hypothesis that shorter commuting To analyze the self-perceived perfor- participants: “How often do you have times support a higher level of self-report- mance data, we employed the strategy to cancel/change your commute due to ed work performance in the cockpit. expressed by Sloan and Cooper, which external factors?” The answers to this Exploring single items from the 15-item weights the scores differentially accord- question were compared to the factor of Sloan and Cooper test found significant stress level (rs =0.260, p<0.001, one-tailed). ing to importance. differences between commuter and non- Fewer cancelations or changes in travel The testing of self-perceived perfor- commuter pilots in the following items: plans generate significantly less stress mance indicated a significant result. • Being ahead of the game (t(388.6)=- in commuter pilots. This means that the Noncommuter pilots reported better performance during duty (mean 0.107) 3.848, p<0.001, one-tailed (Cohen’s stability and plannability of the commute d=-0.348). has an indirect proportional significant than the commuter pilots (mean 0.138) influence on the stress level experience of (t(374)=-3.575, p<0.001, one-tailed). • Excess mental capacity (t(390)=-2.797, commuter pilots. Examining the data on average commut- p<0.01, one-tailed) (Cohen’s d= 0.284). Another interesting finding is that the ing time in comparison with self-reported • Coping with things that go wrong cost of commuting was found to have no performance levels reveals a significant (t(390)=-4.473, p<0.001, one-tailed) influence on the self-perceived perfor- difference in self-reported performance (Cohen’s d=-0.444). mance of commuter pilots and only a very minor influence on their self-reported stress level (rs =0.209, p<0,001, one-tailed). An in-depth review was con- ducted on the individual stress items posed in the survey. This review found significant results in the relationship between qual- ity of work and stress/safety. It was found that commuter pilots are more conscious of commut- ing stress and have higher stress values than noncommuter pilots. The following lists selected individual stress items in the survey: • Commuting makes me think about the safety issues connected to my commuting (t(368.3)=-2.555, p<0.05, one- tailed). • I think that commuting influences the quality of

April-June 2017 ISASI Forum • 25 • Quality of interpersonal relations one-tailed) of performance difference. time [and that a] pilot commuting differs with aircrew (t(381)=-2.789, p<0.01, This indicates less self-perceived from the commuting of other workers one-tailed) (Cohen’s d=-0.281). stress levels experienced supports in terms of frequency and variability, • Degree of mental and physical coor- higher levels of self-perceived work distance, transport modes, and time dination (t(376.3)=-3.109, p<0.001, performance. of day.” It’s also true that most other one-tailed) (Cohen’s d=0.326). Table 5 presents the subjective levels of industries lack strong regulating legisla- tion, and commercial aviation operators • Number of errors made (t(379)=- performance in commuter and noncom- muter pilots. require regulation relating to fatigue risk 1.984, p<0.05, one-tailed) (Cohen’s management to ensure efficient and safe d=0.201). management of fatigue risk associated • Extent of errors made (t(379)=-1.714, Discussion with commuting. p<0.05, one-tailed) (Cohen’s d=0,176). Commuting between place of residence Currently, the reference to commuting and the workplace is rarely considered in ICAO guidelines is vague and assigns • Many pilots when asked to assess the an enjoyable time. Generally, commuting responsibility for fatigue management to quality of their performance reply time involves exposure to some form of the individual crewmember. Such guide- that it’s “just a feeling”—can you physical and psychological stress (e.g., lines are insufficient in an industry that is assess yourself on a scale in this way? heat, cold, smells, people, etc.), and the highly regulated and in some cases even (t(373.1)=-2.784, p<0.01, one-tailed) level of stress experienced in commuting encourages or obliges pilots to commute (Cohen’s d=-0,282). can be affected by the mode of transport through industry-based policies and sub- • Correlation between the weighted or the form of transport (e.g., active or sidized crew tickets. Sloan–Cooper total value of self-per- passive). In the aftermath of the Colgan Air acci- ceived performance and the total The National Research Council notes dent investigation, the NTSB highlighted calculated stress level supported a that “commuting is one of many activities a risk in connection with pilot com- significant level (rs=-0.482, p<0.001, that usually occur during a pilot’s off-duty muting and fatigue and found that very 26 • April-June 2017 ISASI Forum limited data existed in relation to pilots performance of pilots that the number regulation (or through macrolevel reg- commuting and that operators are not of errors made by commuter pilots was ulation) rather than through assigning required to “know” whether their pilot significantly higher on commuting days microlevel (or personal) responsibility employee is a commuter because the compared with noncommuter pilots. to pilots. A possible approach is to commuting is conducted in the off-du- The factor of mental engagement understand that pilot commuting is an ty hours. However, aviation operators noted by Green (1985) is also indicated industry standard that requires actively know, or at least have the opportunity in the item “being ahead of the game” addressing and managing individual to monitor, the travel behavior of their (Sloan and Cooper 1986), for which a pilots’ commutes on an operator level in pilots through examining information significantly better result was reported a manner that reduces the experience of revealed through subsidized ticketing by the noncommuter pilots in the study. stress as part of an expanded FRMS that sales. Considering the “commuting trip The noncommuter pilots also indicated implements safety regulations. [as] the time during which one is free having higher levels of “excess mental Some operators in the United States from the duties from work and family” capacity” available in the cockpit during (e.g., FedEx, which reported to the com- is an inappropriate approach reflecting duty, and self-reported that they found mittee that it allows pilots to reserve the on how pilots cope with occupational “coping with things that go wrong” sig- jumpseat in advance) provide sleeping stress. nificantly easier than did the commuter facilities at both the sorting hubs and The results of this study demonstrate pilots, which might be due to a lack of the outlying stations, and include time that pilot commuting is a prevalent preconditioned mental engagement. spent in commuting from the pilot’s industry factor, with 56.8% of the study The “quality of interpersonal relations home airport to the domicile in their sample of European airline pilots re- with aircrew” and the “degree of mental calculation of duty time with respect porting themselves to be commuters. A and physical coordination,” which have to the limits established by the labor factor adding to the prevalence of pilot been demonstrated as vital to crew re- contract. Delta Air Lines reported that commuting is the shift from legacy air- source management, were found by the it provided reserved seats for the trip to lines to low-cost carrier operation and study to be significantly impaired in the the pilot’s duty location and provided their scheduling policies in relation to commuter pilots on commuting days minimum rest periods of 4–9 hours, saving on overnight costs and per diems compared to the noncommuter pilots. depending on the carrier, between the for pilots—returning daily to their Stress was found to effect self-re- arrival of the commuting flight and designated home base to having pilots ported performance in this study, and commencement of preflight activities provide themselves with overnight commuting times were found to cause for a pilot’s operational flight. accommodations at home base rather stress. Sexton, Thomas, and Helmreich’s Operators ensuring that the com- than scheduling them on overnight duty research notes that “pilots were least muting trip is plannable and that pilots flight schedules. In this study, 70.3% of likely to deny the effect of fatigue on receive support for the journey will participants indicated working for a performance.” The authors of this study decrease pilots’ stress levels, which, ac- mid- and short-haul operator, which also hypothesize that pilots are least cording to the results of this study, will means they face this challenge. likely to deny the effect of commuting increase pilots’ work performance. En- A possible result of this scheduling on stress and performance and self-re- suring such strategies are implemented policy could be an aggregated commut- port knowing the risks associated with is an appropriate risk-mitigation tool in ing behavior to save money on over- commuting. In this study, the pilots relation to pilot commuting. Achieving night costs and to return to the resi- were posed the following question: sound cooperation in the development dence of friends and family during duty “Many pilots when asked to assess the of an industry–pilot commuting model to avoid the cost of accommodations, quality of their performance reply that it based on research to improve aviation resulting in reduced sleeping periods. is ‘just a feeling’—can you assess your- safety is a further research aim of the The study results indicate that 15.9% of self on a scale in this way?” Although the authors of this study. pilots commute more than nine times in answer to this is general, the commuter a duty period, and 43.1% commute more pilots in this study self-reported impair- Conclusion often than the average of 4.99 times. ment in performance significantly more Commuting, self-reported stress This 43.1% commute of an average than did the noncommuter pilots in this experienced in a commute, and self-re- one-time commute time of three hours study. ported pilot work performance are and two minutes highlights that pilots The responses to the item “commut- closely connected variables. Analysis of experience significant levels of fatigue ing makes me think about the safety empirical data can clarify the factors when off duty. issues connected to my commuting,” that reduce the stress associated with The findings of this study demonstrate indicate that pilots are aware that com- pilot commuting and allow the pilot to that the variables of commuting cause muting causes stress and that commut- better perform in a cockpit environ- pilots stress. As Green (1985) notes, peo- er pilots are significantly more aware ment. Managing pilot commuting ple who are stressed are more prone to of the safety issues associated with through a sound industry-level fatigue committing errors due to their cognitive commuting. risk-management program, rather than engagement with stress factors, rather It must be asked how it is possible assigning responsibility to individual than with their work duty. The study to manage the safety risks associated pilots, will enhance flight safety through also found in the self-reported work with pilot commuting through industry lower levels of pilot fatigue. April-June 2017 ISASI Forum • 27 NEWS ROUNDUP

ISASI Holds 52nd Reachout All participants received a bound Society Continues Work on ICAO booklet that contained copies of the Pow- Projects Workshop in Seoul, Korea erPoint presentations. Schleede’s pres- entations were given in English with oc- Dr. Soon, Cheol-Byeon and Dr. Yoo, Kyung- The ISASI–ICAO Working Group casional translation assistance from Yoo. In (Jenny), longtime members of ISASI and reviewed State Letter AN 6/1.2-17/5, The participants were actively engaged in officers of the Korean Society of Avia- issued by the International Civil Aviation the program and asked many questions. tion and Railway Accident Investigation Organization (ICAO) on January 13 on Certificates of participation were award- (KSARAI), organized the 52nd Reachout the subject of “proposals for the amend- ed to all workshop participants. Workshop held in Seoul, Korea, on Febru- ment to Annex 13 concerning access The fourth day involved two programs ary 13–17. Both are professors at the Korea to evidential material during investi- on bloodborne pathogen (BBP) training. Aerospace University, which provided the gations and monitoring the progress of The first was held at the facilities of Kore- venue for the majority of the workshop. Dr. safety recommendations.” The proposed an Air for about 25 Korean Air employees. Kang, Woong-Lee, president of Korea Aer- amendments to Annex 13 were devel- The second was held at the facilities of ospace University, and Dr. Cho, Tae-Hwan, oped during the second meeting, held Asiana Airlines for about 15 employees. chairman of KSARSI and former chairman in June 2016, of ICAO’s Accident Inves- The last day involved BBP training at of the Korea Aircraft and Railway Acci- tigation Panel (AIGP/2) charged with the Korea Aerospace University for about dent Investigation Board (KARAIB), led reviewing a variety of topics, including 75 employees of seven Korean low-cost introductions and opening remarks for the the need to amend the standards and airlines. workshop. recommended practices in Annex 13— The BBP training included a training The first three days of the workshop Aircraft Accident and Incident Investi- involved presentations on accident investi- video and PowerPoint presentation previ- gation. ISASI is as an approved ICAO in- gation management and accident preven- ously developed by the Canadian Society ternational observer organization. ISASI tion. Ron Schleede, ISASI vice president; of Air Safety Investigators. Considerable Vice President Ron Schleede, Treasurer Byeon; and Yoo provided presentations to numbers of BBP protective equipment Bob MacIntosh, and Nick Stoss (Canada) more than 150 participants, who repre- packages were provided to participants represented the Society at the AIG/2. sented the full spectrum of the aviation to practice donning and removing the The amendments elevate three safety community in Korea—government, protective equipment. All participants previous recommended practices to airlines, manufacturing, military, and aca- received certificates of completion of the standards in Annex 13. The first action demia. Several investigators from KARAIB BBP training. requires that a state conducting an also attended. The Reachout workshop was conduct- investigation under Annex 13 “…shall en- Workshop topics included pre-accident ed at no cost to ISASI. Schleede’s travel, sure that any investigations conducted planning, dispatch and arrival on scene, lodging, etc., were covered by the spon- under the provisions of this annex have organizing the investigation, managing sors, which included the Korea Aerospace unrestricted access to all evidential ma- the accident site, offsite tests and research, University, KSARAI, Korean Air, Asiana terial without delay.” The other two ac- report writing, and safety action develop- Airlines, Air Busan, Korea Express Air, tions require that a state conducting the ment. Additionally, Soon gave presenta- Jeju Air, Jin Air, Eastar Jet, Air Seoul, Korea investigation, or any other state issuing a tions on human factors and black boxes, Airforce Safety Agency, the Korea Safety safety recommendation, “…shall imple- and Yoo gave presentations on ICAO and Policy organization, and Shinhan Air. ment procedures to record the responses Annex 13. Soon and Yoo received several applica- received…to safety recommendation tions for issued,” and that a state that receives a new ISASI safety recommendation “…shall imple- members to ment procedures to monitor the pro- be submit- gress of the action taken in response to that safety recommendation.” ted for ap- The latter two provisions are related proval. They to initiatives promoted by the ISASI also are in delegation to AIG/08, held in Montreal in the process October 2008. ISASI submitted a working of preparing paper at AIG/08 promoting the estab- an appli- lishment of a safety recommendation cation for database at ICAO that would include the Korea safety recommendations issued and Aerospace safety actions taken. Shown during the Reachout Workshop, from the left, are Dr. Song, Byung-Heum, University Schleede and MacIntosh will represent vice president, KSARAI; Dr. Cho, Tae-Hwan, president, KSARAI (former chairman of to become ISASI at the AIGP/3 panel meeting that KARAIB); Ron Schleede, vice president, ISASI; Dr. Lee, Dong-Ho, chairman, KARAIB; Dr. Soon, Cheol-Byeon, director general, KSARAI; and Dr. Yoo, Kyung-In (Jenny), a corporate will take place at ICAO in Montreal in executive director, KSARAI. member. July.

28 • April-June 2017 ISASI Forum NEWS ROUNDUP

ISASI Participates in Air Accident controllers, manufacturers, managers, and tact was made with the safety faculty for educators attended the three-day confer- each institution, and literature about the Investigation Courses in Singapore ence. A small group of ISASI volunteers student Mentoring Program and the 2017 worked enthusiastically to introduce the ISASI International Councilor Caj Frostell Rudolph Kapustin Scholarship application Society to a steady stream of visitors in the conducted a two-week accident investi- were distributed. Information on the up- exhibit hall. gation course at the Singapore Aviation coming ISASI military tutorial was shared Attendees were eager to learn how Academy February 6–17. Other instructors with the five Armed Forces branches that they could better prepare themselves for included ISASI members David McNair also exhibited to generate interest in the (Canada) and Alain event. Guilldou (France), With more than 600 students in attend- as well as several ance, the conference was an excellent Singapore Trans- venue to introduce ISASI to a young and port Safety Inves- diverse demographic of the industry and tigation Bureau engage future members. It was a huge investigators. success as volunteers were able to interact There were 37 face-to-face with aviation professionals seminar partic- and promote the Society’s ipants from 10 goal of safety education countries. Dur- and accident prevention ing the training, and raise awareness Aircraft Accident Investigation Techniques and Management Course of ISASI overall. This instructors used an participants. ISASI PowerPoint worthwhile presence aircraft accident investigation duties and presentation to promote the Society’s was made possible due take a more active role in promoting safety goals and efforts. A second two-week to ISASI members con- and accident prevention in their organi- accident investigation course was held at tributing their personal time zations. ISASI Office Manager Ann Schull the Singapore Aviation Academy February and the generous donation of air transpor- stacked the display booth with materials 20–March 3. This course included fellow- tation by Erin Carroll, Southwest Airlines illustrating the valuable resources availa- ships through the Singapore Cooperation manager of air operations investigations, ble to ISASI members as well as flyers on Program and resulted in 34 participants for Schull to attend. the upcoming meetings across the country from 24 countries from all over the world. in New Orleans, Louisiana; Washington, Two U.S. Regional Chapters Elect D.C.; and San Diego, California. Volun- New Officials teering alongside Schull were Professor ISASI Promotes Air Safety at Anthony Brickhouse, Kathy Carl, Capt. Women in Aviation Conference Janina Paschke Clark, and Gormley, who U.S. Society President Toby Carroll recently educated attendees about the benefits announced the appointment of new officers for two regional chapters. Steve ISASI was among some 165 companies of ISASI, exclusive educational tools, and Demko will take over from Luke Schiada as and organizations exhibiting at the 28th the worldwide networking and outreach the new president of the Northeast Region- Annual Women in Aviation International opportunities available through member- al Chapter. Conference held March 2–4 in Orlando, ship. The group signed up 13 new mem- Three newly elected officers for the Florida, reports Erin Gormley. More than bers, reunited with members who joined at Pacific Northwest Regional Chapter 4,500 female and male aviation profession- previous conferences, and planted the seed (PNRC) of the U.S. Society met in Renton, als, including pilots, mechanics, air traffic of ISASI in future members. Visitors were also encouraged to review the Washington, on February 18 to discuss “Call for Papers” for the upcom- reactivation of the group. ing annual Society conference to consider contributing their relevant safety experience with a submission. Nearly 30 universities with aviation programs were present, and visits were paid to each one to discuss the benefit of starting an ISASI student chapter and to increase awareness of the ISASI volunteers sign first new member Jenessa Meserve. New PNRC officers are, from left, President Anna From left, Kathy Carl, Janina Clark, Jenessa Meserve, Ann Rudolph Kapustin Memorial Bernhardt, Vice President Masood Karim, and Schull, and Anthony Brickhouse. Erin Gormley is not pictured. Scholarship. A point of con- Secretary-Treasurer Jeanne Elliot.

April-June 2017 ISASI Forum • 29 INVESTIGATION OF ISASI INFORMATION SINGLE-PILOT OFFICERS President, Frank Del Gandio OPERATION ACCIDENTS ([email protected]) (Continued from page 13) Executive Advisor, Richard Stone ([email protected]) to a point where the stick pusher The investigator must keep in mind Vice President, Ron Schleede was activated, and, subsequently, he that repetitive patterns that cause ([email protected]) Secretary, Chad Balentine did not react appropriately, leading accidents exist due to weaknesses in ([email protected]) to a series of pitch oscillations until the aviation system and even not be- Treasurer, Robert MacIntosh, Jr. it finally stalled and entered in an ing mandatory, safety recommenda- ([email protected]) uncontrolled dive. Controlled flight tions are an effective way to enhance was reestablished 44 seconds later, at aviation safety and break certain COUNCILORS FL295, and the aircraft proceeded to Australian, Richard Sellers tendencies. ([email protected]) its final destination. Canadian, Barbara Dunn ([email protected]) Conclusion European, Rob Carter Safety recommendations ([email protected]) This paper went through several International, Caj Frostell Most single-pilot accidents have subjects to provide a manufacturer’s ([email protected]) New Zealand, Alister Buckingham several contributing factors in perspective learned from years common, and just like in any other ([email protected]) supporting single-pilot accidents Pakistan, Wg. Cdr. (Ret.) Naseem Syed type of aircraft, safety recommenda- investigations. The complexity of Ahmed ([email protected]) tions for single-pilot accidents are United States, Toby Carroll these topics makes it impossible to the most important and valuable ([email protected]) compile all the knowledge that is product of the investigation. They suggest a course of action to improve desirable to be part of the repertoire NATIONAL AND REGIONAL airworthiness, operation, policy, or of the next generation of investigators SOCIETY PRESIDENTS any other safety issue identified, and in a single paper. However, I hope this AsiaSASI, Chan Wing Keong they can be issued at any time during paper, which originated from ([email protected]) Embraer’s commitment to continu- Australian, Richard Sellers the investigation. They are based ([email protected]) on findings of the investigation and ously assist investigations involving Canadian, Barbara Dunn ([email protected]) may address deficiencies that are not its products, may serve as a reference European, Olivier Ferrante ([email protected]) directly related to what is ultimate- and contribute to better investiga- Korean, Dr. Tachwan Cho (contact: Dr. Jenny ly determined to be the cause or a tions, with the purpose of making air Yoo—[email protected]) contributing factor for the accident. transport safer. Latin American, Guillermo J. Palacia (Mexico) Middle East North Africa, Ismaeil Mohammed Abdul (contact: Mohammed Aziz— [email protected]) New Zealand, Alister Buckingham ([email protected]) Pakistan, Wg. Cdr. (Ret.) Naseem Syed Ahmed ([email protected]) Russian, Vsvolod E. Overharov ([email protected]) United States, Toby Carroll MOVING? NEW E-MAIL ACCOUNT? ([email protected]) Do you have a new mailing address? Have you UNITED STATES REGIONAL recently changed your e-mail address? Then CHAPTER PRESIDENTS contact ISASI at [email protected] to ensure that your Alaska, Craig Bledsoe ([email protected]) magazine and other ISASI materials are delivered to Arizona, Bill Waldock ([email protected]) Dallas-Ft. Worth, Erin Carroll you. Please include your previous address with your ([email protected]) Great Lakes, Matthew Kenner change request. Members in Canada, New Zealand, ([email protected]) Mid-Atlantic, Ron Schleede and Australia should contact your national society. ([email protected]) Northeast, Luke Schiada ([email protected]) Northern California, Kevin Darcy ([email protected]) Pacific Northwest, Kevin Darcy ([email protected]) Rocky Mountain, David Harper ([email protected])

30 • April-June 2017 ISASI Forum ISASI INFORMATION

Southeastern, Robert Rendzio Air Line Pilots Association Hall & Associates LLC ([email protected]) Airbus HNZ New Zealand Limited Southern California, Thomas Anthony Airclaims Limited Honeywell Aerospace ([email protected]) Airways New Zealand Hong Kong Airline Pilots Association Alitalia SpA Human Factors Training Solutions Pty. Ltd All Nippon Airways Co., Ltd. (ANA) Independent Pilots Association COMMITTEE CHAIRMEN Allianz Insitu, Inc. Audit, Dr. Michael K. Hynes Allied Pilots Association Interstate Aviation Committee ([email protected]) Aloft Aviation Consulting Irish Air Corps Award, Gale E. Braden ([email protected]) Aramco Associated Company Irish Aviation Authority Ballot Certification, Tom McCarthy Asiana Airlines Japan Transport Safety Board ([email protected]) ASPA de Mexico Jones Day Board of Fellows, Curt Lewis ([email protected]) ASSET Aviation International Pty. Ltd. KLM Royal Dutch Airlines Bylaws, Darren T. Gaines Association of Professional Flight Attendants Korea Aviation & Railway Accident ([email protected]) Australian and International Pilots’ Association Investigation Board Code of Ethics, Jeff Edwards ([email protected]) (AIPA) L-3 Aviation Recorders Membership, Tom McCarthy ([email protected]) Australian Transport Safety Bureau Learjet/Bombardier Aerospace Mentoring Program, Anthony Brickhouse Aviation Investigation Bureau, Jeddah, Lion Mentari Airlines, PT ([email protected]) ­ Kingdom of Saudi Arabia Lockheed Martin Aeronautics Company Nominating, Troy Jackson Aviation Safety Council Middle East Airlines ([email protected]) Avisure Military Air Accident Investigation Branch Reachout, Glenn Jones ([email protected]) Becker Helicopters Pty. Ltd. National Aerospace Laboratory, NLR Scholarship Committee, Chad Balentine Bundesstelle fur Flugunfalluntersuchung (BFU) National Institute of Aviation Safety and ([email protected]) Bureau d’Enquêtes et d’Analyses (BEA) Services Seminar, Barbara Dunn ([email protected]) CAE Flightscape National Transportation Safety Board Cathay Pacific Airways Limited National Transportation Safety Committee- Charles Taylor Aviation Indonesia (KNKT) WORKING GROUP CHAIRMEN China Airlines NAV CANADA Air Traffic Services, Scott Dunham (Chair) Civil Aviation Authority, Macao, China Pakistan Air Force-Institute of Air Safety ([email protected]) Civil Aviation Department Headquarters Pakistan Airline Pilots’ Association (PALPA) Ladislav Mika (Co-Chair) ([email protected]) Civil Aviation Safety Authority Australia Pakistan International Airlines Corporation Airports, David Gleave ([email protected]) Civil Aviation Safety Investigation and Analysis (PIA) Cabin Safety, Joann E. Matley Center Papua New Guinea Accident Investigation ([email protected]) Colegio Oficial de Pilotos de la Aviación Commission (PNG AIC) Corporate Affairs, Erin Carroll Comercial (COPAC) Parker Aerospace ([email protected]) Cranfield Safety & Accident Investigation Phoenix International Inc. Critical Incident Stress Management (CISM), Centre Plane Sciences, Inc., Ottawa, Canada David Rye--([email protected]) Curt Lewis & Associates, LLC Pratt & Whitney Flight Recorder, Michael R. Poole Dassault Aviation PT Merpati Nusantara Airlines ([email protected]) DDAAFS Qatar Airways General Aviation, Steve Sparks Defence Science and Technology Organisation Republic of Singapore Air Force (RSAF) ([email protected]) (DSTO) Rolls-Royce PLC Co-Chair, Doug Cavannah Defense Conseil International (DCI/IFSA) Royal Danish Air Force, Tactical Air Command ([email protected]) Delft University of Technology Royal Netherlands Air Force Government Air Safety Facilitator, Delta Air Lines, Inc. Royal New Zealand Air Force Marcus Costa ([email protected]) Directorate of Flight Safety (Canadian Forces) RTI Group, LLC Human Factors, Richard Stone Dombroff Gilmore Jaques & French P.C. Saudia Airlines-Safety ([email protected]) DRS C3 & Aviation Company, Avionics Line of Scandinavian Airlines System Investigators Training & Education, Business Sikorsky Aircraft Corporation Graham R. Braithwaite Dubai Air Wing Singapore Airlines Limited ([email protected]) Dutch Airline Pilots Association SkyTrac Systems Ltd Military Air Safety Investigator, Bret Tesson Dutch Safety Board Southwest Airlines Company ([email protected]) Eclipse Group, Inc. Southwest Airlines Pilots’ Association Unmanned Aerial Systems, Tom Farrier Education and Training Center for Aviation Spanish Airline Pilots’ Association (SEPLA) ([email protected]) Safety State of Israel EL AL Israel Airlines Statens haverikommission Embraer-Empresa Brasileira de Aeronautica Swiss Accident Investigation Board (SAIB) CORPORATE MEMBERS S.A. The Air Group AAIU, Ministry of Transport Embry-Riddle Aeronautical University The Boeing Company Accident Investigation Board Norway Etihad Airways The Japanese Aviation Insurance Pool (JAIP) Accident Investigation Bureau Nigeria European Aviation Safety Agency (EASA) Transportation Safety Board of Canada Administration des Enquêtes Techniques EVA Airways Corporation Turbomeca Aer Lingus Executive Development & Management Advisor UND Aerospace Aero Republica Finnair Plc United Airlines Aerovias De Mexico, S.A. De C.V. Finnish Military Aviation Authority United States Aircraft Insurance Group Air Accident Investigation Bureau of Mongolia Flight Data Services Ltd. University of Balamand/Balamand Institute of Air Accident Investigation Bureau of Singapore Flight Data Systems Pty. Ltd. Aeronautics Air Accident Investigation Unit-Ireland Flight Safety Foundation University of Southern California Air Accident Investigation Sector, GCAA, UAE Gangseo-gu, Republic of Korea Virgin America Air Accidents Investigation Branch-UK GE Aviation WestJet Air Asia Group General Aviation Manufacturers Association Air Astana JSC Global Aerospace, Inc. Air Canada Grup Air Med S.A. Air Canada Pilots Association Gulfstream Aerospace Corporation April-June 2017 ISASI Forum • 31 ISASI 107 E. Holly Ave., Suite 11 Sterling, VA 20164-5405 USA

INCORPORATED AUGUST 31, 1964 CHANGE SERVICE REQUESTED

WHO’S WHO Aegean Airlines: Greece’s Largest Airline (Who’s Who is a brief profile prepared by the represented ISASI corporate member organization to provide a more thorough understanding of the organization’s role and function.—Editor) egean Airlines, a member of our staff. Our goal is to continue investing which involves the Civil Aviation Service, the Star Alliance since 2010, is in our fleet and to enhance one of our the company’s procedures, and the man- Greece’s largest airline. Since its main competitive advantages—the low ufacturer’s instructions and always takes A inception in 1999, the airline has average age of our aircraft. into consideration the environment. Tech- been providing full-service, premium-qual- Aegean Airlines operates three technical nicians trained according to European ity short- and medium-haul flights. bases in Greece, located in Athens, Thessa- requirements and equipped with European In 2013, Aegean acquired degrees are responsible for the Olympic Air; as a result, passen- maintenance of the aircraft and gers—both visitors and Greeks their safe function. alike—now have increased flight Every aircraft in Aegean’s frequencies and connections as fleet is equipped with the latest well as improved accessibility and most sophisticated safety to Greece’s islands, including systems, including ACAS II some of the more remote ones. (Airborne Collision Avoidance Total traffic of both companies System), EGPWS (Enhanced reached 11.6 million passengers Ground Proximity Warning in 2015. loniki, and Heraklion. The main technical System), and DFGS (Digital Navigation In early 2014, Aegean announced its base is located at Athens International System). At Aegean, we care about the student support program “Close to Youth,” Airport “E. Venizelos” and has two hangars environment and make constant up- which enables 500 students to travel to and the greater number of technicians. grades to reduce noise, emissions, and fuel and from their home and study location The technical base has been constructed consumption. Aegean’s fleet consists of free of charge. according to modern specifications and 38 Airbus A320s, 8 Airbus A321s, 1 Airbus Aegean invests in strengthening its equipment. This base has several sections, A319, 4 Dash 8-100s, 10 Dash8-Q400s and international presence and on support- carefully designed to guarantee maximum 2 ATRs. ing Greek tourism both in Athens and in efficiency. The store rooms, engineering Aegean has been honored with the regional airports. Aegean’s 2016 network laboratories, administration offices, tech- Skytrax World Airline Award as the best offers flights to 145 destinations (34 nical electronic library, and computer labs European regional airline for 2016. It’s the domestic and 111 international) to 45 offer the necessary environment for the seventh time that the company has countries. We constantly invest in new and technical support of the aircraft. received this distinction—we also received sophisticated aircraft as well as on control Aircraft maintenance is always per- the award in 2009, 2011, 2012, 2013, 2014, systems, technical support, and training of formed according to European legislation, and 2015.

32 • April-June 2017 ISASI Forum